The Opinions of the Personal Data Protection Authority (KVKK) on Cybersecurity Practices and Cyberattacks (2)

4) Decision No: 2021/187

a) In the case subject to the decision, the data breach stemmed from an error occurring in the systems of a third-party firm from which the data controller procured information technology/systems services. ("Due to a systemic error originating at the support service provider from which the data controller received information systems services, a technical error occurred regarding the 'Report' correlation with certain firms that were customers of the data controller within the scope of system services, / A 'Report' file belonging to employees of 31 other customer companies participating in the system was transmitted to 28 customer companies within the scope of the system service; as a result of the query selecting the 'Report' operating erroneously, sub-data belonging to 681 natural person customers who were employees of 31 employer companies within the system was erroneously transmitted via the system to 28 employer companies also within the scope of the system...")

An error originating from the internal systems of a third-party IT service provider/external service provider affected the data controller utilizing these systems. However, alongside this circumstance, it is understood that the data controller failed to establish a mechanism to provide self-detection and notice of this breach, as notice was subsequently received only after a customer informed the data controller. This constitutes the primary legal infringement upon which the KVKK grounded its administrative fine. ("The breach was identified as a result of a customer company receiving the report informing the data controller of the matter, failing to be detected spontaneously by the data controller; this circumstance demonstrates non-compliance with the statement under Section 3.2 'Monitoring Personal Data Security' in the Personal Data Security Guide (Technical and Administrative Measures) that 'It must be determined whether an intrusion or unauthorized movement exists in IT networks'...")

Cybersecurity solutions such as DLP, as detailed in the preceding installment of this article, can prevent or generate alerts regarding the exfiltration of sensitive data from internal networks externally or from restricted internal network segments to other internal zones. However, compromised software or hardware within the network architecture may simultaneously impair DLP technologies. Routing outbound internet traffic through proxy servers and subjecting such traffic to filtering and cybersecurity solutions on these intermediary servers may offer a potential solution at this stage, or alternative technical remedies may be deployed. Nevertheless, in data breaches arising from the unforeseen failure of software or hardware despite the execution of all reasonable audits, expecting the deployment of extreme cybersecurity solutions would not, in our view, be legally justified. In the decision, it is noted that the data controller failed to conduct required audits regarding the proper functioning of the systems. ("Because the systemic error causing the data breach originated from application software, pursuant to the statement under Section 3.5 'Procurement, Development, and Maintenance of Information Technology Systems' in the Personal Data Security Guide (Technical and Administrative Measures) published by our Authority that 'Security requirements must be taken into account by the data controller when determining needs regarding the procurement, development of new systems, or improvement of existing systems. Controls regarding the accuracy and appropriateness of application system inputs must be conducted, and control mechanisms must be embedded into applications to verify whether correctly entered data has been corrupted intentionally or as a result of errors occurring during processing,' errors of this nature ought to have been remediated prior to deploying the process into production, having failed to be detected prior to the subject breach...")

• Therefore, it can be stated that maintaining personal data in a lawful manner mandates establishing required cybersecurity solutions alongside conducting routine audits to ensure the proper operational integrity of the network and its component systems.

5) Decision No: 2021/311

a) In the case subject to the decision, a promotional campaign on the data controller's website generated heavy client traffic that exerted a DDoS effect, exceeding the capacity of the servers. Consequently, the data controller provisioned additional servers to the server network and expanded server capacity, keeping site data accessible to users during these maintenance operations. However, during this procedure, an improperly functioning cybersecurity solution created a risk whereby data from the database that ought not to have been exposed on the website's front-end became accessible to authenticated users logging into the system. ("On May 18, 2020, high volume access to the data controller's website occurred due to a new campaign, exceeding the capacity of application servers, / While new application servers were being added by the data processor, copies of the existing site state were generated to mitigate potential downtime, / During this procedure, the objective was to capture a static copy of the webpage and display this static copy to customers while adding new application servers, / During this process, due to a function—utilized to prevent DDoS attacks and included within services procured by the data processor from a third party—failing to operate as defined, a copy of user profiles was generated alongside the existing interface, rendering randomly copied user profile data visible to users logging into member accounts...")

The decision notes that the data controller tested the malfunctioning cybersecurity function within a production environment under limited external data flow. However, the function—which generated no errors under limited data traffic—caused a system failure under heavy traffic conditions. The failure to conduct prior testing anticipating heavy traffic, coupled above all with executing system maintenance and updates while internet users could access the site under active data traffic, was cited as grounds for unlawful processing.

("Although the function was subjected to testing prior to deployment into production, this test was conducted with a limited number of users; the data controller ought to have anticipated high volume due to the campaign, executed software checks suitable for such volume, and deployed the application thereafter; furthermore, modifications and updates to be executed on the website by the data controller ought not to have been conducted during peak operating hours, but rather during hours of lowest site traffic and by taking the site offline to prevent breaches of this nature...")

• Therefore, it can be stated that maintaining personal data in a lawful manner mandates taking systems offline from incoming internet user traffic while executing maintenance or updates on systems linked to databases hosting personal data, alongside subjecting systems to testing under extreme conditions and volume prior to public exposure.

b) In databases hosting sensitive credentials such as usernames and passwords, such data is customarily stored utilizing cryptographic methods. In this framework, hash functions may be deployed at the primary stage. Thus, a password such as "12345" appears as a complex string of characters absent the decryption key. However, hash values can frequently be reverted or cracked using specialized software, or decrypted by querying rainbow tables containing precomputed hashes and corresponding plain-text strings. Consequently, plain-text data (e.g., passwords) may be exposed. For this reason, data or passwords are not hashed directly; rather, pseudo-random characters are appended or prepended prior to hashing and database storage (a technique designated as salting).

In the case subject to the decision, it was noted that the data controller failed to deploy hashing or derivative cryptographic solutions, citing this omission as grounds for unlawful processing. ("In addition to these, while the data controller was required to store users' personal data by masking or encrypting it, the measures of 'encryption and data masking' set forth in Section 4.1 'Summary Table of Technical Measures' of the Personal Data Security Guide (Technical and Administrative Measures) were planned to be adopted only after the breach occurred...")

• Therefore, maintaining personal data in a lawful manner mandates storing data within databases utilizing cryptographic solutions. Furthermore, as affirmed in Board Decision No. 2020/511 containing analogous reasoning, cryptographic keys must be maintained securely in separate environments.

(The most rigorous operational standards for these cryptographic solutions are codified within banking legislation and the Regulation on Information Systems of Banks and Electronic Banking Services. For data controllers seeking stricter standards, the provisions of said regulation serve as an authoritative legal and technical framework.)

To provide an explanatory clarification at this junction: if data residing solely within the database is encrypted, protection is established exclusively against unauthorized system intruders. Consequently, to safeguard against interception of data in transit, data traffic itself must be routed through encrypted channels (e.g., deploying SSL when exposing a site to the internet).

6) Decision No: 2018/10, "Adequate Measures to Be Adopted by Data Controllers in Processing Special Categories of Personal Data"

The relevant section of the decision provides as follows:

*"3- Where environments where special categories of personal data are processed, stored, and/or accessed constitute electronic media:

a) Data must be stored utilizing cryptographic methods,

b) Cryptographic keys must be maintained securely in separate environments,

c) Transaction logs of all activities executed on data must be logged securely,

d) Security updates for environments hosting data must be continuously monitored, required security tests must be regularly conducted/commissioned, and test results must be recorded,

e) Where remote access to data is required, at least two-factor authentication systems must be deployed...

5- Where special categories of personal data are to be transferred:

a) If data transfer via email is required, it must be executed in encrypted form using corporate email addresses or Registered Electronic Mail (KEP) accounts,

b) If transfer via flash drives, CDs, or DVDs is required, data must be encrypted via cryptographic methods and the cryptographic key maintained in a separate environment,

c) If transfer is executed between servers in distinct physical environments, data transfer must be conducted by establishing a VPN between servers or via sFTP protocols...

6- Alongside the measures specified above, technical and administrative measures aimed at ensuring an appropriate level of security set forth in the Personal Data Security Guide published on the Personal Data Protection Authority website must likewise be taken into account."*

7) Decision No: 2020/113

a) Internet traffic flows across numerous intermediary network devices between client users and database/application servers. Even when exiting a local network to the internet, multiple intermediary locations such as switches may exist on the path to the router. Within internet traffic, alongside ISP router hops across the backbone, DNS, proxy, and VPN servers, intermediary devices in bridged setups, peer nodes in P2P networks, and various third parties may be integrated into the communication chain. Even absent such architecture, client traffic may be redirected to such intermediary devices by malicious actors. These third parties positioned between client and server in data traffic can intercept unencrypted communications. Interception of traffic by persons compromising or controlling systems in intermediary device positions is designated as a man-in-the-middle attack. However, numerous methodologies exist for sniffing data traffic between two parties, whether via malware deployment, executing packet analysis systems on the network without a man in the middle, or derivative techniques.

In the case subject to the decision, individuals accessing the data controller's system with authorized credentials connected from a public Wi-Fi hotspot without utilizing a VPN. In public hotspots, the network is customarily segmented into multiple VLANs, separating the public segment from other network zones. Nonetheless, the public segment remains exposed to malicious operations by both the network administrator and other guest users on the public network (absent dedicated security solutions). For instance, utilizing a basic packet analysis tool under such conditions permits the monitoring, capturing, or reading of unencrypted guest communication data.

• Therefore, it can be stated that maintaining personal data in a lawful manner mandates that systems must not be connected to from public hotspots without utilizing a VPN or analogous secure mechanisms.

In our submission, devices providing remote access to network architectures hosting personal data should never join unauthenticated hotspot networks. Beyond traffic monitoring, collateral risks exist on such networks. Indeed, even if the connection itself is secure, entities providing hotspot access are statutorily required under Law No. 5651 to maintain log records, thereby automatically logging data regarding target IP addresses and open ports of the data controller. This represents a circumstance harboring potential security risks in its own right.

b) In the decision, it was noted that the data controller failed to deploy SSL on its public-facing application (which can result in the interception of data traffic) and failed to conduct penetration testing on its systems. These omissions represent deficiencies regarding the lawful maintenance of personal data. These matters were detailed in the first installment of this article.

("Prior to the data breach, systems were accessed without restriction from public cafe environments outside the data controller's internal network, penetration testing was conducted only after the breach, vulnerabilities such as SQL Injection and Cross-Site Scripting capable of causing access to critical information existed prior to the breach, and application traffic could easily be sniffed owing to the absence of an SSL Certificate defined within the mobile application...")

Furthermore, the decision states that the system was vulnerable to injection attacks. To elucidate: if required filtering measures are not implemented on database servers, programming languages such as SQL can be manipulated to extract personal data residing in the database. In XSS attacks, executing malicious scripts on servers permits attacks against third parties connecting to said servers, obtaining data via the server, or compromising personal data through derivative techniques. (Interception of data traffic and injection attacks constitute distinct technical phenomena.)

Atty. Alp Öztekin, LL.M.