Category: Azure

Kyle Chin
updated Aug 21, 2023

Cybersecurity is necessary to protect data from criminals. However, the world of cybersecurity is not so simple. Therefore, a discussion of cybersecurity ethics needs to examine the morality of businesses collecting, processing, using, and storing data.

How cybersecurity professionals affect security measures is also worth exploring. Businesses and individuals should ask themselves whether the ends justify the means and to what extent they are willing to sacrifice data privacy for data protection.

This post underlines the ethical concerns and cybersecurity issues surrounding information security policies, procedures, systems, and teams and how they ought to contribute to the well-being of consumers.

What Are Ethics in Cybersecurity?

Ethics can be described as ideals and values that determine how people live and, increasingly, how businesses and their employees work.

While it is far from the technical specifications of networks and device configurations, it is an increasingly important part of business operations. It can be codified and included in an organization’s framework, determining acceptable behavior throughout the company in any scenario.

One of the main benefits of a strong ethical foundation for a business is that it will have a moral compass to help make ethical decisions in a rapidly changing business environment. The world is experiencing massive changes in information technology with advancements in artificial intelligence, machine learning algorithms, 5G, and data collection and processing.

The cyber threat landscape is also rapidly evolving, and businesses must make critical decisions about protecting themselves and their clients. With cybercrime on the rise and emerging threats driven by new technology such as AI, businesses need to elevate their cybersecurity. Doing so without sacrificing the customers or clients they set out to protect requires a strong ethical foundation and a written code of conduct.

The ACM Code of Ethics and Professional Conduct

In 1992, the Association for Computing Machinery (ACM) developed its Code of Ethics and Professional Conduct for computer systems workers. While it is not mandated, except for members of the ACM, it can be a useful starting point for Chief Information Security Officers (CISOs) and other stakeholders to think about and take a stance on ethical practices when tackling sensitive cybersecurity issues.

The Code of Ethics was revisited and revised in 2018. While the cloud stands to make more updates in the face of 5G, AI, and other advances in computing, it remains a valuable resource for anyone seeking to define ethical standards concerning computer systems and technology.

Having a clear set of ethical principles is helpful because it can clarify and speed up important decision-making in an increasingly complex, rapidly evolving cyber threat landscape.

The ACM Code of Ethics is divided into four categories:

• General Ethical Principles
• Professional Responsibilities
• Professional Leadership Principles
• Compliance with the Code

General Ethical Principles

The General Ethical Principles section makes the following assertions about the role of computing professionals. Computing professionals should:

1. Use their skills to benefit society and people’s well-being, and note that everyone is a stakeholder in computing.
2. Avoid negative and unjust consequences, noting that well-intended actions can result in harm that they should then mitigate.
3. Fully disclose all pertinent computing issues and not misrepresent data while being transparent about their capabilities to perform necessary tasks.
4. Demonstrate respect and tolerance for all people.
5. Credit the creators of the resources they use.
6. Respect privacy, using best cybersecurity practices, including data limitation.
7. Honor confidentiality, including trade secrets, business strategies, and client data.

Professional Responsibilities

The Professional Responsibilities section also says that computing professionals must prioritize high-quality services, maintain competence and ethical practice, promote computing awareness, and perform their duties within authorized boundaries.

1. Strive to achieve high quality in both the processes and products of professional work.
2. Maintain high standards of professional competence, conduct, and ethical practice.
3. Know and respect existing rules pertaining to professional work.
4. Accept and provide an appropriate professional review.
5. Give comprehensive and thorough evaluations of computer systems and their impacts, including analysis of possible risks.
6. Perform work only in areas of competence.
7. Foster public awareness and understanding of computing, related technologies, and their consequences.
8. Access computing and communication resources only when authorized or when compelled by the public good.
9. Design and implement systems that are robustly and usably secure.

Professional Leadership Principles

Professional Leadership pertains to any position within an organization that has influence or managerial responsibilities over other members and has increased responsibilities to uphold certain values set by the organization.

1. Ensure that the public good is the central concern during all professional computing work.
2. Articulate, encourage acceptance of, and evaluate fulfillment of social responsibilities by the organization or group members.
3. Manage personnel and resources to enhance the quality of working life.
4. Articulate, apply, and support policies and processes that reflect the principles of the Code.
5. Create opportunities for members of the organization or group to grow as professionals.
6. Use care when modifying or retiring systems.
7. Recognize and take special care of systems that become integrated into the infrastructure of society.

Compliance with the Code

Of course, compliance with the Code of Ethics is the only way to ensure cybersecurity professionals uphold certain ethical standards. Without enforcement of the Code of Ethics or similar ethical considerations, it is impossible to document and recognize adherence to ethics and social responsibility.

1. Uphold, promote, and respect the principles of the Code.
2. Treat violations of the Code as inconsistent with membership in the ACM.

Corporate Social Responsibility and Cybersecurity

To compete with other businesses and delivery the user experiences that consumers expect, modern businesses are obligated to collect and process increasing amounts of data. This particular genie is already out of the bottle, so the question is not really whether big data should exist but how businesses use and protect data.

Cybersecurity helps prevent and mitigate data breaches and attacks that threaten information security, so it is crucial for public safety and well-being, as well as helping to ensure the longevity of businesses. There is so much at stake that cybersecurity professionals should be willing to come under scrutiny by those in and outside the field.

Cyber ethics encapsulates common courtesy, trust, and legal considerations. Acting ethically should protect individuals, organizations, and the wider economy. So it’s vital for cyber professionals and the organizations that employ them. The following considerations will explore what makes effective cybersecurity and explain how poor cybersecurity is not only ineffective but also potentially unethical.

Information Security

Businesses have a moral obligation to protect their customers and business partners. They benefit from data that allows them to operate and can give them a competitive advantage, but they need to protect that information from hackers and accidental leaks.

Unfortunately, businesses that are hacked are often at fault. While nobody deserves to be hacked, a business’s moral obligations to consumers are such that they are expected to have adequate cybersecurity for their computer systems and respond promptly and decisively in the event of a cyber incident.

Equifax’s 2017 cyber attack is a prime example of a business that damaged its reputation due to inadequate cybersecurity and poor response to attacks. It was hacked around May 2017 but did not disclose the breach until September.

While Equifax’s president for Europe said that protecting consumer and client data was always its top priority, it failed to follow through with patching a software security vulnerability it knew about in March and failed to let affected customers know so that they could take steps to protect themselves from phishing, identity theft, and other kinds of fraud.

Equifax’s human and technological failures compromised 14.5 million sensitive data records, including addresses, birth dates, driver’s licenses, and social security numbers. It also puts the firm’s morality into question, as it processes sensitive information and purports to help customers with their financial security, but its ineffective cybersecurity procedures put those people at risk.

Transparency

Ethically, businesses should be prepared to disclose the risks inherent to the business if they could substantially affect people, whether customers, business partners, or their supply chain.

Data breach reporting is a significant part of a business’s transparency. While reporting a breach highlights a business in crisis, failing to report promptly can lead to a more significant loss of trust, criticism from industry professionals, and sometimes, as in Equifax’s case, action from investigators.

Even if a business operates in an unregulated industry or a cyber attack does not cause business disruption or affect clients, reporting all data breaches is a worthwhile ethical consideration. The more businesses report cyber attacks, the more information there is for cybersecurity experts and industry professionals to share and learn from. This protects other businesses and their clients from emerging threats.

While revealing a vulnerability or data breach according to applicable regulations may not be necessary, there is a moral question as to whether this information should be shared regardless. Being transparent about discovering vulnerabilities can help all businesses protect their information systems and clients.

Cyber incidents are varied, and cybercriminals are continually researching new methods to apply and vulnerabilities to exploit. So how businesses respond to threats and potential threats needs to change on a case-by-case basis. However, they can base their decision-making on an explicit, underlying ethical framework that guides the business according to its values and corporate social responsibility.

While some businesses reject revealing data breaches “unnecessarily” for fear of losing trust or business, disclosing data breaches late can cause more damage and even harsh penalties. Handling a crisis professionally and ethically can even be good for a firm’s reputation, as in the case of Norsk Hydro’s handling of the fallout from its 2017 ransomware attack, which impressed industry professionals and cybersecurity experts.

Organizations and their cybersecurity teams can reap rewards from being proactive and enacting policies and procedures according to a defined, documented code of ethics.

Security vs. Privacy Protection

A prime ethical dilemma in cybersecurity concerns cybersecurity experts’ privileged access to sensitive information. In effect, they must understand how cybercriminals operate and be able theoretically to perform the same feats without crossing the line into the territory of black hat hackers.

Cybersecurity professionals set access privileges, monitor network activity, and can read people’s emails. They can scan machines and therefore can compromise and protect people’s personal lives.

Collecting data leads to ethical questions but so does protecting it. Ethically, everyone deserves dignity, which is tied in with privacy. But how do businesses achieve privacy when they collect customer data, and that data must be protected?

Social engineering and identity theft are among the biggest cyber risks to the public. This is partly because it can affect people beyond those whose data is stored. With stolen data, a cybercriminal can launch phishing attacks against the victim and their associates.

Keeping personally identifiable information (PII) secure, therefore, is paramount. However, that requires personnel to access and in some ways manipulate that data. Anyone working in cybersecurity is walking a tightrope of ethical issues every day. It’s helpful to acknowledge this so that grey areas can be defined and clients are reassured.

Confidentiality

Excellent cybersecurity is not just about technical standards. Cybersecurity professionals need to demonstrate their moral standards when handling sensitive data. During daily duties, cybersecurity professionals will have access to confidential data and files. This could include sensitive data such as payroll details, private emails, and medical records.

Intellectual property theft is one of the most costly cybercrime, as stealing a business’s product designs and concepts can give opponents an unfair advantage while saving them the massive cost and time investment of product development. Nation-states may sponsor cyber espionage to achieve this advantage, risking destabilizing the affected nation’s market and economy. Intellectual property theft can be a serious risk to human life in a critical infrastructure industry, such as defense or healthcare.

It almost goes without saying that cybersecurity staff shouldn’t say anything to the public about the confidential data and intellectual property they see, nor should they store or transmit it in any way that is not aligned with the business’s goals to protect data. “Almost” because ethical debates often involve bringing things out of the shadows and into the light.

An implicit understanding may not be enough to ensure the confidentiality of sensitive data. It’s better to have documented policies and procedures regarding confidentiality and the organization’s attitude to how cybersecurity interacts with personal data.

On April 13, 2023, federal investigators arrested Jake Teixeira, an air national guardsman, concerning the unauthorized transmission of classified US intelligence documents. Teixeira’s role in the Massachusetts Air National Guard was as a Cyber Transport Systems Journeyman responsible for maintaining communication networks.

While there are some claims that he acted as a whistleblower, he shared the documents in a small private group on a social media platform, not seeming to have intended to share it with a wider audience.

Nonetheless, this massive data security breach calls into question cybersecurity professionals’ commitment to upholding the law when faced with tempting confidential information. Cybersecurity teams must be continuously committed and engaged to perform their duties honorably, within the law, and according to the expectations of their employers.

Although The Association for Computing Machinery (ACM) developed a Code of Ethics and Professional Conduct for computer systems workers, ethics in cybersecurity is not regulated. Ethics can’t be ensured by law enforcement.

Having said that, unethical behavior can lead to fines, loss of revenue, and loss of customers, so businesses and cybersecurity professionals will benefit from addressing ethics seriously.

While there’s no handy accreditation that cybersecurity staff can achieve to attest to their honesty, hiring organizations should look at a cybersecurity firm’s history and culture for evidence of its ethical stance on cybersecurity.

Security

Cybersecurity professionals cannot have a lapse of concentration or a couple of days where they’re off their game and let things slide. Responsibility for others’ information security is a massive contractual and ethical responsibility. Almost no matter what the individual does, scrutiny will be on any assigned cybersecurity team or professional in the event of a cyber incident.

Cybersecurity professionals must maintain their competence level, respect sensitive information privacy, and uphold the well-being of those they serve. It requires honesty for these team members to evaluate their skills, abilities, and alertness and ensure that they take the appropriate action to stay on top of their game.

Ethical Hacking

Ethical hacking refers to sanctioned hacking by businesses onto their own systems to discover vulnerabilities and security gaps. Ethical hackers attempt to find vulnerabilities to exploit and break into information systems to fix those issues before cybercriminals find them.

But now imagine an ethical break-in, in which an ethical burglar break into people’s homes and then advises them on which locks they should have used and where to hide their laptops. Ethical hackers use illegal means to achieve positive results.

To protect data from hackers, particularly when they are using increasingly sophisticated methods and rapidly advancing technologies, cybersecurity professionals must use the same techniques. Cybersecurity programmers need to know how to commit crimes by black hat hackers, such as stealing credit card data. What stops them from doing this, however, is that ethical principles separate them.

Cyber professionals must be aware of computer ethics since what they do gives them access to privileged information. This is especially true for professionals working in critical infrastructure, including defense, healthcare, finance, and manufacturing, where the consequences of unethical actions regarding sensitive data could cause serious harm to individuals, organizations, and the economy.

Cybersecurity professionals and businesses that need them must understand cyber ethics and insist that a moral code is always evident in their attitude and behavior.

Whistleblowing

Before the dark web became known as a haven for hackers and cybercriminals to extort money, purchase malware, and prepare to commit multiple kinds of cybercrime, it existed in large part to protect whistleblowers.

Whistleblowing refers to someone reporting their organization’s wrongdoing, typically an employee. A whistleblower’s objection might be that the organization or someone in it is acting illegally, fraudulently, immorally, or without proper regard for safety or human rights. Furthermore, the issue should be in the public interest.

Public sector whistleblowers are protected by the First Amendment. Even so, whistleblowing might be considered a grey area when considering cyber ethics.

If a cybersecurity expert reveals confidential information to stop a harmful practice, the objective is good, but how they achieved this breaks the ethical confidentiality essential to that employee-employer relationship.

Edward Snowden famously blew the whistle on the National Security Agency’s unethical, invasive surveillance of innocent US citizens. While the former computer intelligence consultant and CIA systems administrator is a hero to many, his actions were criminal. The US Department of Justice charged him with stealing government property and violating the Espionage Act of 1917.

Jesselyn Radack, from the Government Accountability Project, argued that Snowden’s contract with the Government was less important than the social contract of a democracy.

Security vs. Functionality

While organizations have a responsibility to society to protect data, they need to balance this requirement with maintaining functionality. A technically workable cybersecurity solution is not necessarily the best if it prevents the organization from operating. This is a moral debate because organizations won’t always use the most secure cybersecurity practices or systems. Operating a modern business means navigating such trade-offs daily.

Cybersecurity experts have a responsibility to balance securing information and keeping organizations running. Some businesses need to be able to work quickly, such as in healthcare where the most robust security system could slow daily operations and risk human life. A holistic approach to information security is required based on thorough risk management.

Source :
https://www.upguard.com/blog/cybersecurity-ethics

Leah Sadoian
updated Sep 15, 2023

There are a variety of cybersecurity regulations in Europe, including the ePrivacy Directive, which focuses on enhancing data protection, processing personal data, and privacy in the digital age. This Directive, recently updated with the ePrivacy regulation, continues the European Union’s ongoing efforts to create cohesive and comprehensive European data protection and cybersecurity standards across all member states.

Upgrade your organization’s cybersecurity standards with UpGuard Breachsight >

What is the ePrivacy Directive?

The Privacy and Electronic Communications Directive 2002/58/EC, or the ePrivacy Directive, is a European Union cybersecurity directive on data protection and privacy protection. The current ePrivacy Directive addresses the growing landscape of new digital technologies and electronic communications services. The Directive aims to harmonize national protection of fundamental rights within the EU, including privacy, confidentiality, and free data movement.

The ePrivacy Directive was enacted in 2002. It required each EU Member State to pass its national data protection and privacy laws, regulating essential issues like consent, spam marketing, cookies, and confidentiality.

Key Components of the ePrivacy Directive

Since the ePrivacy Directive focuses on the protection of online privacy in the electronic communications sector, the Directive’s key components include standards around how people communicate with each other electronically, aligning them with recent technological advancements.

Cookies and Consent Mechanisms

A significant component of the ePrivacy Directive is cookies, which are small data files websites use to track user behavior. Specifically, the Directive states that websites must obtain informed user consent before storing or retrieving any information on their electronic devices, giving the ePrivacy Directive the nickname “cookie law.”

Gaining this consent includes providing end-users with information about the purpose of the data storage and an opportunity to accept or opt-out. Many websites utilize a cookie banner to obtain cookie consent for website visitors. However, cookies essential for site functionality or for delivering a service requested by a user (like tracking the items in an online shopping cart) are exempt from this requirement. Note that the Directive applies to both first-party and third-party cookies.

Protection of Personal Data in Communications

Concerning data protection, the Directive states that providers of electronic communication services must ensure that their services are secure—which in turn secures any personal data that may be shared through those services. Standard electronic communication services include email and instant messaging.

These providers must also inform their users whenever a risk, such as a data breach or ransomware attack, leaves their personal data vulnerable to misuse.

Data Retention

Data retention refers to how companies retain your data, and the ePrivacy Directive includes standards for this practice.

Specifically, the Directive states that when providers of services no longer need your data, they must erase or anonymize it. There are specific situations in which data retention is allowed, such as billing services or issues of national security.

Otherwise, data may only be retained if a user consents to it, and they must also be informed why the data is being processed and the length of time it will be stored.

Unsolicited Marketing Communications

The ePrivacy Directive includes strict restrictions on the use of digital marketing communications. Unsolicited communications for direct marketing purposes are not allowed without the recipient’s consent. This includes email and text message marketing.

Typically, this is done through opt-in or opt-out systems determined by individual EU member states. However, the overall rule is that marketing communications cannot be sent without explicit consent from the user.

Location Data

The ePrivacy Directive sets instructions for using location data obtained through electronic communications. Specifically, location data must be processed with informed consent and should be anonymized when no longer needed.

This provision is very relevant for mobile service providers and location-based services. Like the marketing communications provision, an opt-in or opt-out mechanism allows users to provide explicit consent before location data is provided.

Communications Confidentiality

Companies that provide electronic communication services must implement appropriate security measures to safeguard users’ data. They must also notify users and relevant authorities in case of any security breaches involving personal data. Additionally, the Directive governs how traffic data, which includes information about communication between individuals, can be processed and stored.

Even though the primary goal of the ePrivacy Directive is to protect confidentiality, it does allow for the retention of metadata for billing, service quality, and other purposes. Member states may require data retention under specific conditions, often related to national security or criminal investigations.

Member State Laws

The ePrivacy Directive is a directive that requires every EU Member State to establish national laws to accomplish the Directive’s goals. There is some variation in the regulations across different countries due to this, unlike the GDPR, which is a regulation and applies directly throughout the EU.

How the ePrivacy Directive Affects the GDPR

The General Data Protection Regulation (GDPR) is a mandatory regulation in Europe that protects the personal data of its citizens. Since the GDPR and the ePrivacy directive both concern data privacy, they work in tandem across various components.

• Scope: The ePrivacy Directive focuses explicitly on the electronic communications sector, and the GDPR extends data privacy laws to other industries that process personal data.
• Consent: Both the ePrivacy Directive and the GDPR focus on user consent, but the GDPR also outlines principles of lawful processing, including contractual necessity, legitimate interests, and legal obligation.‍
• Confidentiality vs. Data Protection: The ePrivacy Directive is primarily concerned with the privacy and security of electronic communications, and the GDPR includes broader concepts of data protection like data minimization, accountability, and individuals’ rights to access, rectify, and erase personal data.‍
• Security Measures: The ePrivacy Directive requires providers of electronic communication services to implement security measures to protect user information. At the same time, the GDPR mandates robust security measures and includes the concept of “data protection by design and default.”‍
• Data Breach Notifications: Both require notification of data breaches to users and regulatory authorities. The ePrivacy Directive only requires communication service providers to provide notification, but the GDPR extends that requirement to all data controllers and processors.

Who Must Comply with the ePrivacy Directive?

The ePrivacy Directive applies to entities providing electronic communication services in the EU, including but not limited to:

• Telecommunication Companies: Traditional telecom providers offer fixed or mobile telephony services.
• Internet Service Providers (ISPs): Entities providing internet connectivity services.
• Over-the-top (OTT) Providers: Companies that offer online communication services, such as instant messaging apps and VoIP services like Skype or WhatsApp.
• Website Owners: Any website that uses cookies or similar technologies to track user behavior must comply with the Directive.
• Email and SMS Marketers: Businesses that send marketing messages via email or SMS must adhere to the rules set by the Directive.
• Location-Based Services: Services that use location data also fall under the Directive’s jurisdiction.

Penalties for Noncompliance

Penalties for failing to comply with the ePrivacy Directive may differ across EU Member States, as each country is responsible for incorporating the Directive into national law. As a result, penalties can vary from monetary fines to legal actions, and the severity of the consequences will depend on the nature of the breach and the location of the incident. Below are some typical types of penalties that may be enforced:

• Financial Fines: These can vary widely from state to state but are generally designed to be dissuasive. Some countries have a cap on fines, while others may calculate them as a percentage of the annual turnover of the offending company.
• Legal Sanctions: In some instances, severe or repeat violations may result in legal action, including the possibility of criminal charges.
• Reputational Damage: Beyond legal penalties, companies that violate ePrivacy laws often suffer significant reputational damage, which can result in loss of customer trust and revenue.
• Cease and Desist Orders: Regulatory bodies may require the violating entity to stop the offending action immediately, often at the cost of temporarily or permanently turning off a service or feature.
• Data Audits: In some cases, the regulatory bodies may require a thorough audit of data protection practices within the offending organization.
• Notification Requirements: Failing to notify the authorities and individuals affected by a data breach, as stipulated by the Directive, can lead to additional penalties.

In 2022, Google and Meta were both found to be in violation of the ePrivacy Directive and faced steep fines for their non-compliance. France’s Commission Nationale Informatique & Libertés (CNIL) fined Google €150M and Facebook another €60M for not offering an option for users to reject non-essential cookies in line with the option to accept all tracking. This violates the ePrivacy Directive’s requirements around cookies and consent mechanisms.

The Future: Introducing the ePrivacy Regulation

Since 2002, the digital communications industry has evolved rapidly, which means the ePrivacy Directive needed drastic updating. In 2017, The European Commission proposed the ePrivacy Regulation, which aims to replace the existing ePrivacy Directive and better align it with the General Data Protection Regulation (GDPR) data protection laws.

The regulation is still under discussion amongst the EU Council because of the scope of the rules and the impact it would have on big tech companies, large telecom providers, and even areas of online advertising, media, and national security.

This new legislation is a regulation of the European Parliament and Council of the European Union. It specifies and complements the ePrivacy Directive on privacy-related topics such as the confidentiality of communications, consumer privacy controls through electronic consent and browsers, and cookies.

Key Differences

• Legal Form and Scope: As a directive, member states must achieve specific goals but have the authority to decide how to do so, which can lead to differences in implementation across countries. The ePrivacy Regulation is a directly applicable law that becomes enforceable across the European Union, creating greater consistency.‍
• Cookies and Trackers: The ePrivacy Regulation expands on the requirement for user consent before utilizing cookies and tracking technologies but simplifies the rules around this requirement. This can include allowing users to consent through browser extensions and specific exceptions for cookies that improve user experience.‍
• Consent: The ePrivacy Regulation aligns the ePrivacy Directive’s requirements for user consent with the GDPR’s more stringent standards. This also simplifies consent mechanisms.‍
• Electronic Marketing: The ePrivacy Regulation extends the ePrivacy Directive’s restriction on unsolicited communications for marketing purposes to cover new marketing methods and forms of electronic communication, like marketing through social media platforms.‍
• Data Protection and Security: The ePrivacy Directive requires service providers to utilize security measures and report data breaches. The ePrivacy Regulation aligns those requirements with the GDPR’s broader data protection framework, which has stricter data breach notification timelines.‍
• Penalties: Instead of allowing individual member states to determine penalties for noncompliance, the ePrivacy Regulation adopts a penalty framework similar to the GDPR, with fines based on a company’s global turnover, up to 4% or up to €20 million, whichever is higher. It also gives more power to Data Protection Authorities, aligning it with the GDPR.‍
• International Impact: The ePrivacy Regulation’s alignment with the GDPR means data protection standards are not just primarily focused on EU member states but now affect any company that offers services or data transfers to EU residents (even if they are not located within the EU).

UpGuard Helps Your Organization Stay Compliant with Privacy Regulations

Enhance your organization’s data privacy standards with UpGuard. Whether you’re looking to stay compliant with the EU’s ePrivacy Regulation or the CCPA in the states, our all-in-one attack surface management platform, BreachSight, helps you understand the risks impacting your external security posture and know that your assets are constantly monitored and protected.

UpGuard BreachSight features include:

• Security Ratings: Use our security ratings for a data-driven, objective, and dynamic measurement of your organization’s security posture. Our security ratings are generated by analyzing trusted commercial, open-source, and proprietary threat intelligence feeds and non-intrusive data collection methods.
• Continuous Security Monitoring: Get real-time information about misconfigurations, understand your risk profile, and get started in minutes, not weeks, with our fully integrated solution and API. Because we use externally verifiable information, you won’t have to lift a finger to get started.
• Attack Surface Reduction: Reduce your attack surface by discovering exploitable vulnerabilities and permutations of your domains at risk of typosquatting.
• Data Protection: UpGuard’s proprietary Data Leak Search Engine scans every corner of the Internet and identifies data that presents a risk. It monitors your Internet presence and doesn’t check every website where we can find cloud storage buckets and source code repos.
• Workflows and Waivers: Simplify and accelerate how you remediate issues, waive risks, and respond to security queries. Use our real-time data to get information about risks, rely on our workflows to track progress, and know precisely when issues are fixed.
• Security Profile: Eliminate security questionnaires and stop answering the same questions repeatedly. Create an UpGuard security profile and share it before being asked.
• Reporting and Insights: The Reports Library makes accessing tailor-made reports for different stakeholders in one centralized location easier and faster. See all risks–across various domains, IPs, and categories–in the UpGuard platform or extract the data directly from the API.
• Business Operation Management: Share access to your UpGuard account with other team members with confidence. Each user gets an individual account with fine-grained access control.
• Third-Party Integrations: Integrate and extend the UpGuard platform with other tools with our easy-to-use API that can save hours of human time.
  
  Source :
  https://www.upguard.com/blog/eprivacy-directive