{"id":9805,"date":"2019-03-22T13:46:15","date_gmt":"2019-03-22T17:46:15","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=9805"},"modified":"2023-05-24T15:54:03","modified_gmt":"2023-05-24T19:54:03","slug":"autopsying-the-marriott-data-breach-this-is-why-insurance-matters","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/autopsying-the-marriott-data-breach-this-is-why-insurance-matters\/","title":{"rendered":"Autopsying the Marriott Data Breach: This is why insurance matters"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-so-far-marriott-s-massive-2018-breach-has-cost-it-just-3-000-000\">So far, Marriott\u2019s massive 2018 breach has cost it just $3,000,000<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Today we\u2019re going to autopsy last year\u2019s Marriott data\nbreach, which affected nearly 400,000,000 guests and looked to be one of the\nmost pervasive breaches in history. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are a few big takeaways that come with this. And we spoke with a range of security experts to get their opinions on them. We\u2019ll cover what happened, why it happened, who did it, and whether the culprit exonerates Marriott. But first we\u2019re going to start with a quick refresher, followed by the Marriott Data Breach\u2019s total cost \u2013 which we were updated on at the start of March.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12779\"><\/span>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-marriott-data-breach-in-five-minutes\">The Marriott Data Breach in Five Minutes<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Marriott Data Breach: Who&#039;s Affected &amp; What to Do\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/QJ2dMUD5E4U?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">By this point, pretty much everyone is at least aware of the Marriott Data Breach, but let\u2019s at least cover the basics before we get into unraveling the ramifications of it all. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For starters, this breach is huge. By some estimates it\u2019s the second biggest of all-time, behind only <a href=\"https:\/\/www.thesslstore.com\/blog\/yahoo-breach\/\">Yahoo<\/a> and well ahead of <a href=\"https:\/\/www.thesslstore.com\/blog\/equifax-data-breach-total-data-lost-the-final-count\/\">Equifax<\/a>. The breach actually began in 2014 and wasn\u2019t discovered until September 10<sup>th<\/sup> of this year. In the four years between the network being breached and said discovery, \u201cup to approximately 500 million guests\u201d made reservations using the compromised system and now potentially have their personal data compromised. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Things like:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"alignright\"><img loading=\"lazy\" decoding=\"async\" width=\"122\" height=\"153\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/Hacker.png\" alt=\"\" class=\"wp-image-9811\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/Hacker.png 122w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/Hacker-75x94.png 75w\" sizes=\"auto, (max-width: 122px) 100vw, 122px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Full names<\/li>\n\n\n\n<li>Mailing addresses<\/li>\n\n\n\n<li>Phone numbers<\/li>\n\n\n\n<li>Email Addresses<\/li>\n\n\n\n<li>Passport numbers<\/li>\n\n\n\n<li>Starwood Preferred Guest account information<\/li>\n\n\n\n<li>Birthdates<\/li>\n\n\n\n<li>Genders<\/li>\n\n\n\n<li>Arrival\/Departure <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"http:\/\/dgregscott.com\/about\/\">Greg Scott is a cybersecurity researcher and author<\/a>, one of his biggest issues with the cybersecurity world in general is companies\u2019 reticence to disclose information about breaches and attacks. This occurs for a number of reasons, not the least of which is to protect their reputation, but that tact doesn\u2019t help to improve the security ecosystem.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u201cAs far as I can tell, nobody is talking in public about specifics,\u201d says Scott.&nbsp; \u201cThis is a shame. We can speculate based on other attacks, but until somebody involved speaks up, all we have is speculation. We may never find out what happened. And that\u2019s a huge problem with all these attacks \u2013 everyone hides behind, \u201cit\u2019s an ongoing investigation\u201d and so everyone else keeps making the same mistakes. &nbsp;Every attack I\u2019ve been able to analyze \u2013 every single one \u2013 was preventable.\u201d<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-marriot-data-breach-total-cost-this-is-why-you-need-good-insurance\">Marriot Data Breach \u2013 Total Cost: This Is Why You Need Good Insurance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We knew Marriott had cybersecurity liability insurance <a href=\"https:\/\/www.sec.gov\/Archives\/edgar\/data\/1048286\/000162828018001756\/mar-q42017x10k.htm\">from\na release it made following the disclosure of its breach<\/a>. What we did not\nknow at the time is how adequate that coverage would be. Cybersecurity\ninsurance is still developing, with a patchwork of policies from different insurers\ncovering different things.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We actually took <a href=\"https:\/\/www.thesslstore.com\/blog\/cyber-insurance\/\">a deep dive on Cyber Insurance<\/a> last year if you\u2019re interested in learning a bit more.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-default is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Although we carry cyber\/privacy liability insurance that is designed to protect us against certain losses related to cyber risks, that insurance coverage may not be sufficient to cover all losses or all types of claims that may arise in connection with cyber-attacks, security breaches, and other related breaches. Furthermore, in the future such insurance may not be available to us on commercially reasonable terms, or at all.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">It&#8217;s clear from that statement that even Marriott wasn\u2019t sure\nhow this situation was going to play out with its insurance and it was already\npreparing itself for a shifting insurance market and the possibility that it\nwould be unable to find coverage in the future.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That concern may have been a bit premature. Because while there has been rampant speculation that this breach will cost billions \u2013 speculation based on <a href=\"https:\/\/www.ibm.com\/security\/data-breach?cm_mmc=Search_Google-_-Security_Optimize+the+Security+Program-_-WW_NA-_-%2Bcosts%20of%20%2Bdata%20%2Bbreach_b&amp;cm_mmca1=000000NJ&amp;cm_mmca2=10000253&amp;cm_mmca7=9060421&amp;cm_mmca8=kwd-295901325299&amp;cm_mmca9=_k_Cj0KCQjwj9LkBRDnARIsAGQ-hUdSPus2rrf2dGZcXlYVkA1pc9Rxsz7ceua0B7xvUzHhA3wpG4a0AIAaAja6EALw_wcB_k_&amp;cm_mmca10=253508236949&amp;cm_mmca11=b&amp;gclid=Cj0KCQjwj9LkBRDnARIsAGQ-hUdSPus2rrf2dGZcXlYVkA1pc9Rxsz7ceua0B7xvUzHhA3wpG4a0AIAaAja6EALw_wcB\">extrapolated costs from a Ponemon study<\/a> \u2013 so far, the total has been far below that.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">At the beginning of March, Marriott <a href=\"https:\/\/marriott.gcs-web.com\/static-files\/723f49d1-f23d-40e9-8073-56996e8427b9\">released its earnings report<\/a> for Q4 of 2018, as well as its full-year 2018 report. Buried in its press release, on page five, is mention of the costs incurred so far.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-default is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">In the 2018 fourth quarter, the company incurred $28 million of expenses and recognized $25 million of insurance proceeds related to the data security incident it disclosed on November 30, 2018.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Admittedly, referring to one of the most massive breaches in\nhistory as \u201cthe data security incident\u201d is either somewhat ominous or a massive\nunderstatement \u2013 it\u2019s tough to tell.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless, Marriott appears to have been able to use its\nexisting insurance policy to help mitigate most of the cost. So far. Because\nthere are still potentially regulatory and compliance fines, plus lawsuits. Marriott\u2019s\ncyber insurance may kick in on some of those, too \u2013 but we also don\u2019t know\nenough about the policy to estimate how much, if at all. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">&#8220;The attack may point to out of date or badly implemented security on point of sale and reservation systems,\u201d says <a href=\"https:\/\/www.bestvpn.com\/about-us\/\">Ray Walsh, a cybersecurity and VPN expert<\/a>. \u201cUnfortunately for the Marriott, which now faces a massive class-action lawsuit, it is possible that the hack was performed by infiltrating systems using a phishing attack. Such methods are relatively crude but can lead to infection with sophisticated malware and trojans that permit hackers to download secondary exploits from Command and Control servers. If the past is anything to go by, the consequences for the Marriott will likely be an expensive out of court settlement.&#8221;<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">As we mentioned earlier, the parallel being most commonly made is to the <a href=\"https:\/\/www.thesslstore.com\/blog\/equifax-data-breach-learn\/\">Equifax situation<\/a>, but that\u2019s not necessarily a 1:1 comparison. Equifax was a credit monitoring agency, one whose data was arguably more lucrative than Marriott\u2019s. That\u2019s not to say that Marriott\u2019s data isn\u2019t valuable \u2013 it is. But you could also turn around the Equifax information and either <a href=\"https:\/\/www.thesslstore.com\/blog\/2018-cybercrime-statistics\/\">sell it or commit fraud with it more quickly<\/a> than what would be required with Marriott\u2019s. Part of that can be attributed to the difference in the data that was stolen, and some of it is likely a result of the redundancies in the Marriott database \u2013 where the same individuals may have multiple entries across different Marriott brands and properties. There&#8217;s also a difference between who was behind the two breaches, which we&#8217;ll get to in a moment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We will continue to update this part of the article as more of\nthe details about the Marriott Data Breach\u2019s cost become available. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-marriott-s-security-posture-was-likely-poor-but-its-response-was-worse\">Marriott\u2019s Security Posture Was Likely Poor, But Its Response Was Worse\u2026<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Realistically, we\u2019re reaching a point where attacks and breaches\nare so commonplace that you almost have to resign yourself to the fact that it\u2019s\nno longer a matter of if \u2013 but when. So while maintaining a good security\nposture is critical, an organization\u2019s response to a cyber attack or breach is\nequally, if not more important. <\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u201cMost of the criticism of Marriott and Starwood has centered around its response to the hack and not that it was compromised in the first place,\u201d <a href=\"https:\/\/fractionalciso.com\/about-us\/\">says Rob Black, CISSP, and the founder of and managing principal of Fractional CISO<\/a>. \u201cThe fact that it was a state sponsored attack will certainly diminish Marriott\u2019s culpability in many minds. However, regardless of the attacker, Marriott\u2019s detection and response was not ideal.\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Black pointed to a range of issues that became obvious in\nthe days and weeks after Marriott\u2019s disclosure:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>That it took Marriott 4 years to detect the\nbreach<\/li>\n\n\n\n<li>That its due diligence during its acquisition of\nStarwood didn\u2019t turn this up<\/li>\n\n\n\n<li>That it waited months to disclose the breach (November\n30) after discovering it in September<\/li>\n\n\n\n<li>That it potentially violated the SEC\u2019s reporting\ntimeframes<\/li>\n\n\n\n<li>That in all likelihood its security controls\nwere lacking<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u201cWhen a breach occurs, the executive management team is responsible,\u201d says Black. \u201cHaving a response plan in place before the incident allows for the clean up and communication to go much smoother. The incident response plan could be the difference between an executive team being removed when an incident occurs.\u201d<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-too-much-trust-in-employees-or-not-enough\">Too Much Trust in Employees \u2013 Or Not Enough?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As we mentioned, this attack actually began in 2014 and was\ncarried out over four years before it was finally discovered. As scary as that\nsounds though, it\u2019s hardly an isolated incident.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">\u201cThis type of&nbsp;\u201clying in wait\u201d threat is driving many IT organizations to rethink how they secure their network to combat hackers who are sophisticated and&nbsp;patient to wait for the big payoff,\u201d said Dan Dearing, the Senior Director of Product Management for <a href=\"https:\/\/www.pulsesecure.net\/\">Pulse Secure<\/a>. \u201cThe new security buzzword that describes how companies can defeat this type of threat is&nbsp;\u201czero-trust.\u201d Essentially, IT cannot trust anything or anyone inside or outside of their network. Instead, they must deploy security tools that help enable them to always verify who the user is, whether the user is authorized to access the desired application or data, and finally if the user\u2019s laptop or mobile device meets the security standards of the company.&nbsp;Only if all three conditions are met is the user allowed on the network.\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Others, like Grant Elliott, <a href=\"https:\/\/ostendio.com\/about\/team-3\/\">the CEO of the SaaS platform maker, Ostendio<\/a>, disagree. He thinks employees need to be better informed and trained to identify and respond to digital threats.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Organizations need to stop treating their people as the problem, but rather as the first line of defense. Investments need to be made in better training, better vendor management and data needs to be viewed less in terms of &#8216;Ownership&#8217; and more around &#8216;Right of Use&#8217; and &#8216;Right of Access&#8217;. The government can help too by improving incentives, both positive like tax credits for training, and punitive like GDPR and the soon to be introduced CCPA.&nbsp;&nbsp;<\/p>\n<\/blockquote>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12768\"><\/span>\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-marriott-breach-was-likely-caused-by-chinese-state-backed-attacker\">The Marriott Breach Was Likely Caused by Chinese State-Backed Attacker<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When the other shoe dropped in the Marriott Data Breach\nscandal it landed with a sickening thud. The New York Times and the Washington\nPost quickly reported that Chinese state-backed hackers were likely responsible\nfor the breach.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And if that doesn\u2019t make the hair on the back of your neck\nstand up a little\u2014it should. This is yet another escalation in a burgeoning\ncyber war between the world\u2019s foremost powers. The US has already been engaged\nin a high profile spat with Russia stemming from its interference in the 2016\nUS Presidential elections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While nobody was under the impression that the US and China were playing nicely, this shines more light on the conflict than we\u2019ve seen in recent years. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But does that, at least partially, let Marriott off the\nhook?<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Not one bit,\u201d says Greg Scott.&nbsp;\u201cAlthough execs will surely try to use that as an excuse. State-backed actors don\u2019t have any more creativity than private crooks looking to make money.&nbsp; [Thought] state backed actors may have more patience and more resources.&nbsp; Which means potential victim companies need to remain vigilant\u2026 Big companies and small companies and everyone else are *<strong>already<\/strong>* in the crossfire of a cyber war.&nbsp; It\u2019s not burgeoning, it\u2019s already here. And it\u2019s not just between the US and China, it\u2019s between everyone who has data, and lots of attackers who want to steal it. Why would anyone be surprised that the enemies of the United States try to steal secrets from US companies? The question we should all ask is, why are our companies *<strong>still<\/strong>* so unprepared, even after years of headlines?\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Greg Elliott agrees:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">&#8220;While it is difficult for any company to protect against a sustained state-owned hack by a foreign government, there is a reason these types of breaches keep occurring. Many US companies are an easy target. Why? The state of corporate cyber-defense in the US is at best, inconsistent, and at worst broadly mediocre..&nbsp; That is not to say some companies don&#8217;t spend a lot of money on security. But often they spend it on buying the latest shiny new cyber -tool, rather&nbsp;than focusing on developing a broad risk-based approach.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cSecurity budgets are delegated to the CISO, who often sits within the IT function, meaning solutions tend to be tech rather than people focused. While technology should play a key role in any cyber defense strategy, risk management must come first and in the cloud-based, IOT orientated environment we operate in, no technology can, on its own, ring-fence our data.\u201d<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Black, who works closely with CISOs agrees that US companies\nneed to increase their security spend and better train their employees. But he\u2019s\nmuch more fatalistic about our current digital reality.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">As a society, we should expect that our country&#8217;s enemies will use our data and infrastructure to try and undermine the United States and its companies.&nbsp;As a consumer, we should all be prepared for our data to be exposed.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">That seems like a nice, cheery note to end on.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>As always, leave any comments or questions below\u2026<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"267\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg\" alt=\"Hashed Out by The SSL Store is the voice of record in the SSL\/TLS industry.\" class=\"wp-image-7276\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-1024x267.jpg 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-300x78.jpg 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568-768x200.jpg 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2018\/08\/bigstock-222348568.jpg 1559w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>So far, Marriott\u2019s massive 2018 breach has cost it just $3,000,000 Today we\u2019re going to autopsy last year\u2019s Marriott data breach, which affected nearly 400,000,000 guests and looked to be&#8230;<\/p>\n","protected":false},"author":6,"featured_media":9813,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[2803,10012],"class_list":["post-9805","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-data-breach","tag-marriott","post-with-tags"],"views":31059,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/03\/Marriott-Featured.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/9805","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=9805"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/9805\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/9813"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=9805"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=9805"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=9805"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}