When protected, sensitive or confidential data is accessed or used by someone without authority, this is a data breach. This can involve any kind of data such as personal health, financial, or business related.
Not all data breaches result from hacking into a computer. One can breach data simply by peering over someone’s shoulder at the computer screen when they shouldn’t be. It can also be elaborately planned: A company’s new employee may actually be working for an extensive crime ring to steal data from the inside. Needless to say, a data breach can lead to identity theft (among many other problems).
In the workplace, especially retail, where credit cards are processed, the Payment Card Industry Data Security Standard is designed to provide retailers with guidelines to eliminate data breaches. In a healthcare workplace, HIPAA (Health Insurance Portability and Accountability Act) helps control who has access to personal health information.
How can you protect yourself?
As a consumer you must keep your operating system updated to the latest secure version.
Run antivirus, antispyware, antiphishing and a firewall.
Protect your wireless communications with encryption and use a VPN for portable devices.
Use secure passwords with upper/lower case and numbers.
In the event someone else is responsible for a breach read very carefully any notification of a data security breach and don’t assume that the breach was accidental or that identify theft is not likely.
Use an identity theft protection product. It will scavenge cyberspace for any unauthorized use of personal information such as from your credit cards and Social Security number; will keep track of personal credit information; and will send an alert if suspicious activity is detected—maybe even prior to you receiving a consumer notification.
https://safr.me/wp-content/uploads/2013/12/3D-300x153-1.jpg153300Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2013-12-09 06:00:012018-04-27 09:53:53What is a Data Breach and how do I protect Myself?
Digital device theft is a big problem. I’ve seen numerous stories about iPhones being stolen right from a person’s hand while the user was talking on it. Others have reported sitting in a coffee shop while having a conversation and having someone walk in, see the person’s iPad, swipe it, and before anyone can get out of their chair, be halfway down the block.
You’d definitely be distraught if someone walked into your office and stole your laptop, which unfortunately very is common too. You’d be out several hundred dollars due to the loss of the hardware. But the reality is, that stolen digital device will cost much more in lost data if a breach occurs—and then, of course, lost time from having to recover from the data loss.
Protect the data and the device:
Dummy terminal: This means your device doesn’t have any data on it. All your data is cloud based or on a central server. If it’s lost or stolen, then the loss is only a hardware one.
Make sure any device or dummy terminal is password protected.
Situational awareness: No matter where you are, or as safe as you might think you are, there is a possibility your device will be targeted.
Never fight for material items. If thieves want it, they can have it.
Reduce the risks by keeping your devices close when riding the subway or on a bus.
Never put down your devices and walk away, such as in an airport or coffee shop.
Lock all doors in rooms where your devices reside, including in a home, apartment, dorm or office.
Lock/locate/wipe: There are numerous tools available to lock your device if it isn’t password protected (which it had better be!), locate via a GPS or internet/WiFi connection, and wipe the data remotely.
Determine if your device has lock/locate/wipe built in, or seek out a third-party application.
Backup data: This is essential and easy to do. Most of your data should already be in the cloud if you are using cloud-based services such as Google Docs.
Use Mozy, Crashplan, Carbonite or iCloud—or all of these—to seamlessly back up your data.
Use local external drives that copy data to one another.
Backup devices: Is your mobile your life? Then get another one. You need a backup. Is laptop theft a matter of life or death? If you’d have even one day of downtime because of hardware theft, then you need a second laptop.
Have all the data synched in the cloud.
Consider keeping the device plugged into the network and all your data in sync 24/7/265.
WiFi snooping: It isn’t just hardware theft you need to be concerned about. WiFi snoopers are as common as your everyday smash-and-grab thieves.
Protect your WiFi-connected devices with Hotspot Shield VPN. This is a free tool that will encrypt all your data as it travels over a WiFi network.
https://safr.me/wp-content/uploads/2013/11/1D2-1.jpg250297Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2013-11-21 09:00:042018-04-27 09:54:16Prepare now for device and data theft
In 2009, there were a reported 140 million records compromised, compared to 360 million in 2008. In 2010 there have been almost 13 million records stolen. But don’t have a party just yet. Criminals are fine-tuning their craft and getting better. The industry just isn’t making it as easy. 97% of those records were stolen using malware – malicious software designed to attack the target’s existing systems and software in place.
A reported 50% of the malware was installed remotely. Almost 20% came from visiting infected websites and almost 10% was installed when employees clicked infected links that conned or “socially engineered” them.
A recent Verizon report stated, “Over the last two years, custom-created code was more prevalent and far more damaging than lesser forms of customization, the attackers seem to be improving in all areas: getting it on the system, making it do what they want, remaining undetected, continually adapting and evolving, and scoring big for all the above.”
This may be also attributed to an inside job. A rogue employee on the inside always has the advantage of knowing exactly how to remain undetected.
The report further stated that organized crime rings may “recruit, or even place, insiders in a position to embezzle or skim monetary assets and data, usually in return for some cut of the score, the smaller end of these schemes often target cashiers at retail and hospitality establishments while the upper end are more prone to involve bank employees and the like.”
In the past three years that’s a total of 513 million records. On average, every citizen has had his or her data compromised almost twice. Where’s your Social Security number in that mix?
To ensure peace of mind, subscribe to an identity theft protection service, such as McAfee Identity Protection, which offers proactive identity surveillance, lost wallet protection, and alerts when suspicious activity is detected on your accounts. For additional tips, please visit http://www.counteridentitytheft.com
https://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.png00Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2010-09-03 16:46:252010-09-03 16:46:25Organized Web Mobsters Getting Jobs Inside Corps
Computerworld reported that a hacker threatened to expose health data and demanded $10 million from a government agency. The alleged ransom note posted on the Virginia DHP Prescription Monitoring Program site claimed that the hacker had backed up and encrypted more than 8 million patient records and 35 million prescriptions and then deleted the original data. “Unfortunately for Virginia, their backups seem to have gone missing, too.” “Uh oh,” posted the hacker.
Holding data hostage is sometimes done using “ransomware” Otherwise known as “ransom software.” The software gets on your PC as the result of you downloading an infected attachment or clicking the links in the body of an email. Sometimes you can get ransomware simply by visiting a website in what’s called a “drive-by.”
Once your PC is infected with ransomeware it locks down your files in a way that prevents you from accessing them and gives the bad guy full control of your machine. Sometimes the virus poses as a “Browser Security and Anti-adware” security application whose license has expired. Windows machines infected by the malware are confronted by a full-screen message that poses as a Windows error.
This type of an exploit not common, but it’s definitely a rising star in the malware community. The best way to avoid this is to make sure your PC is updated with the most current version of your operating system, and anti-virus definitions. It’s also very important not to click on links in the body of an email or visit rogue websites that may have viruses that inject themselves into your browser.
https://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.png00Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2010-04-02 17:00:482010-04-02 17:00:48Be careful Your PC Isn’t Held for Ransom
The feds are getting better at busting criminals every day. Seventeen criminals, many from Eastern Europe, pilfered more than 95,000 stolen credit card numbers and $4 million worth of fraudulent transactions.
The New York Times reports the men were involved in a vast conspiracy known as the Western Express Cybercrime Group, which trafficked in stolen credit card information through the Internet and used it to create forged credit cards and to sell goods on eBay. They used digital currencies like e-gold and Webmoney to launder their proceeds.
Several of the scammers — Viatcheslav Vasilyev, Vladimir Kramarenko, Egor Shevelev, Dzimitry Burak and Oleg Kovelin — were charged with corruption. Vasilyev, 33, and Kramarenko, 31, were arrested at their homes in Prague, have been extradited to Manhattan. Shevelev, 23, was arrested in Greece last year, is still awaiting extradition. Burak, 26, a citizen of Belarus and Kovelin, 28, a citizen of Moldova have not been arrested
Vasilyev and Kramarenko recruited work from home employees to advertise and sell electronics on eBay. When someone would purchase an item, the two men would pocket the buyer’s payment, give a cut to their recruit, then use a stolen credit card number to purchase the item from a retail store and send it to the buyer. In essence, they used eBay to obtain a legitimate buyer’s credit card number through a legitimate channel and didn’t actually “hack” anything. They simply set up pseudo-fake auctions that, in most cases, delivered the product, but also obtained the victim’s credit card number and then made fraudulent charges.
Burak and Shevelev were “carders” who sold stolen credit card information on a website called Dumpsmarket and, probably, in chat rooms. “Dumps” is a criminal term for stolen credit cards and “carders” are the scammers who buy and sell them. Kovelin was a criminal hacker who stole victims’ financial information via phishing emails and more than likely used the victims’ own account information against them.
Protect yourself:
Check your credit card statements often, especially after using an online auction site. Refute unauthorized charged within 60 days to be made whole by the issuing bank.
Don’t just buy the lowest priced product on and auction site. Use auction sellers who have been approved my many and have a solid track record.
Anytime you ever receive an email asking for personal information, credit information, banking etc, do not enter it. Just hit delete. Often victims will receive and email from a trusted source like eBay directly to their account because they have been actively engaging the fraudulent auctioneer. eBays system doesn’t recommend giving your credit card information outside their network in an email.
Get a credit freeze. Go to ConsumersUnion.org and follow the steps for your particular state. This is an absolutely necessary tool to secure your credit. In most cases, it prevents new accounts from being opened in your name. This makes your Social Security number useless to a potential identity thief.
Every week we learn of a new hack, another breach, credit cards stolen and another identity theft victim.
Many have blamed the bad guy or criminal hackers for all the problems we have in the security world. And while the bad guy is certainly a problem, they are a small part.
The people responsible for their own physical or computer security or the security of others are often the guilty.
You wonder why your credit card company sent you a new card? Because some baboon didn’t do his job and your were compromised.
Chances are we could look at 7 out of 10 data breaches and point to someone who didn’t properly flip a switch or lock a door.
Recent studies polling companies with 1000 or more employees when asked to define the most important measures for protecting confidential data, nearly half of all respondents said, “communicating and training users on confidential data security policies.”
And when asked to rate their organizations performance with regard to, “communicating and training users on confidential data security policies,” more than one-fourth of security professionals gave their organization a rating of either “fair” or “poor.”
North Americans ranked 24% as being “poor” while Europeans ranked 38%. I suspect the North Americans are just lying and are just as lax. I read the papers and see the data. Pleeeeze. I have my eye on you Focker.
Security is not entirely an IT problem. There are many “to-dos”, policies in place regarding physical security that must be observed. And if followed properly, would reduce many of the breaches we see.
One plain and simple example is dumpster diving. How prevalent are shredders? I’ve gone though 4. Besides the copy machine or your desk/laptop, a shredder should be the most used home/office appliance.
Here is an infuriating video of a dumpster diver here, also a security professional who spent 3 minutes in the dumpster of a local bank. He found a laptop, wire transfers and Social Security Numbers. That’s not an IT problem. That’s a stupid-lazy-people problem.
How is anyone supposed to feel secure and protect their identity when others are responsible for our security? The fact remains we are an open sore and idiots keep pouring salt in the wounds.
Robert Siciliano Identity Theft Speaker discussing Idiots who didn’t secure a wireless connection and exposed 45 million credit cards Here
I’m excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information.
https://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.png00Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2009-03-19 14:03:302009-03-19 14:03:30Identity Theft Prevention is a People Problem
An axiom in business is that we buy from and do business with those who we know like and trust. In the 21st century we have seen CEOs, investment bankers, politicians and those in the highest positions of trust completely screw everyone who put them on their pedestal.
Madoff pleads guilty for orchestrating a 65 billion dollar Ponzi scheme and 3 rows of investors in attendance at his trial clapped, applauded and sang. These are people that bestowed an incredible amount of money in a man that is probably a psychopath.
What does this say about us as a species that trusts so much?
Charles Ponzi began his scheme 100 years ago and was caught 10 years later. The SEC stepped in and stopped him. The SEC didn’t stop Madoff. They allowed him to prosper, until his operation imploded.
Growing up most of us were schooled on “Stranger Danger” because our parents were also told not to talk to strangers. Strangers are “strange” therefore dangerous. At least that seemed to be the theory. Unfortunately I’ve seen all too often that people we know are sometimes the baddest apples in the bunch. Kids coaches, swim teacher, clergy etc.
In a Wall Street Journal articleBruce Schneier makes the point that people are over all good and generally honest. So approaching a stranger probably wouldn’t mean imminent danger. Basically true.
On the other hand if someone pursues or approaches you, they are essentially paying unwanted attention to you, or distracting you from the truth. Maybe getting ready to take advantage of you in some devious way.
We see this all the time when law enforcement sets up a 14 year old female named Dixey14 in a chatroom and she’s (or he) is quickly approached by 50 men with webcams snapping pictures of themselves. So in this sense talking to strangers is bad. Video Here
Nigerian identity theft 419 scams are based on one single principle to be successful; get to know your mark, get them to like you and they will trust you. Done. They start off a stranger, then become their victims night in shining armor coming to your emotional (and financial) rescue. Scambaiter video Here
I’ve talked over and over about insiders at a company maliciously hacking away at the network and stealing data. They aren’t strangers, they are the funny drunk dudes at the Christmas party.
You want to prevent being scammed? Prevent Data theft? Prevent identity theft? Prevent being hacked?
Do not exclusively rely on any one system to protect you. Don’t expect the government and their bazillion bureaucratic agencies to protect you. Don’t think law enforcement or any other authoritative agency will be there when a predator strikes.
All existing systems work often, and fail as much.
Security is about layers. The more layers of protection you have in place, the more difficult you make it for the bad guy to get access. Redundancy, predictive, proactive thinking.
Someone pour me a scotch. Single malt.
Oh, and I’m very excited to work with uni-ball in 2009 in a partnership to help raise awareness about the growing threat of identity theft and provide tips for protecting yourself. Check out uniball-na.com for more information
Robert Siciliano Identity Theft Expert Discussing Bernie Madoff Con Man Here
https://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.png00Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2009-03-13 08:19:332009-03-13 08:19:33Mom Was Wrong. Strangers Good. People We Know Bad.
Why hack your online bank? Because thats where the money is!
White Hat Hackers (good guys) probably never anticipated whats happening. There are more viruses out there than ever. Black Hat Hackers (bad guys) are in full force. Back in the year 2000 some have said the white hats were about a year ahead of the black hats in technology. Meaning it would take about a year for the bad guys to crack the white hats stuff.
Others research shows by 2004 the black hats were about 2 weeks behind the white hats. Here we are in 2009. In many cases the black hats are years ahead of the white hats. The good guys are losing. Badly.
Many of the new viruses sit on your hard drive dormant, waiting to be “woken up” when they are signaled. Many of these Trojans are designed to sniff out when you are banking online. They sit and wait, then stike when you log on.
Consider that in our own bodies we already have numerous viruses that come alive when our immune system is down or when its woken up by coming on contact with another. Your PC is no different, there’s often something lurking in there. We get viruses on our PC simply by visiting a website, clicking on a link or downloading a program we think is clean, and many many more ways.
Studies show the amount of viruses quadrupled from over 15,000 in 2007 to almost 60,000 in 2008. The problem is the technology of the criminal hacker has evolved and is further evolving faster than the white hats. This means you have to be on your game. Don’t let your guard down and stay informed.
Basic stuff, again – basic;
Run Windows Update; Or it may be called “Microsoft Update” on your PC. This is a free update to your operating system that Microsoft provides. There are two ways to access this. Either click “Start” then “All Programs”, scroll up the menu and look for the link “Windows Update or Microsoft Update”. Click on it. Your browser (Internet Explorer) by default will launch taking you right to Microsoft’s Windows Update web page and will begin the process of looking at your PC and checking to see what security patches you don’t have. Follow the prompts and click “Express” and let it lead you in the direction it wants. The goal here’s for XP is to end up with “Service Pack 3” installed. Or go to “Control Panel” and seek out “Security Center”. And click “Turn on Automatic Updates” and let Microsoft do this automatically. In Vista the process is similar and your goal is “Service Pack 1”
Install Anti-Virus; Most PCs come with bundled anti-virus that runs for free for 6 months to a year. Then you just re-up the license. If you don’t, then every day that the anti-virus isn’t updated, is another opportunity for criminal hackers to turn your PC into a Zombie that allows your computer to be a Slave sending out more viruses to other PCs and turning your PC into a Spambot selling Viagra. You can also install a different anti-virus program for a fee or free. McAfee is great, Symantec is loosening their grip on the “bloatware” and getting better. Avast is free and good, but free scares me. Free means you have to manually scan your PC and most people don’t do manual very well. Theres also a paid version.
Install Spyware Removal Software; Most anti-virus providers define spyware as a virus now. However it is best to run a spyware removal program monthly to make sure your PC is rid of software that may allow a criminal hacker to remotely monitor you’re keystrokes, websites visited and the data on your PC. I like Lavasofts Ad-Aware Free www.lavasoft.com. There are plenty of good ones.
Run Firefox or Chrome; Microsofts Internet Explorer is clunky and the most hacked software on the planet. Mozillas Firefox is less hacked and more secure. The jury is still out on Googles Chrome browser, but it’s sweet! Maintain the default settings keep the pop-up blockers and phishing filters on.
Secure Your Wireless; If you are running an unsecured wireless connection at home or the office, anyone can jump on your network from 300-500 feet away and access your files. Serious. The router has instruction on how to set up WEP or WPA security. WPA is more secure. If this is a foreign language to you, then hire someone or get your 15 year old to do it.
Install a Firewall; Microsoft’s operating system comes with a built in firewall. But it is not very secure. Go with a 3rd party firewall that is prepackaged with anti-virus software.
Use Strong Passwords; Little yellow stickys on your monitor with your passwords isn’t good. Use upper case, lower case, alpha-numeric passwords that you change up every 6 Months.
PLEASE, you other security dudes or dudets, chime in. We need your guidance too.
Robert Siciliano Identity Theft Expert discussing online banking Here
https://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.png00Robert Sicilianohttps://safr.me/wp-content/uploads/2023/03/small-logo-safr-me-300x98.pngRobert Siciliano2009-02-25 16:16:212009-02-25 16:16:21Your Online Bank Account’; Criminal Hackers Hacking It
Hackers have breached another huge payment processor. Who? As of this writing they aren’t saying. A statement issued by the Community Bankers Association of Illinois states “Visa announced that an unnamed processor recently reported that it discovered a data breach. The processors name has been withheld pending completion of the forensic investigation” The Open Security Foundation posted a notice on its website Here
According to VISA officials, the breach affected all card brands. Evidence indicates that the account number, PAN and expiration dates were stolen. No cardholder Social Security numbers, unencrypted personal identification numbers (PIN), addresses or telephone numbers or other personal information were involved in the breach.
An increase in card-not-present fraud suggests some BIN number have been targeted by criminals.
VISA officials reported that while the number of accountholders affected is undetermined, it appears to be fewer than those affected by the recent Heartland Payment Systems breach, but a significant number nonetheless. And unlike the Heartland breach, where thieves also captured Track 2 data, officials reiterated that no personal information was taken in this most recent event.
The status of the processor’s PCI compliance is unknown at this time. Bankers. MORE TO COME….”
Why not go after processors, thats where all the data is!
Visa and MasterCard are in the process of notifying affected banks about what they say is a “major compromise”. So far this is not related to the Heartland Payment Systems breach where an expected 100 million cards have been compromised. Or it may be, we don’t know.
Initial reports say the criminal hackers planted malware, or malicious software on the processors servers. Malware of this type generally has some type of remote control component that allows a criminal hacker to remotely access the server and divert data underground.
Visa reached out to all affected banks on February 12th when they conducted a conference call disclosing the severity of the issue. Apparently the compromise occurred from February of 2008 till August 2008 the past few weeks.
At this point neither Visa or MasterCard haven’t disclosed which processor has been compromised nor have they disclosed the size of the breach.
Whether the unknown processor was compliant or not has also not been revealed.
Check your credit and banking statements carefully. Scrutinize every charge and refute any unauthorized charges within 30-60 days. Call your bank/credit card company immediately if you see any fraudulent activity.
Robert Siciliano Identity Theft Speaker Expert discussing another ugly data breach Here.
What happens when you have an unlocked door at the home of and employee at the top U.S. nuclear weapons laboratory? How about 3 stolen computers with yet to be disclosed data, that was said to be non-classified. We hope. Were the computers stolen to be resold for crack? Or for nuclear weapons secrets? We may never know. Or we may find out the hard way.
At the Los Alamos National Laboratory in Santa Fe New Mexico dozens more (67 total) systems are currently listed as missing. Officials are conducting a full review of the lab’s policies and procedures governing the use of official computers at employees’ homes.
Situations like this are common in every industry with every conceivable form of data. We just wish it wasn’t data from a nuclear weapons facility.
Its important to point out that the facility has as many as 40,000 computers including desktops, laptops, PDAs, printers and so on. Do the math, less than a .25 percent lost or stolen. The lab has been documented at a better than 99.5 accountability rate.
We know there is no such thing as 100% security whether protecting from hardware or data thieves. Security is an ongoing, never ending, consistent, on your toes, don’t let your guard down, vigilant process.
And its not just criminal hackers causing big problems, lowly burglars looking for their next bag of dope stole a laptop computer from the home of a government employee containing 26.5 million Social Security Numbers, a US primary identifier. This $500 laptop cost millions.
Can you say your organization has a 99.5% success rate?
What policies do you have in place to foster a security minded culture? Here are just a few bullets as examples for you to add too.
# Cover all organizational systems used for processing, storing or transmitting personal information.
# Security risks faced assessed in the development of the policy
# Cost-effective measures devised to reduce the risks to acceptable levels
# Monitored and periodically reviewed.
# Staff and management made aware of the protective security policies and how to implement them.
Not all data breaches result from hacking into a computer. One can breach data simply by peering over someone’s shoulder at the computer screen when they shouldn’t be. It can also be elaborately planned: A company’s new employee may actually be working for an extensive crime ring to steal data from the inside. Needless to say, a data breach can lead to identity theft (among many other problems).
