State of Cybercrime

Medical Privacy Expert Adam Tanner (Part I) Jan 25, 2017

Show notes

Adam Tanner is the author of "Our Bodies, Our Data", which tells the story of a hidden dark market in drug prescription and other medical data. Adam explains how the sale of "anonymized" data is a multi-billion dollar business not covered by HIPPA rules. In this first part of our interview, we learn from Adam how the medical data brokers got started and why it's legal. Transcript Inside Out Security: Today, I'd like to welcome Adam Tanner. Adam is a writer-in-residence at Harvard University's Institute for Quantitative Social Science. He's written extensively on data privacy. He's the author of What Stays In Vegas: The World of Personal Data and the End of Privacy As We Know It. His articles on data privacy have appeared in Scientific American, Forbes, Fortune, and Slate. And he has a new book out, titled "Our Bodies, Our Data," which focuses on the hidden market in medical data. Welcome, Adam. Adam Tanner: Well, I'm glad to be with you. IOS: We've also been writing about medical data privacy for our Inside Out Security blog. And we're familiar with how, for example, hospital discharge records can be legally sold to the private sector. But in your new book, and this is a bit of a shock to me, you describe how pharmacies and others sell prescription drug records to data brokers. Can you tell us more about the story you've uncovered? AT: Basically, throughout your journey as a patient into the healthcare system, information about you is sold. It has nothing to do with your direct treatment. It has to do with commercial businesses wanting to gain insight about you and your doctor, largely, for sales and marketing. So, take the first step. You go to your doctor's office. The door is shut. You tell your doctor your intimate medical problems. The information that is entered into the doctor's electronic health system may be sold, commercially, as may the prescription that you pick up at the pharmacy or the blood tests that you take or the urine tests at the testing lab. The insurance company that pays for all of this or subsidizes part of this, may also sell the information. That information about you is anonymized. That means that your information contains your medical condition, your date of birth, your doctor's name, your gender, all or part of your postal zip code, but it doesn't have your name on it. All of that trade is allowed, under U.S. rules. IOS: You mean under HIPAA? AT: That's right. Now this may be surprising to many people who would ask this question, "How can this be legal under current rules?" Well, HIPAA says that if you take out the name and anonymize according to certain standards, it's no longer your data. You will no longer have any say over what happens to it. You don't have to consent to the trade of it. Outsiders can do whatever they want with that. I think a lot of people would be surprised to learn that. Very few patients know about it. Even doctors and pharmacists and others who are in the system don't know that there's this multi-billion-dollar trade. IOS:Right … we've written about the de-identification process, which it seems like it's the right thing to do, in a way, because you're removing all the identifiers, and that includes zip code information, other geo information. It seems that for research purposes that would be okay. Do you agree with that, or not? AT: So, these commercial companies, and some of the names may be well-known to us, companies such as IBM Watson Health, GE, LexisNexis, and the largest of them all may not be well-known to the general public, which is Quintiles and IMS. These companies have dossiers on hundreds of millions of patients worldwide. That means that they have medical information about you that extends over time, different procedures you've had done, different visits, different tests and so on, put together in a file that goes back for years. Now, when you have that much information, even if it only has your date of birth, your doctor's name, your zip code, but not your name, not your Social Security number, not things like that, it's increasingly possible to identify people from that. Let me give you an example. I'm talking to you now from Fairbanks, Alaska, where I'm teaching for a year at the university here. I lived, before that, in Boston, Massachusetts, and before that, in Belgrade, Serbia. I may be the only man of my age who meets that specific profile! So, if you knew those three pieces of information about me and had medical information from those years, I might be identifiable, even in a haystack of millions of different other people. IOS: Yeah …We have written about that as well in the blog. We call these quasi-identifiers. They're not the traditional kind of identifiers, but they're other bits of information, as you pointed out, that can be used to sort of re-identify. Usually it's a small subset, but not always. And that this information would seem also should be protected as well in some way. So, do you think that the laws are keeping up with this? AT: HIPAA was written 20 years ago, and the HIPAA rules say that you can freely trade our patient information if it is anonymized to a certain standard. Now, the technology has gone forward, dramatically, since then. So, the ability to store things very cheaply and the ability to scroll through them is much more sophisticated today than it was when those rules came into effect. For that reason, I think it's a worthwhile time to have a discussion now. Is this the best system? Is this what we want to do? Interestingly, the system of the free trade in our patient information has evolved because commercial companies have decided this is what they'd want to do. There has not been an open public discussion of what is best for society, what is best for patients, what is best for science, and so on. This is just a system that evolved. I'm saying, in writing this book, "Our Bodies, Our Data," that it is maybe worthwhile that we re-examine where we're at right now and say, "Do we want to have better privacy protection? Do we want to have a different system of contributing to science than we do now?" IOS: I guess what also surprised me was that you say that pharmacies, for example, can sell the drug records, as long as it's anonymized. You would think that the drug companies would be against that. It's sort of leaking out their information to their competitors, in some way. In other words, information goes to the data brokers and then gets resold to the drug companies. AT: Well, but you have to understand that everybody in what I call this big-data health bazaar is making money off of it. So, a large pharmacy chain, such as CVS or Walgreen's, they may make tens of millions of dollars in selling copies of these prescriptions to data miners. Drug companies are particularly interested in buying this information because this information is doctor-identified. It says that Dr. Jones in Pittsburgh prescribes drug A almost all the time, rather than drug B. So, the company that makes drug B may send a sales rep to the doctor and say, "Doctor, here's some free samples. Let's go out to lunch. Let me tell you about how great drug B is." So, this is because there exists these doctor profiles on individual doctors across the country, that are used for sales and marketing, for very sophisticated kind of targeting. IOS: So, in an indirect way, the drug companies can learn about the other drug companies' sales patterns, and then say, "Oh, let me go in there and see if I can take that business away." Is that sort of the way it's working? AT: In essence, yes. The origins of this trade date back to the 1950s. In its first form, these data companies, such as IMS Health, what they did was just telling companies what drugs sold in what market. Company A has 87% of the market. Their rival has 13% of the market. When medical information began to become digitized in the 1960s and '70s and evermore since then, there was a new opportunity to trade this data. So, all of a sudden, insurance companies and middle-men connecting up these companies, and electronic health records providers and others, had a product that they could sell easily, without a lot of work, and data miners were eager to buy this and produce new products for mostly the pharmaceutical companies, but there are other buyers as well. IOS: I wanted to get back to another point you mentioned, in that even with anonymized data records of medical records, with all the other information that's out there, you can re-identify or at least limit, perhaps, the pool of people who that data would apply to. What's even more frightening now is that hackers have been stealing health records like crazy over the last couple of years. So, there's a whole dark market of hacked medical data that, I guess, if they got into this IMS database, they would have the keys to the kingdom, in a way. Am I being too paranoid here? AT: Well, no, you correctly point out that there has been a sharp upswing in hacking into medical records. That can happen into a small, individual practice, or it could happen into a large insurance company. And in fact, the largest hacking attack of medical records in the last couple of years has been into Anthem Health, which is the Blue Cross Blue Shield company. Almost 80 million records were hacked in that. So even people that did... I was hacked in that, even though I was not, at the time, a customer of them or had never been a customer of them, but they... One company that I dealt with outsourced to someone else, who outsourced to them. So, all of a sudden, this information can be in circulation. There’s a government website people can look at, and you'll see, every day or two, there are new hackings. Sometimes it involves a few thousand names and an obscure local clinic. Sometimes it'll be a major company, such as a lab test company, and millions of names could be impacted. So, this is something definitely to be concerned about. Yes, you could take these hacked records and match them with anonymized records to try to figure out who people are, but I should point out that there is no recorded instance of hackers getting into these anonymized dossiers by the big data miners. IOS: Right. We hope so! AT: I say recorded or acknowledged instance. IOS: Right. Right. But there's now been sort of an awareness of cyber gangs and cyber terrorism and then the use of, let's say, records for blackmail purposes. I don't want to get too paranoid here, but it seems like there's just a potential for just a lot of bad possibilities. Almost frightening possibilities with all this potential data out there. AT: Well, we have heard recently about rumors of an alleged dossier involving Donald Trump and Russia. IOS: Exactly. AT: And information that... If you think about what kind of information could be most damaging or harmful to someone, it could be financial information. It could be sexual information, or it could be health information. IOS: Yeah, or someone using... or has a prescription to a certain drug of some sort. I'm not suggesting anything, but that... All that information together could have sort of lots of implications, just, you know, political implications, let's say. AT: I mean if you know that someone takes a drug that's commonly used for a mental health problem, that could be information used against someone. It could be used to deny them life insurance. It could be used to deny them a promotion or a job offer. It could be used by rivals in different ways to humiliate people. So, this medical information is quite powerful. One person who has experienced this and spoken publicly about it is the actor, Charlie Sheen. He tested positive for HIV. Others somehow learned of it and blackmailed him. He said he paid millions of dollars to keep that information from going public, before he decided finally that he would stop paying it, and he'd have to tell the world about his medical condition. IOS: Actually I was not aware of the payments he was making. That's just astonishing. So, is there any hope here? Do you see some remedies, through maybe regulations or enforcement of existing laws? Or perhaps we need new laws? AT: As I mentioned, the current rules, HIPAA, allows for the free trade of your data if it's anonymized. Now, I think, given the growth of sophistication in computing, that we should change what the rule is and to define our medical data as any medical information about us, whether or not it's anonymized. So, if a doctor is writing in the electronic health record, you should have a say as to whether or not that information is going to be used elsewhere. A little side point I should mention. There are a lot of good scientists and researchers who want data to see if they can gain insights into disease and new medications. I think people should have the choice whether or not they want to contribute to those efforts. So, you know, there's a lot of good efforts. There's a government effort under way now to gather a million DNA samples from people to make available to science. So, if people want to participate in that, and they think that's good work, they should definitely be encouraged to do so, but I think they should have the say and decide for themselves. And so far, we don't really have that system. So, by redefining what patient data is, to say, "Medical information about a patient, whether or not it's anonymized," I think that would give us the power to do that. IOS: So effectively, you're saying the patient owns the data, is the owner, and then would have to give consent for the data to be used. Is that, about right? AT: I think so. But on the other hand, as I mentioned, I've written this book to encourage this discussion. The problem we have right now is that the trade is so opaque. Companies are extremely reluctant to talk about this commercial trade. So, they do occasionally say that, "Oh, this is great for science and for medicine, and all of these great things will happen." Well, if that is so fantastic, let's have this discussion where everyone will say, "All right. Here's how we use the data. Here's how we share it. Here's how we sell it." Then let people in on it and decide whether they really want that system or not. But it's hard to have that intelligent policy discussion, what's best for the whole country, if industry has decided for itself how to proceed without involving others. IOS: Well, I'm so glad you've written this book. This will, I'm hoping, will promote the discussion that you're talking about. Well, this has been great. I want to thank you for the interview. So, by the way, where can our listeners reach out to you on social media? Do you have a handle on Twitter? Or Facebook? AT: Well, I'm @datacurtain and I have a webpage, which is http://adamtanner.news/ IOS: Wonderful. Thank you very much, Adam. Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrimeMore from Varonis ⬇️ Visit our website: https://www.varonis.comLinkedIn: https://www.linkedin.com/company/varonisX/Twitter: https://twitter.com/varonisInstagram: https://www.instagram.com/varonislife/

More Ann Cavoukian: GDPR and Access Control Jan 18, 2017

Show notes

We continue our discussion with Dr. Ann Cavoukian. She is currently Executive Director of Ryerson University’s Privacy and Big Data Institute and is best known for her leadership in the development of Privacy by Design (PbD).

In this segment, Cavoukian tells us that once you’ve involved your customers in the decision making process, “You won’t believe the buy-in you will get under those conditions because then you’ve established trust and that you’re serious about their privacy.”

We also made time to cover General Data Protection Regulation (GDPR) as well as three things organizations can do to demonstrate that they are serious about privacy.

Learn more about Dr. Cavoukian:

Follow her on Twitter: @AnnCavoukian
Read her book: Who Knows: Safeguarding Your Privacy in a Networked World

Transcript

Cindy Ng: Dr. Cavoukian, besides data minimalization, de-identification, user access control, what are some other concrete steps that businesses can take to benefit from protecting privacy?

Dr. Cavoukian: I think one of the things businesses don't do very well is involve their customers in the decisions that they make, and I'll give you an example. Years ago I read something called "Permission Based Marketing" by Seth Godin, and he's amazing. And I read it, and I thought, "Oh this guy must have a privacy background," because it was all about enlisting the support of your customers, gaining their permission and getting them to, as Godin said, "Put their hand up and say 'count me in.'" So I called him, he was based in California at the time, and I said, "Oh Mr. Godin, you must have a privacy background?" And he said something like, "No, lady, I'm a marketer through and through, but I can see the writing on the wall. We've gotta engage customers, get them involved, get them to wanna participate in the things we're doing."

So, I always tell businesses that are serious about privacy, "First of all, don't be quiet about it. Shout it from the rooftops, the lengths you're going to, to protect your customer's privacy. How much you respect it, how user-centric your programs are, and you're focused on their needs in delivering." And, then, once they understand this is the background you're bringing, and you have great respect for privacy, in that context you say, "We would like you to consider giving us permission to allow it for these additional secondary uses. Here's how we think it might benefit you, but we won't do it without your positive consent." You wouldn't believe the buy-in you will get under those conditions because then you have established a trusted business relationship. They can see that you're serious about privacy, and then they say, "Well by all means, if this will help me, in some way, use my information for this additional purpose." You've gotta engage the customers in an active dialog.

Cindy Ng: So ask, and you might receive.

Dr. Cavoukian: Definitely, and you will most likely receive.

Cindy Ng: In sales processes they're implementing that as well, "Is it okay if I continue to call you, or when can I call you next?" So they're constantly feeling they're engaged and part of the process, and it's so effective.

Dr. Cavoukian: And I love that. Myself, as a customer... I belong to this air miles program, and I love it, because they don't do anything without my positive consent. And, yet, I benefit because they send me targeted ads and things I'm interested in. And I'm happy to do that, and then I get more points and then it just continues to be a win-win.

Cindy Ng: Did you write anything about user access controls? What are your thoughts on that?

Dr. Cavoukian: We wrote about it in the context of that you've gotta have restricted access to those who have... I was gonna say, "Right to know." Meaning there are some business purpose for which they're accessing the data. And that can be...when I say, "business purpose," I mean that broadly, in a hospital. People who are taking care of a patient, in whatever context, it can be in the lab. They go there for testing. Then they go for an MRI, and then they go... So there could be a number of different arms that have legitimate access to the data, because they've gotta process it in a variety of different ways. That's all legitimate, but those people who aren't taking care of the patient, in some broad manner, should have absolutely complete restricted access to the data. Because that's when the snooping and the rogue employee...

Cindy Ng: Curiosity.

Dr. Cavoukian: ...picture, the curiosity, takes you away, and it completely distorts the entire process in terms of the legitimacy of those people who should have access to it, especially in a hospital context, or patient context. You wanna enable easy access for those who have a right to know because they're treating patients. And then the walls should go up for those who are not treating in any manner. It'd be difficult to do, but it is imminently doable, and you have to do it because that's what patients expect. Patients have no idea that someone might be just, out of curiosity, looking at their file. You've had a breast removed, you had... I mean horrible things happen.

Cindy Ng: Tell us about GDPR, and it's implications on Privacy by Design.

Dr. Cavoukian: For the first time, right now the EU has the General Data Protection Regulation, which passed for the first time, ever. It has the words, the actual words, "Privacy by Design" and "Privacy as the default" in the stature.

Cindy Ng: That's great.

Dr. Cavoukian: It's a first, it's really huge, but what that means, it will strengthen those laws far higher than the U.S. laws. We talked about privacy as the default. It's the model of positive consent. It's not just looking for the opt out box. It's gonna really raise the bar, and that might present some problems in dealing with laws in the states.

Cindy Ng: Then there's also their right to be forgotten, and we live in such a globalized world, people both doing business in the states and in Europe, it's been complicated.

Dr. Cavoukian: It does get very complicated. What I tell people everywhere that I go to speak is that if you follow the principles of Privacy by Design, which in itself raised the bar dramatically from most legislation, you will virtually be assured of complying with your regulations, whatever jurisdiction you're in. Because you're following the highest level of protection. So that's another attractive feature about Privacy by Design is it offers such a high level of protection that you're virtually assured of regulatory compliance, whatever jurisdiction you're in.

And in the U.S., I should say, that the FTC, the Federal Trade Commission, a number of years ago, under Jon Leibowitz, when he was Chair, they made Privacy by Design the first of three best practices that the FTC recommended. And since he's left, and Chairwoman Edith Ramirez is the Chair, she has also followed Privacy by Design and Security by Design, which are absolutely, interchangeably critical, and they are holding this high bar. So, I urge companies always to follow this to the extent that they can, because it will elevate their standing, both with the regulatory bodies, like the FTC, and with commissioners, and jurisdictions, and the EU, and Australia, and South America, South Africa. There's something called GPN, the Global Privacy Network, and a lot of the people who participate in these follow these discussions.

Cindy Ng: What are three things that organizations can do in terms of protecting their consumers' privacy?

Dr. Cavoukian: So, when I go to a company, I speak to the board of directors, their CEO, and their senior executive. And I give them this messaging about, "You've gotta be inclusive. You have to have a holistic approach to protecting privacy in your company, and it's gotta be top down." If you give the messaging to your frontline folks that you care deeply about your customer's privacy, you want them to take it seriously, that message will emanate. And, then what happens from there, the more specific messaging is, what you say to people, is you wanna make sure that customers understand their privacy is highly respected by this company. "We go to great lengths to protect your privacy." You wanna communicate that to them, and then you have to follow up on it. Meaning, "We use your information for the purpose intended that we tell you we're gonna use it for. We collect it for that purpose. We use it for that purpose." And then, "Privacy is the default setting. We won't use it for anything else without your positive consent after that, for secondary uses."

So that's the first thing I would do. Second thing I would do is I would have at least quarterly meetings with staff. You need to reinforce this message. It's gotta be spread across the entire organization. It can't just be the chief privacy officer who's communicating this to a few people. You gotta get everyone to buy into this, because you... I was gonna say the lowest. I don't mean low in terms of category, but the frontline clerk might be low on the totem pole, but they may have the greatest power to breach privacy. So they have to understand, just like the highest senior manager has to understand, how important privacy is and why and how you can protect it. So have these quarterly meetings with your staff. Drive the message home, and it can be as simple as them understanding that this is... You're gonna get what I call, "privacy payoff." By protecting your customer's privacy, it's gonna yield big returns for your company. It will increase customer confidence and enhance customer trust, and that will increase our bottom line.

And the third thing, I know this is gonna a little pompous, but I would invite, and only because this happened to me, I've been invited in to speak to a company, like, once a year. And you invite everybody, from top to bottom. You open it up and... People need to have these ideas reinforced. It has to be made real. "Is this really a problem?" So, you bring in a speaker. I'm using myself as an example because I've done it, but it can be anybody who can speak to what happens when you don't protect your customer's privacy. It really helps for people inside a company, especially those doing a good job, to understand what can happen when you don't do it right and what the consequences are to both the company and to employees. They're huge. You can lose your jobs. The company could go under. You could be facing class action lawsuits.

And I find that it's not all a bad news story. I give the bad news, what's happening out there and what can happen, and then I applaud the behavior of the companies. And what they get is this dual message of, "Oh my God, this is real. This has real consequences when we fail to protect customer's privacy, but look at the gains we have, look at the payoff in doing so." And it makes them feel really good about themselves and the job that they're doing, and it underscores the importance of protecting customer's privacy.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

#realthreats Jan 13, 2017

Show notes

Next month, the world will be talking security at the annual RSA Conference, which will be held in San Francisco on February 13th to the 17th. When it comes to discussing security matters, experts often tell us to take stock of our risks or to complete a risk assessment. However, perhaps before understanding where we might be vulnerable, it might be more important to consider exactly what threats we’re really faced with.

In this episode of the Inside Out Security Show, I asked our panelists – Cindy Ng, Mike Thompson, Kilian Englert, and Mike Buckbee about four #realthreats – disgruntled employees, passwords on sticky notes, hijacked accounts and ransomware.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Dr. Ann Cavoukian on Privacy By Design Jan 06, 2017

Show notes

I recently had the chance to speak with former Ontario Information and Privacy Commissioner Dr. Ann Cavoukian about big data and privacy. Dr. Cavoukian is currently Executive Director of Ryerson University’s Privacy and Big Data Institute and is best known for her leadership in the development of Privacy by Design (PbD). What’s more, she came up with PbD language that made its way into the GDPR, which will go into effect in 2018. First developed in the 1990s, PbD addresses the growing privacy concerns brought upon by big data and IoT devices. Many worry about PbD’s interference with innovation and businesses, but that’s not the case. When working with government agencies and organizations, Dr. Cavoukian’s singular approach is that big data and privacy can operate together seamlessly. At the core, her message is this: you can simultaneously collect data and protect customer privacy. Transcript Cindy NgWith Privacy by Design principles codified in the new General Data Protection Regulation, which will go into effect in 2018, it might help to understand the intent and origins of it. And that's why I called former Ontario Information and Privacy Commissioner, Dr. Ann Cavoukian. She is currently Executive Director of Ryerson University's Privacy and Big Data Institute and is best known for her leadership in the development of Privacy by Design. When working with government agencies and organizations, Dr. Cavoukian's singular approach is that big data and privacy can operate together seamlessly. At the core, her message is this, you can simultaneously collect data and protect customer privacy. Thank you, Dr. Cavoukian for joining us today. I was wondering, as Information and Privacy Commissioner of Ontario, what did you see what was effective when convincing organizations and government agencies to treat people's private data carefully? Dr. CavoukianThe approach I took...I always think that the carrot is better than the stick, and I did have order-making power as Commissioner. So I had the authority to order government organizations, for example, who were in breach of the Privacy Act to do something, to change what they were doing and tell them what to do. But the problem...whenever you have to order someone to do something, they will do it because they are required to by law, but they're not gonna be happy about it, and it is unlikely to change their behavior after that particular change that you've ordered. So, I always led with the carrot in terms of meeting with them, trying to explain why it was in both their best interest, in citizens' best interest, in customers' best interest, when I'm talking to businesses. Why it's very, very important to make it...I always talk about positive sum, not zero sum, make it a win-win proposition. It's gotta be a win for both the organization who's doing the data collection and the data use and the customers or citizens that they're serving. It's gotta be a win for both parties, and when you can present it that way, it gives you a seat at the table every time. And let me explain what I mean by that. Many years ago I was asked to join the board of the European Biometrics Forum, and I was honored, of course, but I was surprised because in Europe they have more privacy commissioners than anywhere else in the world. Hundreds of them, they're brilliant. They're wonderful, and I said, "Why are you coming to me as opposed to one of your own?" And they said, "It's simple." They said, "You don't say 'no' to biometrics. You say 'yes' to biometrics, and 'Here are the privacy protective measures that I insist you put on them.'" They said, "We may not like how much you want us to do, but we can try to accommodate that. But what we can't accommodate is if someone says, 'We don't like your industry.'" You know, basically to say "no" to the entire industry is untenable. So, when you go in with an "and" instead of a "versus," it's not me versus your interests. It's my interests in privacy and your interests in the business or the government, whatever you're doing. So, zero sum paradigms are one interest versus another. You can only have security at the expense of privacy, for example. In my world, that doesn't cut it. Cindy NgDr. Cavoukian, can you tell us a little bit more about Privacy by Design? Dr. CavoukianI really crystallized Privacy by Design really after 9/11, because at 9/11 it became crystal clear that everybody was talking about the vital need for public safety and security, of course. But it was always construed as at the expense of privacy, so if you have to give up your privacy, so be it. Public safety's more important. Well, of course public safety is extremely important, and we did a position piece at that point for our national newspaper, "The Globe and Mail," and the position I took was public safety is paramount with privacy embedded into the process. You have to have both. There's no point in just having public safety without privacy. Privacy forms the basis of our freedoms. You wanna live in free democratic society, you have to be able to have moments of reserve and reflection and intimacy and solitude. You have to be able to do that. Cindy NgData minimalization is important, but what do you think about companies that do collect everything with hopes that they might use it in the future? Dr. CavoukianSee, what they're asking for, they're asking for trouble, because I can bet you dollars to doughnuts that's gonna come back to bite you. Because, especially with data, that you're not clear about what you're gonna do with it, so you got data sitting there. What data does is in identifiable form is attracts hackers. It attracts rogue employees on the inside who will make inappropriate use of the data, sell the data, do something with the data. It just...you're asking for trouble, because keeping data in identifiable form, once the uses have been addressed, just begs trouble. I always tell people, if you wanna keep the data, keep the data, but de-identify it. Strip the personal identifiers, make sure you have the data aggregated, de-identified, encrypted, something that protects it from this kind of rogue activity. And you've been reading lately all about the hackers who are in, I think they were in the IRS for God's sakes, and they're getting in everywhere here in my country. They're getting into so many databases, and it's not only appalling in terms of the data loss, it's embarrassing for the government departments who are supposed to be protecting this data. And it fuels even additional distrust on the part of the public, so I would say to companies, "Do yourself a huge favor. You don't need the data, don't keep it in identifiable form. You can keep it in aggregate form. You can encrypt it. You can do lots of things. Do not keep it in identifiable form where it can be accessed in an unauthorized manner, especially if it's sensitive data." Oh my god, health data...Rogue employees, we have a rash of it here, where...and it's just curiosity, it's ridiculous. The damage is huge, and for patients, and I can tell you, I've been a patient in hospitals many times. The thought that anyone else is accessing my data...it's so personal and so sensitive. So when I speak this way to boards of directors and senior executives, they get it. They don't want the trouble, or I haven't even talked costs. Once these data breaches happen these days, it's not just lawsuits, they're class action lawsuits that are initiated. It's huge, and then the damage to your reputation, the damage to your brand, can be irreparable. Cindy NgRight. Yeah, I remember Meg Whitman said something about how it takes years and years to build your brand and reputation and seconds ruined. Dr. CavoukianYeah, yes. That is so true. There's a great book called "The Reputation Economy" by Michael Fertik. He's the CEO of reputation.com. It's fabulous. You'd love it. It's all about exactly how long it takes to build your reputation, how dear it is and how you should cherish it and go to great lengths to protect it. Cindy NgCan you speak about data ownership? Dr. CavoukianYou may have custody and control over a lot of data, your customer's data, but you don't own that data. And with that custody and control comes an enormous duty of care. You gotta protect that data, restrict your use of the data to what you've identified to the customer, and then if you wanna use it for additional purposes, then you've gotta go back to the customer and get their consent for secondary uses of the data. Now, that rarely happens, I know that. In Privacy by Design, one of the principles talks about privacy as the default setting. The reason you want privacy to be the default setting...what that means is if a company has privacy as the default setting, it means that they can say to their customers, "We can give you privacy assurance from the get-go. We're collecting your information for this purpose," so they identify the purpose of the data collection. "We're only gonna use it for that purpose, and unless you give us specific consent to use it for additional purposes, the default is we won't be able to use it for anything else." It's a model of positive consent, it gives privacy assurance, and it gives enormous, enormous trust and consumer confidence in terms of companies that do this. I would say to companies, "Do this, because it'll give you a competitive advantage over the other guys." As you know, because you sent it to me, the Pew Research Center, their latest study on Americans' attitudes, you can see how high the numbers are, in the 90 percents. People have had it. They want control. This is not a single study. There have been multiple surveys that have come out in the last few months like this. Ninety percent of the public, they don't trust the government or businesses or anyone. They feel they don't have control. They want privacy. They don't have it, so you have, ever since, actually, Edward Snowden, you have the highest level of distrust on the part of the public and the lowest levels of consumer confidence. So, how do we change that? So, when I talk to businesses, I say, "You change that by telling your customers you are giving them privacy. They don't even have to ask for it. You are embedding it as the default setting which means it comes part and parcel of the system." They're getting it. I do what I call my neighbors test. I explain these terms to my neighbors who are very bright people, but they're not in the privacy field. So, when I was explaining this to my neighbor across the street, Pat, she said, "You mean, if privacy's the default, I get privacy for free? I don't have to figure out how to ask for it?" And I said, "Yes." She said, "That's what I want. Sign me up!" See, people want to be given privacy assurance without having to go to the lengths they have to go to now to find the privacy policy, search through the terms of service, find the checkout box. I mean, it's so full of legalese. It's impossible for people to do this. They wanna be given privacy assurance as the default. That's your biggest bet if you're a private-sector company. You will gain such a competitive advantage. You will build the trust of your customers, and you will have enormous loyalty, and you will attract new opportunity. Cindy NgWhat are your Privacy by Design recommendations for wearables and IoT innovators and developers? Dr. CavoukianThe internet of things, wearable devices and new app developers and start up...they are clueless about privacy, and I'm not trying to be disrespectful. They're working hard, say an app developer, they're working hard to build their app. They're focused on the app. That's all they're thinking about, how to deliver what the app's supposed to deliver on. And then you say, "What about privacy?" And they say, "Oh, don't worry about it. We've got it taken care of. You know, the third-party security vendor's gonna do it. We got that covered." They don't have it covered, and what they don't realize is they don't know they don't have it covered. "Give it to the security guys and they're gonna take care of it," and that's the problem. When I speak to app developers...I was at Tim O'Reilly's Web 2.0 last year or the year before, and there's 800 people in the room, I was talking about Privacy by Design, and I said, "Look, do yourself a favor. Build in privacy. Right now you're just starting your app developing, build it in right now at the front end, and then you're gonna be golden. This is the time to do it, and it's easy if you do it up front." I had dozens of people come up to me afterwards because they didn't even know they were supposed to. It had never appeared on their radar. It's not resistance to it. They hadn't thought of it. So our biggest job is educating, especially the young people, the app developers, the brilliant minds. My experience, it's not that they resist the messaging, they haven't been exposed to the messaging. Oh, I should just tell you, we started Privacy by Design certification. We've partnered with Deloitte and I’ll send you the link and we're, Ryerson University, where I am housed, we are offering this certification for Privacy by Design. But my assessment arm, my audit arm, my partner, is Deloitte, and we're partnering together, and we've had a real, real, just a deluge of interest. Cindy NgSo, do you think that's also why people are also hiring Chief Privacy Officers? Dr. CavoukianYes. Cindy NgWhat are some qualities that are required in a Chief Privacy Officer? Is it just a law background? Dr. CavoukianNo, in fact, I'm gonna say the opposite, and this is gonna sound like heresy to most people. I love lawyers. Some of my best friends are lawyers. Don't just restrict your hiring of Chief Privacy Officers to lawyers. The problem with hiring a lawyer is they're understandably going to bring a legal regulatory compliance approach to it, which, of course, you want that covered. I'm not saying...You have to be in compliance with whatever legislation is in your jurisdiction. But if that's all you do, it's not enough. I want you to go farther. When I ask you to do Privacy by Design, it's all about raising the bar. Doing technical measures such as embedding privacy into the design that you're offering into the data architecture, embedding privacy as a default setting. That's not a legalistic term. It's a policy term. It's computer science. It's a... You need a much broader skill set than law alone. So, for example, I'm not a lawyer, and I managed to be Commissioner for three terms. And I certainly valued my legal department, but I didn't rely on it exclusively. I always went farther, and if you're a lawyer, the tendency is just to stick to the law. I want you to do more than that. You have to have an understanding of computer science, technology, encryption, how can you... De-identification protocols are critical, combined with the risk of re-identification framework. When you look at the big data world, the internet of things, they're going to do amazing things with data. Let's make sure it's strongly de-identified an…

Fireside Chat with the Future Dec 23, 2016

Show notes

Over the past few weeks, we started seeing a few new security trends that we think haven’t yet had their defining moment and will likely see more of next year. We reflected on the predictions we made last year and shared our annual cybersecurity predictions for 2017.

Meanwhile the Inside Out Security Show panel – Kilian Englert, Forrest Temple and Mike Buckbee - also speculated on a few things of their own based on a few articles they’ve read the news recently – hackers guessing your credit card information in less than six seconds, the security implications of the Amazon Go Grocery Store, and more malvertising. Plus, we also continued our never ending debate on privacy.

But what the panelists couldn’t get enough of were the allegations that Russia attempted to affect the outcome of the US presidential election. No, we didn’t discuss the politics of what happened, but they did share teachable moments we can all learn from.

To start – we’ve all heard of scams where the IRS or FBI call about identify theft or about our taxes. But what happens when the real FBI is really calling? If there isn’t a process in place for every little detail that happens, then we’re left vulnerable.

“My first step would be to see if it’s really the FBI calling. Because there are so many weird scams around stuff like that,” advises Mike Buckbee.

Kilian Englert supplemented Mike’s advice with this suggestion: “If you look at some of the standards that come out, like the NIST standards. A lot of them recommend having some type of plan in place…some plan, any plan.”

And don’t be deterred because Forrest Temple reminds us, “You don’t see the successes; you only see the failures…That’s how data security is. Maybe there are a million successful for every failure, you just don’t know.”

Click play to hear the rest of the show and why Kilian isn’t a fan of Barcelona Football. There’s a point! We promise!

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Is Security a Benefit or a Feature? Dec 19, 2016

Show notes

I recently came across a tweet that was shared during the Infosecurity Maganzine Conference in Boston, “Security is a benefit, but not always a feature.” Why? You can spend a lot of money and still be hacked or not spend a dime and not be hacked.

How did the Inside Out Security Show panel react? Here's what Mike Buckbee, Kilian Englert and Alan Cizenski had to say:

Buckbee: It’s all tradeoffs. It’s all a bet. If you go into a casino and putting money down…While it’s true you can spend a lot of money and still get hacked, it’s less likely than you spend nothing. Or not even so much spend, in terms of money, but in terms of effort. You spend the effort and time to make secure systems….so you’re trying to play the odds.

Englert: We can write it up as a true-ism…We’ve never been hacked before, so we must be secure. That’s the default security mindset, which is at odds with the truth…The best security in the world, only takes you so far.

Cizenski: When you’re spending money on security tools, at that point, at the very least, you’re gonna have an audit trail or something to look back at so you can say, “How did that happen?” Instead of just thinking, “We’ve never been hacked. We’re good.”…When it does happen, you can’t really do much about it [if you don’t have an audit trail].

Click play to learn more!

Additional comments include:
• A rogue admin who took down a former employer’s network
• Admins who experience burn out
• NIST announced guidance on SMS on two factor.
• Whether or not security problems are the user’s fault or not
• As well as the latest research report on security shortcomings on a heart device.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Password Expert Per Thorsheim on Biometrics and Keystroke Dynamics Dec 12, 2016

Show notes

Based in Norway, Per Thorsheim is an independent security adviser for governments as well as organizations worldwide. He is also the founder of PasswordsCon.org, an annual conference that’s all about passwords, PIN codes, and authentication. Launched in 2010, the conference invites security professionals & academic researchers to better understand and improve security. In part one of our discussion with Per, we examined two well-known forms of authentication – passwords and hardware. In this segment, he talks about a lesser known form -biometrics and the use of keystroke dynamics to identify individuals. Per explains, “Keystroke dynamics, researchers have been looking at this for many, many years. It’s still an evolving piece of science. But it’s being used in real life scenarios with banks. I know at least there’s one online training company in the US that’s already using keystroke dynamics to verify if the correct person is doing the online exam. What they do is measure how you type on a keyboard. And they measure the time between every single keystroke, when you are writing in password or a given sentence. And they also look for how long you keep a button pressed and a few other parameters.” What’s even more surprising is that it is possible to identify one’s gender using keystroke dynamics. Per says, “With 7, 8, 9 keystrokes, they would have a certainty in the area of 70% or more…and the more you type, if you go up to 10, 11, 12, 15 characters, they would have even more data to figure out if you were male or female.” Those who don’t want to be profiled by their typing gait can try Per Thorshim’s and another infosec expert Paul Moore’s Keyboard Privacy extension. Transcript Cindy Ng: Let's talk a bit about biometrics because that's really interesting. Keystroke dynamics and it refers to your typing gait: how often you pause, how fast you type. With just a few characters if you type seven to nine characters, you can build a profile of a person. I'm wondering if you can talk a little bit about if you're able to tell someone's gender, are you also taking into account their location? How can you tell whether or not they're typing with one or two hands, their gender, their age? These are soft metrics, but really important and... Per Thorsheim: Keystrokes dynamics... There have been researchers looking into this for many, many years already. But still, it's a really a modeling piece of science. But it is also being used today in real-life scenarios with banks. I know that there is at least one online training company in the U.S. who is already using keystroke dynamics, to verify if the correct person is actually doing the online exam as an example. What they do is they measure how you type on your keyboard and they measure the time between every single keystroke when you're writing in a password or a given sentence. They also look out for how long you keep each button depressed and a few other parameters. Now, this sounds weird, I know. But I learned from researchers in France, they have been collecting this kind of data from a lot of men and women, and talk about men and women being different in many different areas. But I had never guessed. I would have never believed until they told me that men and women in general type differently on a keyboard, using normal standard 10 finger touch type on a keyboard. They said that as soon as you have entered seven, eight, nine characters onto a keyboard, we can with a pretty good probability tell you if it is a man or a woman typing on the keyboard. That is again assuming typing normally with 10 fingers touch type on a keyboard. Cindy Ng: What is the accuracy rate of the gender identification? Per Thorsheim: The accuracy that they talked about is they would say that with seven, eight, nine keystrokes, they would have a certainty on this in the area of 70% or more. So, of course, it's not that good, but it's improving. And the more you type if you go up to 10, 12, 15 characters, they would have even more data to figure out whether you're a male or female. But that's just figuring out male or female. It doesn't identify you as a unique human being on planet earth. Because in that setting, this technology is nowhere near good enough. There are lots of people that would actually type just like you on a keyboard, in the world. Cindy Ng: What's the probability of you typing in the same way as other people in our population? Per Thorsheim: If you have an iPhone and you're using Touch ID with your iPhone or maybe an iPad today, the fingerprint reader that is being used by Apple today, they usually say that those devices have what we call a false acceptance rate or false rejection rate of 1 in 50,000. Meaning that 1 in 50,000 attempts, where you try to identify to your own phone will fail even if you're using the correct finger. The other way around 1 in 50,000 people, it means that person among 50,001 will have a fingerprint that will be accepted as you. But it's not you getting in. So false acceptance rate, 1 to 50,000. With the keystroke dynamics, the last time I heard was 1 in 100. So they're saying that if you're in a room with 200 people, there will be 1, maybe even 2 people in there that would be able to type on the keyboard almost the same way as you do. Then they would be able to be identified as being Cindy, but it's not. It's them typing on a keyboard. Cindy Ng: What's the potential abuse when we're using keystroke dynamics? Per Thorsheim: The frustration is from the privacy perspective of this. A very simple example that I have been using, which is maybe chauvinistic as well as being male is, say that you go to an online store and you want to purchase a vacuum cleaner and you have never been there before. You don't have an account, nothing. In the search field, you type in vacuum cleaner. Based on that and nothing else, you have already given them so many keystrokes that they can identify whether you are male or female. So if you are male or when they assume you are male based on how you type, they will give you the 3000 watts, black, shiny, Porsche model vacuum cleaner which is big and makes a lot of noise and it can run by itself. If they identify you as being female, maybe they think that you prefer the low noise, nice colored, red colored vacuum cleaner that doesn't take up a lot of space when it's not being used. That's a very simple example. But from a privacy perspective, this can be used for tracking you across multiple route source. They can identify you as a returning customer. They can also use it to check if you are, say, allowing your kids or your husband or your girlfriend to log in to your accounts. They can be able to use that for fraud detection to say that this is the wrong person logging in. That can be a good feature to have. It can also be abused in ways that will affect your privacy or your right to privacy. Cindy Ng: All the different types of authentication: passwords, hardware, biometrics. It all culminates to behavioral profiling, which is a hallmark worry for many. You and another security expert, Paul Moore, created Keyboard Privacy. It's supposed to disrupt your keystroke tracking gait from 82% to 3%. I read this in an article. Can you tell us a little bit more about Keyboard Privacy? Per Thorsheim: We learned about this keystroke dynamics being used with several banks here in Norway, where I live. We learned about this because we received information from people who told us that, "Did you actually know the banks are using keystroke dynamics?" We said, "No." We didn't know that. But we figured out that it is being used. We looked at the source code of web pages where we log in and we saw that they're actually using keystroke dynamics. They are using keystroke dynamics as a sort of fraud prevention. They want to make sure that the correct person is logging into their own account and not somebody else. That's a good purpose. What we reacted to was the fact that they didn't tell us, that they had suddenly started to build these biometric profiles, the keystroke dynamics profile of every single user that are using online banking here in Norway. Also, a couple of banks in the UK as well are doing this. So we had an evening, me and Paul, and we were talking to each other and like privacy counsels, blah blah blah, security usability, blah blah blah. But they just wanna say, just for the fun of it. How can we break this? How can we prevent them from being able to recognize if it is me or Paul or anybody else logging into my accounts? Say, we would like to do that, prevent app tracking to be able to identify us as being male or female. So we looked at the code and we realized, well, they are looking at a very low number of parameters, two, three, four, different parameters. One of them being the amount of time between each key press and another parameter is being, how long will you keep each key depressed on your keyboard? The plug-in that Paul created based on my idea was that the plug-in for Google Chrome will take all your keystrokes from your keyboard. And before they enter any form on that page you're visiting, we will put in a random time delay between each keystroke, and that random time delay will be anything from zero milliseconds to 50 milliseconds. To the human eye, even if you type really fast, that delay is so small that you won't be able to notice on screen. But for anyone using keystroke dynamics, this will completely destroy their capability of building a profile on how you type, and it will also destroy their ability to detect whether it is you or anyone else logging into a specific account. Cindy Ng: There is warning before you install it. It says it can read and change all your data on websites you visit. I was wondering if you can expand on that warning. Do you store the data that you're changing? Per Thorsheim: For those who are interested in programming and can read a code, you can read a code for this plug-in and it's pretty simple and short code. The only thing we do is to insert this random time delay between different websites. We also have an option to turn it off for specific websites. If you use that option, of course, that information will be stored locally on your computer. Say that for bank X or website Y, we have stored information on your computer saying that the plug-in shouldn't be used for this website. You want to be yourself, so to speak. The thing is that with these plug-ins is that since the plug-in is receiving whatever you type on your keyboard and does something to that data before putting it into a website, it wouldn't be fully possible for us, just like anybody else developing plug-ins, to record everything you type on your keyboard ,and as an example, send it off to us or to your favorite three-letter agency country in the world. Cindy Ng: With your password conference, that's really interesting. It's the one and only conference on passwords. Tell us a little bit more about that. Per Thorsheim: I'm the founder of and running PasswordsCon, which is the world's first and as far as I know only conference in the world which is only about passwords and digital authentication. It's a conference that I started in 2010, by support from the University of Bergen in Norway where I live. So it's two and a half days with geeky people from all over the world, academics and security professionals and password hackers if you like, that are discussing how to break passwords, how to secure them, how to transmit them, how to store them, how not to store them of course, all kinds of science and real world experience into handling passwords from every imaginable perspective. I can tell you this, I know. You don't have to say this. I know that it sounds very nerdy and a lot of people do ask me like, why this insane interest in passwords. But I can also tell you that I think that almost everyone that has ever participated for the first time at this conference, when I ask them afterward, so the obvious question, "What did you think of the conference?" I think that almost everyone has responded by saying that, "Wow! I had never thought that such a topic like passwords, which I consider to be such an insignificant and very small part of my everyday life and security, can actually be expounded into so many topics like statistics, cryptography, linguistics, math, psychology, colors, adherence, sounds, and everything." So people have been really, really fascinated when they have participated in this conference. Also, lots of people have gained new ideas from research and also for taking back to their your own organizations to implement. Cindy Ng: I think what people are saying now is that security and technology, it's becoming so seamless. That it's kind of almost like a utility, where you just plug and play which has its own problems with Mirai botnet attack. Per Thorsheim: Yeah. Cindy Ng: With the default password problems. So I would equate passwords with electricity and as a huge important utility for people to understand, to synthesize, to work together, to figure it out. We often tend to innovate and create as fast as possible without security and privacy from the start. So it's a great thing for everyone. So I applaud you for doing that. Per Thorsheim: Yeah. Thank you. I am concerned about the internet of things as we say and the Mirai botnet really showed us. It really gave us not one, several lessons on security or insecurity of internet of things and all kinds of connected devices. It's interesting to see that the major attack vector who was that there were security cameras, DVRs, all kinds of equipment that was collected to the internet and they were running with default usernames and passwords and they were available online. So just by doing an internet-wide scan, you will find hundreds of thousands of such devices are collected and you can easily break into and use them for illegal purposes. Which we saw with the Mirai botnet. Cindy Ng: Often times people set the password as default, thinking that the user will go back and change it. But that's not the case. It's also a good segue to hear from a password expert, a security adviser. What are your password secrets, that you can...? Per Thorsheim: I will draw a line between whether you are tech savvy and using computers. Or if you're like my own mother, who doesn't take an interest at all. I have to draw a line there. First of all, if you're like my own mother and you're not really interested in learning how to use computers and most technology, you're just one of those that you just want it to work. The best advice I can give you is to write down your passwords on a piece of paper or in a small notebook and keep it in your kitchen drawer or somewhere at home, where it is reasonably safe. In that, you will put down the passwords or the pass phrases that you use for different sites and services on the internet. Most of those passwords, you don't have to remember them. You don't need to use them every day. An important part is that... And I'm sorry to say this. But you have to try to use unique passwords for different services that you're using online. Because we know that bad guys, as soon as they're able to get access to your password and you're using them from one site to one service, they will try very quickly to use the same username and password across other services to gain access to more accounts, more money, more information, more data that they can use and abuse about you, sell to spammers and the like online. So write down and use unique passwords. That's advice for my mother. If you're a…

A Technologist’s Hippocratic Oath Dec 07, 2016

Show notes

Last month, there was a thought-provoking article on programmers who were asked to do unethical work on the job. We often talk about balancing security with precaution and paranoia, but I wondered about the balance of ethics and execution.

As always, I was curious to hear the reactions from the Inside Out Security Show panel – Mike Buckbee, Kris Keyser, and Mike Thompson.

Here’s what they had to say:

Thompson: “The downside in technology is that shortcuts lead to lapses in security…In healthcare, there are tight regulations…but who is making that decision in the technology industry?”

Buckbee, “We talk about different kinds of crime like property, violent crime, and white collar crime. There’s cybercrime as well. People have different acceptable models in these different areas. [For instance] when it comes to SQL injection, you probably don’t think that adding a few additional characters to a URL is a felon criminal trespass, but it totally could be…”

Keyser, “I drew a parallel between engineers that work in the physical space and engineers that work in the digital space. And engineer or somebody who builds a faulty house with a poor structure or horrible locking system, there would be repercussions for that if the house collapsed…I don’t think people have realized the parallels between that and the digital space.”

Click play to see what else they had to say! Additional responses include: thoughtful insights to the most recent San Francisco MUNI hacker that got hacked, potentially unnecessary malware fixes, as well as the latest hacking tools and exploits.

Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

More from Varonis ⬇️

Visit our website: https://www.varonis.com

Password expert Per Thorsheim On Life After Two Factor Authentication Dec 02, 2016

Show notes

Based in Norway, Per Thorsheim is an independent security adviser for organizations and government. He is also the founder of PasswordsCon.org, a conference that’s all about passwords, PIN codes, and authentication. Launched in 2010, the conference is a gathering security professionals & academic researchers worldwide to better understand and improve security worldwide. In part one of our conversation, Per explains - despite the risks - why we continue to use passwords, the difference between 2-factor authentication and 2-step verification, as well as the pros and cons of using OAuth. Naturally the issue of privacy comes up when we discuss connected accounts with OAuth. So we also made time to cover Privacy by Design as well as the upcoming EU General Data Protection Regulation(GDPR). Transcript Cindy NgRecently, I had the pleasure to speak with an independent security advisor, Per Thorsheim, on all things passwords. Based in Norway, he is the founder of Passwords Con, the world's first and only conference about passwords. It's a gathering of security professionals and academic researches from all around the world where they discuss ways to improve security worldwide. Thank you, Per. Let's get started. So, a very important question, so, lots of security experts have warned us the dangers of passwords, but why are we continuing to use it? Per ThorsheimWell, it's cheap to use from a business perspective. There are many cases where we don't have a business situation where, you know, there's no point in using anything else than passwords. They are available in every single system we use, and if you want something else, it's going to be more expensive. And who's going to pay for that? Cindy NgA lot of people are using password managers to manage all our different accounts for all our different sites. And there’s also two-factor authentication which can be tiresome. You suggested that there's life after two-factor authentication. Can you tell us a little bit more about that? Per ThorsheimYeah, you know, we have National Security Awareness month here in Norway, just like in the US, in all of October. And a very important message that we have been bringing out in all possible channels over the past month is to use two-factor authentication. And basically what that is, is that in addition to having a username and password, you would have a code that you need to enter that you will get from a key from a text message or something similar. Maybe you have a couple of codes written down on a piece of paper that you have to type in, in addition to your password. That's two-factor authentication. Now, what I mean about life after two-factor authentication is that every step that we add into the process of authenticating, you know, how to figure out that you are the correct person logging into our system, takes time. And by adding a second factor, it will take you, in most cases, a little bit extra time to be able to log in. For some people, that's okay. For some people, it's a disruption. It's annoying, and what I've been thinking about, you know, by saying, "life after two-factor authentication," is, "What happens today when, in my case, I have, like, 400 accounts on different services all over the internet and at home and at different, you know, banks and insurance companies and so on? What happens today that I'm actually using two-factor authentication with all of those accounts?" I'm just imagining to myself that that's going to be very annoying. It's going to take a lot of time. Every time I have to log in to any kind of service, I have to type in username, I have to type in my password or pass phrase, and then I also have to look at my phone to receive a text message or find you know, that dumb piece of hardware dongle that I forgot at home, probably, and type in a code from that one as well. So from a usability perspective, I'm a little bit concerned, maybe even a little worried about what's the world going to be in a couple years when all the services that I'm using today are either offering or even requiring me to use two-factor authentication? Now, from a security perspective, adding this kind of two-factor authentication's a good thing. It increases security in such a way that in some cases, even if I told you my password for my Facebook account, as an example, well, I have two-factor authentication. You won't be able to log in, because as soon as you type in my username and password, I will be receiving a code via SMS from Facebook on my phone, which you don't have access to. Now, without that code, you will not be able to log in to my account. The security perspective of this is really good which is why we recommend it. From the usability side, I'm a little bit concerned about the future. Cindy NgWhat's the difference between the two-factor authentication and the two-step authentication, in terms of increasing usability? Per ThorsheimTwo-step verification process is what I consider to be a good trade-off between good security and good usability. With two-step verification, which is what Facebook and Twitter and Google does in most cases, is that you will do the initial setup process of your account and an initial setup of your two-factor authentication procedure, like, once, to log in, using the Facebook app on your phone, on your iPad. Maybe you're using the browser on your computer. And you do this authentication with username, password, and entering the additional code once per device or per app that you're using or maybe for each and every single web browser on different computers that you may be using. And as soon as you've done that, Facebook will remember the different browsers and apps you have used, and then, you know, they are already pre-approved. So then next time you log in, you only type in your username and password, which reduces complexity and time for you. But still they remember your browser, so they see that, "Oh, yep, that's Per logging in from a browser that he had already used before, so we know that this browser probably belongs to Per. And as long as the username and password is correct, he gets access to his Facebook account." The two-factor authentication process, I would have to enter that additional code every single time I log on, and that's the difference between the two-step verification and the two-factor authentication. Cindy NgWhat if I decide to delete my cookies? Per ThorsheimWell, then it's all gone. Then you have to do the setup process again, and this applicable to when you're using your web browser. But if you are using the official Facebook app for iOS or for Android, as an example, these features are built into the application. In that setting, it's not just a standard cookie. There's a little bit different security built into the app. But, of course, you can do this on the app as well to basically delete your cookie. Cindy NgYou would essentially have to do a risk analysis on yourself to figure out what the trade-off is in that regard. Per ThorsheimYeah, absolutely. You know, when I go traveling abroad, I go to many different countries, and some of them may be, well, should I say, a little less democratic and a little more hostile, perhaps, than others. So I do my personal risk analysis on wherever I go, do I need a strong PIN code? Do I need a strong password? Should I be using two-factor authentication? And this is a risk analysis, and it's also trade-off for the usability. I'm just like, I guess, everybody. I want security to be good, but I'm not willing to sacrifice too much of the usability in order to keep up good security, because then I will probably stop using the service if I'm forced to be compliant with all kinds of security requirements all the time, when there's, you know, from my perspective, no point in doing so. Cindy NgLet's also talk about other security options, such as O-auth. Tell us a little bit more about the pros and cons of using that as an option to log in. Per ThorsheimWell, it solves many problems, especially in terms of usability. I can go to an online store here in Norway, and I'll want to purchase myself a new computer, or maybe I would like to order tickets to the movie theater to go with somebody to watch a movie, as an example. And instead of having to sign up for an account, I can use what we call a social login, where they are using O-auth in the background, and you basically sign up using your Facebook account. Now, this is, from a usability perspective, it's very easy to do. The privacy concerns about this is the fact that Facebook will be getting access to information like you went to the movie theater, and they will maybe be able to find out which movie you actually went to see and how many tickets you've purchased. I don't know. Maybe they can. And the movie theater, they will also get information from Facebook about me, who I am, my age, my gender, maybe some other pieces of information as well. And in my opinion, the movie theater shouldn't be asking me, you know, who I am or anything. You know, I want to see a movie. I'm not going to make any trouble for them, and I'm going to pay for the tickets, and that's it. There are lots of privacy concerns about this, at least from my perspective. And I am a little bit concerned that most people, they don't really realize how much information they actually give away about themselves when they are using this kind of authentication to all kinds of services around. Cindy NgYou're really speaking to data minimalization, which is part of the "Privacy by Design" guideposts, to collect what you really need, not collect every single thing. When you go see the movies, they don't need to know every single friend that you have on Facebook, for instance. Per ThorsheimYeah, and, of course, from science modeling perspectives, I can see that they actually have an interest in knowing this about you. But, you know, the movie theater, they don't give me a discount when I provide lots of personal information about myself, compared to those who just purchase a ticket and pay in cash. And they remain completely anonymous, so to speak, for the movie theater, while I'm paying the same price, but at the same time I also give them information about my age, address and phone number, email address, gender, a lot of pieces of information as well. In one way, I would say that, well, if they would give me a discount, maybe I would be interested in giving away more personal information about myself. It's going to be interesting when the GDPR actually comes into law. I still do have my concerns about GDPR. I mean, it's a EU law, so that will be implemented in different countries in the EU and also in Norway. I mean, we are actually not actually a member of the European Union, but still the GDPR will be put into our laws and regulations as well. And the most important aspect of GDPR, in my opinion, is that if you are a service provider of any type, and you suffer a data breach of personally identifiable information about, you know, users, especially if that information is sensitive - that is, regarding sexuality, health, criminal records, political activity, religious activity, membership in worker unions, as an example - the GDPR says that the company or organization in question can get a fine up to 4% of their total global yearly revenue. And, you know, you look at the numbers of Apple and Microsoft and Google, of how much revenue they make in a full year, and then, you know, 4% of that amount is going to be the maximum fine for one single data breach. That's a lot of money. Today, data breach laws here in Norway, as an example, will give you a fine so small that anybody can pay it without any problems at all. So this is a game-changing regulation that is coming into law for the European Union. How it will be interpreted in courts, and how big those fines will actually be, that is going to be very interesting to see from starting in somewhere in 2018. Cindy NgYeah, it'll be a challenge to see how they can enforce it when US companies do business in Norway or any of the EU countries. Per ThorsheimWell, absolutely. I mean, there have been attempts to set up agreements between European Union and the US, as an example, for Cloud services from Google, from Apple, from Microsoft and so on that will regulate how US companies are to handle data about European citizens and also whether the US government can get access to that data or not. And these are, as far as I know, still ongoing discussions, of course, but there are also laws and regulations and agreements already in place on this. That applies, again, to how US companies are handling data about European citizens stored on computers in Europe. Cindy NgLet's talk about hardware. What do you think about things like the YubiKey and the RSA Tokens. How effective is having hardware in... Per ThorsheimWell, from the risk analysis perspective, it's a good thing. If I give you an app that you will use on your phone that will provide you with codes that you need to log in, somebody would either have to steal your phone. They could eventually trick you, talk you into giving them the code from your app by, you know, calling you and say, "Hey, this is from Microsoft Support in India, and we are calling to make you aware that you have some problems with your account. We need to verify your account by having you read up the present token number that you have on your phone at the moment." But, in general, from a risk analysis perspective, having a hardware token is good thing, security-wise. And it's much better than using just an app or receiving a text message by SMS, because an app is a piece of software that may have vulnerabilities, and SMS messages are also being sent, essentially, in the glare. And we know from assessing vulnerabilities in the worldwide user networks that they can be interrupted, and they can also be sent through hostile servers, where an adversary can read them in plain text and then get access to your account. If you have a handheld device, maybe with a, you know, small screen and doesn't have any connectivity at all, it just generates a new code every 30 seconds or 1 minute or 5 minutes, like RSA Secure ID. It's much harder for an attacker to get access to those codes. They would either have to trick you, or they would have to steal comments in that physical token from you. Cindy NgIt's interesting how social engineering can happen with hardware that's supposed to protect us too. Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrimeMore from Varonis ⬇️ Visit our website: https://www.varonis.comLinkedIn: https://www.linkedin.com/company/varonisX/Twitter: https://twitter.com/varonisInstagram: https://www.instagram.com/varonislife/