BA/Boots Data Breach – Expert Comment

It appears that the very serious British Airways/Boots data breach has arisen through a double layered third party compromise, if initial reports are correct.

Working closely with third parties, whilst bringing many benefits, adds a lot of risks unless key security measures are in place, with the right controls and monitoring.

When working with a supplier, organisations need to secure remote access without exposing the keys to their kingdom.

It’s vital to separate third parties from credentials, not allow VPN access, use multi-factor authentication, and record sessions.