Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

12/19/2018
02:30 PM
Connect Directly
Twitter
RSS
E-Mail vvv
100%
0%

Privacy Futures: Fed-up Consumers Take Their Data Back

In 2019, usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy.

According to a recent Pew survey, two-thirds of Americans do not believe current laws are doing enough to protect their privacy, and six out of 10 respondents would like greater autonomy over their personal data. In an even more surprising turn of events, leadership at several leading tech companies — among them Apple CEO Tim Cook — are now encouraging smarter government regulation and data privacy laws. These shifts indicate a growing awareness and concern within the United States around data privacy and data protection.

In 2019, I predict constituents across the US will seek even greater data protection legislation from their representatives. In the aftermath of the recent Marriott data breach, for example, several members of Congress demanded cybersecurity legislation focusing on consumer protection and privacy, among them, Senator Mark Warner (D-Va.) who  asked for "laws that require data minimization, ensuring companies do not keep sensitive data that they no longer need …. and data security laws that ensure companies account for security costs rather than making their consumers shoulder the burden and harms resulting from these lapses."

Battle Royale: Authoritarian vs. Democratic
While the US has been, for the most part, sitting on the sidelines over the past few years, we've seen a steady march toward greater data localization laws that foreshadow a global battle over data security and privacy. On the one hand are authoritarian regimes that are implementing data localization policies to enable greater government access to both personally identifiable information and intellectual property. This digital authoritarianism includes Internet controls and restrictions, integrating disinformation, and limiting individual data access through various forms of censorship. One the other are the democratic nations that are using legislation such as  the European Union's General Data Protection Regulation (GDPR), which favor the rights of the individual over government access to the data of private citizens.

Russia, for instance, recently announced greater oversight and harsher fines to existing data laws, which include requiring government access to encryption keys and storing Russian users' personal data in Russia. But Russia is not alone. According to Freedom House's Freedom of the Net, this form of digital authoritarianism is the most dominant trend, coinciding with eight consecutive years of rising global Internet censorship.

Conversely, GDPR and now the California Consumer Privacy Act (CCPA) represent the emergence of more democratic models that focus on individual data protection and provide a counterweight to digital authoritarianism. Given these global trends — coupled with constituent pressure — the US will find it increasingly difficult to maintain its current patchwork of industry and state-specific approaches to cybersecurity and data protection. Expect to see the US step off the bench and put some skin in the game.

2019: The Year of Security UX?
While the United States will inevitably see additional forms of data protection legislation introduced in 2019, given the stagnation of current cybersecurity legislation in Congress and the nonstop mega-breaches, the public likely will not be satisfied to sit back and wait and see if legislation gets passed. In the last few weeks of 2018, the recent Marriott mega-breach, the National Republican Congressional Committee email hack, and the Facebook email dump have served as constant reminders about the magnitude of this problem. Given the confluence of corporate breaches, proliferation of attackers, and the global diffusion of surveillance and censorship, individuals want to take back control and gain agency in their own data protection.

The security industry notoriously lacks usability and often blames the user as the weakest link and source of all security problems. But in 2019, users will revolt against this and demand greater, more intuitive individual control over their data. The movement toward usable security will also drive security professionals to work closely with social scientists and user experience experts to ensure that incentive structures and human-computer interaction match those for the broader population of product users and consumers. Usable security will become the new buzzword and signal a rejection of the argument that there must be a trade-off between convenience and security and privacy. The public will demand both convenience and data protection, and there will finally be some progress toward true democratization of security for the masses.

Related Content:

Dr. Andrea Little Limbago is the chief social scientist at Virtru, a data privacy and encryption software company, where she specializes in the intersection of technology, cybersecurity, and policy. She previously taught in academia before joining the Department of Defense, ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lunny
0%
100%
lunny,
User Rank: Strategist
12/20/2018 | 12:10:07 PM
Make the Data Worthless
As more and more data is released through breaches, malicious attacks or simple mistakes, at some point it is all out there.  Once your name, social security number, birth date, place of birth, and other data has been released, there's no reeling it back in.  You can change your name perhaps, but the rest cannot be changed.  We spend a great deal of time and effort trying to protect this data.  We're running out of fingers to put in the dyke while more and more data continues to be released.  With advanced analytics and quantum computing emerging, the ability to accurately infer private data from existing public data will become a reality.

Our goal then, should be to make it harder to use this data to impersonate someone.  It is far too easy to pretend to be another person, by having pieces of key data, to steal money.  We all love the convenience of online commerce, but this problem is the price we pay.  Years ago (many years), I was in the military.  In order to pay with a check anywhere on base, my check had to have the following printed on it; my full name, my social security number (yes, that!), my address, my phone number, and my military unit designator.  But in the 1980s, it wasn't worthwhile to steal that information to impersonate me.  Lots of effort for little gain.  But now, a threat actor can steal information for thousands, or millions, of people and use it to impersonate them for financial gain.  Maybe just $10 per identity on average, but that's a lot of money at scale.

We wouldn't have to protect this type of information if it wasn't so useful to those who would use it to impersonate others for illicit financial gain.  We need to find a better way to assure the identity of both parties in virtual transactions.  Then, all of this data that we spend billions trying to protect would become generally useless and we wouldn't have to protect it.  Maybe we should be spending our money on a cure rather than salves for the symptoms.
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17513
PUBLISHED: 2019-10-18
An issue was discovered in Ratpack before 1.7.5. Due to a misuse of the Netty library class DefaultHttpHeaders, there is no validation that headers lack HTTP control characters. Thus, if untrusted data is used to construct HTTP headers with Ratpack, HTTP Response Splitting can occur.
CVE-2019-8216
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8217
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8218
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure .
CVE-2019-8219
PUBLISHED: 2019-10-17
Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .