Cover Your App: Five Lessons from Recent Data Breaches

It's 2012: Do you know all of the places where your personal information lives? Apparently Zappos doesn't and neither do a host of other businesses, as reported in the news on an almost daily basis. Businesses are overwhelmed by how much information they collect, and get into trouble because they don't know what data they actually have, where it's coming from, or where it's going, and hang on to it longer than they should. What's more, as in the case of Facebook, they're not always doing what their privacy policies say they are.

While many people claim they care about their online privacy, our share-it-whenever-wherever mentality seems to evidence otherwise. Judging by consumers' increased use of anti-tracking software, their concerns seem to be more about keeping their online behavior a secret than actively protecting the vast amount of business, financial and personal data that is shared and stored online.

That is until something happens. You'd be surprised how many businesses wait for a data breach before really dealing with your privacy and security. Here are five ways to avoid the most common mistakes:

• Learn the privacy rules of the road. Businesses often don't know what's in their privacy policies, but you can and should. Before hitting "I accept," read a company's privacy policy thoroughly. If you don't understand it, call customer service for explanation.
• Avoid oversharing. Companies often disperse their information too widely, not always knowing where it lands. Be aware of the third-party relationships that businesses and organizations you deal with have, and assume your information is likely to be shared with them unless you expressly forbid it.
• Be vigilant. Businesses need appropriate controls in order to quickly detect if a breach has occurred, how it happened, what data has been stolen and how the breach can be fixed. Many businesses leave themselves highly vulnerable in this regard, as do consumers. While there are no fail safe solutions, doing something as simple as reviewing monthly bank and credit card statements for any suspicious activity can make the difference between the minor nuisance of replacing your account number and card, and the major challenge of dealing with personal identity theft. Using unique passwords on different websites you visit, and changing them regularly, adds another layer of protection.
• Don't let your mobile devices go missing. Some of the biggest and most expensive business information breaches in recent history happened because of simple human error. We've all heard stories about the laptop with classified information left at the airport or the business phone forgotten in the taxi. This one's pretty basic: Watch your technology like you would your kids.
• Lock it up. Businesses should, but often don't, encrypt data and that's where many of the problems start. Installing and using passcodes on computers and PDAs is no more of a basic security practice than locking your house and car.

While there is no silver bullet to guarantee that your online information will be 100 percent secure, you can learn from the mistakes that have a habit of repeating themselves. A few simple changes in how you handle your online activities and personal technology can have a huge impact in safeguarding your life on the Internet. Now more than ever, in the absence of any real solutions to cybercrime, it's up to the public to take this responsibility into their own hands.

This Friday, Jan. 28, which the National Cyber Security Alliance has designated Data Privacy Day 2012, to "promote the importance of data privacy and encourage digital citizens to exercise closer control over how their personal information is collected, shared, and stored online," would be a good time to start.

 

Comments

[Jay Gould]

04:07 PM on 01/25/2012

The Zappos hackers seem to have accessed some of the information stored in retailer's customer profiles. We don't know whether or not the criminals have been able to actually access the customers' accounts, as we don't know if they could have retrieved the passwords. Yet, even if they did, that wouldn't have done them much good. What could have happened? Let's say that they attempted to place an order. Well, even if it did go through, which is unlikely, it would've been disputed by the cardholder who would have been reimbursed for any possible losses. Aside from that, any card data that may have been stored in a hacked profile would have been perfectly unusable, because it only shows the last 4 digits of the account number.

The bottom line is that, as the data breach was immediately discovered and the customer passwords reset, the hackers would have been left with such information that they could have found on Yellow Pages, with much less trouble and for free. For a more detailed analysis: http://blog.unibulmerchantservices.com/the-zappos-data-breach-10-days-on-the-lessons-continue.

[iamwired]

02:19 PM on 01/25/2012

Email accounts and Password strengh is where its at folks. Don't use the same info for everything in your life. You know that email that you gave your friends and shared with everyone so that they can send you chain letters? Well don't use that one for bank accounts, or any online account. Keep multiple ones for different purposes. For passwords use mixes of upper case and lower case letters, with numbers and/or special charcters. That will make it much more difficult for someone to download some common tools that can solve your password in no time. Especialy if it is a common word.

Be Safe