Public Data
Exposure Audit
A simple, fixed-fee audit of the things you’ve got running out in the world, and what information they’re revealing. We’ll find things like public cloud buckets containing private data, forgotten apps and subdomains, SaaS services configured to be accessible to anyone with a link or worse, accidentally-leaked credentials, and more.
Find public files
Check the exposure
Assign the fix
You get a ranked list of data to close off.
The five areas we’ll be looking at
Leaked secrets: Passwords and API keys committed to public code repositories or removed later, but still accessible from commit history, leaked through accidental publication of private packages, committed to the wrong place (personal accounts!), etc.
Leaked code and configs: Passwords, API keys and source code leaked via exposed cloud buckets, web servers configured to reveal environment variables, folders containing .git files exposed on websites, etc.
Exposed databases: Databases configured to be accessible from any device on the Internet rather than only from other parts of your system, particularly ones still using their default password. Particularly common with dev/staging sites. A common one we find is poor configuration of row-level security in Supabase, meaning anyone can use the anonymous key included with your website to gain full access to your database.
Exposed documents: Documents, images, task boards, calendar invites etc stored on third-party, usually SaaS, services but configured to be accessible to anyone with a link, anyone in your organisation, anyone on the internet, or worse still indexed by search engines.
The dead estate: Subdomains pointing nowhere or somewhere they shouldn’t, forgotten apps, services, test sites and other items of technology still accessible to the general public. Often the remnants of these point to cloud buckets, servers, databases, SaaS tools etc that were supposed to have been decommissioned along with the thing itself, and can reveal sensitive information to outsiders.
How we do it
Using a mixture of automated and manual tools we’ll look for any accidental leaks of information from your company to outsiders. This may involve searching for your organisation using tools such as Shodan, looking at publicly-searchable code repositories, mapping out the subdomains belonging to your domain(s) and checking for unexpected things that might be running on them, looking at how your domains appear in web archives and elsewhere, and lots more.
If we find something we’ll check it’s accessible but not attempt to take advantage of it: we’ll let you know if a database is accessible from the internet but won’t read or download the data within it unless we’re given specific written authorisation.
Deliverables
At the end of the exercise we’ll write a report describing the items we’ve found. For each, we’ll explain the implications of a random member of the public being able to access it, how we found it, how you should go about resolving it, and how serious we think it is. Items that include personal data will be flagged up as these could affect your ability to adhere to the ICO’s 72 hour breach reporting requirement.
If we stumble upon something especially dire, such as a database with default credentials accessible to the world, a folder containing access keys etc., we’ll let you know as soon as possible rather than wait until we’re ready to send the report.
Costs
The audit itself has a fixed cost. Remediation of any problems will be quoted separately. If you’d like us to monitor for new exposures on an ongoing basis or carry out follow-up audits (say, quarterly), let us know and we can provide quotes for those too. This audit is a supplement to compliance-type exercises such as ISO 27001 and Cyber Essentials rather than a substitute.
What we need from you
The domains belonging to your organisation, ideally also any that used to belong to it
Links to any public-facing websites/apps/services
If applicable, information about your cloud estate
Get in touch
Book a Secrets Leakage Audit here and we’ll be in touch.