If the Yahoo data breach has taught us anything, it's that no enterprise is immune to compromise. Yahoo revealed late last month that at least 500 million user accounts were compromised during an attack that happened in 2014. Stolen data included users' names, email addresses, telephone numbers, dates of birth and encrypted passwords. The exact security holes attackers exploited remains unclear, though security firm Venafi recently told CSOonline's Steve Ragan that its own investigation pointed to weak cryptographic controls ; that 27 percent of certificates exposed externally via Yahoo's websites hadn't been reissued since January 2015. More details are sure to follow, but enterprises and their customers needn't wait for more news to better defend themselves. Here's a look at four lessons that, if heeded, can help reduce the risk of attack. 1. Everything must be encrypted. Yahoo encrypted passwords, but it's unlikely that much else was encrypted.