Practice Good Personal Data Hygiene
As people the world over increase their personal hygiene habits to contain the novel coronavirus, COVID-19, we must pay just as much attention to our personal data hygiene. That's because scammers and cybercrooks do not take a break during times of turbulence.
In fact, they clamor for more chaos.
A global crisis provides the perfect cover for the nefarious tricks and traps of criminals. So, as you are changing your daily routine, increasing your use of technology to work from home and opening your heart to those in need, remember to keep up a healthy guard against scams and security intrusions.
Although we are in unusual times where everything seems odd and often scary, common sense remains one of your biggest allies in the fight against fraudsters. And, there are plenty of resources out there to guide your decisions. Use them to check (and recheck) every offer, request, warning and "too good to be true" promotion that comes your way.
|
|
Data Security & Privacy Beacons
|
People and places making a difference**
Have you seen an organization or individual taking actions to improve privacy? Send me a note to nominate a privacy beacon of your own!
The U.S. Federal Trade Commission (FTC)
continues to earn a place in our Privacy Beacons feature, as the agency keeps putting out great resources. One of the most recent ones is a fun and inventive activity that raises awareness of scams circulating the country.
FTCScamBingo encourages players to print off the bingo card and mark off scams as they experience them. The game can be used by private citizens and even by
businesses as part of their information security and privacy awareness and training programs. If you're home with family during the pandemic, consider doing this activity with those in your home. Fun, informative and educational! If you play, please let us know. Did you get a Scam Bingo?
Douglas J. Leith of Trinity College in Dublin, Ireland, has just released the results of a study on web browser privacy. His team of researchers analyzed the
backend server connections of six popular browsers. As it turns out, one of our prior Beacons, Microsoft Edge, was deemed among the least private by the study!
This is a good reminder that using self-proclaimed privacy-friendly tools that check out upon high-level inspection may require a deeper dive. You want to be sure so-called privacy-improving solutions aren't actually privacy-degrading.
Lead Stories
is an online journal that detects and debunks trending fake news stories and hoaxes originating on sites, networks, prank generators and satirical websites. One of their ongoing features is the Hoax Alert, and I was so happy to see the recent Lowe's anniversary check scam covered. I saw many people sharing posts on social media about the scam as if it were real; certainly they were hoping it was real. (Some of these individuals even went so far as to delete my comments warning them about the dangers of falling for the trap.) Kudos to Lead Stories for explaining the scam so well.
The U.S. Department of Health and Human Services (HHS) has prepared a terrific resource on the Office of the Inspector General's website. The information posted is alerting the public about fraud schemes related to COVID-19. Among the more disturbing is a scam in which Medicare beneficiaries are offered COVID-19 tests in exchange for personal details, including Medicare information. As the HHS reports, such services are unapproved and illegitimate. Please be suspicious of all unexpected texts, emails, calls or visitors offering COVID-19 tests or supplies. Rely on your trusted medical professionals, such as your primary care physician or local clinic, for answers to any questions you have about your personal risks or testing and treatments available to you.
**Privacy beacon shout-outs do not necessarily indicate an organization or person is addressing every privacy protection perfectly throughout their organization (no one is). It simply highlights a noteworthy example that is, in most cases, worth emulating.
|
|
It's important to mitigate the risks of working remotely
In recent weeks, many people have been challenged to quickly transition to working from home. Given the large number of workers and entire industries that have gone remote, we must all by hyper diligent in the protection our new home offices from opportunistic cyber attackers.
Because so many organizations had to enact remote working capabilities with urgency, they had little time to train employees with proper procedures.
In fact, many organizations did not even have documented policies, let alone procedures, for their employees to follow for work-from-home security and privacy. This lack of preparedness, coupled with the sheer number of distractions employees face as they monitor news about COVID-19, is likely to open up businesses and employees to a variety of increased risks. These include:
Phishing scams: Cybercriminals send phishing emails, texts and even social media posts that appear to be from someone inside the company. One of their common tricks is to pretend they've been kicked out of the system and need access codes to get back in.
- TIPS: Verify the email with a phone call to the colleague. Never click on links or provide sensitive information over email or any other method of contact. Continue to utilize the help of your IT resources even when working from home.
Remote desktop tool vulnerabilities: Because remote desktops, a.k.a. remote desktop protocols or RDPs, are so widely used, they are common targets for cyber criminals. Case in point: Hackers are exploiting vulnerabilities in Zoom to hijack virtual meetings and even spread malicious code.
- TIPS: Add an extra layer of security by using a virtual private network (VPN). Computers connected to a VPN are assigned a private IP address, which allows them to access a remote connection much more securely. Be sure to also use a strong password. Speak with your employer's information security or IT area for help. If VPNs are not implemented correctly, hackers can exploit those vulnerabilities.
- TIPS: One way to secure your wi-fi connection, protecting you and your employer, is to use WPA2 security. The technology guards access to your router by requiring each new device to submit a password before it can connect. More are available at Privacy Security Brainiacs.
Increased accessibility to information and devices: Working from home for the first time could mean you don't have a dedicated space for your technology or documents. Spouses, kids, roommates and other unauthorized individuals can easily gain access to your computer and its contents, or to papers with sensitive data lying around or even thrown in the trash.
- TIPS: Keep your computer powered off or log out when not in use. Change your password more frequently. Don't allow family members to use a computer you use for business. Also, invest in a cross-shredder for your home office.
Internet of Things (IoT): As mentioned in previous Tips, I'm committed to raising awareness of risks posed by Internet of Things (IoT) devices and feel it's important to be aware of issues that could arise in our new remote working environments.
In a home office, you may have a device like an Amazon Echo or Dot. It's been proven that those gadgets (or more specifically, the human engineers and analysts behind them) are capable of eavesdropping on users. Could they be recording you as you speak about sensitive or confidential information?
- TIPS: Keep smart speakers and other listening devices out of your home office. Or, turn off the microphone until you need it. You may also consider changing the device's "wake word," so you don't inadvertently record conversations or send to someone on your contact list by mistake.
Data security and privacy protections you may have taken for granted in your office space aren't guaranteed at home. We must all be extra careful and take measures to protect the sensitive data we work with and around.
Remote Working Resources for the Privacy Professor Community
During the COVID-19 pandemic, work from home (WFH), remote working and the use of mobile devices has increased dramatically. Employees are setting up home offices, using mobile devices and online meeting tools for work, as well as performing work activities on the road and in other temporary locations. A large number of organizations throughout the world, of all sizes and across many industries, have been asking our team for policies and procedures to deal with the data security and privacy challenges this presents.
To help these organizations with their information security and privacy needs during these difficult times, we created a new page on our Privacy Security Brainiacs site.
There, you can find
home and mobile computing
policies and procedures, tools and tips, as well as news items to help during the pandemic and long after the crisis has ended.
We are also including a no-cost set of remote working and mobile computing policies
to help you establish or update your own.
Because things are moving rapidly, we plan to continuously update Privacy Security Brainiacs throughout the crisis and beyond. If you have feedback or suggested additions, please let us know!
|
|
 |
Scammers Take Advantage of COVID-19 Fears
|
Awareness and common sense are great allies against schemes
This is prime time for con artists.
With lowered guards and a voracious appetite for information, people in a crisis are much more prone to believe what they're told. This is especially true in an increasingly digital environment in which scammers and con artists have a multitude of technologies to hide their true selves.
Scammers are communicating via text, email, voicemail, social media and many other channels. They're posing as the federal government officials and representatives of the Centers for Disease Control and Prevention (CDC) and the World Health Organization (WHO). Because these agencies have become part of our daily lives amid the pandemic, we are more inclined to believe they're contacting us with critical information we need.
For example, passengers who were aboard the Diamond Princess cruise ship are receiving emails asking them to click a link to see their COVID-19 test results. If you've had such a test done recently, it would be hard to resist clicking on it. That's exactly what hackers are banking on.
Indeed, the parent company of Princess cruise lines announced that hackers had gained unauthorized access to employees' email accounts. The hack exposed the personal data of those who traveled and worked aboard the Princess and Holland America cruises.
Now, with the announcement that U.S. citizens will receive stimulus checks, many totaling in the thousands, there are likely to be an even greater level of scam attempts against citizens. It's fairly easy to predict an explosion of phishing emails enticing people to click a link, download an attachment or call into a nefarious line with their social security numbers to receive their money.
- Hang up on robocalls.
- Fact-check information.
- Know who you're buying from.
- Don't respond to emails or calls about checks from the government.
- Don't click on links from sources you don't know.
- Watch for emails claiming to be from Center of Disease Control (CDC).
- Ignore online offers for vaccinations.
- Do your homework when it comes to donations.
|
|
Heading for a Future of Health Surveillance
|
Balancing pandemic prevention with personal privacy
Several countries and agencies are facing criticism about not containing the spread of COVID-19 fast enough. Especially because the technology to track diseases and the movement of people exist, some are critical about the choice to avoid deploying it.
Among several reasons digital surveillance is not used as widely as it could be is an appreciation for privacy in many areas of the world. But, as Axios correspondent Bryan Walsh recently suggested in his reporting,
the loss of privacy may soon be weighed more critically against p
ublic health benefits.
History can be a great teacher when it comes to this debate. Over the past several decades, governments have enacted policies or relaxed regulations during times of crisis. While they begin as temporary measures, they often stay in place even after the crisis comes to an end.
The U.S. Patriot Act stands out as a recent and poignant example. The legislation
was hurriedly written and put into place right after 9/11. Although it was meant to be temporary, the law is still in place nearly two decades later. And, law enforcement and the U.S. Department of Justice have even been attempting to expand the law's surveillance capabilities. They are actively trying to compel some tech companies to weaken encryption while purchasing facial recognition capabilities from others.
The increase in companies leveraging COVID-19 as a selling point for surveillance has ramped up in the past month, and will likely continue on for years. How successful our legislators are at balancing pandemic prevention with personal privacy depends greatly on all of us. Use your voices and share your opinions. The people who introduce and vote on our laws need to hear from you.
|
|
|
What 'Right to Be Forgotten' Bills Are Forgetting
|
| |
