the first rule of data breach opsec is: if you don't store data it can't be breached
2
Post
Replies:
5
@brooke a quibble: if you *collect* data, but do not *store* it (eg if it's sent to a cloud service and then immediately discarded after the operation it was collected for is finished), it can't be exfiltrated in a later breach, but it *can* be exfiltrated if an APT is monitoring your network or servers at the time the data passes through
there is also the Twitter Exception: if you intake data but do not store it *by policy*, it might still be retained in a a debug log you didn't realize was on
1
@mcc good point!!!!
1
@brooke drop database customers;
There, now everyone is safe! :)
1
