State of Cybercrime

When Our Reality Becomes What the Data Says Mar 20, 2017

Show notes

In our "always-on" society, it's important that our conversation on IoT security continues with the question of data ownership.

It's making its way back into the limelight when Amazon, with the defendant’s permission, handed over user data in a trial.

Or what about a new software that captures all the angles from your face to build your security profile? Your face is such an intimate aspect to who you are, should we reduce that intimacy down to a data point?

I discussed these questions with this week’s Inside Out Security Show panel – Cindy Ng, Forrest Temple, Kilian Englert and Mike Buckbee.

Additional articles we discussed:

Leaked data tranche of 8,700 documents purportedly includes tools that turn smart TVs into covert surveillance devices.
Spammers expose their entire operation through bad backups
Inside the TalkTalk 'Indian scam call centre'
A sysadmin told the courts he was authorized to trash his employer’s network
Google accidentally spreads fake news

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Security Courts the Internet of Things Mar 09, 2017

Show notes

As more physical devices connect to the internet, I wondered about the responsibility IoT manufacturers have in building strong security systems within devices they create. There’s nothing like a lapse in security that could potentially halt the growth of a business or bring more cybersecurity awareness to a board.

I discussed these matters with this week’s Inside Out Security Show panel – Cindy Ng, Forrest Temple, Kilian Englert and Mike Buckbee.

First in line to be discussed was the shocking revelation that while car manufacturers enabled users to control their vehicles with an app, they never thought through what happens when it’s sold. What’s the harm? In the words of the car owner, “If I were a criminal, I could’ve stolen the car.”

In another alarming article, a security researcher recently discovered that anyone can connect and control a cuddly CloudPets via Bluetooth, recording private conversations with the built-in microphone. If you’re a parent who finds this IoT toy a cute way to leave messages with your child, your privacy may be at stake.

Additional recent news articles we discussed include:

AWS North Virginia facility outage
Speedy data transfer via the blink of its hard drive LED light indicator

Tool of the week: Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Proper Breach Notification Mar 03, 2017

Show notes

I recently came across an article that gave me pause, “Why Data Breaches Don’t Hurt Stock Prices.” If that’s the case and if a breach doesn’t impact the sale of a company, does security matter?

So I asked the Inside Out Security Panel – Cindy Ng, Forrest Temple, Mike Buckbee and Kilian Englert.

They gently reminded me that there’s more than just the stock price to look at – brand, trust, as well as pending lawsuits.

In addition to these worries, proper breach notification is becoming a bigger responsibility. Is there a good or bad way to notify others about a breach? We discussed a controversial way a vendor disclosed their breach as well as some of the top stories of the week:

Tool of the week: Netflix Stethoscope

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Gambling with User Data Feb 22, 2017

Show notes

The debate between users volunteering their data for better service versus being perceived as a creepy company who covertly gathers user data remains a hot topic for the Inside Out Security panel –Cindy Ng, Kris Keyser, Mike Buckbee, and Kilian Englert.

There were two recent stories that triggered this debate. Recently, a smart television manufacturer agreed to pay a $2.2 million fine to the Federal Trade Commission for “collecting viewing data on 11 million consumer TVs without the consumer’s knowledge or consent.” Is that creepy or perhaps the argument could be made that viewing data only helps with the overall user experience?

Contrast the aforementioned story with one where psychologists and data scientists can measure a user’s voluntary Facebook likes to diagnose a personality type. This is known as psychometrics and measured using a model often referred to as OCEAN: openness (how open you are to new experiences?), conscientiousness (how much of a perfectionist are you?), extroversion (how sociable are you?), agreeableness (how considerate and cooperative you are?), and neuroticism (are you easily upset?). With your personality type identified, marketers believe that it can be used to influence users in a future purchasing decision or voting in a presidential election.

The panelists had vastly different views on acceptable and unacceptable behaviors.

Tool of the week: Git pre-commit hook to search for Amazon AWS API keys.

Other stories covered in this podcast:

Introducing "fabricated" data breaches to Have I been pwned
Engineers hack a casino slot machine
Really, really smart computers that play poker
Microsoft hosts the Windows source in a monstrous 300GB Git repository
76 apps in Apple’s App Store still don’t use best practices to protect user data

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Professor Angela Sasse on the Economics of Security Feb 14, 2017

Show notes

In part two of my interview with Angela Sasse, Professor of Human-Centred Technology, she shared an engagement she had with British Telecom(BT).

The accountants at BT said that users were resetting passwords at a rate that overwhelmed the helpdesk's resources, making the cost untenable. The security team believed that the employees were the problem, meanwhile Sasse and her team thought otherwise. She likened the problem of requiring users to remember their passwords to memory exercises. And with Sasse’s help, they worked together to change the security policy that worked for both the company and the user.

We also covered the complexities of choosing the right form of authentication (i.e. passwords, 2FA or biometrics?), the pros and cons of user training, and the importance of listening to your users.

Transcript

Cindy Ng: Is there an engagement that you're able to talk about publicly of what happens when you're first engaged with an organization, what that process looks like?

Angela Sasse: You know, when we originally published "Users Are Not the Enemy," we didn't say that it was...this first study was down in British Telecom, but they subsequently did out themselves as the organization. And they actually approached me originally, because they knew they had a problem, but the security people hadn't realized. They thought it was...the employees were the problem. They were getting heat from the accountants over the cost of running the password reset desks because their employees couldn't cope with the passwords. There was an awful lot of resets going on.

And those help desks got bigger and bigger, you know, both the internal ones and also the ones they were running for some of the services, you know, for the internet services they were running. And the accountants basically said, "The help desks have reached this size now, and this is untenable." You know, I mean, first of all, they can't grow anymore, and in the long run you've got to look to reducing this. You know, the cost is just untenable.

And so they originally said, "Oh, it's people's fault they can't remember their passwords," and whereas once we did the study, I said to them, "No, you're asking them to do memory exercises, to perform feats of memory that humans just can't do." And so, to me, actually, at this time, so this was in the late '90s, you know, it was clear to me that single sign-on, you know, that they really needed to look to bring a lot of the different systems they had behind a single sign-on. And that took a while. So that business case took, in total, five years to put that through the company and put it into action.

But there was a couple of things that we worked on with them to reduce the load as much as we could without having a single sign-on mechanism. So, for instance, to get the company to standardize the user IDs, because if you've got lots of different passwords, having lots of different user IDs on top of that really doesn't help. And the next thing we did, which is something that only really has happened very recently, is to increase the lifetime of passwords, so to, basically, say, like, changing them every 30 days is ridiculous, right? You're pushing people...you know, the only way they can remember that is by either using the same password everywhere or by having very easy passwords with just numbers at the end, you know, that they keep increasing whenever they have to change it. So we basically worked with them and put...you know, basically changed the policies.

And then they also took a view that for some of the infrequently-used systems, it was okay to write them down, to write passwords down, and then securing what they were writing down. That was the process over a period of time, and I think every time they made a change, they could see it was getting slightly better until the point then when they introduced a single sign-on. And I think a lot of organizations...I also know we worked with a financial services institution at the time where they went though a similar process.

But then, of course, with outsourcing, the ability to put everything behind a single sign-on was going away. So even if you had a single sign-on for your internal systems, with all the outsourced stuff, and, you know, if you have, like, your blue book and your gym is contracted out. You know, some even contract their HR out, and all of those service providers have their own access credentials. Then employees very quickly end up with, you know, maybe half a dozen or up to ten different passwords again. So that problem got back, and I think it's just taken a long time. About 10 years ago, some organizations experimented with having biometric access to our IT systems. And that sort of, it worked for some of them, but others just found that it wasn't robust enough, and you had far too high error rates. But effectively now we've seen a shift to two-factor authentication. That means that the memory part of it isn't so onerous anymore.

So I think it really culminated, for me, in when GCHQ released their password advice last year. They changed the government guidance, and that put into practice a lot of those things. We have observed, and some other research has also observed and basically advised, you know, to say that expiring passwords without good reason is counterproductive, that you really should move to two-factor authentication or another form of, you know, continuous authentication, to reduce the workload on users have to do, and so on.

And I think, actually, that the result of that was that now the CISOs who can understand that, who engage, who listen to their employees or their customers now effectively have the backing to say, "Just because I'm making things easier to use doesn't mean my security is worse. Basically, look at this. You know, the government agency responsible for our security now says that you've got to make security usable if you want it to be effective." And so they now have the backing, and they have something to point to, to make those changes. And it's less of a taking a personal risk and sticking their neck out, if you know what I mean.

Cindy Ng: Have you heard about...I think NIST said that SMS is not a good form of two-factor authentication, because you don't know if their phones are in the actual person's hands?

Angela Sasse: Well, I mean, my view is you can...you know, you've got to really see what risks for those different things are. You know, that is only true if, A, the phone has been taken away from the person and if they have not put any form of access control on it. And that's really changed. The vast majority of phone users do protect access to their phone. They put either a PIN or a fingerprint authentication on it, right? And I think in that case it's perfectly reasonable.

Cindy Ng: And in terms of biometrics, you mentioned that it wasn't working when organizations were attempting to use biometrics as a form to authenticate. What form, their eyeball, their thumbprint?

Angela Sasse: It varies. So, I've seen thumbprint work very well in some organizations and not well in others. Iris recognition is quite widely used in some high-end, because it's a fairly expensive biometric...

Cindy Ng: Or voice?

Angela Sasse: Voice is now making, after years of being a sort of, like, bit of a sleeping beauty, it's now making great strides, you know, in banking, for telephone authentication.

Cindy Ng: How are you able to tie usability and security back to the bottom line?

Angela Sasse: That actually really is research that's happening now. Very occasionally, you find there's a very, very clear, now, business metric that will tell you how well you're doing, you know, so that when, for instance, security has an impact on customers, right? So we know, for instance, that the kind of two-factor authentication that the banks introduced here in the UK upset a lot of customers and that they changed as a result of that. And that basically really pushed the development of phone-based banking, because they thought, you know, they could actually sort of... Because, really, I think by the time they rolled out the two-factor authentication using these various card readers and things like that, it was kind of like it was already felt to be quite clunky and difficult. And they felt that they could actually make it a lot easier to use and more accessible on the phone and also more acceptable to many customers on the phone. I think that's...you know, in the financial sector we've seen those changes happening there.

Cindy Ng: Is there a final message or something that I didn't cover that you think is worth expressing?

Angela Sasse: Well, I think...so one of the things I find quite helpful when I try and get security people to understand what this whole, you know, how do you actually work with the end users. Because at the end of the day, I really believe this, we have to work together, you know? If we don't work together, that's the whole point of the "Users Are Not the Enemy" paper, right? If the good guys don't work together, then you're really making the attackers' job a lot easier. We need to work together, and we want to make it easy for people to do the right thing. We don't wanna get too much into the way of their activities, so we need to then be very clear about what they're expected to do and things that they're expected not to do as a way of making sure the security that we've deployed actually works.

And I think, to deflect, one of the things I always use is the 90-10 rule. So, whilst a lot of security experts, you know, their first thought is, "Oh, can I provide some user training or some user education to make them, you know, able to use the security I've put in place?" I would actually point out, it's user education that's for about 10% of cases. 90% of the cases is change the technology to make it easier to use. And, you know, it's only in 10% of cases, is it that you're changing people's knowledge or changing people's behavior in order to do that. So it's something you do very occasionally. It's not the default position.

And the second things is that I've sometimes seen that you can't change everything at once. Even if you've got a very ambitious program to overhaul security in your organization, basically, you've gotta acknowledge that you can't shut down the company. The core business still has to run. That means you have a limited amount of attention, and people have a limited amount of time to deal with this. So phasing things - you know, when you're changing, you know, you change one or two bad habits first. Once they have bedded in, you then do the next couple of ones and so on. So it's a rolling, ongoing program that you have a longer period of time.

Cindy Ng: Is there a priorities list?

Angela Sasse: There isn't a general blueprint. The organization has to develop that plan themselves based on their risk assessment and risk management plan. So they have to identify the sort of, you know, that they say, "Here is the security mechanisms that we really need to work to mitigate quite a key risk." And clearly those are the behaviors that need to be transformed first.

Cindy Ng: Usually, it's being compliant or the regulators making sure that they're not in trouble with the... That's a huge driving force too.

Angela Sasse: Clearly. I mean, if otherwise you lose your license or you're not able to operate, it is very important to be compliant. But you should, you know...I always think it's very important that organizations make sure that their mechanism is working, as opposed to, you know, I basically can say, "I have a policy. This is what people are supposed to do," and then turn a blind eye to the fact that most of them, most of the time, aren't doing it.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Security Monk vs. Emperor Palpatine Feb 10, 2017

Show notes

This week, we continue our ongoing ransomware discussion with the Inside Out Security Show panel - Cindy Ng, Kilian Englert, Mike Buckbee, and Mike Thompson.

But before we launched into our conversation, as an icebreaker, I asked the panel what their advice would be to this tired sysadmin who deleted the wrong directory on the wrong server?

Buckbee: Do exactly what they did to fix the problem.

Englert: It happens, just have to recover and move on.

Thompson: Always take a snapshot before touching your production server.

Back to Ransomware

I likened this singular, life-changing malware to Emperor Palpatine. Why? The scammers try to be your friend and provide customer support. Meanwhile, they’re clever about extorting money from you.

There were a few interesting ransomware stories that we covered:

An IT pro that tried to fight back by sending the perpetrators a Locky ransomware. We’re not certain if it was a success, but at least he tried
One hijacked a hotel from making new hotel keys
Police storage devices that record video data were infected
The scariest of them all, Google Play hosted a ransomware app that infected a user’s cell phone

Moving away from ransomware, here are some other stories we covered:

Android VPNs don’t really encrypt
Backups of backups – pressing delete doesn’t fully delete your data
US can’t just seize data

Tool of the week: Google’s Site Reliability Engineering

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

An Extra Factor of Authentication Feb 03, 2017

Show notes

Inspired by this tweet, I asked the Inside Out Security Show panel – Cindy Ng, Kilian Englert, Mike Buckbee, and Alan Cizenski - if they could add an extra factor of authentication, what would it be?

Plus, we covered a few hot topics:

The risks of replacing passports and manned desks with biometric scanning and automation
What would it take to set up AD for 28 million users?
Buying technology is not a strategy
A password manager that doesn’t encrypt everything? Does perfect security exist?
What you can learn from reverse engineering 16K apps

Tool for a Sysadmin

PsHosts: Powershell Cmdlet Module for modifying the hosts file on Windows

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Medical Privacy Expert Adam Tanner (Part II) Feb 01, 2017

Show notes

Adam Tanner is the author of "Our Bodies, Our Data", which tells the story of a hidden dark market in drug prescription and other medical data. In recent years hackers have been able to steal health data on a massive scale -- remember Anthem? In this second part of our interview, we explore the implications of hacked medical data. If hackers get into a data brokers' drug databases and combine with previously stolen medical insurance records, will they rule the world? Transcript Inside Out Security: Today, I'd like to welcome Adam Tanner. Adam is a writer-in-residence at Harvard University's Institute for Quantitative Social Science. He's written extensively on data privacy. He's the author of What Stays In Vegas: The World of Personal Data and the End of Privacy As We Know It. His articles on data privacy have appeared in Scientific American, Forbes, Fortune, and Slate. And he has a new book out, titled "Our Bodies, Our Data," which focuses on the hidden market in medical data. Welcome, Adam. Adam Tanner: Well, I'm glad to be with you. IOS: We've also been writing about medical data privacy for our Inside Out Security blog. And we're familiar with how, for example, hospital discharge records can be legally sold to the private sector. But in your new book, and this is a bit of a shock to me, you describe how pharmacies and others sell prescription drug records to data brokers. Can you tell us more about the story you've uncovered? AT: Basically, throughout your journey as a patient into the healthcare system, information about you is sold. It has nothing to do with your direct treatment. It has to do with commercial businesses wanting to gain insight about you and your doctor, largely, for sales and marketing. So, take the first step. You go to your doctor's office. The door is shut. You tell your doctor your intimate medical problems. The information that is entered into the doctor's electronic health system may be sold, commercially, as may the prescription that you pick up at the pharmacy or the blood tests that you take or the urine tests at the testing lab. The insurance company that pays for all of this or subsidizes part of this, may also sell the information. That information about you is anonymized. That means that your information contains your medical condition, your date of birth, your doctor's name, your gender, all or part of your postal zip code, but it doesn't have your name on it. All of that trade is allowed, under U.S. rules. IOS: You mean under HIPAA? AT: That's right. Now this may be surprising to many people who would ask this question, "How can this be legal under current rules?" Well, HIPAA says that if you take out the name and anonymize according to certain standards, it's no longer your data. You will no longer have any say over what happens to it. You don't have to consent to the trade of it. Outsiders can do whatever they want with that. I think a lot of people would be surprised to learn that. Very few patients know about it. Even doctors and pharmacists and others who are in the system don't know that there's this multi-billion-dollar trade. IOS:Right … we've written about the de-identification process, which it seems like it's the right thing to do, in a way, because you're removing all the identifiers, and that includes zip code information, other geo information. It seems that for research purposes that would be okay. Do you agree with that, or not? AT: So, these commercial companies, and some of the names may be well-known to us, companies such as IBM Watson Health, GE, LexisNexis, and the largest of them all may not be well-known to the general public, which is Quintiles and IMS. These companies have dossiers on hundreds of millions of patients worldwide. That means that they have medical information about you that extends over time, different procedures you've had done, different visits, different tests and so on, put together in a file that goes back for years. Now, when you have that much information, even if it only has your date of birth, your doctor's name, your zip code, but not your name, not your Social Security number, not things like that, it's increasingly possible to identify people from that. Let me give you an example. I'm talking to you now from Fairbanks, Alaska, where I'm teaching for a year at the university here. I lived, before that, in Boston, Massachusetts, and before that, in Belgrade, Serbia. I may be the only man of my age who meets that specific profile! So, if you knew those three pieces of information about me and had medical information from those years, I might be identifiable, even in a haystack of millions of different other people. IOS: Yeah …We have written about that as well in the blog. We call these quasi-identifiers. They're not the traditional kind of identifiers, but they're other bits of information, as you pointed out, that can be used to sort of re-identify. Usually it's a small subset, but not always. And that this information would seem also should be protected as well in some way. So, do you think that the laws are keeping up with this? AT: HIPAA was written 20 years ago, and the HIPAA rules say that you can freely trade our patient information if it is anonymized to a certain standard. Now, the technology has gone forward, dramatically, since then. So, the ability to store things very cheaply and the ability to scroll through them is much more sophisticated today than it was when those rules came into effect. For that reason, I think it's a worthwhile time to have a discussion now. Is this the best system? Is this what we want to do? Interestingly, the system of the free trade in our patient information has evolved because commercial companies have decided this is what they'd want to do. There has not been an open public discussion of what is best for society, what is best for patients, what is best for science, and so on. This is just a system that evolved. I'm saying, in writing this book, "Our Bodies, Our Data," that it is maybe worthwhile that we re-examine where we're at right now and say, "Do we want to have better privacy protection? Do we want to have a different system of contributing to science than we do now?" IOS: I guess what also surprised me was that you say that pharmacies, for example, can sell the drug records, as long as it's anonymized. You would think that the drug companies would be against that. It's sort of leaking out their information to their competitors, in some way. In other words, information goes to the data brokers and then gets resold to the drug companies. AT: Well, but you have to understand that everybody in what I call this big-data health bazaar is making money off of it. So, a large pharmacy chain, such as CVS or Walgreen's, they may make tens of millions of dollars in selling copies of these prescriptions to data miners. Drug companies are particularly interested in buying this information because this information is doctor-identified. It says that Dr. Jones in Pittsburgh prescribes drug A almost all the time, rather than drug B. So, the company that makes drug B may send a sales rep to the doctor and say, "Doctor, here's some free samples. Let's go out to lunch. Let me tell you about how great drug B is." So, this is because there exists these doctor profiles on individual doctors across the country, that are used for sales and marketing, for very sophisticated kind of targeting. IOS: So, in an indirect way, the drug companies can learn about the other drug companies' sales patterns, and then say, "Oh, let me go in there and see if I can take that business away." Is that sort of the way it's working? AT: In essence, yes. The origins of this trade date back to the 1950s. In its first form, these data companies, such as IMS Health, what they did was just telling companies what drugs sold in what market. Company A has 87% of the market. Their rival has 13% of the market. When medical information began to become digitized in the 1960s and '70s and evermore since then, there was a new opportunity to trade this data. So, all of a sudden, insurance companies and middle-men connecting up these companies, and electronic health records providers and others, had a product that they could sell easily, without a lot of work, and data miners were eager to buy this and produce new products for mostly the pharmaceutical companies, but there are other buyers as well. IOS: I wanted to get back to another point you mentioned, in that even with anonymized data records of medical records, with all the other information that's out there, you can re-identify or at least limit, perhaps, the pool of people who that data would apply to. What's even more frightening now is that hackers have been stealing health records like crazy over the last couple of years. So, there's a whole dark market of hacked medical data that, I guess, if they got into this IMS database, they would have the keys to the kingdom, in a way. Am I being too paranoid here? AT: Well, no, you correctly point out that there has been a sharp upswing in hacking into medical records. That can happen into a small, individual practice, or it could happen into a large insurance company. And in fact, the largest hacking attack of medical records in the last couple of years has been into Anthem Health, which is the Blue Cross Blue Shield company. Almost 80 million records were hacked in that. So even people that did... I was hacked in that, even though I was not, at the time, a customer of them or had never been a customer of them, but they... One company that I dealt with outsourced to someone else, who outsourced to them. So, all of a sudden, this information can be in circulation. There’s a government website people can look at, and you'll see, every day or two, there are new hackings. Sometimes it involves a few thousand names and an obscure local clinic. Sometimes it'll be a major company, such as a lab test company, and millions of names could be impacted. So, this is something definitely to be concerned about. Yes, you could take these hacked records and match them with anonymized records to try to figure out who people are, but I should point out that there is no recorded instance of hackers getting into these anonymized dossiers by the big data miners. IOS: Right. We hope so! AT: I say recorded or acknowledged instance. IOS: Right. Right. But there's now been sort of an awareness of cyber gangs and cyber terrorism and then the use of, let's say, records for blackmail purposes. I don't want to get too paranoid here, but it seems like there's just a potential for just a lot of bad possibilities. Almost frightening possibilities with all this potential data out there. AT: Well, we have heard recently about rumors of an alleged dossier involving Donald Trump and Russia. IOS: Exactly. AT: And information that... If you think about what kind of information could be most damaging or harmful to someone, it could be financial information. It could be sexual information, or it could be health information. IOS: Yeah, or someone using... or has a prescription to a certain drug of some sort. I'm not suggesting anything, but that... All that information together could have sort of lots of implications, just, you know, political implications, let's say. AT: I mean if you know that someone takes a drug that's commonly used for a mental health problem, that could be information used against someone. It could be used to deny them life insurance. It could be used to deny them a promotion or a job offer. It could be used by rivals in different ways to humiliate people. So, this medical information is quite powerful. One person who has experienced this and spoken publicly about it is the actor, Charlie Sheen. He tested positive for HIV. Others somehow learned of it and blackmailed him. He said he paid millions of dollars to keep that information from going public, before he decided finally that he would stop paying it, and he'd have to tell the world about his medical condition. IOS: Actually I was not aware of the payments he was making. That's just astonishing. So, is there any hope here? Do you see some remedies, through maybe regulations or enforcement of existing laws? Or perhaps we need new laws? AT: As I mentioned, the current rules, HIPAA, allows for the free trade of your data if it's anonymized. Now, I think, given the growth of sophistication in computing, that we should change what the rule is and to define our medical data as any medical information about us, whether or not it's anonymized. So, if a doctor is writing in the electronic health record, you should have a say as to whether or not that information is going to be used elsewhere. A little side point I should mention. There are a lot of good scientists and researchers who want data to see if they can gain insights into disease and new medications. I think people should have the choice whether or not they want to contribute to those efforts. So, you know, there's a lot of good efforts. There's a government effort under way now to gather a million DNA samples from people to make available to science. So, if people want to participate in that, and they think that's good work, they should definitely be encouraged to do so, but I think they should have the say and decide for themselves. And so far, we don't really have that system. So, by redefining what patient data is, to say, "Medical information about a patient, whether or not it's anonymized," I think that would give us the power to do that. IOS: So effectively, you're saying the patient owns the data, is the owner, and then would have to give consent for the data to be used. Is that, about right? AT: I think so. But on the other hand, as I mentioned, I've written this book to encourage this discussion. The problem we have right now is that the trade is so opaque. Companies are extremely reluctant to talk about this commercial trade. So, they do occasionally say that, "Oh, this is great for science and for medicine, and all of these great things will happen." Well, if that is so fantastic, let's have this discussion where everyone will say, "All right. Here's how we use the data. Here's how we share it. Here's how we sell it." Then let people in on it and decide whether they really want that system or not. But it's hard to have that intelligent policy discussion, what's best for the whole country, if industry has decided for itself how to proceed without involving others. IOS: Well, I'm so glad you've written this book. This will, I'm hoping, will promote the discussion that you're talking about. Well, this has been great. I want to thank you for the interview. So, by the way, where can our listeners reach out to you on social media? Do you have a handle on Twitter? Or Facebook? AT: Well, I'm @datacurtain and I have a webpage, which is http://adamtanner.news/ IOS: Wonderful. Thank you very much, Adam. Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrimeMore from Varonis ⬇️ Visit our website: https://www.varonis.comLinkedIn: https://www.linkedin.com/company/varonisX/Twitter: https://twitter.com/varonisInstagram: https://www.instagram.com/varonislife/

Full show notes at the publisher

Parents of Security Jan 27, 2017

Show notes

While I thought we could ride on our recent successes for just a bit longer, attackers are back in full swing, filling my twitter feed with latest jaw dropping security news.

As I waded in worry, I stumbled upon an interesting Benjamin Franklin quote, “Distrust and caution are the parents of security.”
Should distrust and caution be the parents of security? Who or what should the parents of security be?

I brought these questions to the Inside Out Security Show panelist – Cindy Ng, Kilian Englert, Mike Buckbee, and Forrest Temple.
Also, here are some of the stories we covered.

Stop using SMB1
Learn about the latest vulnerabilities
Gmail phishing scam
Hi-res image of your peace sign could lift your fingerprint
IT employee offered to unlock data for $200,000. Maybe it should have just been $2,000?

Sysadmin Tool: Nishang - PowerShell for penetration testing and offensive security.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com