---
title: 'ISR08: Information Leakage'
description: OWASP Infrastructure Top 10 reference for information leakage vulnerabilities including exposed sensitive data and insufficient data classification
---

# 08 Information Leakage

Identifier: ISR08:2024
Category: Data Protection

## Description

Information leakage occurs when confidential or sensitive data is unintentionally or maliciously
exposed, either within or outside an organization, due to inadequate security measures or personnel
negligence.
This leakage can manifest in various forms: improper disposal of documents, misconfigured
permissions on network shares, or unsecured communication channels.
It can also result from insider threats where disgruntled employees or malicious insiders
intentionally exfiltrate data for personal gain or sabotage.
This threat requires a holistic approach encompassing robust access control, data encryption,
regular audits, and a culture of security awareness among employees.

## Risk

* The severity depends on what information is leaked; internal IP addresses expose new network
  targets, while personally identifiable information or protected data can lead to fraud, identity
  theft, or competitive disadvantage.
* Information leakage can expose an organization to extortion threats from malicious actors.
* Cumulative risk emphasizes the need for stringent cybersecurity measures, continuous monitoring,
  and a well-informed workforce.

## Vulnerability checklist

* Access permissions on network shares or databases are misconfigured or overly permissive.
* Sensitive data is transmitted over unsecured communication channels.
* Documents containing sensitive information are improperly disposed of.
* No data handling policies exist or adherence to regulatory compliance is not enforced.
* Employees lack security awareness training on data leakage prevention.
* Incident reporting processes are absent or slow.

## Prevention controls

1. Employ encryption technologies to ensure data remains unintelligible in case of interception
   or unauthorized access.
2. Implement strict access control measures so only authorized individuals can access sensitive
   information.
3. Conduct regular security audits and network monitoring to identify and rectify potential
   weaknesses.
4. Provide comprehensive security training and awareness programs to equip employees with
   knowledge to recognize and prevent data leakage scenarios.
5. Foster a culture of accountability and quick incident reporting to mitigate damage when
   leakage occurs.
6. Establish clear data handling policies and ensure adherence to regulatory compliance.

## Example attack scenarios

### Scenario A — Customer data access for all employees

Due to a system misconfiguration, all employees gain unrestricted access to a database containing
sensitive customer information.
A curious employee browses the database and inadvertently shares customer data externally while
on a public network.
Simultaneously, a malicious insider extracts and sells the data on the dark web.
Customers report fraudulent activities traced back to the data leakage, resulting in significant
financial, legal, and reputational damage.

## Detection guidance

* Monitor access logs for unusual or broad access patterns to sensitive data stores.
* Scan network shares and databases for overly permissive access configurations.
* Detect sensitive data patterns in outbound network traffic.
* Review document disposal and data handling practices during audits.

## Remediation

* Restrict access permissions to sensitive data stores following the principle of least privilege.
* Encrypt all sensitive data at rest and in transit.
* Remediate misconfigured network shares and database permissions immediately.
* Establish and enforce data classification and handling policies.
* Implement data loss prevention (DLP) monitoring on egress points.
* Conduct organization-wide security awareness training focused on data handling.
