Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Policy

1/25/2018
09:05 AM
Simon Marshall
Simon Marshall
Simon Marshall
50%
50%

8 Personal & Professional Data Privacy Tips to Follow

With International Data Privacy Day coming later this month, Security Now offers a checklist to help protect personal and professional data.

Although International Data Privacy Day on January 28 falls over a weekend this year, no one in their right mind should cease vigilance for 24 hours to celebrate it.

And if something does go wrong on that day, what would be the point of bolting the privacy door after an event occurs? Multiply this concept by 365 days a year, and it's a reminder that bearing best practice in mind can save time, money and integrity.

In the spirit of "forewarned is forearmed," we decided not to wait until later this month to ask Joe Carson, chief security scientist at Thycotic, to share his eight new privacy protection tips. Some are common sense, while others relate to threats which have increased over the last few months. All of them involve keeping our identities and personal data a secret. (See Thycotic's Joseph Carson: Hackers Will Soon Read Your Mind.)

Security needs friction
Don't be tempted to make security frictionless for yourself; it may be easier, but never use a social login to access other accounts or utilities. That moment of inconvenience is there to remind you -- again -- of the value of your data. "If the social login gets compromised it means that cyber criminals could cascade to all the accounts using that social login," said Carson. Factor in privacy
Two-factor authentication for social media is an inconvenience, but it's vital. Many have slipped into a lax mindset when it comes to identifying ourselves for account access. That's because social networks are open by default, privacy is basic or turned off and security is optional. So, what about a new mindset where we make security decisions based on the value of the data we're protecting?

(Source: Pixabay)
(Source: Pixabay)

Always tune privacy settings with data value at the forefront of decisions. Quickly, two-factor authentication becomes common practice. "If multi-factor authentication is available use it," said Carson. "I prefer using an authenticator application like Google, Microsoft, Symantec or Authy instead of SMS."

Be $tr0ng3r
Always devise a strong password, unique to an account, and change it regularly. If you're tempted to assign the same password several times over, so that it's more memorable, just don't. Still relying on a "master sheet" of paper -- or worse, a Word document -- to track hundreds of passwords?

"Get a password manager to help track the age of each password," said Carson, "it lets you know what additional security controls have been applied and helps generate complex passwords for all your accounts so you won't have to type or remember them."

Don't be overly social
At heart, we all dislike those incentives from social media firms aimed at extracting more personal information from us while we're registering or trying to log back in. But the more you provide beyond the minimum to open an account, the more information someone will find if they hack it; it's pretty simple. "If you have already added this information, set it to hidden or remove it from your profile," said Carson. Some people on public WiFi are spies
Using public WiFi is becoming very risky. Not only is there an inherent risk to your data over an unsecured connection, but the cyberthieves are now making their WiFi look like your WiFi; always check the SSID exactly matches the real credentials of the hotspot you're using. Data criminals love to have their own SSID that's very similar, or one that simply says "FreeWiFi." (See WPA3 Standard Teased at CES Following KRACK Attack.)

The risks of public WiFi are so high that Carson recommends always using a VPN for access. If that's not an option, routing data via the cellular network is a good alternative. Something simple, like disabling auto WiFi connect settings, or enabling "Ask To Join," will remove the risk of your device connecting by default to networks like "café," "airport" or "lobby" -- since these are names that scammers use too. Also, don't elect to "remember" the network.


The fundamentals of network security are being redefined – don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

One worrying trend is for criminals to host their own websites, such as Facebook, waiting for you to enter your credentials. Use the latest browser versions as they are tooled to spot this deceit. "Always assume someone is monitoring your data over public WiFi," advises Carson. Don't change any passwords over public WiFi, or enter any financial authentication details. Steer away from any links that look suspicious.

You don't have to 'like' social media
There are risks associated with liking a social page or comment, or following the user. "Different applications can access your profile," said Carson. "Once access is granted most people don't practice the good cyber hygiene required to clean up when the access is no longer required."

Beware of images
"In order to capture information about what device and browser you use, your software versions, patch levels and more, hackers may send you an HTML email containing a tiny image," said Carson. "Simply clicking on this email will download the image into your email client automatically, by default, unless you change your settings. And in downloading that image you are sharing information that hackers can use to exploit your systems." Is this expected, valid and trusted?
The golden rule that stops many unnecessary security issues in their tracks is to step back and briefly consider whether an interaction that shares data is expected, valid and trusted. A "no" answer in there is an advance alarm signal that something may be wrong.

"We are a society of clickers; we like to click on things like hyperlinks," advises Carson. "Nearly 30% of people will click on malicious links. We all need to be more aware and cautious. Before clicking, stop and think."

Have a safe 2018.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-38258
PUBLISHED: 2021-10-25
NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostProcessCallback().
CVE-2021-38260
PUBLISHED: 2021-10-25
NXP MCUXpresso SDK v2.7.0 was discovered to contain a buffer overflow in the function USB_HostParseDeviceConfigurationDescriptor().
CVE-2021-39223
PUBLISHED: 2021-10-25
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.t...
CVE-2021-39224
PUBLISHED: 2021-10-25
Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. (e.g. an attacker could see that the file `shared.txt` is locat...
CVE-2021-39225
PUBLISHED: 2021-10-25
Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 allows another authenticated users to access Deck cards of another user. It is recommended that the Nextcloud Deck App is upgraded to 1.2.9, 1.4.5 or 1.5.3. Ther...