Your establishment probably adopts different strategies to protect the names, emails, and other sensitive information of clients and employees, but what about their faces?
A configuration mistake that left over nine million facial recognition images exposed highlights the growing privacy risks businesses face when they collect and store biometric information. Learn more about it here.
The Consequences of Poorly Configured Cloud Storage
Independent security researcher Jeremiah Fowler discovered an unsecured Amazon S3 storage bucket containing roughly 450 GB of data associated with ClarityCheck, a reverse lookup service. This database contained more than nine million image files of adults, teenagers, and children.
The problem didn’t necessarily come from a targeted, sophisticated cyberattack but from a storage system that lacked proper authentication controls. It allowed people to access files through URLs found in the company’s website code.
The company disputed describing the database as publicly exposed because the URLs weren’t indexed by search engines. Still, security experts note that sensitive information remains exposed when unauthorized people can access it without authentication.
Why Should Businesses Care About Facial Image Exposure?
You can easily replace a compromised password, but replacing your face proves almost impossible. Exposed facial images could potentially support the following criminal activities:
- Identity fraud and impersonation
- Targeted phishing and social engineering
- Fake social media profiles and catfishing
- AI-generated personas and deepfakes
- Unwanted identification of employees or customers
The risks of a data breach increase when criminals combine facial images with other personal information. In this incident, researchers also found API misconfigurations that could reveal email addresses, phone numbers, and physical addresses.
Protecting Your Company’s Biometric Data
If you don’t want your facial recognition images exposed, consider the following proactive measures.
Secure Your Cloud Storage
Start by double-checking your storage configurations. Require authentication before users can access sensitive files and make sure your S3 buckets and similar resources don’t allow unintended public access.
Restrict Availability
Not every employee or application needs the company’s image files to work properly. Apply least privilege controls so people and systems can access only the data they actually need.
Review Third-Party Services
Before sending any kind of identity verification data to an outside provider, investigate how it protects the information. Pay attention to its security controls, retention practices, deletion procedures, and policies for sharing or using uploaded images.
Minimize Stored Data
Why keep sensitive images you no longer need? Establish retention periods and securely delete files when they no longer serve a legitimate business purpose. Reducing the amount of biometric information you store also reduces what attackers could obtain during a breach.
What Can Businesses Learn From This?
ClarityCheck’s mistake that left millions of facial recognition images exposed shows that you don’t need a sophisticated zero-day attack to create a major privacy problem. A misconfigured storage bucket can be enough.
Take a fresh look at the images and biometric information your business stores. Know where that data lives, who can access it, and which third parties handle it. A few minutes spent reviewing those controls could prevent a much bigger privacy headache later.