There are many criminals who see a fairly easy way to make quick money through online crime. And those are who we hear about most often.  However, the world is also full of rebels - individuals intent on going against the grain. Sometimes they do it to bring awareness, other times they do it just because they can. We've seen a lot of this happening in cybersecurity recently. Hackers hacking just because. Others doing so behind the guise of justice. Still others truly attempting to shine a light on a problem.

Even with the best of intentions, however, there are consequences. Take, for instance, the hacker or hackers who exposed the private spaces of consumers who had failed to change the default passwords on home video monitors. Although a website statement said they did it to "give awareness of technical security problems around private life," the hackers ended up acting like hypocrites.

They violated the privacy of those whose intimate spaces they put online in the name of pointing out a security problem; how many of those people whose baby rooms and intimate living quarters they live-streamed then had other bad things happen to them? There were other ways they could have let them know about the security problem. Before acting, even with good intent, everyone needs to consider the potential harm to those involved.
 

When we see someone making an honest, naive mistake with their security, it's most responsible to take concerns to them privately. Sincere education trumps public humiliation any day of the week, and we can't allow it to become okay to sacrifice privacy in the name of security awareness.

We talked about this very topic on my latest visit to the Great Day morning show in April. Have a listen. It was also one of several pointers in my recent talk at Purdue University. Access the recording of that talk here.   

Your location: shared 5,398 times 

A Carnegie Mellon University computer scientist recently studied how much the average mobile app user really knows about the rampant sharing of personal data. The study also looked at the impact this knowledge would have on behavior - in other words, how many people would chose to change app settings on their smartphones after learning how much data that app is collecting?

Twenty-four Android users were shown which apps were accessing their data and how often. One user, for instance, found his location data had been shared 5,398 times by 10 apps within 14 days. Just one of these apps, Groupon, checked in on the user's whereabouts 1,600 times over that 2-week window.

Fifty-eight percent of the study participants took action, specifically changing their app settings, upon learning of this rampant sharing of personal details. The other 40 percent, likely representative of the rest of the world, did nothing. That's probably because apps don't often allow users to pick and choose the data they are willing to share. 

As John Zorabedian wrote on Sophos' Naked Security, "...without the ability to change app permissions on a granular level, users are left with little choice - you can either use the app or not."

The next time you are tempted to download an app, pay careful attention to the permissions screen. Are you willing... really... to share the information they want with potentially hundreds or thousands of others, to use as they want? Is the reward that app promises worth the risk?

What you wear to work

Dress code or not, mini controversies about wardrobe seem to creep up in the workplace. Someone dresses too casual or doesn't cover up enough. Another person wears inappropriate shoes or a T-shirt with an off-color saying. Today, those controversies are extending to wearable devices, such as smart glasses and watches.

As I wrote in a recent blog post, those wearables not only create privacy and security risks through the wide range of video and audio surveillance capabilities many have; but also through their wireless connectivity to networks and other types of smart devices. This creates dangerous pathways to valuable data.

Have you established information security and privacy policies for the use of wearable computing devices within your organization? You may not want to wait much longer to do so. One in every five Americans already owns and uses some type of wearable device.

For more on the challenges businesses are struggling with for their always-connected employees, read my recent Dell blog post, "Look backward to get future-ready for BYOD."

Ransomware, malicious software that blocks computer access until a sum of money is paid, appears here to stay, and in fact, is spreading quickly. Its list of victims is growing. So much so that it recently (and boldly) added police departments to that mounting list. And most of the police departments are paying the crooks the ransom demanded...because they have not had recent backups of the files taken hostage!

So what can you do if a ransomware artist comes a calling? Hope he or she is using CoinVault ransomware. That's because anti-virus maker Kaspersky has released a fix for those victimized by this "horrible piece of malware."

The best way to avoid becoming a victim in the first place is to follow these steps recommended by the FBI:

• Update your antivirus software.
• Enable automated OS and web browser patches.
• Use strong and varied passwords.
• Install a pop-up blocker.
• Only download software, especially free software, from sites you know and trust.
• Don't open attachments or click on links in unsolicited e-mails, even if they come from people in your contact list. Close out the e-mail and go to the organization's website directly.
• Use the same precautions on your mobile phone.
• Conduct regular system back-ups and store the backed-up data offline.

Privacy Professor on the News...

... and on the Road

I have a growing list of presentation and training events confirmed. Here is the public event where I will be next. Stop by and say hello if you'll be in the area.

August 25: I will teach a class on how to perform a privacy impact assessmentand implementing Privacy by Design within organizations at Data Privacy Asia, Singapore

Reader Questions

I was grateful for your tips on securing my home Wi-Fi, but I have a few follow up questions. You recommended using "WPA2 Encryption." How can I tell what I'm currently using?

Great question! Click on the "Properties" of your wireless connection icon; on a Windows machine is typically found in the lower right portion of your screen.  It will show the type of encryption that is in place.

You also said to make sure all wireless access points, like printers, are secured. How can I tell if my printer is secure? When setting it up to my home WiFi, I have to use the network password. 

Typically the password that is requested is for the WiFi router you are using, not the printer itself. You can click on or go to "Devices and Printers" and click on the Properties for your printer. Then go to Security and then set your permissions there to only allow the computers within your house to connect to and use the printer.

I will answer more of this reader's questions in next month's Tips.