CISSP Asset Security: A Secret URL Is Not Access Control

Nine million images of people's faces. No password. No encryption. And when a researcher reported it, the operator's position was essentially that the data was not really public, because you had to know the URL to reach it.

That one sentence is worth more to a CISSP candidate than a week of flashcards. It is a complete, real-world statement of a control failure that the exam tests constantly and that study guides usually reduce to a slogan.

What actually happened

Independent researcher Jeremiah Fowler found a 450GB database belonging to ClarityCheck, a reverse-lookup service that markets itself on identifying unknown callers and letting you research people online. The service described itself as private and secure.

The database was neither password-protected nor encrypted. No authentication was required to retrieve its contents. The addresses were not indexed by search engines, but they could be discovered by reading the service's own client code. The images had been gathered from third-party sources including social media and dating sites, and the set included photographs of teenagers and children.

There is one more detail, and it is the one I would put on the exam. The service's own policy said uploaded images were stored for fourteen days and then automatically deleted. Fowler found images with timestamps well past that.

Obscurity is not access control

Start with the defence, because it is the most instructive part.

"You had to know the URL" is a claim that the difficulty of discovering an address constitutes a control over access to the resource. It does not, and the reason is structural rather than a matter of degree.

An access control makes a decision. It receives a request, evaluates it against some notion of who is asking and what they are permitted to do, and returns a grant or a denial. Every part of that is missing here. The server was not deciding anything. It answered every request identically, because there was no mechanism present that could have answered differently.

A hidden address is not a key. A key is a thing you check. An address is a thing you type. And an address has a property no secret should have: it is transmitted to every party in the path, logged by intermediaries, stored in browser history, and — as happened here — embedded in code the service ships to its own clients.

This is why the CISSP treats security through obscurity as a property that may accompany controls and may never substitute for them.

Absent controls are not weak controls

Here is the distinction that separates a passing answer from a confident one, and it is subtle enough that it is worth slowing down for.

A weak control is a control. A short password, a stale ACL, an over-broad role — these are mechanisms that exist and perform poorly. They fail gradually, they produce logs, they can be measured, and they can be strengthened by changing a setting.

An absent control is not a bad version of a control. It is a gap where no decision is being made at all. There is nothing to tune, nothing to monitor, nothing to report on, and no evidence that anything was ever evaluated.

That difference drives the remediation. You strengthen a weak control. You introduce an absent one — which is a design and ownership problem, not a configuration problem. An exam question that offers you "strengthen the existing access controls" when no access control exists is offering you a correct-sounding action against a system where it cannot be performed.

Classification is driven by impact, not by likelihood

The second trap in this incident is the one people fall into when estimating how bad it is.

Classification asks what happens if this data is disclosed, altered, or lost. It is a statement about consequence. It does not ask how probable that outcome is, how attractive the target looks, or how competent the attacker would need to be. Those are likelihood questions, and likelihood belongs to risk assessment, not to classification.

Here, the consequence side is not ambiguous. Facial biometrics are not revocable. You cannot rotate a face the way you rotate a credential. The subjects never transacted with the service at all — the images were collected from third parties — so they had no opportunity to consent, and no way to know they were in the set. Some of them were children.

None of that changes if the database is difficult to find. A candidate who reasons "the URL was obscure, so the impact is lower" has quietly substituted likelihood for impact. That substitution is one of the most reliable distractors the exam has, precisely because it feels like good judgement.

Without a named owner, nothing downstream is mandatory

This is the part of Domain 2 that looks like administrative trivia on the page and turns out to be the whole ballgame in practice.

Now notice what happens when the owner row is empty.

Classification never gets assigned, so no control requirement is ever derived. Encryption becomes a good idea rather than a requirement. Authentication becomes a backlog item. The retention job is written but never given a deadline anyone is accountable for. Evidence-producing logging is the first thing cut when the release is late.

None of those are decisions to skip a control. They are what happens when nobody has the standing to insist. A retention policy that says fourteen days, with images sitting there well past fourteen days, is the signature of exactly this: a stated intention with no owner behind it and no mechanism enforcing it.

And accountability does not transfer when you outsource. If the storage is someone else's platform, the custodian changes and the owner does not. You can contract out the running of a control. You cannot contract out being answerable for whether it exists.

Retention and destruction — the end of the lifecycle

The fourteen-day policy points at the last phase of the data lifecycle, which is where Domain 2 candidates tend to be weakest because it is the least glamorous.

Retention is a decision about how long the data must or may be kept, and it is driven by legal, regulatory, and business requirements — not by how cheap storage has become. Destruction is what makes that decision real. A retention policy with no destruction mechanism behind it is a sentence in a document.

For the media itself, NIST SP 800-88 gives the three levels, and the distinction between them is a favourite exam target:

• Clear — overwrite with standard read/write commands. Defeats casual recovery using the device's normal interface. The data may still be reachable through laboratory techniques or from areas the interface does not address.
• Purge — render recovery infeasible even with laboratory techniques. Degaussing and cryptographic erase live here.
• Destroy — physically ruin the media so it cannot be reused at all: shredding, disintegration, incineration.

Two traps worth memorising:

Degaussing works on magnetic media. It does nothing useful to an SSD or any other flash-based device, because there is no magnetic domain to disrupt. An answer offering degaussing for solid-state media is testing whether you know what the technique physically does.

Cryptographic erase is only as good as the key management. It works by destroying the key so the ciphertext becomes unrecoverable — which assumes the data was encrypted properly in the first place, that every copy of the key is accounted for, and that no plaintext copy escaped before encryption. It is fast and it is genuinely effective when those hold. When they do not, it is a statement of hope.

Note also where the domain boundary falls. The lifecycle of the data — including its retention period and its destruction — sits in 2.4. Sanitising the media because the hardware has reached end of life is 2.5. The two get discussed together and they are not the same question.

The crossover trap

A well-built distractor is usually a true statement drawn from the right-hand column, answering a question you were not asked.

The uncomfortable part

The operator did not need a sophisticated attacker. There was no intrusion, no zero-day, no insider. A researcher read the code, followed an address, and the server handed over 450GB because nothing in the path was configured to ask who he was.

The distance between that and a functioning control was not a budget or a technology. It was somebody with the standing to say this data is classified at this level, therefore these controls are required, and I am accountable for whether they exist.

If you can name that person for the most sensitive dataset your organisation holds, Domain 2 will feel like common sense on exam day. If you cannot, you have just found the most valuable thing this episode can give you.

Listen to the full episode: CISSP Cyber Training Podcast — the incident breakdown, asset identification and classification, owner versus custodian and controller versus processor, the full retention and destruction walkthrough, and exam-style questions built to teach the trap rather than the answer.

Studying for the CISSP? CISSP Cyber Training runs three tiers — Accelerator for self-paced study, Pro for the full question bank and monthly office hours, and the Sprint Cohort for candidates working to a booked exam date.

Shon Gerber, CISSP — Former Commander, 177th Information Aggressor Squadron · Former CISO · Fractional CISO · Founder, CISSP Cyber Training

Sources: ClarityCheck data leak exposes 9M face images, Cybernews · 9 million images of people's faces exposed by reverse lookup service, Malwarebytes · NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization