Living and working in Iowa, I had a front row seat for the fallout of poor technology testing during the February Iowa Caucus meltdown. The
failure of a new caucus results reporting app was a classic example of how broken tech can kickoff a series of unfortunate circumstances.
Rampant speculation, conspiracy theories and misinformation are just a few of the negative consequences you can expect when technology fails. Elections, already under a massive amount of scrutiny, simply can't take the added pressure of a technology snafu.
The solution to preventing unproven technology from cause a mess like this in your world? Testing, testing and more testing!
Here are direct links to a few of the episodes on this topic in particular:
While testing doesn't solve every problem, it certainly goes a long way toward securing optimal outcomes. The good news in Iowa
is that all the caucus goers recorded their candidate choices on cards, so those can be used to ensure accurate results, despite the failure of the app.
Read on to learn about the value of thinking ahead to prevent a wide range of data security and privacy problems.
|
|
Data Security & Privacy Beacons
|
People and places making a difference**
Have you seen an organization or individual taking actions to improve privacy? Send me a note to nominate a privacy beacon of your own!
The Microsoft Edge Chromium browser is built around empowering users to avoid being tracked on the web. The browser offers three levels of privacy settings, and the default automatically blocks trackers from sites users haven't visited before. This blocks harmful trackers and also improves the relevancy of ads users allow. Some are
comparing the browser to Ghostery, the
open-source privacy and security browser extension developed by in 2010 by David Cancel.
Have you used it? Do you like it?
Decent Security has dedicated a page specifically to malware and phishing that helps would-be and actual victims report attacks. The feature essentially enables the
blacklisting of phishing sites, protecting more people from becoming exposed to what are often fast-spreading scams.
U.S. Lawmakers
across party lines have come together to pass the TRACED Act, which will make it easier for people to spot incoming robocalls, a system often used by scammers to reach more victims faster. The legislation calls on telecom carriers to implement a number-authentication system so you can see who is on the other end of the line. It also increases penalties for companies that fail to implement a robocall mitigation program.
NIST has created a Privacy Engineering Collaboration Space where practitioners can discover, share, discuss and improve upon open-source tools, solutions and processes that support privacy engineering and risk management. The online venue is open to the public, which is really important, as it provides a terrific resource for consumers to see the plethora of options available to tech developers. There simply is no excuse for not implementing good data security and privacy controls with a resource like this available.
Etsy recently impressed me with its procedure for double-checking user requests to change passwords. I've saved their emails as excellent examples of good privacy-awareness communication. Give me a shout via email if you'd like me to forward you a copy.
Carnegie Mellon researchers have created the Internet of Things (IoT) Assistant app to informs users about the IoT technologies around them and what data they are collecting. And, if the technologies detected offer privacy features, like opting in or out of data collection, the app helps users access them. How cool is that!
**Privacy beacon shout-outs do not necessarily indicate an organization or person is addressing every privacy protection perfectly throughout their organization (no one is). It simply highlights a noteworthy example that is, in most cases, worth emulating.
|
|
The Ever-Expanding Internet of Things (IoT)
|
|
New monthly feature to spark IoT awareness
As a member of the NIST Cybersecurity of IoT Program, which I started doing work for in January of this year, I've committed to, among other things, helping raise awareness of the risks posed by Internet of Things (IoT) devices. So, each month, I'll add a new piece of news or commentary on an IoT trend here in this space.
This month, I'm offering up a round up of the different
IoT infographics the team and I have created over the past several years.
Please take a look and let me know if you have any questions. I'm happy to prepare different file formats if that helps you share these with the people in your community. Just
shoot me a request via email.
Who Has Your Health Data? Health data is copied and shared millions of times by hundreds of medical devices, networks and systems.
|
|
 |
Will You Let Alexa Ride in Your Car?
|
The hidden privacy data issues of Alexa Built-In
When I learned of the new Encore GX car with Alexa Built-In, my mind went straight to the privacy concerns. While the automaker is promoting this as a high-end feature, not everyone will want this new-era digital surveillance built into their vehicle.
With Alexa on board, Amazon (and countless third parties with access to Amazon data) will know every minute detail of drivers' and their passengers' habits. This includes the businesses they visit, the music they listen to, the conversations they have while riding down the road and anything else they might do in their cars.
Embedding Alexa into our personal devices certainly isn't a new concept. You can find it in the Lexus ES, the Fitbit Versa 2, the ecobee4 Smart Thermostat, Sony headphones, the Vector Robot by Anki, to name a few. While the convenience of Alexa integration is nice, consumers shouldn't have to pay with their privacy.
It would be a real privacy-beacon move for Amazon to build easy-to-use privacy capabilities into Alexa and Echo to allow for quick and intuitive ways to completely shut off listening/recording.
Devices Gain in Popularity Despite Security Bugs
Amazon and plenty of other Big Tech companies have come under fire for data privacy issues, as
this CNET article
highlights. S
ecurity researchers found an
error, tucked away in a calculator app, that could allow malicious apps
to enable continuous listening. Any provider the size of Amazon that allows a third-party app to eavesdrop on its users should be penalized, at a minimum by a reduction of interest in their products. Yet, Alexa-enabled devices continue to grow in popularity.
Take Amazon Up on Its Privacy Offers
Consider what could be construed if Alexa misheard a question and responded with something completely out of left field that made you appear to be someone you're not. Amazon's updated privacy measures allow you to ask Alexa why she responded the way she did to clear up any confusion. But it's still a scary thought to consider the implications of your voice data taken out of context.
Amazon has also put measures in place to make it easier for users to determine (and delete) voice data recorded via Alexa. How many people take advantage of these features, though?
As of now, we can still choose whether we want Alexa and other IoT devices in our private spaces. That could change, however. The benefits of Alexa and other cloud-based voice services are easily sold, but the downsides are often unknown to the consumer. It's becoming more of a default to have them embedded within products we buy, like a vehicle, where previously we weren't forced to think about a threat to our privacy.
|
|
Low-Tech Ways to Safeguard Your Privacy
|
Mitigating data security and privacy risks in the physical realm
Protecting yourself digitally is important. So, too, is keeping an eye on your physical surroundings. Below is a round up of quick tips for staying safe IRL (in real life).
Avoid abbreviating the date in 2020: When signing documents, don't shorten the year to "20." Scammers can modify a date written as "3/3/20" to read "3/3/2017" or "3/3/2018," opening the door for all kinds of fraud.
Finely shred paper documents: Your sensitive and personal information lives in a lot of places these days. Properly disposing of paper data is just as critical as deleting your digital info. Check the link for some of the best home shredding products available.
Write or whisper personal information: When personnel in banks, clinics, stores, etc. ask for your Social Security Number, birthday or other confidential information, don't feel like you have to speak it out loud so those around you can hear. Sketch it down on a piece of paper or lower your voice so others around can't hear. If this happens to you often, carry a note pad or small notebook with you to make such communications.
|
|
|
Old Laws, New Tricks
|
| |
