Guard the Backdoor 

In a recent blog post for ISACA, I explored the dangers of backdoors, such as hardcoded passwords, built into various security technologies.

It's a sure thing. This incredibly dangerous practice will almost surely result in significant system outages and program mistakes. History demonstrates so-called "secret" technology has put associated systems at risk, leading to breaches and other costly security incidents.

Consider a real-life example. In 2013, security company Barracuda had an undocumented backdoor in its security tool. When publicized, it became extremely unsafe and Barracuda's customers said they didn't want it. There is no such thing as a "secret" backdoor if even one human knows about it.

Humans are the weakest link. Even trusted insiders present the greatest threat to systems and information. Regardless of whether you thought he was right or wrong in his actions, Edward Snowden has become the poster child for the high risks and consequences of trusted insiders that break their promises to keep the secrets.

Innovation becomes the victim. When weak security caused by things like backdoors is exposed, it harms the nation economically. With every passing privacy breach, consumers and businesses - both domestic and international - lose trust. Forrester Research estimates recent allegations about U.S. data surveillance activities may have reduced U.S. technology sales overseas by as much as $180 billion.

Making Your Life Easier... even after yours is over

What will happen to your email account, your online photo storage or your social media accounts after you're no longer around to manage them? Making plans now can make those decisions much simpler for the ones you leave behind. Here are a few things to consider:

• Every day, 8,000 Facebook users die around the world.
• It is difficult to gain access to the social accounts of deceased family and friends.
• Some U.S. states are pushing companies like Google to make family access easier.
• There are services that will allow individuals to schedule social posts that can run even after they die (things like birthday or anniversary well-wishes are popular).
• My friend Christopher Burgess's company Red Folder says today's estate planners are receiving more requests for help with planning the inheritance of digital assets. 
• Christopher is graciously offering a 20% coupon to my Privacy Professor Tips readers. Enter the following discount code when you make an order at https://my.redfolder.co: RF-0996nXba6336 

Smart Grid Privacy Becomes a Hot Topic

By 2015, there will be 1 trillion connected devices and objects generating 2.5 GB per day of data... Big Data! Many people do not consider that the energy consumed in their homes is already a part of the Big Data phenomenon.

So what's the big deal, you might ask. The report created by the privacy group I've led for the NIST Smart Grid Interoperability Panel, NISTIR 7628 Volume 2 Revision 1, starting on logical page 291, addresses that common question thoroughly. 

As discussed in in NISTIR 7628 Vol 2, all sorts of inferences about people's private lives are possible when energy data is analyzed. Everything from the number of family members to the types of appliances in a house can be determined with the right set of information. Of course, how granular someone could get to determine activities or behaviors depends largely on how frequently meter reads occur and a wide range of other factors.

To generate more awareness of the associated privacy risks and to provide guidance to smart-grid device developers, utilities and those creating laws and standards for the smart grid, I've written "Data Privacy for the Smart Grid." In simple, everyday language, the book explores a variety of very real concerns with smart grid privacy.

Privacy Threat Round Up

These threats may not be new, they continue to find new victims every day.

• A vulnerability in Apple computers has been identified by US-based security researcher Trammell Hudson.
   
• Scammers are misusing sites like Care.com and Sittercity.com to locate counterfeit check scheme victims.
   
• A new phishing scam uses professionally written text free of the grammatical and orthographic abuse that gives away many phishing emails. (Thank you to my my friend Dr. Faith Heikkila for this pointer!) 
   
• Ransomware hackers hold your computer hostage, locking you out of your own laptop/desktop, until you pay what you demand. Find out more about ransomware in my blog posts You Need to Know about Ransomware and How to Protect Against Virulent Ransomware.

Privacy Professor on the Road

I have a growing list of events confirmed. Here is where I will be for certain in the coming months:

Feb 16: Teaching a half-day class, "Mitigating Risks and Privacy Concerns with Geo-Data/Privacy and Risks of IT Systems" at the Alaska Surveying and Mapping Conference in Anchorage, AK.

March 4: Facilitating a round table privacy discussion "Data Privacy - Evolving Customer/Regulator Expectations" at the Utility Analytics Summit in Phoenix, AZ.

March 17: Co-presenting the session, "GAPP vs. Gaps: Managing Enterprise Privacy" at the ISACA NA CACS Conference in Orlando, FL.

March 18 & 19: Providing a 2-day class, "Conducting a Privacy Impact Assessment," at the ISACA NA CACS Conference in Orlando, FL.

April 14: Providing a closed privacy discussion/class to the executives and board members of a large multi-national corporation in Tennessee.
 

A Discount Gift to You!

For a limited time, I am offering several of my information security and privacy tools and products at a 25% discount! See them at www.privacyprofessor.org.