Data Security and Privacy with the Privacy Professor

Latest Episodes:

Privacy & Cybersecurity for Your Life During the Holidays Dec 03, 2022

Show notes

Are you armed with the privacy and security knowledge and awareness necessary to identify all the holiday scams and cybercrooks that emerge and try not only new scams and crimes, but also all the same scams and crimes that have proven to be effective year after year for decades? Are you prepared to help those to whom you give tech gifts so that they use them in the most secure and privacy-protecting way possible? Can you secure those tech gadgets that you receive as gifts to keep the hackers from accessing them and using them to steal your money or commit identity fraud to basically steal your life? You all need to maintain a high-level of awareness and knowledge about privacy and cybersecurity for your life during the holidays. Listen in to hear my conversation with two cybersecurity and privacy experts answer these and many more questions. Cheryl Jackson and Todd Fitzgerald have spent their entire careers dedicated to educating and raising the awareness of security and privacy issues for their co-workers, clients and the general public. Todd and Cheryl also share a huge amount of information about awareness events and education they’ve provided over the years, including those that were huge successes, and a few they were not so successful, and describe why. Please tune in! #Privacy #PrivacyManagement #RiskManagement #CyberSecurity #DataSecurity #Cybercrime #PersonalData #HolidayScams #PersonalData #Awareness #Education

Let’s Stop the Robocall Scammers! Nov 05, 2022

Show notes

Everyone is inundated with robocalls! Many of them are legitimate, such as those providing notifications about environmental threats such as hurricanes and tornadoes. And those giving alerts about missing persons. And there are many others that are legal, but can still be quite annoying, such as from political candidates. There are also increasingly more robocalls that are used to commit scams and a wide range of crimes. Security expert Ben Rothke is fed up with all these robocall scammers! Ben has been researching this longtime, and constantly evolving scam for many years. In fact, he has amassed over 100 recorded scam calls that he provides to the public to raise their awareness for identifying these scammers. During this episode Ben describes many different ways that robocalls are used to commit crimes. Such as for spreading ransomware, gaining access to bank and other types of financial accounts, tricking people into buying high-dollar items, or for compelling the targeted robocall victims to send the crooks money. Listen in to hear Ben discuss these and many more different types of robocall crimes, and the tactics used. Mr. Rothke will also describe the overall problem, the security and privacy risks that they can bring, and what needs to be done to get rid of this scourge. Please tune in! #Privacy #PrivacyManagement #RiskManagement #CyberSecurity #DataSecurity #Cybercrime #PersonalData #RoboCalls #RobocallCrimes #RoboCallScams #PersonalData #Awareness

“Wacky Tobaccy” Laws, Privacy & Security! Oct 01, 2022

Show notes

At this time in our current enlightened period in history, we're actually not enlightened with regard to cannabis benefits, medicinal uses, how to debunk disinformation that has been being spread since the 1930s, and how to protect the privacy of cannabis users, as well as their associated personal data, and the business data of the dispensaries. Have you used cannabis, of any kind in any form? Have any of your family members or friends? For recreation and/or for medicinal purposes? Do you know how or if the associated data you provided to the dispensaries was protected, shared, and used? At least 38 U.S. states, along with Washington, D.C. and 16 US territories, have legalized cannabis of some type, in some way. Want to hear which ones? Do you know which of these laws include requirements for privacy and/or data security? Do you know the current status of federal regulations for cannabis legalization? Including how HIPAA may or may not apply? Do you know what the difference is between cannabis, medical cannabis and marijuana, if any? What about the differences between CBD and THC? Do you know the medical benefits of cannabis? Do you know the ways in which the cannabis dispensaries put your data at risk? And your privacy at risk? Were you aware of the recent data privacy breaches at cannabis dispensaries? Or, about a huge security flaw that allowed 85,000 cannabis dispensary customers’ personal data to be searchable and viewable online, by anyone? Do you realize the harms that could occur to those whose personal data and associated cannabis purchasing history and related details were obtained by others? Or, if even just the financial data of a cannabis store was breached and used by competitors? Hint: They are significant! Popular guest and medical cannabis security and privacy expert Michelle Dumay returns for this fourth in a series of shows about current cannabis laws and regulations, personal data privacy and security risks involved with in-person and online sales, and provides some wise advice for all these issues. Please tune in to hear this enlightening discussion! #Privacy #PrivacyManagement #RiskManagement #CyberSecurity #DataSecurity #MedicalCannabis #Cannabis #Laws #Marijuana #WackyTobaccy #Dispensaries #Breach #PersonalData #HIPAA #CBD #THC

Action is Necessary to Improve Voting & Elections Security! Sep 03, 2022

Show notes

Many claims have been, and still are being, made about elections and voting security, more than ever since the 2020 election. Some claim there was widespread “voting fraud.” While no process or technology, of any kind for any purpose, is 100% secure, the 2020 general elections were determined through audits and assessments by dedicated elections workers, federal and state civil servants, and cybersecurity experts, to have been the most secure in history, based on the combined results of over a thousand audits and risk assessments. However, as misinformation grows, and increasingly more types of voting devices are used, elections officials must ensure security is continually be monitored, updated and improved to address newly discovered vulnerabilities and threats. Here are some facts important to know up front: Voting machine equipment, standards and procedures vary greatly from state to state, and even county to county. And, there is great diversity in the types and ages of the over 100,000 voting machines used throughout the U.S. These facts make it necessary to perform ongoing review and assessment of voting machines and procedures physical security, cyber security, and procedural security. Just a few key issues that must be considered for elections and voting technology security include: • How widely are voting security standards used by the over 100,000 polling locations throughout the U.S.? Who provides oversight of this? • Who are “insiders” within the election and voting ecosystem? And, what types of insider threats exist that need to be addressed? • Is the internet a threat vector to voting systems? Are the voting systems ever connected to the internet? • In what ways are voting procedures throughout the states and territories different? Would committing widespread fraud be possible? • What are actions can elections officials and workers take to better protect voting systems, and the full elections process? • Where can U.S. states and territories obtain help to strengthen the security of the technologies, activities and physical components of the elections systems? Listen in to hear Marci Andino, the Sr Director, Elections Infrastructure Information Sharing & Analysis Center (EI-ISAC) at Center for Internet Security, answer these questions, and more! #Cybersecurity #Privacy #RiskManagement #Education #MarciAndino #CISecurity #Voting #Elections #Democracy #VotingSecurity #ElectionsSecurity

Secure Coding Fixes the Top 25 Most Dangerous Software Weaknesses Aug 06, 2022

Show notes

In the news every day are security incidents and privacy breaches caused by software programming errors, sloppy practices, lack of sufficient testing, and many other engineering-, coding-, and programming-related reasons. This has been progressively getting worse for the past 40, 50 years as technology has been proliferating, along with code, and different programming languages. Case in point: At the root of most Zero Day exploits is unsecure software code, created by programmers and coders who did not create the code to be secure to begin with. For the past several years the US Cybersecurity and Infrastructure Security Agency (CISA), has published their Top 25 Most Dangerous Software Weaknesses list. When looking at this list, it is clear that most, if not all, are a result of poor coding practices. A lack of secure coding! These software weaknesses are getting worse, not better, as time goes on! Listen to this episode to hear expert, pioneer, current practitioner and thought-leader for software security, Dr. Mich Kabay, discuss many of real-life examples of poor coding that have resulted in problems, incidents and breaches, occurring long ago and up through those that are still occurring today. And, hear how code can be made more secure. We will also go through as many of the CISA top 25 dangerous software weaknesses as time allows to point out the coding errors and problems that made the software weak, unsecure, and dangerous. All software engineers, programmers and coders do not need to be cybersecurity experts. However, all of them *DO* need to be experts in secure coding and the applicable security and privacy standards involved in the software development life cycle (SDLC). #SecureCoding #Cybersecurity #Privacy #RiskManagement #Education #MichKabay #ZeroDay #SDLC

IoT Data Creates Frankenstein Profiles Claiming to Be You Jul 02, 2022

Show notes

There are an estimated 20 – 30 billion “smart” internet of things (IoT) devices currently used in the world. Most of them are listening devices, meaning everything heard within the vicinity of the device is sent to cloud systems, analyzed, and actions are taken. This number is projected to increase to 75 – 100 billion by 2025. This data and results of artificial analysis (AI) using the words and conversations of people, and sounds, in the vicinity of the device are sent to numerous, sometimes thousands, of other third parties who then perform their own data AI and take even more actions. In most cases profiles about the individuals are made using the IoT data and AI results that are used for making many assumptions about, then taking activities impacting, the associated individuals. Targeted marketing. Loan rates and approvals. Health determinations. Deciding who is a good or bad parent. Identifying pregnancies. The list is unlimited. Even real-life activities described in science fiction, such as determining those who, in the future, are likely to commit crimes, likely to get a disease, or likely to have some other significant impact. These projections are also sent to numerous entities. Those can include law enforcement, government agencies, home owners associations, political campaigns, marketers (of course!), and many others. Even ransomware gangs and other criminals are using these digital profiles to target their victims. Wait, it gets worse! Around 10% - 25% of AI results are incorrect. And when considering people of color, this number increases, due to continuing problems with bias in AI. That translates to 2 – 7.5 billion current devices sending data about those in the vicinity of the devices, who then are having erroneous profiles made about them. And, possibly actions are being taken that will harm them in some way as a result. Digital personas that are Frankenstein creations resulting from often faulty AI resulting from the use of audio voices of others, and sounds around you! In this episode, Dr. Joseph Turow, author of “The Voice Catchers: How Marketers Listen In to Exploit Your Feelings, Your Privacy, and Your Wallet,” discusses his in-depth and insightful research into this topic. Dr. Turow also provides many examples, and also provides some very good advice. Please join us for a very interesting and informative discussion! #IoT #IoTPrivacy #IoTSecurity #Stalkerware #JosephTurow #TheVoiceCatchers #VoiceAnalysis #Surveillance #AI #PersonalData #MonetizingPeople

Catching KGB Hackers with 75¢ and a 2400 Baud Modem Jun 04, 2022

Show notes

Nation state hackers have been trying to get into the secrets stored on computers for decades. The Russian KGB has been trying, and often succeeding, to hack into computer systems before there was a publicly accessible internet; back when the Arpanet was used primarily to connect university and government computer systems. Do you know who caught the KGB in the act of their hacking activities within these computer systems when no one else, not even the FBI or the military, was interested in finding a hacker that was getting into some of the Arpanet connected computers? Why, an astronomer, of course! Tune in to hear Dr. Clifford Stoll describe in great detail how he caught the KGB hackers, without the use of network security tools (what has been used during the past thirty years didn’t exist back then!), using his brilliance and other tools available to him at the time, such as dial-up phone line modems and reams of paper printouts. Through his perseverance and patience, he was able to catch the hackers. Dr. Stoll wrote the book, The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage, in 1989 which provides his first-person account of his hackers-catching odyssey. A 1990 PBS documentary, “The KGB, the Computer, and Me,” provided additional information. In this episode we cover additional facts about the hack, that include more discussion of the technical and security perspectives, still applicable, and some of the specific work that Dr. Stoll did during his tracking of the wily hackers, that actually seem to have inspired some of the tools commonly used by cybersecurity pros today…that they probably don’t even realize were first established by Clifford Stoll! We also hear Dr. Stoll’s thoughts about cybersecurity, education, technology, the importance of asking questions and curiosity, the polarimetry of Jupiter at large phase angles, Klein bottles, and much, much more. See more about Clifford Stoll at https://www.ted.com/speakers/clifford_stoll. See Dr. Stoll’s paper, “Polarimetry of Jupiter at Large Phase Angles” at https://repository.arizona.edu/bitstream/handle/10150/282394/azu_td_8020326_sip1_m.pdf?sequence=1&isAllowed=y #CliffordStoll #TheCuckoosEgg #KGB #Hacking #NationState #CyberEspionage #HoneyPots #DigitalSpying #RiskManagement #CyberCrime #CyberSecurity

How Stalkers & Assaulters Track & Find Victims with IoT Tech May 07, 2022

Show notes

Assaulters and stalkers are increasingly using technologies to target, surveil, and attack their victims. IoT tech in particular is increasingly being used. • What types of IoT tech are being used to track down and ultimately attack the targeted victims? • What types of popular, tiny, inexpensive IoT devices are increasingly used by assaulters and stalkers for surveilling and then tracking down victims to abuse and assault? • In what ways are a variety of different types of IoT tech devices being used for these nefarious purposes? • How common are these types of attacks where IoT is used to facilitate these crimes? • In what ways do IoT devices provide a sense of false security, that then actually makes weaponizing them to commit crimes easier? • Why don’t more of the victims know that their IoT devices are being used by abusers and stalkers to track them down? • What aren’t there more publicized criminal court cases for these incidents where IoT tech was used to facilitate attacks on the targeted victims? • What can people do to keep from being victims of assaults through the IoT devices they use? Tune in to hear Adam Dodge, founder of Ending Technology-Enabled Abuse (EndTAB), provide answers to these and many more questions, along with valuable insights and advice. See more about Adam Dodge at https://endtab.org/about-hayden #IoT #IoTPrivacy #IoTSecurity #DomesticAbuse #AdamDodge #EndTAB #AirTags #Stalkerware #DigitalLiteracyAgainstDigitalViolence

What Do UNIX, Linux & Dirty Pipe Have in Common? Listen To Hear! Apr 02, 2022

Show notes

A lot of news has been released lately about the Dirty Pipe vulnerability in the Linux OS. How is this related to UNIX? Listen in to hear Rik Farrow, the world’s most experienced and knowledgeable expert on UNIX and Linux, explain! Rik will provide his advice about careers in UNIX and Linux security, and answer a wide range of questions Rebecca has received from listeners about these topics. A few of the questions covered include: • How many versions of UNIX are there? • What makes Linux different than UNIX? • Which has more security capabilities; UNIX, Linux, Windows, Android or iOS? • How many web servers run UNIX? Or Linux? Why? • Basically, what is the Dirty Pipe vulnerability? • What types of devices are impacted by Dirty Pipe? • How to avoid being a victim of the Dirty Pipe exploit? • What about running shell scripts? Can that be done securely? Tune in to hear Rik provide valuable insights to these and many more questions. See more about Rik Farrow at http://rikfarrow.com/about/ #UNIX #Linux #DirtyPipe #Cybersecurity #PersonalData #RiskManagement #Privacy #TechCareers #SecurityCareers

Transportation Cybersecurity & Privacy: Highway to Digital Hell? Mar 05, 2022

Show notes

There have been many reports about over-the-road trucking delays causing problems throughout the full supply chain and delaying deliveries of critical products throughout all industries. However, what about the cybersecurity and privacy risks within the transportation industry? There has been little, if any, thoughtful public discussion of the wide range of surface transportation cybersecurity and privacy risks. Cybersecurity vulnerabilities could cause many more disruptions within this critical part of infrastructures within all countries! And privacy risks within the transit system are many, but usually not recognized. These weaknesses and vulnerabilities could be exploited in ways that cause a vast array of significant harms. Hear the world’s most experienced expert in transportation cybersecurity and privacy, David Elfering, discuss the issues in this episode. We will cover: • The largest cybersecurity risks within over-the-road trucking/transit systems and supporting physical structures • The greatest privacy risks within the transportation industry • The complexity of the systems used within all components of the transportation industry, including the widespread and increasing use of IoT throughout, which also increases risks • The risks that third parties and othats within the supply chain bring to the transportation industry • Some significant cybersecurity and privacy risks and challenges with personnel in the transportation industry, that are not found in most other industries. See more about David Elfering at his LinkedIn page: https://www.linkedin.com/in/aroundomaha/ #Transportation #TransportationRisks #Cybersecurity #PersonalData #RiskManagement #Privacy #TruckingRisks #CriticalInfrastructure

Our TOPPODCAST Picks

Follow Us

Stay Connected

Data Security and Privacy with the Privacy Professor

Related Podcasts

Links

Stay Connected