Todd A. Jacobs | Pragmatic Cybersecurity<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@briankrebs" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>briankrebs</span></a></span> The best way to prevent <a href="https://infosec.exchange/tags/dataexfiltration" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dataexfiltration</span></a> when breached is not to collect or store unnecessary data in the first place. That makes many of the current spate of <a href="https://infosec.exchange/tags/databreaches" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>databreaches</span></a> avoidable, self-inflicted incidents for which large companies are never held accountable in any truly meaningful way.</p><p>You're spot on when you say that <a href="https://infosec.exchange/tags/databrokers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>databrokers</span></a> rely on large <a href="https://infosec.exchange/tags/datalakes" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>datalakes</span></a> of sensitive data they don't need directly. They also rely on large data sets where any typical datum may be harmless in itself, but often <em>becomes</em> sensitive or dangerous when aggregated, and often exponentially more so when connected to intrinsically sensitive data such as <a href="https://infosec.exchange/tags/PII" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PII</span></a>, <a href="https://infosec.exchange/tags/PHI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>PHI</span></a>, or identity.</p><p>Setting aside the financial incentives and lack of accountability for the data brokers, how do <a href="https://infosec.exchange/tags/businessleaders" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>businessleaders</span></a>, <a href="https://infosec.exchange/tags/regulatoryagencies" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>regulatoryagencies</span></a>, and <a href="https://infosec.exchange/tags/electedpoliticians" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>electedpoliticians</span></a> justify this state of affairs to you? It's not like the public and private sectors don't also have data they want to protect, so why allow this shadow industry to prosper? This seems even more mystifying when it's so clearly a double-edged sword even for the brokerages' paying customers!</p>