{"id":1537,"date":"2018-02-27T14:14:12","date_gmt":"2018-02-27T13:14:12","guid":{"rendered":"https:\/\/www.thenextquarterly.com\/?p=1537"},"modified":"2020-04-10T13:21:57","modified_gmt":"2020-04-10T12:21:57","slug":"how-to-protect-your-and-your-companys-data-in-an-increasingly-connected-world","status":"publish","type":"post","link":"https:\/\/thenextorganization.com\/en\/how-to-protect-your-and-your-companys-data-in-an-increasingly-connected-world\/","title":{"rendered":"How to protect your (and your company's) data in an increasingly connected world"},"content":{"rendered":"[et_pb_section fb_built=”1″ _builder_version=”3.22″][et_pb_row _builder_version=”3.25″][et_pb_column type=”4_4″ _builder_version=”3.25″ custom_padding=”|||” custom_padding__hover=”|||”][et_pb_text _builder_version=”4.4.2″ hover_enabled=”0″]

Data and account security are among the most overlooked potential risks in personal and company environments. While security in these fields is a necessary no-brainer, most people tend to follow a \u2018do as I say, not as I do\u2019 way of thinking. This is due to the thought that it won\u2019t happen to them. The scary thing is, accounts have probably already been hacked.<\/strong><\/p>\n

Let\u2019s take the example of http:\/\/haveibeenpwned.com<\/a><\/strong>. The website checks whether any e-mail address has been included in a hack of a website in the past few years. One of the prime benefits of the internet is that it does not forget, makes data instantly accessible and has a global presence. At the same time, those characteristics also make it a prime spot for crooks. Having a password stolen is probably going to be pretty inconsequential, with possibly no repercussions at all. But once the data is out there, it is very hard to get rid of it, much less erase it.<\/p>\n

An average company gathers loads of data as a result of daily operations. Obviously, this also causes a risk, because every data-point is also one that can be stolen. One of the most dangerous situations arises when a company is collecting unneeded or unwanted data. \u2018Because the capabilities are there\u2019 isn\u2019t a good reason to be storing it. Moreover, because the data is not especially valuable to this company, the protection will also probably not have the highest priority. Meaning that there\u2019s now potentially data freely accessible that\u2019s not so valuable to the company, but all the more to the data owners. This is also what the upcoming EU General Data Protection Regulation (GDPR) tries to prevent, by forcing companies to enable customers to access personal data; companies will at least be thinking of the data they have at present<\/p>\nAttack vectors<\/strong>\n

There are many ways in which malicious people will try to steal, or even trick users into giving them, data. The ways they try this are called \u2018attack vectors\u2019. By now, probably everyone knows the shady African prince asking for money; including deliberate spelling errors for weeding out attentive readers. That attack vector is probably not as effective, as it was before. Below are a few potential threats:<\/p>\n

Phishing<\/strong>
Phishing is the activity in which \u2018hackers\u2019 are trying to cheat the user into giving them their login info. For example, the user gets an email saying their Netflix account will be retired unless they login immediately and provide their credit card info. The link in the email will not send the user to Netflix, but to another domain entirely. This is also why proper security and encryption is so important. A legit, but unsecure, website can also be tricked into asking for this information.<\/em> Once the user enters the credit card info and his password, the data is compromised. The tricky part is, that this technique does not need a lot of effort to be set up and can be put to use pretty quickly. By sending the email to tens of thousands of people, only a few need to respond to plausibly making it a lucrative venture. Also, these attacks are getting more and more sophisticated by making the login-pages near-identical copies as well as also using \u2018real\u2019 links to the website in their e-mail to give it the veneer of legitimacy.<\/p>\n

High-profile people (celebrities, politicians, etc) might also be targeted for so-called \u2018spear-fishing\u2019, which is a directed attack at a specific person because they can access valuable data. An example of this is the hack into the Democratic Party in the U.S. in 2016.<\/p>\n

Social engineering<\/strong>
Everyone knows the standard security questions that used to be (in some cases, still) asked to verify an account. \u2018What was your mother\u2019s maiden name?\u2019, \u2018What\u2019s the name of your city of birth?\u2019, and so on. These questions were asked in a simpler time, when people did not foresee handing most of their private information over to social media. The unfortunate thing is that while people might forget, computers hardly ever do so. So every post, every scrap of information often is relatively easy to find. Making these \u2018hard-to-know\u2019 questions, not so hard to guess. Once the password is reset on e.g. your e-mail address, the \u2018hacker\u2019 can now proceed to modify most passwords of accounts associated with that specific email address.<\/p>\n

Social engineering is probably the most used technique in situations where someone wants to target you specifically. For example because you have an interesting twitter handle<\/a><\/strong>.<\/p>\n

The main issue is that people will always try to help someone with a good story, which makes the security protocol as strong as the weakest link. In other words, a human factor will always weaken security systems. This is not in itself a \u2018bad thing\u2019, but it should be accounted for.<\/p>\n

The risk with some of these attack vectors is that they\u2019re easy to direct at thousands of people at the same time. This makes it a low-risk investment in time and effort coupled with a potentially high reward, even when only a tiny percentage of people fall for it.<\/p>\n

Stolen data<\/strong>
Even when someone has all of the necessary preventions and security in place, this does not mean that your data is safe with other companies. Hacks, inadvertent releases of data and breaches have been widely reported over the past few years. One of the biggest ones yet was the credit company \u2018Equifax\u2019 last year<\/a><\/strong>\u00a0, with over 250 million records being published. Another one was that Uber paid a hefty sum to cover up a breach of 50 million records of drivers and passengers. The scope and size of these data-sets are very big.<\/p>\n

The scary bit is that in the case of Equifax a critical part of their infrastructure was left unpatched when a weakness was discovered. Meaning that the \u2018hackers\u2019 did not have to perform any elaborate hacks, they just exploited a known weakness and ended up with a quarter of a billion records of financial information. Showing that performing regular updates is every bit as important as is usually stated.<\/p>\n

Tips to prevent this from happening<\/strong>
Knowing all this, what can anyone do to minimize the damage?<\/p>\n