Data Security and Privacy with the Privacy Professor

Latest Episodes:

A Synthetic Data Deep Dive: Privacy Protector, Foe or Other? Feb 05, 2022

Show notes

Synthetic data has increasingly been in the news in recent years. It is being used for many purposes, such as training artificial intelligence (AI) models, and for more thoroughly testing software. It is also being described as a new type of privacy enhancing technology (PET). In what other ways is synthetic data being used? Do data protection regulations and other laws and legal requirements apply to synthetic data? E.g. do the associated individuals need to provide consent for organizations to use synthetic data where pieces of their personal data was incorporated? How do the Data Protection Authorities (DPAs) in Europe view synthetic data? As personal data that must be protected under GDPR? Or not? In the U.S. how about HIPAA? Is synthetic data created using health data, that is defined to be protected health information (PHI), covered by HIPAA? How can synthetic data be a PET when it is created from actual personal data? And what about synthetic identity theft? This is a growing problem. How is synthetic data involved with that? Couldn’t this data be used for such crimes? Is identifiability a risk with synthetic data? Why or why not? What are other types of privacy risks with synthetic data? How is synthetic data use evolving? Listen to this discussion to hear answers to these, and many more questions about synthetic data use, risks, and benefits. The use of synthetic data is increasingly exponentially, so the time to learn more is now! See more about Dr. El Emam at replica-analytics.com. #SyntheticData #PersonalData #RiskManagement #Privacy #ReplicaAnalytics #KhaledElEmam #GDPR #HIPAA

How to Fix the Log4j Problem & Prevent Similar Types of Incidents Jan 08, 2022

Show notes

The Log4j security vulnerability is likely a result of insufficient secure coding and/or testing practices for software that is used in billions of devices worldwide. This vulnerability is now being actively exploited, causing a wide variety of security incidents and privacy breaches. New attacks are announced weekly, and sometimes daily, that are exploiting that vulnerability. How did such a dangerous vulnerability make its way into billions of devices? Hear a preeminent applications development and cybersecurity expert, Dr. Mich Kabay, explain Log4j, how the Log4j vulnerability could have been prevented, and the ways in which similar vulnerabilities can be prevented. We also discuss open source software code security in general, the different types of tests that are used to validate open source software code, and the criticality of doing thorough tests before putting software into production. See more about Dr. Kabay at mekabay.com. #Cybersecurity #RiskManagement #Privacy #SecureCoding #Log4j #OpenSourceCode #SoftwareSecurity #SoftwareTesting #SecurityTesting #MichKabay

Who's Responsible for BPO Contact Center Privacy & Cybersecurity? Dec 04, 2021

Show notes

Rebecca discusses the importance of call/contact center and customer service privacy and cybersecurity practices with privacy law and business process outsourcing (BPO) expert, Jon Bello. Often the contact center, or customer service group, is the only barrier between a caller and the personal information and access to the account of a particular individual. BPO staff are common targets of social-engineering to get into others’ accounts and to locate where others are located. Mr. Bello discusses BPO contact center privacy and cybersecurity risks, and actions BPOs take to mitigate those risks. Many real-life situations and examples are discussed. Jon Bello also discusses the results of a poll he did about whether or not the use of AI to monitor work from home environments was okay. The results were interesting, and somewhat surprising! What types of monitoring occur within call centers? That is also discussed. See more about Mr. Jon Bello in the bio posted on this VoiceAmerica show site. #Cybersecurity #RiskManagement #RiskManagement #Privacy #BPO #CallCenter #OutsourcingSecurity #JonBello

Protecting Aviation Critical Infrastructure from Cyber Attacks Nov 06, 2021

Show notes

The US Transportation Security Administration (TSA) recently announced they are requiring critical US airport operators, passenger aircraft operators, and all-cargo aircraft operators to designate cybersecurity coordinators, and to report cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA). Lower-level transportation organizations are encouraged to follow the rules as well. Why hasn’t this been done before now? Will it be enough to protect the highly complex and diverse system of air travel, and related aircraft and other equipment, within the US? Especially as new tech continues to emerge, and each traveler and aviation industry worker has on average two to ten (and more) mobile and IoT devices with them at all times, a large portion of which are connecting in and out of those many aviation network systems? Will this effort provide a model for more secure air travel in other countries? Don’t miss this compelling and informative episode! Listen to hear and learn many real-life lessons from a cybersecurity and privacy expert, and longtime practitioner who was, and still is, a CISO for multiple organizations and built cyber security programs within the aviation industry. We discuss a wide range of topics, such as: • The state of cybersecurity in the aviation industry, and how only recently cybersecurity management leadership positions were established. • How cybersecurity is significantly underfunded in aviation organizations, and how aviation CISOs can use Cecil’s advice to increase support for cybersecurity efforts and investments. • The cybersecurity weak points throughout airport systems and associated physical ecosystems. • The importance of addressing cybersecurity throughout the entire lifecycle of all aviation projects, from concept consideration through retiring aircraft and equipment. • The ways in which being multi-lingual supports better cybersecurity management, not only for critical infrastructure industries, but in all industries. See more about Mr. Cecil Pineda in the bio posted with this episode description on this VoiceAmerica show site. #Cybersecurity, #RiskManagement, #CriticalInfrastructure #AviationSecurity #RiskManagement #NationalSecurity #CecilTheCISO #CriticalInfrastructureCyberSecurity

Software Development Security Practices Suck! Wise Up Now! Oct 02, 2021

Show notes

Why do so many business leaders insist on using unsecure systems and software development practices? Often to skimp on IT budgets and to race to production. Or leaders with marketing expertise, but no actual tech understanding, make bad decisions to align with their sales tactics and marketing messages. Or, for other reasons. But with demonstrably ongoing damaging consequences. In this episode we speak about the critical need for secure software engineering, development and testing, and the need to follow stringent, secure software development practices to stem the consistently increasing digital hemorrhaging of security incidents and privacy breaches. Listen to this episode to learn the importance of building security into the full software and systems development lifecycle from Dr. Rhonda Farrell. Dr. Farrell is a worldwide recognized cybersecurity expert and instructor, with multiple cybersecurity and privacy certifications, including those in software security development. Learn actions that need to be taken to improve the current inadequate state of systems and software development and maintenance security practices. Also hear the need to engage pre-school through secondary and post-graduation education students about the absolute need to build secure technology, and how to do so. Dr. Farrell will also provide information about the Cyber & STEAM Global Innovation Alliance (CSTGIA) she founded, CSTGIA goals, the resources it provides, and describe how everyone can get involved. See more about Dr. Rhonda Farrell in the bio posted with this episode description on this VoiceAmerica show site. #Cybersecurity, #RiskManagement, #RhondaFarrell #SSDF, #SoftwareSecurity, #SystemsSecurity, #ApplicationsSecurity, #SDLC, #WomenInTech

Demystifying Cyber Insurance: Facts to Get the Right Coverage! Sep 09, 2021

Show notes

Listen to this episode to learn from Judy Selby, a worldwide recognized and award-winning cyber insurance expert, about the considerations to take into account for different types of cyber insurance, and how recent, and growing numbers of, ransomware and cyberattacks and hacks are impacting the cyber insurance coverage packages. Throughout the recent history of ransomware and other types of malware and cybercrime and hacking, organizations have become increasingly dependent upon cyber insurance to cut their losses. But with ransoms becoming so huge, and cyber-attacks becoming so prevalent, are cyber insurers going to change the conditions for which they will provide cyber insurance? Can cyber insurance requirements actually change, even possibly improve, cybersecurity practices within organizations who get cyber insurance? And what else does cyber insurance cover besides ransomware and other types of malware? What are the different types of cyber insurance that businesses do have available to them? What are complicating factors in establishing actuarial tables, and then coverage packages and premium rates, for cyber insurance? Do new laws impact cyber insurance coverage and rates? Will premiums be impacted by the policy holders if they use cybersecurity tools that have been compromised, such as SolarWinds? Listen to this episode to hear Judy Selby, Partner in the New York office of the Kennedys global law firm, answer these questions, and many more! Also, hear how you can get a free copy of her best-selling book, Demystifying Cyber Insurance: 5 Steps to the Right Coverage. #Cybersecurity, #RiskManagement, #JudySelby, #CyberInsurance, #CyberLiability, #CyberLiabilityInsurance

The BOM Episode! DBOMs! SBOMs! And...Supply Chain Cybersecurity! Aug 07, 2021

Show notes

Before the Solarwinds hack made global news daily for many weeks starting in December, 2020, most of the public had never heard the term “supply chain,” let alone know about the inherent data and cyber security risks they bring to organizations. You know it is a significant issue when the President of the United States issues an Executive Order (on Feb. 24, 2021) to significantly strengthen supply chain security in all industries. The risks have always been there, but the number, types and methods capable of exploiting the risks have increased exponentially in recent years as new technologies, and tech companies, have proliferated throughout the world. The Solarwinds incident spotlighted to everyone paying attention to cybersecurity how protecting supply chains needs to be a top cybersecurity and privacy priority for every business using purchased technologies and/or contracting third parties to do work for them. Bills of Materials (BOMs) are tools that have been around since at least the 1960s to support business. They can also be used to support securing the supply chain. Do you know how? Do you know what BOMs are? In this episode we chat with cybersecurity expert Chris Blask, VP of Strategy at Cybeats, and the inventor of the Digital Bill of Materials (DBOM), for the details! What are SBOMs? What is the relationship between an SBOM and a DBOM? What are the cybersecurity benefits of SBOMs and DBOMs? What are other business benefits? Do SBOMs and DBOMs change the functionality of the associated hardware, software, firmware, system? What portion of organizations use SBOMs and DBOMs? How long have SBOMs and DBOMs been in use? Hear the answers to these questions, and much more, in this episode! #Cybersecurity, #Privacy, #ChrisBlask #Cybeats #SupplyChainSecurity #RiskManagement #SupplyChain #SupplyChainManagement

4th Amendment Does Not Give LE the Right to Access Encrypted Data Jul 03, 2021

Show notes

The recent take-down of 300 criminal syndicates in more than 100 countries by the DoJ, selling their own 12,000 encrypted devices and services to which they had the decryption keys, has resurrected the question of encryption and lawmakers’ claims that backdoors into encryption are necessary. Lawmakers, and even some data security personalities, point to this event saying it proves encryption should have backdoors. There are also claims that the fourth amendment supports this view. But wait! Doesn’t it prove otherwise? And, doesn’t the long history of failures for creating encryption backdoors prove that encryption solutions with backdoors built in put everyone at risk? Why can’t encryption be engineered to let in only the good guys and those meant to encrypt and decrypt the data, and not allow others access? Listen in as cybersecurity and encryption pioneer and multi-award-winning security and cryptography expert, owning many patents on cryptographic and network protocols, Dr. Steven Bellovin, answers these questions and many more in this highly informative discussion with Rebecca. You will hear insights and facts about encryption that have not been discussed anywhere else!

Data Pipelines & Data Lakes Security & Compliance Answers & Info Jun 05, 2021

Show notes

What are “high-speed streaming analytics data pipelines”? What is the function of a data pipeline? Are there more security risks associated with data pipelines, or less, compared to VPN transmissions, and network transmission technologies that have been used for decades? What are “data lakes”? How are they different from data warehouses? Is it possible to meet data protection compliance requirements using data pipelines and data lakes? What are the security risks with using data lakes? What is a MiNiFi? Listen in as Gal Shpantzer, cybersecurity expert and the architect of the largest supported MiNiFi deployment in the world, answers these questions and many more in an informative discussion with Rebecca. You will hear security and privacy insights, and learn important facts about data lakes and data pipelines, that have not been discussed anywhere else! Follow Gal on Twitter: @Shpantzer #Cybersecurity #Privacy #DataPipelines #DataLakes #MiNiFi #RiskManagement

Defending Against Nation-State Hacking & Cyber Warfare Attacks May 01, 2021

Show notes

There have been many news reports in the past several months about nation-state espionage, and in particular nation-state cyberthreats and cybersecurity warfare attacks. So, what exactly are nation-state cyberthreats? What countries are the sources of the cyberthreats? What countries are launching cyberattacks? Russia? China? The USA? Others? Who should be defending against these cyberthreats? Government? Corporations? Individual citizens? In what ways have US citizens committed cyberattacks against their own country on behalf of other nation-states? Why is profiling based on an individual’s nationality and heritage a very bad idea for defending against nation-state cyberattacks? And in what ways does it actually do much more harm than good, and does not protect against the actual nation-state cyberwarfare practices? Listen in as Christopher Burgess, a 30+-year CIA security expert, nation-state cyberthreats and cyberwarfare expert, writer, speaker and commentator on security issues, answers these questions and many more in an informative discussion with Rebecca. Follow Christopher on Twitter: @burgessct #Cybersecurity, #Privacy, #NationalSecurity, #NationStateThreats #CyberWarFare #NationalSecurity #CyberWarfareAttacks

Our TOPPODCAST Picks

Follow Us

Stay Connected

Data Security and Privacy with the Privacy Professor

Related Podcasts

Links

Stay Connected