The Agence nationale de la sécurité des systèmes d'information (ANSSI), France's national agency for information system security, has released an experience report detailing the weaknesses that contributed to a data scraping incident involving the Direction générale des finances publiques (DGFIP). The report highlights a series of vulnerabilities, ranging from the exposure of business applications to the handling of compromised accounts. While the incident involved compromised accounts, the ANSSI emphasizes that it cannot be reduced to a single cause. Instead, the report outlines a series of areas for improvement, including application controls, authentication, access rights, detection, and incident response. The agency notes that a complete audit of IT systems is needed to fully identify all exploitable vulnerabilities. The measures proposed are not an exhaustive list of proven weaknesses but rather a framework to strengthen the overall security posture. The first area of concern is the exposure of business applications. The ANSSI distinguishes between internal applications, which should only be accessible from DGFIP workstations or through a secure virtual private network (VPN), and those with limited external use, which should also be restricted to internal networks or specific IP addresses. For public-facing applications, the agency recommends measures such as geofiltration and filtering suspicious IP addresses. These steps are critical in reducing the risk of unauthorized access and data extraction. The second point focuses on authentication mechanisms. The ANSSI stresses the importance of preventing the theft of user identifiers and recommends measures such as prohibiting personal devices for accessing professional resources and enforcing multi-factor authentication (MFA). However, the agency cautions that not all MFA methods are equally secure. For example, one-time codes sent via email may not be sufficient if the email account is also compromised. Instead, the agency favors physical tokens or authentication apps for the second factor of MFA. Additionally, it recommends strengthening passwords and separating personal and professional use to prevent personal devices from becoming entry points for attackers. The third area of concern involves access rights and consultation perimeters. The ANSSI highlights the need for fine-grained control over what users can access within an application. It emphasizes that while a user may be authorized to use an application, they should not be able to access an unlimited amount of data. This distinction is crucial in preventing data scraping, where an attacker with valid credentials can generate numerous requests that individually appear legitimate but collectively extract large amounts of data. Limiting access rights not only protects confidentiality but also limits the damage if an account is compromised. The fourth weakness concerns mechanisms to limit scraping activity. The ANSSI recommends implementing quotas on data access, including limits on the number of requests and the volume of data exchanged over a given period. These measures can help distinguish between normal user activity and automated scraping. The agency also suggests creating multiple layers of restrictions rather than relying solely on authentication. These steps are particularly important in scenarios where an account has already been compromised, as they can prevent an attacker from exploiting the application indefinitely. The final two areas focus on detection and response. The ANSSI recommends integrating applications into a Security Information and Event Management (SIEM) system to monitor for suspicious activity. It also suggests automatically blocking accounts after detecting unusual behavior, which can significantly reduce the window of opportunity for attackers. Additionally, the agency emphasizes the need for a thorough analysis of compromised accounts, including revoking active sessions and investigating the root cause of repeated compromises. According to the ANSSI, an action plan has been developed with the DGFIP, though the timeline for implementation remains unclear.