In advance of the annual international Privacy Data Day, please share these three action tips to protect the privacy of consumers and businesses:
 

1. Nothing is truly free, including mobile apps. Be aware of the personal information you give mobile app providers. Many free apps sell your information to a wide range of companies, some of which may have malicious intents. Studies have shown most apps do not have many, or even any, security controls built in. Check privacygrade.org to see if the app you want respects your privacy and has security built in.

2. Be cautious with new "smart" devices. A wide range of new and unique gadgets -- from socks to smart cars -- connects you directly to other entities (and even to the Internet) to automatically share information about your activities, location and personal characteristics. Before using such devices, make sure you know which data they are collecting, how it will be used and with whom it will be shared.

3. Only share personal information with trusted sources. Be extra careful not to share sensitive personal information, such as social security numbers, credit card numbers and driver's license numbers. Don't do business with an entity that does not have a posted privacy notice.

Sony Hack Reminds Employees to Watch What They Write 

For every accurate statement made about the recent Sony Pictures hack, there have been at least two inaccurate ones. Shockingly, many of these errors have been uttered by people in positions of authority, such as politicians and other self-proclaimed cybersecurity "experts."

That's why I was so happy to be invited to talk about the incident on the Great Day morning show last week. The full episode is available here.

Increasingly, entertainment companies are coming under attack from headline-hungry hackers. Sometimes these criminals have an agenda; sometimes they are simply curious to learn what they can get away with. On Christmas Day, in fact, a hacker group going by the name Lizard Squad generated a complete worldwide outage striking the online services of Xbox One and Playstation 4.

However, it's important for people to know every organization is vulnerable to hackers. True, some are much more susceptible because not enough attention nor enough resources are allocated to have an effective information security program. 

Just as notable is the fact every person is vulnerable to hackers, as evidenced by the reputation damage suffered by several Sony Pictures executives whose emails were leaked to media. Things you may think are funny or private, when exposed to a broader audience out of context, can paint a public picture of a person you are not. Remember: You should never put anything into an email...especially your work email... you would not want the entire world to be able to see if that message is not encrypted.

Make 2015 the year your organization -- and even you personally -- resolves to improve security and privacy efforts. Even small things, such as thinking twice about the content of your work emails, can make a big difference should your organization become the inevitable next victim of a headline-inducing attack. 
 

Example of a Popular Phishing Scam

In December, I received the following phishing scam from an entity purporting to be PayPal. 

I reported the incident by sending an email to PayPal at spoof@paypal.com (something you and your employees, friends and colleagues should get into the habit of doing; it really does make a difference!). If you're unsure where to send suspected phishing emails, check the spoofed company's privacy policy on their website, as there is usually an email address for you to use for such purposes posted within.

***REMINDER: Any website that gathers personal information either through a form or through the use of cookies or other webbugs should have a privacy policy posted on that site.

How can you spot phishing emails like this one? Consider the following:

• The domain name does not match the sender's (in this case the sender is "PayPal;" the domain is "payea.com")

• The IP address noted in the email is from China.

• Unlike less sophisticated phishing attempts, this one is actually pretty articulate. Often you'll find misspellings, poor grammar and other hints that the language used in the email is not the spammer's area of expertise.

Terrorists Adding Phishing to Weapons Arsenal

ISIS is apparently using phishing schemes to go after their enemies. As reported by The Register, the terror group has sent "booby-trapped" emails from what appears to be an anti-ISIS group.

The impersonating emails ask the recipient to read a report about the actions of ISIS by clicking on a link embedded in the message. Once they do, the victim's computer is instantly infected with spyware, which The Register reporter believes terrorists are using to identify the precise location of its enemies and then target their victims. Iain Thomson writes:

Imagine a person regularly using a cafe for web access; if ISIS can map the cafe's network address to its physical location, it will know exactly where that person is when he or she switches on their laptop.

Scary stuff. 

Bloggers Targeted by Malware Campaign

The Hacker News recently broke a story about the "SoakSoak" malware infection of more than 100,000 blogs. Each hosted by Wordpress, a popular open source blogging service, the infected blogs caused users to inadvertently download malicious files on their computer systems.  

Gizmodo believes the source to be Russian  and also says the attack could have been prevented. Kate Knibbs writes, "This is yet another stark reminder that ignoring vulnerabilities is an act of hubris that should not be tolerated."

If you run a Wordpress site, there are a few things you can do:

• Check for the presence of malware on your site by using the free Sucuri Malware and Security Scanner
   
• If you find malicious code, remove it immediately
   
• Update Wordpress' premium plug-in
   
• Get behind an effective firewall, such as CloudProxy

Privacy Professor on the Road

I have a couple of events confirmed, and many being discussed. Here is where I will be for certain in March:

March 17: Co-presenting the session, "GAPP vs. Gaps: Managing Enterprise Privacy" at the ISACA NA CACS Conference in Orlando, FL.

March 18 & 19: Providing a 2-day class, "Conducting a Privacy Impact Assessment," at the ISACA NA CACS Conference in Orlando, FL.

A Discount Gift to You!

For a limited time, I am offering several of my information security and privacy tools and products at a 25% discount! See them at www.privacyprofessor.org.