The Opinions of the Personal Data Protection Authority (KVKK) on Cybersecurity Practices and Cyberattacks (1)

Introduction

In this article, simplified versions of decisions rendered by the Personal Data Protection Authority/Board (KVKK) regarding cybersecurity are presented to the reader alongside analytical commentary. To enhance readability and prevent excessive length, the publication of this work in discrete installments has been deemed appropriate.

Prior to addressing the substance of the matter, it must be noted that framework norms governing the retention of personal data in electronic media, as well as guidelines issued by official institutions (KVKK) that substantiate these frameworks, currently exist. Upon examining how these frameworks are substantiated, one inevitably concludes that a data controller acts in compliance with the law solely within a system where "robust cybersecurity practices are implemented and maintained properly."

There always exists the possibility that actors may avoid liability owing to the absence of specific elements within liability theories. However, the overarching principle remains clear: data controllers who fail to safeguard the personal data entrusted to them by data subjects via the high-level security solutions articulated in the relevant decisions and guidelines cannot reasonably assert a defense alleging third-party criminality ("is the thief entirely blameless?").

1) Decision No: 2020/567

a) The underlying incident in this decision—wherein the data controller was found to have acted unlawfully—involved brute-force attacks, characterized as credential-guessing attempts, which facilitated unauthorized server connections and access to member account contents. In the decision, this incident is detailed as follows: "It was caused by malicious actors attempting usernames and passwords obtained from other websites on the 'Member Login' tab of the data controller's website, resulting in unauthorized access to the accounts of 29 customers, / The personal data affected by the breach comprised the names, surnames, email addresses, telephone numbers, registered addresses, and historical purchase information under the customer transaction category belonging to 29 customers..."

Brute-force attacks generally inflict no direct damage upon target servers. Rather, by deploying specialized software or manual input of specific username/password combinations, the attacker aims to gain system access upon matching input entries with database records. Utilizing passwords as a cybersecurity solution constitutes a single-factor security measure. Because the system cannot ascertain whether the party originating the request is genuinely authorized, if the entered username and password match the database entries, direct system access is granted irrespective of the client's identity. Consequently, as a advanced cybersecurity measure, multi-factor authentication protocols involving two or more matching stages are integrated for authorized system access. These stages encompass security questions, CAPTCHAs, security codes transmitted via SMS or email, token deployment, electronic signatures, and various derivative mechanisms.

In the case subject to the decision, it was established that no cybersecurity measures providing two-factor or multi-factor authentication for authorized system access were operational. ("Taking into account that user identity verification is required to ensure data security regarding access to personal accounts, and that the data controller planned to deploy two-factor authentication (SMS/Captcha)—a security measure required to be taken prior to the breach—only after the occurrence of the data breach, the data controller failed to take the necessary technical measures to ensure data security...")

• Therefore, it is concluded that maintaining personal data in a lawful manner mandates the implementation of multi-factor authentication.

b) Secondly, the decision emphasizes that "upon examining the account passwords of the data subjects affected by the breach, the passwords utilized by customers comprised solely numeric digits or sole alphabetic strings, and customers were not compelled to create strong passwords upon account creation," citing this deficiency as a ground for unlawful processing.

• Therefore, it is concluded that maintaining personal data in a lawful manner mandates the enforcement of strong password requirements.

c) Technologies such as firewalls and IPS may block malicious client traffic, ensuring that a cyberattack remains at the stage of attempt. The decision notes: "Considering that during the breach occurring at the data controller, attackers managed to gain unauthorized access to a specific number of accounts before the Web Application Firewall (WAF) could ascertain whether the unauthorized access constituted an attack or a normal user login, the data controller failed to ensure application security..." Hence, it is understood that while the data controller deployed a firewall for its website/application, the tool failed to function properly.

• For this reason, it is concluded that maintaining personal data in a lawful manner mandates the deployment of a properly functioning cybersecurity solution capable of blocking malicious client traffic. (In essence, alongside brute-force attacks, such countermeasures are particularly vital against DoS/DDoS and IP spoofing attacks. For if the target system becomes compromised through such attacks, system content may be accessed even without knowing the requisite credentials.)

2) Decision No: 2021/154

a) Where personal data or other sensitive information is hosted on networked servers, a compliant architecture dictates that data traffic flows within closed-circuit LANs/VLANs, with external WAN connections restricted through firewalls and analogous tools. Thus, traffic operates internally via MAC address filtering, externally via IP-restricted devices, and remotely via encrypted channels such as VPNs.

Bypassing these access restrictions, erasing digital footprints in the presence of log-retention software, and executing collateral actions present formidable technical hurdles, while simultaneously constituting multiple statutory offenses. In such a scenario, an internal accomplice utilizing sniffing techniques could access substantial data, reach other network nodes through this data, and ultimately exfiltrate data from within. If the internal accomplice already possesses authorized access to the data, they can directly exfiltrate the accessible data externally without attempting to compromise other network nodes. To mitigate such adverse scenarios, and to ensure tracking alongside deterrence, Data Loss Prevention (DLP) technologies have been developed.

In the case subject to the decision, although the data controller possessed DLP systems, these systems failed to operate properly and could not prevent the data exfiltration. Furthermore, the systems failed to generate timely breach reports, depriving the data controller of contemporaneous notice of the exfiltration. ("The breach occurred when a former employee of the data controller transmitted personal data belonging to certain customers—accessible by virtue of their employment duties—from their corporate email address to their personal Gmail address across 3 separate dates in 3 separate Excel files, / The breach was not detected by the data controller, but was rather discovered by the former employee's new employer upon the employee transmitting the subject personal data to their new workplace email address... / Within the scope of the data controller's agency activities, relevant employees frequently transmitted external emails due to sending policies to customers, preventing immediate detection of breach events during this period / Although it was technically possible via DLP systems to block the external email transmission of documents containing personal data exceeding specific thresholds—such as National Identity Numbers, credit card numbers, IBANs, telephone numbers, and email addresses—and despite the data controller having informed certain employees in a 2017 email that the internal movement and external transmission of National Identity Numbers, credit card data, and IBANs would be monitored and blocked, the failure of the data controller's DLP system to block the transmission of the subject emails demonstrates that the system was improperly configured, contrary to the statement under the heading 'Ensuring Cybersecurity' in the Personal Data Security Guide that '...every software and hardware must be subjected to specific setup and configuration procedures'...")

• Therefore, it is demonstrated that maintaining personal data in a lawful manner mandates the deployment of properly functioning DLP technologies.

3) Decision No: 2020/216

a) In the case subject to the decision, attackers somehow acquired credentials required for authorized access, compromised the data controller's internet-accessible system, and extracted various data from the database. ("A cyberattack was executed against the data controller company's systems to obtain data residing therein, / The debugging feature was active on the application designated 'Pilot', which developers building systems for the company utilized to detect errors and implement improvements, / Through the subject cyberattack, person(s) attempting internet access to the 'Pilot' application obtained the 'PHPSESSID' values of previously logged-in users, thereby gaining access to the 'Pilot' application, / The debugging feature remained active to enable system development via remote internet access, but this configuration simultaneously enabled system compromise via internet-based cyberattacks...")

In cybersecurity architecture, standalone applications may be deployed, or integrated system hardware and software solutions encompassing multiple security features may be utilized. These multi-component security architectures include servers that record access logs to the system/network nodes and log local and internet traffic data via IDS solutions for attack detection, alerting, and operational requirements. Indeed, regarding traffic data, this requirement arises not only under the KVKK for data controllers, but also under Law No. 5651 for collective use providers acting as data controllers. In the subject case, the data controller failed to establish an alerting and log-recording architecture of this nature. ("The inability to definitively ascertain what data was accessed by the attackers demonstrates that control and alert mechanisms were not effectively deployed by the data controller to identify intrusions or anomalies... the failure to deploy log-stamping via timestamps, log correlation, etc.—necessary for logs to serve as evidence in forensic incidents—prior to the breach indicates a failure to adopt required technical and administrative measures...")

• Therefore, it can be concluded that maintaining personal data in a lawful manner mandates the deployment of properly functioning alert mechanisms and log-recording cybersecurity solutions.

b) Secondly, the decision states that while encrypted channels were utilized for WAN/internet access to the data controller's system, requiring user credentials for connection, attackers nevertheless succeeded in compromising the system through these channels. ("For security purposes regarding remote access, connections were executed via VPN to the company IP, with personalized usernames and VPN passwords issued; however, attackers likewise connected to the system via SFTP and VPN...")

The decision emphasizes that although authorization is required for VPN access, connection must not rely on single-factor password entry alone, but must mandate multi-factor authentication tools (e.g., SMS codes). ("Technical measures required to be adopted by the data controller prior to the breach included... activating dual-factor features where available, renewing certificates used in VPN access, and updating employee email access to two-step verification...")

• Therefore, it is concluded that maintaining personal data in a lawful manner mandates the use of properly functioning encrypted communication channels accessible exclusively via multi-factor authentication.

c) Furthermore, the decision notes that following the breach, the data controller commissioned a penetration test, which revealed numerous security vulnerabilities. ("...considering that the penetration test conducted on January 29, 2020 following the breach—and submitted to our Authority by the data controller—identified high and medium-level vulnerabilities, particularly in web applications, this circumstance demonstrates a failure by the data controller to adopt necessary technical measures...")

• Therefore, it is concluded that maintaining personal data in a lawful manner mandates conducting penetration tests at regular intervals and remediating identified vulnerabilities.

(Indeed, during remote working setups, if a client device accessing the system over the internet harbors malware such as spyware or keyloggers, credentials required for authorized access may be compromised. Consequently, ensuring that employee personal computing devices maintain up-to-date and properly functioning antivirus/antimalware software constitutes a necessary cybersecurity solution in its own right.)

Atty. Alp Öztekin, LL.M.