a post by Laura Hautala for C|net [via ResearchBuzz: Firehose with grateful thanks]
Don’t worry. They want it to be safe.
Justin Paine sits in a pub in Oakland, California, searching the internet for your most sensitive data. It doesn't take him long to find a promising lead.
On his laptop, he opens Shodan, a searchable index of cloud servers and other internet-connected devices. Then he types the keyword "Kibana," which reveals more than 15,000 databases stored online. Paine starts digging through the results, a plate of chicken tenders and fries growing cold next to him.
"This one's from Russia. This one's from China," Paine said. "This one is just wide open."
From there, Paine can sift through each database and check its contents. One database appears to have information about hotel room service. If he keeps looking deeper, he might find credit card or passport numbers. That isn't far-fetched. In the past, he's found databases containing patient information from drug addiction treatment centers, as well as library borrowing records and online gambling transactions.
Continue reading
Showing posts with label data_security. Show all posts
Showing posts with label data_security. Show all posts
Friday, 17 May 2019
Wednesday, 1 May 2019
Are You Using Mental Health Apps? They Might Be Sharing Your Data
a post by Carl Velasco for Tech Times [via World of Psychology]
You might want to err on the side of caution when it comes to mental health apps. Most of them are sharing your data to advertisers, a new study has discovered. ( Pixabay )
There are a lot of apps that claim to aid with mental health, doing so by providing introductions on meditation, mindful thinking, and encouraging mental exercises that might help alleviate stress or anxiety.
Mental health is of course a sensitive subject, which is why data related to it should be protected at all costs. A new study suggests that isn't so. Apparently, 29 out of 36 mental health apps were sharing data for advertising or analytics to Facebook or Google, and many of them weren't disclosing that data-sharing to users.
Only six out of 12 Facebook-linked apps informed users what was happening, while only 12 out of 28 Google-linked apps did, as well. Of the entire mental health app pool, only 25 included policies laying out how they used data in any form, while 16 detailed secondary uses.
Continue reading
You might want to err on the side of caution when it comes to mental health apps. Most of them are sharing your data to advertisers, a new study has discovered. ( Pixabay )
There are a lot of apps that claim to aid with mental health, doing so by providing introductions on meditation, mindful thinking, and encouraging mental exercises that might help alleviate stress or anxiety.
Mental health is of course a sensitive subject, which is why data related to it should be protected at all costs. A new study suggests that isn't so. Apparently, 29 out of 36 mental health apps were sharing data for advertising or analytics to Facebook or Google, and many of them weren't disclosing that data-sharing to users.
Only six out of 12 Facebook-linked apps informed users what was happening, while only 12 out of 28 Google-linked apps did, as well. Of the entire mental health app pool, only 25 included policies laying out how they used data in any form, while 16 detailed secondary uses.
Continue reading
Wednesday, 15 November 2017
Enterprise data breach: causes, challenges, prevention, and future directions
an article by Long Cheng,Fang Liu and Danfeng (Daphne) Yao (Virginia Tech, USA) published in WIREs Data Mining and Knowledge Discovery Volume 7 Issue 5 (September/October 2017)
Abstract
A data breach is the intentional or inadvertent exposure of confidential information to unauthorized parties.
In the digital era, data has become one of the most critical components of an enterprise. Data leakage poses serious threats to organizations, including significant reputational damage and financial losses. As the volume of data is growing exponentially and data breaches are happening more frequently than ever before, detecting and preventing data loss has become one of the most pressing security concerns for enterprises.
Despite a plethora of research efforts on safeguarding sensitive information from being leaked, it remains an active research problem.
This review helps interested readers to learn about enterprise data leak threats, recent data leak incidents, various state-of-the-art prevention and detection techniques, new challenges, and promising solutions and exciting opportunities.
Full text (PDF 14pp)
I did not understand much of the text but the images provided made this whole area of unseen attacks clearer.
Abstract
A data breach is the intentional or inadvertent exposure of confidential information to unauthorized parties.
In the digital era, data has become one of the most critical components of an enterprise. Data leakage poses serious threats to organizations, including significant reputational damage and financial losses. As the volume of data is growing exponentially and data breaches are happening more frequently than ever before, detecting and preventing data loss has become one of the most pressing security concerns for enterprises.
Despite a plethora of research efforts on safeguarding sensitive information from being leaked, it remains an active research problem.
This review helps interested readers to learn about enterprise data leak threats, recent data leak incidents, various state-of-the-art prevention and detection techniques, new challenges, and promising solutions and exciting opportunities.
Full text (PDF 14pp)
I did not understand much of the text but the images provided made this whole area of unseen attacks clearer.
Tuesday, 11 April 2017
If You Want to Stop Big Data Breaches, Start With Databases
an article by Lily Hay Newman published in WIRED on 29 March 2017
Thanks to Research Buzz for the link
Over the past few years, large-scale data breaches have become so common that even tens of millions of records leaking feels unremarkable. One frequent culprit that gets buried beneath the headlines? Poorly secured databases that connect directly to the internet.
While companies commonly use these databases to store tempting troves of customer and financial data, they often do so with outdated and weak default security configurations. And while any type of database can be left open or unprotected, a string of breaches over the last few years have all centered around one type in particular: open-source “NoSQL” databases, particularly those using the popular MongoDB database program. Of course there are many types of hacks that can ultimately lead to data breaches, like using spear phishing to gain access to a network, but securing exposed databases is a relatively easy and concrete step organizations can take to strengthen their data defense.
Continue reading
Thanks to Research Buzz for the link
Over the past few years, large-scale data breaches have become so common that even tens of millions of records leaking feels unremarkable. One frequent culprit that gets buried beneath the headlines? Poorly secured databases that connect directly to the internet.
While companies commonly use these databases to store tempting troves of customer and financial data, they often do so with outdated and weak default security configurations. And while any type of database can be left open or unprotected, a string of breaches over the last few years have all centered around one type in particular: open-source “NoSQL” databases, particularly those using the popular MongoDB database program. Of course there are many types of hacks that can ultimately lead to data breaches, like using spear phishing to gain access to a network, but securing exposed databases is a relatively easy and concrete step organizations can take to strengthen their data defense.
Continue reading
Thursday, 27 June 2013
Engaging Remote Employees: The Moderating Role of “Remote” Status in Determining Employee Information Security Policy Awareness
an article by Allen C. Johnston, Barbara Wech and Eric Jack (University of Alabama at Birmingham, USA) published in Journal of Organizational and End User Computing Volume 25 Issue 1 (January-March 2013)
Abstract
Using social cognitive theory as a framework, this study proposes and tests a behavioural model to predict how “remote” status impacts the manner in which social learning cues influence employee awareness of information security policies and ultimately differentiates him or her from in-house employees in terms of information security policy awareness.
Based on data acquired from an online sample of 435 full-time employees across numerous industries and structural equation modeling analysis, the findings suggest that, compared to their in-house counterparts, remote employees experience lower levels of vicarious experiences, verbal persuasion, and situational support, thereby resulting in diminished levels of information security policy awareness.
These findings have strong implications for managers of remote employees and for organizations seeking to reduce the risk associated with an ever-increasing remote workforce. The findings also advance social cognitive theory by incorporating information security policy awareness as an important outcome formed from perceptions of social learning cues external to the individual, but present within the organization.
Abstract
Using social cognitive theory as a framework, this study proposes and tests a behavioural model to predict how “remote” status impacts the manner in which social learning cues influence employee awareness of information security policies and ultimately differentiates him or her from in-house employees in terms of information security policy awareness.
Based on data acquired from an online sample of 435 full-time employees across numerous industries and structural equation modeling analysis, the findings suggest that, compared to their in-house counterparts, remote employees experience lower levels of vicarious experiences, verbal persuasion, and situational support, thereby resulting in diminished levels of information security policy awareness.
These findings have strong implications for managers of remote employees and for organizations seeking to reduce the risk associated with an ever-increasing remote workforce. The findings also advance social cognitive theory by incorporating information security policy awareness as an important outcome formed from perceptions of social learning cues external to the individual, but present within the organization.
Monday, 12 March 2012
The bring your own device nightmare
an article by Graeme Batsman, Data Defender published in lasa knowledgebase (February 2012)
This article looks at the increasing trend of staff bringing their own mobile or portable devices into the work environment and how you can secure your network against intrusion.
Read in full (HTML)
This article looks at the increasing trend of staff bringing their own mobile or portable devices into the work environment and how you can secure your network against intrusion.
Read in full (HTML)
Monday, 1 December 2008
No such thing as security
via Government Computing's email newsletter 6 November
Gordon Brown's comment that ministers cannot guarantee the security of sensitive data is, in one respect, a welcome recognition of reality.
The Prime Minister's problem is that his government has acted as if it can collect increasing amounts of personal data, join it up, offer it to many thousands of civil servants, and still promise it is safe.
Hazel's comment:
The PM admitting that maybe, just maybe, national government is not a safe place to have your data stored is one thing, the next is persuade the PM to stop collecting so much information about each and everyone of us so that there's less to lose and not so much impact if the security measures don't work.
Gordon Brown's comment that ministers cannot guarantee the security of sensitive data is, in one respect, a welcome recognition of reality.
The Prime Minister's problem is that his government has acted as if it can collect increasing amounts of personal data, join it up, offer it to many thousands of civil servants, and still promise it is safe.
Hazel's comment:
The PM admitting that maybe, just maybe, national government is not a safe place to have your data stored is one thing, the next is persuade the PM to stop collecting so much information about each and everyone of us so that there's less to lose and not so much impact if the security measures don't work.
Tuesday, 25 November 2008
Government data losses: Distributed databases are not the answer
via TechRepublic Blogs by Tom Olzak on 3 November
As elected officials and non-elected government employees struggle with how to arise above bureaucratic, information security ineffectiveness, they continue to plan for and establish large, centralized databases containing our information. Is spreading the data across disparate repositories the answer?
Read the full article
As elected officials and non-elected government employees struggle with how to arise above bureaucratic, information security ineffectiveness, they continue to plan for and establish large, centralized databases containing our information. Is spreading the data across disparate repositories the answer?
Read the full article
Tuesday, 9 September 2008
An economic modelling approach to information security risk management
an article by Rok Bojanca and Borka Jerman-Blažič (Faculty of Economics, Ljubljana University and Jožef Stefan Institute, Slovenia) in International Journal of Business Science and Applied Management Volume 3 Issue 3 (2008)
Abstract
This paper presents an approach enabling economic modelling of information security risk management in contemporaneous businesses and other organisations. In the world of permanent cyber attacks to ICT systems, risk management is becoming a crucial task for minimisation of the potential risks that can endeavour their operation. The prevention of the heavy losses that may happen due to cyber attacks and other information system failures in an organisation is usually associated with continuous investment in different security measures and purchase of data protection systems. With the rise of the potential risks the investment in security services and data protection is growing and is becoming a serious economic issue to many organisations and enterprises. This paper analyses several approaches enabling assessment of the necessary investment in security technology from the economic point of view. The paper introduces methods for identification of the assets, the threats, the vulnerabilities of the ICT systems and proposes a procedure that enables selection of the optimal investment of the necessary security technology based on the quantification of the values of the protected systems. The possibility of using the approach for an external insurance based on the quantified risk analyses is also provided.
Abstract
This paper presents an approach enabling economic modelling of information security risk management in contemporaneous businesses and other organisations. In the world of permanent cyber attacks to ICT systems, risk management is becoming a crucial task for minimisation of the potential risks that can endeavour their operation. The prevention of the heavy losses that may happen due to cyber attacks and other information system failures in an organisation is usually associated with continuous investment in different security measures and purchase of data protection systems. With the rise of the potential risks the investment in security services and data protection is growing and is becoming a serious economic issue to many organisations and enterprises. This paper analyses several approaches enabling assessment of the necessary investment in security technology from the economic point of view. The paper introduces methods for identification of the assets, the threats, the vulnerabilities of the ICT systems and proposes a procedure that enables selection of the optimal investment of the necessary security technology based on the quantification of the values of the protected systems. The possibility of using the approach for an external insurance based on the quantified risk analyses is also provided.
Tuesday, 17 June 2008
More of the same (laptop thefts)
Douglas Schweitzer at Computer World 12 June
Here we go again (how many times do I have to write this same line?); this time the stolen laptop contains the data of some 72,000 people with ties to Stanford University - students, faculty, and staff members. And guess what? There's reason to believe the data wasn't encrypted.
Read more
Hazel's comment:
I'm not sure I can bear to comment. This is rapidly turning into farce and would be laughable were it not so serious!
Here we go again (how many times do I have to write this same line?); this time the stolen laptop contains the data of some 72,000 people with ties to Stanford University - students, faculty, and staff members. And guess what? There's reason to believe the data wasn't encrypted.
Read more
Hazel's comment:
I'm not sure I can bear to comment. This is rapidly turning into farce and would be laughable were it not so serious!
Friday, 6 June 2008
Free tools to encrypt your sensitive data
by ResourceShelf Contributing Editor, Dan Giancaterino
from: The Legal Intelligencer
…you spend most of your day lugging around stuff like laptops, USB flash drives, CD ROMs and more. What would happen to the client information on those devices if they are lost or stolen?
Encryption is the answer.
Read the full article -- and despair!
from: The Legal Intelligencer
…you spend most of your day lugging around stuff like laptops, USB flash drives, CD ROMs and more. What would happen to the client information on those devices if they are lost or stolen?
Encryption is the answer.
Read the full article -- and despair!
Thursday, 5 June 2008
LaptopLock - freeware security program protects your laptop if it is stolen
via The Red Ferret Journal by Nigel on 7 May
LaptopLock
Windows freeware (at the moment!) which you install and configure on your hard disk to protect your notebook computer if it's stolen. Once the machine is connected to the Internet it will connect to a central server and then either delete files, encrypt them, execute a program or go 'yah boo!!
Link
LaptopLock
Windows freeware (at the moment!) which you install and configure on your hard disk to protect your notebook computer if it's stolen. Once the machine is connected to the Internet it will connect to a central server and then either delete files, encrypt them, execute a program or go 'yah boo!!
Link
Saturday, 19 April 2008
10 largest data breaches
via KWTL - Keeping Within The Law by Paul [Pedley] on 25 March
FlowingData has a chart of the ten largest data breaches since 2000. In each of the cases listed in this "top ten", the number of people whose data was involved ran into the millions. Perhaps it is useful to look back to the wording of the seventh data protection principle as set out in the Data Protection Act 1998 - "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."
Hazel's comment:
Makes for very interesting reading -- and oh how nice it is to have Paul Pedley "back on the circuit". I really missed his insight into all things pertaining to the legality of information management when his newsletter ceased and before I found his blog. Incidentally, Paul is about to launch a KWTL subscription service encompassing all the issues concerned with information and the law. I'll keep you up to date on that one.
The FlowingData article has a link to a database of data breaches which, if you aren't horrified already, will make you think twice or three times about letting anyone have your data.
FlowingData has a chart of the ten largest data breaches since 2000. In each of the cases listed in this "top ten", the number of people whose data was involved ran into the millions. Perhaps it is useful to look back to the wording of the seventh data protection principle as set out in the Data Protection Act 1998 - "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."
Hazel's comment:
Makes for very interesting reading -- and oh how nice it is to have Paul Pedley "back on the circuit". I really missed his insight into all things pertaining to the legality of information management when his newsletter ceased and before I found his blog. Incidentally, Paul is about to launch a KWTL subscription service encompassing all the issues concerned with information and the law. I'll keep you up to date on that one.
The FlowingData article has a link to a database of data breaches which, if you aren't horrified already, will make you think twice or three times about letting anyone have your data.
Thursday, 6 March 2008
Is your data safe?
Depends on what that data is about and who you want to keep it safe from but ...
An unnamed journalist at ComputerWeekly headlined "Police to be allowed searches of national database of NHS patient records" on 28 February.
Whilst "How secure?" by FishNChipPapers says that ComputerWeekly reports that receptionists at Royal Bolton Hospital's Accident and Emergency department had been looking at the patient records, then printing them to add to the casualty record card.
I say that he says that she says that ... this is how rumours start. However, I have no reason to doubt the sources I've quoted.
An unnamed journalist at ComputerWeekly headlined "Police to be allowed searches of national database of NHS patient records" on 28 February.
It went largely unnoticed but the minister for the NHS’s National Programme for IT, Ben Bradshaw, has confirmed that data on a central database of millions of confidential health records will be made available to police where there is an “overriding public interest”. The phrase “overriding public interest” is not defined.
Whilst "How secure?" by FishNChipPapers says that ComputerWeekly reports that receptionists at Royal Bolton Hospital's Accident and Emergency department had been looking at the patient records, then printing them to add to the casualty record card.
So, not only is the database apparently open to access by all and sundry it also seems that they are doing so to print out the records to add to a record card. And I thought it was about computerising medical records.
I say that he says that she says that ... this is how rumours start. However, I have no reason to doubt the sources I've quoted.
Monday, 25 February 2008
Security is an ecosystem, not a product
via TechRepublic Blogs by Chad Perrin on 4 February
People talk about security as though it's something you can buy and sell.
Full article
Really interesting. Security is a state of mind, it's about psychology not things.
Buy all the window locks you want but if people don't use them ...
the burglar will walk in
Put a firewall on your business network, define sites that must not be used in a business context, do whatever you consider necessary but if your staff circumvent these procedures then, to put it in the vernacular, "you're stuffed".
the burglar / hacker / botnet will get in
People talk about security as though it's something you can buy and sell.
Full article
Really interesting. Security is a state of mind, it's about psychology not things.
Buy all the window locks you want but if people don't use them ...
the burglar will walk in
Put a firewall on your business network, define sites that must not be used in a business context, do whatever you consider necessary but if your staff circumvent these procedures then, to put it in the vernacular, "you're stuffed".
the burglar / hacker / botnet will get in
Subscribe to:
Posts (Atom)
