Source: https://www.myspacebox.net:8443/category/gdpr/
Timestamp: 2018-12-15 17:50:47
Document Index: 354005064

Matched Legal Cases: ['Art. 32', 'art 1', 'art 2', 'art 3', 'art 1', 'art 2', 'art 3']

GDPR | A Box in Space
How much are the first fines for GDPR infringement?
2018 has been the year par excellence for data protection, when data leaks, exfiltrations, and abuses have made headlines all over the world. And against this backdrop of increased awareness about the challenges that working with sensitive data can entail, there is one regulation that has come to the fore: the GDPR (General Data Protection Regulation), which has been mandatory since May 25 this year.
Infringement of this regulation can incur fines of up to 4% of a company’s annual global turnover, or up to €20 million. It is therefore perhaps unsurprising that companies are now examining their data with a fine tooth comb in order to stay on the right side of the legislation. However, in spite of this exigency, to date, only 29% of organizations have implemented all measures necessary to comply with the GDPR.
The first infringement complaints came on May 25, as soon as it came into force, when the nonprofit organization noyb.eu presented four complaints against Facebook, Instagram, WhatsApp, and Android. Noyb argues that these companies forced their users to accept their new service terms, something that violates the GDPR’s requirement that this consent be given freely. Nevertheless, these cases are ongoing, and as such, we still have some time before we see the outcome.
In October, Giovanni Buttarelli, the European Data Protection Supervisor, said that he expected to see the first sanctions before the end of the year. And sure enough, he didn’t have to wait very long.
Sanctions start to appear
The first fine was issued in Austria at the start of October, and although it is not strictly related to personal data processing, it is a good illustration of the reach that the regulation can have. A betting shop received a €4,800 fine for a security camera that was recording part of the pavement outside, since large scale monitoring of public spaces is not permitted under the GDPR.
At the end of the same month, we saw the first fine related to the processing and storage of personal data. The Comissão Nacional de Protecção de Dados (National Data Protection Commission) in Portugal imposed three fines on the Hospital do Barreiro: two €150,000 sanctions and another of €100,000. As such, this set of sanctions has meant a total cost of €400,000 for the hospital. The first two fines of €150,000 were for violation of the principle of data integrity and confidentiality, and violation of the principle of data minimization, which in theory prevents indiscriminate access to data. 985 physicians had active accounts on the system giving them access to clinical files, while the hospital had only 296 active doctors on the date of the inspection.
The third fine was related to the inability of the Hospital as data controller to ensure the confidentiality and integrity of the data of its clients and patients.
The most recent fine was issued in Germany in the middle of November. A German social network, Knuddels.de, received a €20,000 fine after a hack that caused 808,000 email addresses to be leaked, along with over 1.8 million usernames and passwords. This information was then published online with no encryption.
The social network reacted by saying that once the leak had been discovered, it immediately improved its security measures. After the incident, it was discovered that the website had no kind of protection on its sensitive information.
According to LfDI Baden-Württemberg, the German data protection agency responsible for handling this case, one of the reasons that the website received a “relatively low” fine was that it acted with transparency, and quickly implemented security improvements.
2019 will bring new figures
The economic sanctions that we have seen so far are clearly relatively conservative compared to the highest possible penalties, but with the recent spate of high profile data leaks – Marriott, British Airways, Quora – it won’t be long before harsher fines start to appear.
What can you do to avoid a fine – be it millions of Euros or more moderate? The most important thing to bear in mind is that prevention is better than a cure, and by having appropriate protection for the personal data that your company manages, you can avoid sanctions. Start by knowing exactly where this data is stored and who has access to it. To do so, it is vital to have advanced cybersecurity solutions.
Panda Data Control is a module of Panda Adaptive Defense that is specifically designed to help comply with data protection regulations. Discover, audit and monitor all unstructured personal data on your company’s corporate network. Only this way will you know where your company’s data is stored, who is handling it, and what actions they are performing on it.
The post How much are the first fines for GDPR infringement? appeared first on Panda Security Mediacenter.
This entry was posted in b2b, data control, GDPR, News, security on December 12, 2018 by Panda Security.
FOI request finds lack of cybersecurity readiness in many NHS trusts.Redscan has asked NHS trusts about the cybersecurity readiness of its employees and the results show lack of trained staff, lack of
The post NHS could face major cybersecurity threats due to lack of investment appeared first on The Cyber Security Place.
This entry was posted in Cyber Security Threats, cyber security training, Cyber Threats, Data Lack, GDPR, INDUSTRY INSIGHTS, NHS on December 12, 2018 by Sanofiya Shelat.
Italy's regulator found the social giant guilty of misleading consumers as to what it does with their data.
This entry was posted in $11.3 million, data handling, facebook, Fine, GDPR, government, Italy, Privacy on December 11, 2018 by Tara Seals.
The post Is 2019 Privacy Rights’ Break Out Year? appeared first on ...
This entry was posted in china, contributed, data privacy, European Union, GDPR, General Data Protection Regulation, Hitachi Systems Security, Legal News, Opinion, Privacy, Reports, russia, United Nations on December 11, 2018 by Paul.
Nearly a week after Marriott disclosed a massive breach of its Starwood reservation system, customers complain that the company has not communicated with them to tell them whether they are affected. Marriott says it is sending “rolling” emails to hundreds of millions of victims. An estimated 500 million Marriott International customers...
This entry was posted in APT, Crime, Data loss, data privacy, data theft, database, Encryption, European Union, facebook, GDPR, General Data Protection Regulation, Marriott Hotels, Reports, Standards, Threats, Top Stories, Vulnerabilities, Web on December 6, 2018 by Paul.
The General Data Privacy Regulation (GDPR) seems to already be having a positive effect on the state of cybersecurity in Europe less than seven months after it was enacted, showing that policy indeed can have a direct effect on organizations' security practices, security researchers said.
The post Researchers: GDPR Already Having Positive Effect...
AggregateIQ Faces First GDPR Enforcement Over Data-Privacy Dispute
This entry was posted in BitSight, business, compliance, data privacy, European Union, GDPR, Privacy, Regulation, Risk Management, Top Stories, Vulnerabilities on December 5, 2018 by Elizabeth Montalbano.
This entry was posted in breach, Chris Vickery, Cloud Security, Dell EMC, elasticsearch, ElesticDB, GDPR, Marriott International, Merck, Newsmaker Interviews, WannaCry on December 3, 2018 by Tom Spring.
The post Massive Marriott Breach Underscores Risk of overlooking Data Liability appeared first on The Security Ledger.
NotPetya Horror Story Highlights Need for Holistic Security
This entry was posted in Data Breach, Data loss, data privacy, data theft, Encryption, European Union, GDPR, Hacking, Hitachi Systems Security, hospitality, Privacy, Reports, Risk, Risk Management, third party, Top Stories on December 2, 2018 by Paul.
A mammoth data breach was disclosed by hotel chain Marriott International today (30 Nov 18), with a massive 500 million customer records said to have been compromised by an "unauthorized party".
The world's largest hotel group launched an internal investigation in response to a system security alert on 8th September 2018, and found an attacker had been accessing the hotel chain's "Starwood network" and customer personal data since 2014, copying and encrypting customer records. In addition to the Marriott brand, Starwood includes W Hotels, Sheraton, Le Méridien and Four Points by Sheraton.
You are at risk if you have stayed at any of the above hotel brands in the last 4 years
The Marriott statement said for around 326 million of its guests, the personal information compromised included "some combination" of, name, address, phone number, email address, passport number, date of birth, gender and arrival & departure information. The hotelier also said encrypted payment card data was also copied, and it could not rule out the encryption keys to decrypt cardholder data had not been stolen.
The hotel giant said it would notify customers affected and offer some a fraud detecting service for a year for free, so I expect they will be making contact with myself soon. In the meantime, Marriott has launched a website for affected customers and a free helpline for concerned UK customers 0808 189 1065.
The UK ICO said it would be investigating the breach, and warned those who believe they are impacted to be extra vigilant and to follow the advice on the ICO website, and by the National Cyber Security Centre. The hotel chain could face huge fines under the GDPR, and possibly a large scale class action lawsuit by their affected guests, which could cost them millions of pounds.
What I really would like to know is why the hotel chain had retained such vast numbers of guest records post their stay. Why they held their customer's passport details and whether those encryption keys were stolen or not. And finally, why the unauthorised access went undetected for four years.
Tom Kellermann, Chief Cybersecurity Officer for Carbon Black, said "It appears there had been unauthorised access to the Starwood network since 2014, demonstrating that attackers will get into an enterprise and attempt to remain undetected. A recent Carbon Black threat report found that nearly 60% of attacks now involve lateral movement, which means attackers aren’t just going after one component of an organisation - they’re getting in, moving around and seeking more targets as they go."
The report also found that 50% of today’s attackers now use the victim primarily for island hopping. In these campaigns, attackers first target an organisation's affiliates, often smaller companies with immature security postures and this can often be the case during an M&A. This means that data at every point in the supply chain may be at risk, from customers, to partners and potential acquisitions.”
Jake Olcott, VP of Strategic Partnerships at BitSight, said "Following the breaking news today that Marriott’s Starwood bookings database has been comprised with half a billion people affected, it highlights the importance of organisations undertaking sufficient security posture checks to avoid such compromises. Marriott’s acquisition of Starwood in 2016 allowed it to utilise its Starwood customer database. Therefore, proactive due diligence during this acquisition period would have helped Marriott to identify the potential cybersecurity risks, and the impact of a potential breach".
“This is yet another example of why it is critical that companies perform cybersecurity analysts during the due diligence period, prior to an acquisition or investment. Traditionally, companies have approached cyber risk in acquisitions by issuing questionnaires to the target company; unfortunately, these methods are time consuming and reflect only a “snapshot in time” view.
“Understanding the cybersecurity posture of an investment is critical to assessing the value of the investment and considering reputational, financial, and legal harm that could befall the company. After an investment has been made, continuous monitoring is essential.”
This entry was posted in Data Breach, data retension, GDPR, Hackers, Marriott, starwood on November 30, 2018 by Dave Whitelegg.
IT Security Expert Blog: Marriott Hotels 4 Year Hack Impacts Half a Billion Guests!
The hotel giant said an internal investigation launched in response to a system security alert, found an attacker had been accessing the hotel chain's "Starwood network" since 2014, copying and encrypting customer records. In addition to the Marriott brand, Starwood includes W Hotels, Sheraton, Le Méridien and Four Points by Sheraton.
Marriott said it would notify customers affected and offer some a fraud detecting service for a year for free, so I expect they will be making contact with myself soon. In the meantime, Marriott has launched a website for affected customers.
The UK ICO said it would be investigating the breach, and warned those who believe they are impacted, to be vigilant and to follow the advice by on the ICO website, and by the National Cyber Security Centre. The hotel chain could help face huge fines under the GDPR, and possibly a large scale class action lawsuit by their affected guests, which could cost them millions of pounds.
What I would like to know is why the hotel chain had retained such vast numbers of guest records post their stay, why they held their customer's passport details, whether those encryption keys were stolen. And why the unauthorised access went undetected for four years.
The report also found that more than a third (36%) of today’s attackers now use the victim primarily for island hopping. In these campaigns, attackers first target an organisation's affiliates, often smaller companies with immature security postures and this can often be the case during an M&A. This means that data at every point in the supply chain may be at risk, from customers, to partners and potential acquisitions.”
This entry was posted in Data Breach, data retension, GDPR, Hackers, Marriott, starwood on November 30, 2018 by Dave Whitelegg (noreply@blogger.com).
GDPR “helps transparency” and “honesty”: Brendan Eich, Rafal Szymanksi and Sam Kim on Digital Advertising in 2018
When thinking of industries which could potentially benefit from decentralization and distributed ledger technology, digital advertising and marketing may not be the first to come to mind. When looking at a list created for Forbes by Bernard Marr entitled ‘Here Are 10 Industries Blockchain Is Likely To Disrupt’ published July 2018, for example, these sectors […]
The post GDPR “helps transparency” and “honesty”: Brendan Eich, Rafal Szymanksi and Sam Kim on Digital Advertising in 2018 appeared first on Hacked: Hacking Finance.
This entry was posted in AR, augmented reality, Basic Attention Token, BAT, brave, Brendan Eich, CRM, EasyVisual, eu, Europe, forbes, GDPR, Global Tech Makers, Google, Horizont, Interviews, Lucidity Tech, Opinion, Rafal Szymanski, Regulation, Sam Kim, united states of america, usa, vr on November 29, 2018 by Daniel Mitchell.
For some time now, protecting users’ data has been an obligation for companies all over the world. And not just a moral obligation, but a legal one too, since different regulations can impose all kinds of fines on any company that flouts these rules.
And some laws are harsher than others. There is one clear example of how these laws can work: public mistrust of Facebook came to the fore following the Cambridge Analytica scandal, a grave crisis that led to a £500,000 (around €560,000) fine in the United Kingdom. The Information Commissioner’s Office (ICO) in the UK has investigated around 30 companies in a similar situation to Facebook’s. According to their report, the social network founded by Mark Zuckerberg was not diligent in protecting its users’ data or privacy.
However, when all is said and done, how much can a £500,000 fine really hurt Facebook? In actual fact, not only is this sum barely a scratch on the surface of the company’s finances, it is probably something of a relief for Facebook, given that it was not fined after the General Data Protection Regulation (GDPR) came into force on May 25 of this year.
What would have happened with the GDPR?
If Facebook’s negligence had taken place with the GDPR in force, the consequences would have been markedly different. As well as the serious damage to the company’s reputation – something that did in fact happen – the economic sanctions would have been far more substantial.
In case of non-compliance with the GDPR, four levels of sanctions have been laid out: a warning, a reprimand, the suspension of data processing, and a fine. In the case of the fine, there are two different levels:
Level 1. A fine of €10 million or 2% of annual global turnover (whichever figure is higher).
Level 2. A fine of €20 million or 4% of annual global turnover (whichever figure is higher).
In this case, therefore, Facebook, which had earnings of €32.75 billion in 2017, could have had to face a fine of over €1.3 billion. While this sum still wouldn’t be enough to rattle the company financially, it would be far more detrimental.
Six months after the GDPR came into force, many companies are still struggling with it. And some are not going to have the same luck as Facebook, since their fines will now fall under the jurisdiction of the new regulation. This is what will happen with Exactis, which left a database containing 340 million records exposed, or Timehop, which exposed the personal data of 21 million users.
Studying the intricacies of the new legislation shouldn’t be too much of a problem for companies like Facebook, given the teams and the resources available to them. There are, however, other companies that, whether because of their size, or because of the sector they work in, may have more trouble complying with the new rules.
So that the GDPR doesn’t become a headache, companies of all types and all sizes can follow these recommendations:
1.- Protect the company’s cybersecurity Cybersecurity has always been essential for companies, but now more so than ever. As well as being diligent in how they protect data and private information, they must also design action protocols for possible alerts. It’s also important to be cyber-resilient, keeping abreast of the latest strategies used in cyberattacks. If a company suffers a data breach, it must inform the data protection authorities within a maximum of 72 hours after it becomes aware of the breach.
2.- Technology solutions. No company can do all this work alone: some of the responsibilities must be delegated to an external tech solution. In this sense, Panda Data Control, the data protection module of Panda Adaptive Defense, categorizes and correlates all data about cyberthreats in order to carry out prevention, detection, response and remediation tasks, combined with reduction services. The solution monitors all of the company’s activity, detects possible risk situations and simplifies the management of this kind of task within the company.
3.- Protect users Cybersecurity isn’t just about conserving and protecting the company’s information: it is also about protecting the company’s employees, clients, providers, users, and so on. Companies need to protect the privacy of those with whom they have a relationship, as well as being transparent with them so that they know exactly what is being done with their data. To fulfill all of this, companies must also have a data protection delegate to oversee and lead this kind of task.
The post Facebook and Cambridge Analytica: what would have happened with GDPR in force? appeared first on Panda Security Mediacenter.
This entry was posted in GDPR, News, security on November 29, 2018 by Panda Security.
Popular massage-booking app Urban lets masseurs/masseuses log comments about creepy customers, and left its database wide open.
This entry was posted in breach, GDPR, ICO, information commissioner, Law & order, massage, oliver hough, Privacy, Shodan, TechCrunch, urban, urban massage on November 29, 2018 by Lisa Vaas.
Naked Security – Sophos: Creeps outed as massage app exposes database with workers’ comments
Seven European consumer organizations are planning to submit a complaint about Google's location tracking activities to their data protection authorities.
This entry was posted in beuc, GDPR, gdpr compliance, Google, location history, location tracking, Organisations, Privacy, The European Consumer Organisation, Web & App Activity on November 29, 2018 by Danny Bradbury.
Almost a quarter of UK and German businesses (23%) believe the GDPR may have resulted in a greater risk of data breaches, six months after the legislation was introduced. The
The post C-Suite: GDPR Could Lead to Greater Risk of Breaches appeared first on The Cyber Security Place.
This entry was posted in C-Suite, CIO, CISO, Cyber Risk, Cyber Security Solution, Data Breach, data protection, GDPR, identity theft, IT Compliance on November 29, 2018 by The Cyber Security Place.
This entry was posted in 1996 DPA, archive, Data Breach, DPA, GDPR, ICO, uber on November 28, 2018 by Filip TRUTA.
Privacy Law Is Growing More Extensive – Here’s What That Means For Healthcare
Regulations like the GDPR are changing both how we do business and how customers engage with their data. Healthcare is no exception to that rule. Even in light of strict frameworks like HIPAA, health organizations face a number of unique challenges where privacy laws are concerned. Here’s why – and how you can overcome them. […]… Read More
The post Privacy Law Is Growing More Extensive – Here’s What That Means For Healthcare appeared first on The State of Security.
This entry was posted in GDPR, healthcare, HIPAA, security on November 27, 2018 by Tripwire Guest Authors.
Naked Security – Sophos: LinkedIn rapped for targeting ads at 18 million Facebook users
What upset the Data Protection Commissioner: none of the 18 million email addresses were those of LinkedIn users.
This entry was posted in data protection, facebook, GDPR, gdpr compliance, Ireland, LinkedIn, microsoft, Privacy, social networks, targeted ads on November 27, 2018 by John E Dunn.
WeLiveSecurity: German chat site faces fine under GDPR after data breach
The country’s first fine under GDPR is lower than might have been expected, however, as the company earns praise for its post-incident cooperation and enhanced security measures
The post German chat site faces fine under GDPR after data breach appeared first on WeLiveSecurity
This entry was posted in GDPR on November 27, 2018 by Tomáš Foltýn.
It's Germany's first GDPR fine, for an incident that affected millions of accounts.
This entry was posted in breach, chat, Data Breach, data privacy, dating app, Fine, GDPR, Germany, Knuddels, Privacy on November 26, 2018 by Tara Seals.
Sixty-six of percent of phone users said they had suffered data-related harm: 11 percent suffered identity theft, 22 percent account hacking, 14 percent credit cards hacking and 12 percent financial fraud.
This entry was posted in GDPR, General Data Protection Regulation, government, Mobile, Mobile Ecosystem Forum, mobile privacy, Mobile Security, Privacy on November 26, 2018 by Stephen Pritchard.
Chat app Knuddels fined €20k under GDPR regulation
The case is making the headlines, the German chat platform Knuddels.de (“Cuddles”) has been fined €20,000 for storing user passwords in plain text.
In July hackers breached the systems of the company Knuddels and leaked online its data.
In September, an unknown individual notified Knuddels that crooks published user data of roughly 8,000 members on Pastebin and much more data were leaked via Mega.nz.
Knuddels published a data breach notification and forced users into changing passwords, Knuddels also reported the incident to the Baden-Württemberg data protection authority.
The company duly notified its users and the Baden-Württemberg data protection authority.
when you log into the chat, you are currently asked to change your password.
That’s a precaution. Account data from Knuddels have been published on the internet. Although we are currently not aware of any third-party use, we have temporarily deactivated these accounts for their security.” reads a message published on the company forum.
“We are currently checking whether there is a security vulnerability on the platform. As soon as we have more information, we’ll let you know, of course. For problems and questions please contact our support at community@knuddels.de.
Please use the hint when logging in and change your password.”
According to the German Spiegel Online, hackers leaked over 800,000 email addresses and more than 1.8 million user credentials on Mega.nz.
“the company from Karlsruhe violated the obligation to ensure the security of personal data, informed the Baden-Wuerttemberg data protection commissioner Stefan Brink on Thursday in Stuttgart.” reported Spiegel Online.
“He told the company that after a hacker attack, it turned to the DPA and informed users immediately and extensively about the attack. According to the company, around 808,000 e-mail addresses and 1,872,000 pseudonyms and passwords were stolen by unknown persons and published on the Internet.”
At the time the company had verified 330,000 of the published emails. The chat platform violated GDPR regulation by storing passwords in clear text and for this reason, the regulator imposed its first penalty under the privacy regulation.
The fine is not higher because the company cooperated with the authorities.
“Due to a breach of the data security required by Art. 32 DS-GVO, the penalty office of LfDI Baden-Württemberg imposed a fine of EUR 20,000 by decision of 21.11.2018 against a Baden-Württemberg social media provider and – in constructive Collaboration with the company – ensuring significant improvements in the security of user data.” reads the Baden-Wuerttemberg data protection authority.
“By storing the passwords in clear text, the company knowingly violated its duty to ensure data security in the processing of personal data,”
The authority’s State Commissioner for Data Protection and Freedom of Information, Stefan Brink, confirmed it avoided impose the highest possible fines, it doesn’t want bankrupting the company.
“The overall financial burden on the company was taken into account in addition to other circumstances,” the authority noted.
“The hacker attack was a real test of stress for Knuddels.” It was immediately clear that the trust of users could only be regained with transparent communication and an immediate noticeable improvement in IT security. “Knuddels is safer than ever.” declared the managing director of Knuddels GmbH & Co. KG, Holger Kujath.
(Security Affairs – GDPR, data breach)
The post Chat app Knuddels fined €20k under GDPR regulation appeared first on Security Affairs.
This entry was posted in Breaking News, Data Breach, GDPR, Hacking, Law, Laws and regulations, Pierluigi Paganini, Privacy, Security Affairs on November 24, 2018 by Pierluigi Paganini.
Is There Too Much Pressure On CISOs?
Are CISOs really being taken more seriously now? How much do they have to ‘thank’ mainstream media attention of cyber security and data breaches? It seems that every week I
The post Is There Too Much Pressure On CISOs? appeared first on The Cyber Security Place.
This entry was posted in CISO, Cyber Attack, cyber resilience, cyber security, Data Breach, GDPR, INDUSTRY INSIGHTS, security risk on November 23, 2018 by The Cyber Security Place.
It’s months past when the EU’s General Data Privacy Regulations (GDPR) went into effect, and many are wondering, “Where are we now?” Among the many aspects of the GDPR talked about
The post #InfosecNA18: Where Are We with GDPR? appeared first on The Cyber Security Place.
This entry was posted in CISO, Cyber Risk, data privacy, Data Protetcion, GDPR, IT Compliance on November 16, 2018 by The Cyber Security Place.
Emery was staring at her computer screen for almost an hour, eyes already lackluster as the full-page ad on Motiv looped once more. She was contemplating whether she’d give in and get her boyfriend Ben a new fitness tracker as a present for his upcoming marathon. The phone app he was currently using worked, but Ben never got used to wearing his iPhone on his arm. In fact, the weight of it distracted him.
Emery thought that something lightweight, sturdy, and inconspicuous was what he needs as a replacement. And the Motiv Ring—in elegant slate gray, of course—seemed to be the best option. But for $199, she immediately stepped back. Admittedly, the price tag tempted her to go back to cheaper options.
Reaching for her coffee mug, Emery was reminded of the weight of the Ela Bangle around her wrist. Ben had given it to her as a welcome-home present after her two-week medical mission. He had called it a smart locket, one you can’t wear around your neck. He knew she got homesick easily, so Emery was ecstatic when Ben had shown her photos and audio messages near and dear to her all saved on its rounded-square stone.
At least that was what the brochure said. In reality, her personal files were stored in the cloud associated with the Ela.
Although Emery could only rave about her smart locket, she couldn’t help but wonder if anyone else could see her files. She’s as techie as the next nurse in her ward, but stories of hacking, stolen information, and locked out files were frequently discussed at the hospital, making her realize that owning technology from a nascent industry can put one in a precarious position.
Emery and her current situation may be fictitious, but her dilemma is real. Smart jewelry has real appeal, but it doesn’t come without risks to security and privacy.
Whatever enamored them, potential buyers would be wise to consider this one, significant detail before they make up their minds: data. Mainly, what happens with the data they freely allow their smart jewels to monitor, collect, analyze, and store. Could these be accessed, retrieved, transported, or used by anyone who has the skills? Could data leak on accident or because of simple manipulation of certain elements (such as incrementing the user ID)? These are some questions we need to continue asking ourselves in this age of breaches.
Not only that, the data collected about a person’s health and well-being is yet another trove that should be under the protection of a statute like HIPAA—but isn’t. It’s no wonder that lawmakers and those working in the cybersecurity and privacy sectors have expressed concern regarding the evident lack of security of not just wearable technology, but the Internet of Things as a whole.
How smart jewelry works
Smart jewelry, or wearable jewelry, is a relatively new form of wearable technology (WT) capable of low-processing data. And like other WT, it’s generally not a stand-alone device. It requires an app to be paired with your smart jewelry so it can do what it’s designed to do. In a nutshell, this tandem is how smart jewelry—and wearables as a whole—works.
Wearable jewelry that acts as a fitness tracker usually follows the standard model below:
Tracking of data using sensors in the wearable, such as an accelerometer, gyroscope, tracker, and others.
Transmitting of data from the wearable to the smartphone via Bluetooth Low Energy (BLE) or ant plus (ANT+)
Aggregating, analyzing, processing, and comparing the data in the smartphone.
Syncing of data from the smartphone app to its cloud server via an Internet connection.
Presenting data to the user via the smartphone.
In-depth processing and data analysis also happen in the cloud. Manufacturers offer this additional service to users as an option. As you can tell, this is how service providers monetize the data.
Nowadays, smart jewelry is becoming more than just a pretty fitness tracker. Some already function as an extension of the smartphone, providing notifications on incoming calls and new text messages and emails. Others can be used for sleep or sleep apnea monitoring, voice recording, hands-free sharing and communication, unlocking doors, or paying for purchases. A small number of smart jewelry can even act as one’s personal safety device, train or bus pass, bank card, or smart door key.
But while the jewelry gets blingier and the processor—the wearable jewelry’s core computer—gets smarter with time, one is likely to ask: Is smart jewelry getting more secure? Is it protecting my privacy?
Unfortunately, the strong, resounding answer to both is “no.”
Security and privacy challenges faced by smart jewelry
Because of the processor’s size—a necessity to make wearables lightweight, relatively inexpensive, and fit for mass production—manufacturers are already limited from adding any security measure into it. This is an inherent problem in a majority of wearable devices.
In fact, it is safe to say that some vulnerabilities or security shortcoming we find in wearable devices can also be found in smart jewelry, too.
In the research paper entitled, “Wearable Technology Devices Security and Privacy Vulnerability Analysis,” Ke Wan Ching and Manmeet Mahinderjit Singh, researchers at the Universiti Sains Malaysia (USM), have presented several weaknesses and limitations within wearable devices that we have grouped into main categories. These are:
Little or lacking authentication. A majority of wearables have no way of authenticating or verifying that the person accessing or using them are who they claim they are. These devices are then susceptible to data injection attack, denial of service (DoS) attacks, and battery drain hacks. For gadgets that do have an authentication scheme in place, usually, the system isn’t secure enough. This could quickly be taken advantage of by brute force attacks.
Leaky BLE. Because of this, persons with ill intent can easily track users wearing smart jewelry. And if a location can be determined with ease, then privacy is compromised, too. Other Bluetooth attacks that can work against wearables are eavesdropping, surveillance, and man-in-the-middle (MiTM) attacks.
Information leakage. If one’s location can be determined with pinpoint accuracy, it’s possible that hackers can pick up personally identifiable information (PII) and other data just as easily. Information leakage also leads to other security attacks, such as phishing.
Lack of encryption. Some wearables are known to send and receive data to or from the app in plain text. It’s highly likely that smart jewelry is doing this, too.
Lack of or incomplete privacy policy. Some smart jewelry manufacturers make clear what they do to information they collect from users visiting their website. Yet, they hardly mention what they do to the more personal data they receive from their wearables and app. Their privacy policy does not (or seldom) say what is being collected, when is data collected, what will the data be used for, or how long the data can be kept.
Insecure session. Users can access their smart jewelry via its app, and its app saves user accounts. Account-based management is at risk if its weakness is in the way it manages sessions. Attackers would be able to guess user accounts to hijack sessions or access data belonging to the user.
It’s also important to note that, unlike smartphones and other mobile devices, smart jewelry owners have no way of tracking their wearable jewelry should they accidentally misplace or lose it.
How smart jewelry manufacturers are addressing challenges
The European Union’s introduction of the General Data Protection Regulation (GDPR) has created a tsunami effect on organizations across industries worldwide. Manufacturers of wearable devices are no exception. Owners of smartwatches, smart wristbands, and other wearable gadgets may already have noticed some tweaking to the privacy policies they agreed to—and this is a good thing.
When it comes to security and privacy, much to the surprise of many, they are not entirely absent from smart jewelry. Manufacturers recognize that wearables can be used to secure data and accounts. They also understand that their wearables need to be secured. And a small number of organizations are already taking steps.
Motiv, the example we used in our introductory narrative, has already incorporated in their devices biometric and two-factor authentication schemes, which they recently revealed in a blog post. The Motiv Ring now includes a feature called WalkID, a verification process that monitors a wearer’s gait. It runs continuously in the background, which means WalkID regularly checks for the wearer’s identity. The ring can also now serve as an added layer of protection to online accounts that are linked to it. In the future, Motiv has promised its users password-free logins, fingerprint scanning, and facial recognition.
Diamonds—and data—are forever
It was in January of this year that Ringly, a pioneer smart jewelry company, bid farewell to the wearable tech industry (probably for good) after only four years. Although it wasn’t revealed why, one mustn’t take this as a sign of a dwindling future ahead for wearable jewelry. On the contrary, many experts forecast an overwhelmingly positive outlook on wearable tech. However, the wearables industry must make a concerted effort to address the many weaknesses found in modern smart jewelry.
So, should you bite the bullet and splurge on some smart jewelry?
The answer still depends on what you need it for. And if you’re seriously intent on getting one, remember there are security measures you can do to minimize those risks. Regularly updating the app and the firmware, taking advantage of additional authentication modes if available, using strong passwords, never sharing your PIN, and turning the Bluetooth off when not needed are just some suggestions.
How to choose from smart jewelry options plays a key role in safety, too. Make sure that you select a brand that takes security seriously and shows this by continuously improving on the flaws and privacy concerns we mentioned above. First-generation tech is always insecure. What consumers must look out for are future improvements, not just on the look and functionalities, but also how it protects itself and your data.
Lastly, it’s okay to wait. Seriously. You don’t have to have the latest smart ring, necklace, or bracelet if it doesn’t take care of your data or leaves you open to hackers. It would be wise to settle for other alternatives that would address your needs, first and foremost, and make it coordinate with your attire second. After all, the smart jewelry industry is relatively young, so it still has a long way to go. And with every advancement, we can only hope that smart jewelry comes with beefier security measures and privacy-friendly policy implementations.
As for wearables in the business environment—well, that’s another story.
This entry was posted in 101, ant plus, ANT+, BLE, Bluetooth Low Energy, denial of service, DOS, FYI, GDPR, Internet of Things, IoT, sleep apnea monitoring, sleep monitoring, smart jewelry, wearable jewelry, wearable tech, Wearable Technology, WT on November 14, 2018 by Jovi Umawing.
Hackers have been found exploiting a critical security vulnerability that affects a GDPR plug-in for WordPress to take control over vulnerable websites according to security researchers at Wordfence. “These attacks show that
The post Critical Flaw in GDPR Plug-In For WordPress appeared first on The Cyber Security Place.
This entry was posted in Cyber Attack, data protection, GDPR, IT Compliance, Security Vulnerability, WordPress on November 14, 2018 by The Cyber Security Place.
Update your GDPR Compliance plugin right now. Security researchers have identified a critical vulnerability in the popular WP GDPR Compliance plugin assisting over 100,000 website owners around the world to comply with European privacy regulations known as GDPR that was announced by European Union on May 25th, 2018. The vulnerability was discovered by researchers at Wordfence which allows hackers to […]
This is a post from HackRead.com Read the original post: WordPress GDPR Compliance plugin hacked to spread backdoor
This entry was posted in backdoor, GDPR, Hacking, Hacking News, Malware, security, WordPress on November 12, 2018 by Waqas.
The ‘wearable technology’ market has been exponentially growing in recent years and is expected to exceed 830 million devices by 2020. One of the key drivers pushing this rapid expansion are fitness trackers, namely wristband tech and smartwatch apps which monitors our daily activity and health. But as we integrate wearables devices seamlessly into our everyday lives, what are the privacy and security risks they pose? How should wearable manufacturers and app developers be protecting consumers?
Insurance company Vitality offers customers a heavily discounted Apple Watch to customers in return for their fitness routines and health data, the more activity you do each month, the greater your reward through a monthly discount. While this exchange of information for rewards provides a great incentive for consumers to improve their health, the personal data consumers are sharing in return has a tangible value for the insurance company. However, providing an insurance company with a daily data breakdown of one's health is an unacceptable tradeoff for some, regarding such a practice as an invasion of their privacy.
As of May 2018, all EU citizen's privacy rights are legally protected by the General Data Protection Regulation (GDPR). GDPR compliance is required by all companies which process EU citizen data, including those based outside of the European Union. The privacy regulation requires wearable device and app providers to obtain each EU citizen's explicit consent before collecting their personal information, they must also clearly explain what types of personal information they intend to collect, how they intend to use the data, and inform consumers about any other organisation they intend to share their data with. If they don’t, wearable tech firms and app providers should brace themselves for heavy fines by European Information Commissioners.
For further details about the GDPR requirements and for Wearables Software Development Security Advice, read my IBM developerWorks 3 part guidance "A developer's guide to the GDPR" and my Combating IoT Cyber Threats
Wearable personal data is also of value to hackers and criminals, for instance, your fitness routine provides a clear picture of the best times to burglarise your home. With personal consumer data potentially at stake, fitness wearable manufacturers should incorporate both default privacy and security standards into the infrastructure of the device, to help ensure personal information remains safeguarded from known and future cyber threats. UL, a global safety science company, has developed testing for cybersecurity threats and offers security verification processes to assist manufacturers in assessing security risks and helping mitigate them before the product even goes to market. If the industry takes these steps, wearable consumers will feel safe and secure as they reap the intended benefits of this new innovation, while the wearables industry will be well positioned to meet the promise of its growth projections.
This entry was posted in apple, Application Security, data protection, GDPR, IoT, piracy, wearables on November 6, 2018 by Dave Whitelegg.
HSBC Bank, the seventh-largest banking and financial services organizations in the world and the largest in Europe, has been breached by hackers. The bank is now sending letters to an undisclosed number of customers notifying them that hackers have their data.
In a notification template submitted to the California Attorney General’s Office, HSBC said it became aware that online accounts were accessed by unauthorized parties sometime between October 4 and October 14, 2018.
“When HSBC discovered your online account was impacted, we suspended online access to prevent further unauthorized entry of your account,” the notice reads. “You may have received a call or email from us so we could help you change your online banking credentials and access your account. We apologize for this inconvenience. HSBC takes this very seriously and the security of your information is very important to us.”
HSBC adds (emphasis ours), “The information that may have been accessed includes your full name, mailing address, phone number, email address, date of birth, account numbers, account types, account balances, transaction history, payee account information, and statement history where available.”
The bank provides no details of the breach, such as how the attackers managed to infiltrate its systems and then exfiltrate customer data. It does say, however, that its first action after containing the breach was to enhance the authentication process for HSBC Personal Internet Banking. This suggests the breach may have involved credential stuffing (where large numbers of previously-breached credentials are “stuffed” into login forms until they are potentially matched to an existing account), or a vulnerability in the bank’s two-factor-authentication (2FA) process.
On a slightly more positive note, customers are told HSBC is offering a complementary year of credit card monitoring via Identity Guard, which monitors and protects credit data, but also alerts users to activities that could indicate identity theft. Customers must sign up for the freebie within 90 days, or they won’t be eligible after that window is closed.
According to Wikipedia, HSBC’s assets total US $2.374 trillion, as of December 2016, with annual revenue in the tens of billions. Last year alone, it raked in $51.445 billion, or 45.1 billion euros. Considering the sheer number of potential European clients and the amount of personally identifiable information compromised, HSBC stands to incur a stinging fine under the recently introduced General Data Protection Regulation. The GDPR’s penalties for such data breaches are calculated at up to 20 million euros, or 4% of the company’s annual turnover, whichever is greater. Needless to says, EU legislators won’t have too hard of a time making that calculation.
This entry was posted in bank, Data Breach, GDPR, gdpr compliance, HSBC, hsbc bank, Industry News on November 6, 2018 by Filip TRUTA.
This entry was posted in Data Breach, Eurostar, GDPR, Industry News, user accounts on November 2, 2018 by Luana PASCU.
This entry was posted in adobe, Amazon, Application Security, APT1, APT28, APT38, AWS, British Airways, Cisco, Cobalt, cyber security roundup, DDoS, facebook, GDPR, Huawei, kraken, microsoft, Nation State, ncsc, ransomware on October 31, 2018 by Dave Whitelegg.
When assembling an incident response team, it’s worth including someone whose job is to take notes. It might seem like a small point, but it’s a big help for communicating during a breach, and learning lessons afterwards.
Maybe it’s because I write things down for a living, but for me, that was one of the key takeaways from Brian Honan’s presentation at Dublin Information Sec 2018 this week. “Have someone on your team who is a scribe, who will take notes of timelines, of who did what, and who will brief senior management about what’s happening,” he said.
Brian made the remarks during a presentation about how to manage data breaches in light of GDPR’s stringent reporting regime. Organisations that suffer a breach involving personal data must report it to the designated data protection authority within 72 hours. Such a tight timeframe puts incredible pressure on incident response teams. It’s important to plan ahead, and identify the key roles and responsibilities in advance. The team could include specialists in data protection, information security, operations, human resources, legal, public relations and facilities management.
The designated note-taker can be an invaluable buffer between the technical teams scrambling to investigate the incident, and management who will want regular progress reports. Without that buffer, the need for regular updates might distract the investigation team from their work. Accurate notes can form the basis of open communication to an organisation’s staff, customers, media or other stakeholders. “Communicate throughout every part of this process,” Brian said.
Having contemporaneous notes also provides a valuable record for when it’s time to take a fresh look at what happened. “Always review and measure, see where you can improve and how you can make things better,” Brian said.
He recommended conducting a review within 24 hours of an incident. That’s the ideal timeframe because memories fade – we’re only human after all. The longer the time lag between the incident and the review, the less reliable everyone’s recollection will be. But if the review stage is postponed for any reason, good notes are the next best thing.
The post Dublin Information Sec 2018: take note of this advice to embed lessons from a data breach appeared first on BH Consulting.
This entry was posted in Breach Disclosure, breaches, Brian Honan, GDPR, security on October 16, 2018 by Gordon Smith.
Busting myths and misconceptions around GDPR and security
For better or worse, GDPR and security are often wedded together, when the relationship in fact is slightly more complicated. Sarah Clarke, a specialist in privacy, security, governance risk and compliance with BH Consulting, has picked apart some myths and misconceptions around the subject. She kindly gave us permission to use material she published in her excellent Infospectives blog. It’s well worth reading for anyone whose role involves data protection or security.
In part one, she outlines the media backdrop (clickbait headlines and all). She then goes into detail about what the GDPR really says about security and covers security as a source of privacy risks.
Sarah decided to write the blog partly out of frustration from seeing discussions about privacy, GDPR, and the role of security, where facts were in short supply. “Confusion stems from security vendors and security experts misunderstanding the GDPR, not filtering out their security bias, or willingly leveraging GDPR furore to drive a security-centric agenda,” she wrote.
Privacy experts often note that just one principle in GDPR specifically references security. As Sarah argues, the picture is more nuanced. In the daily reality of many organisations, this works a little differently. Security and data protection intersect where people, process, or technical controls are necessary to minimise the risk of harm to data subjects resulting from a personal data breach – or business as usual processing. The two also meet where a security function’s own people, process, or technical controls involve processing personal data. What’s more, both need to work together when security teams must assess, oversee, and/or pay for GDPR-related change.
Minimising risk to data subjects
“If I had to draw out one fact from everything above that needs to be drilled into the heads of many security practitioners (including me in the early days), it’s this: Data Protection is NOT just about minimising the probability and impact of breaches. Data Protection IS about minimising the risk of unfair impact on data subjects resulting from historical data processing, processing done today, and processing you and your third parties might do in future.”
The second part of Sarah’s blog looks at three myths about GDPR. First, is that the regulation makes encryption mandatory, or whether using the technology negates other controls. Secondly, she tackles the assumption that being certified to ISO27001 effectively ensures compliance with GDPR. Third, she asks whether existing security-related risk management is fit for privacy purposes.
Encryption mandated nowhere
Expanding on the first point, Sarah says encryption is a vital tool but not a mandatory one. “The GDPR doesn’t mandate ANY specific controls. It mentions a couple, like pseudonymisation and encryption, but it is all about control selection based upon your local risks… Rendering data unintelligible is an incredibly effective mitigation for post breach data related harm to both data subjects and the organisation, but it in no way negates the need to apply other security and data protection controls.”
Next, she dismisses the idea that becoming certified to the information security standard ISO27001 is the same as GDPR compliance. However she adds that certification helps this way. “The Information Security Management System (ISMS), described in ISO27001, represents a robust way to scope, assess, articulate, document, and manage risks associated with all aspects of organisational security, including personal data security.
Assessing security risk from a privacy perspective
Lastly, Sarah debunks the misconception that security-related risk management is suitable for privacy purposes. The reason being that “the assessment of security related risk is pretty poor in general”. Outside certain fields like the military, healthcare, or energy, few consider the impact on individuals or groups of data subjects. As we’ve seen above, this consideration is central to GDPR.
Sarah outlines “unavoidable and critical steps” to determining the rights and freedoms of data subjects. Finally, she wraps up the post with seven practical steps for organisations to review where security, data processing, and privacy meet. Whether you work in a security role or on the privacy side, we encourage you to read the full posts. Both go into great detail and include helpful external links to other resources and discussion points. Our thanks to Sarah for sharing the material with us. You can read her blogs at www.infospectives.co.uk or follow her on Twitter.
The post Busting myths and misconceptions around GDPR and security appeared first on BH Consulting.
This entry was posted in Data Protection and Privacy, GDPR, security on October 1, 2018 by Gordon Smith.
This entry was posted in British Airways, Data Breach, GDPR, Hacking, magecart, Payment Card Fraud, PCI DSS on September 11, 2018 by Dave Whitelegg.
This entry was posted in British Airways, Data Breach, GDPR, Hacking, magecart, Payment Card Fraud, PCI DSS on September 6, 2018 by Dave Whitelegg.
This entry was posted in Data Security, GDPR on August 28, 2018 by McAfee Enterprise.
This entry was posted in currys, Data Breach, dixons, Dixons Carphone, GDPR, Hackers, ICO, ncsc, PC World, PCI DSS on August 10, 2018 by Dave Whitelegg.
I'm sure the release of the GDPR on 25th May hasn't escaped anyone's attention. After years of warnings about the EU parliament's intended tough stance on enforcing the human right to privacy in the digital realm, a real 'game changer' of a global privacy regulation has finally landed, which impacts any organisation which touches EU citizen personal data.
The GDPR's potential hefty financial penalties for breaching its requirements is firmly on the radar of directors at large enterprises and small businesses alike, hence the massive barrage of emails we have all have received in recent weeks, on changes to company privacy statements and requesting consent, many of which I noted as not being GDPR compliant as obtaining "explicit consent" from the data subject. So there is a long way to go for many organisations before they become truly GDPR compliant state based on what I've seen so far in my mailbox.
Cybercriminals have been quick to take advantage of the GDPR privacy emails deluge, using the subject matter in their phishing attacks to cheat access to accounts and con victims.
NatWest Customers targeted by Scammers
Phishing campaign targeting Airbnb customers
Phishing campaign targeting Apple.
GDPR Fraudster con people with wave of Phishing Emails
On a positive GDPR note, also on 25th May, IBM developerWorks released a three-part guidance series written by myself, aimed at helping Application Developers to develop GDPR compliant applications.
Developing GDPR Compliant Applications Guidance
Part 1: A Developer's Guide to the GDPR
Part 2: Application Privacy by Design
Part 3: Minimizing Application Privacy Risk
Overshadowed by the GDPR coming in force, was the release of new NHS Data Security and Protection Toolkit, aimed at the NHS and their service providers, and the European NIS Directive (for telecom providers) went under the radar, but they are significant to those working in those industries.
Always make sure your Broadband Router\Hub does not permit remote administrative access (over the internet) and is always kept up-to-date with the latest security patches, otherwise, it will be at serious risk of being hacked and remotely controlled by cyber-criminals. As evidenced with month, after a DNS flaw in over 800,000 Draytek Routers has allowed hackers to take them over, malware called VPNFilter has infected 500,000 routers, and serious vulnerabilities has been reported in TP-Link EAP controllers.
IBM made headlines after banning its workers from using USB sticks, which I think is a good and reasonable policy. As quite frankly any modern enterprise, whether large or small, with a decent IT infrastructure and cloud services, staff shouldn't need to use USB devices to move data either internally or externally with third parties, so I see this as a rather smart business and security move to ban all USB devices, as it forces staff to use the more secure and more efficient technology made available.
As my @securityexpert twitter account crossed the 10,000 follower threshold Twitter advised 300 million users to reset their passwords after internal error. Apparently, the passwords for the Twitter accounts were accidentally stored in a database in their "plain text" value instead of using a hashed value for the password, as per best practice. I always strongly recommend Twitter users to take advantage and use the multi-factor authentication system Twitter provides, which reduces the risk of account hacking.
Breaches of note in May included a T-Mobile website bug which exposed personal customer data, Coca-Cola said an insider breached 8,000 accounts, and BMW cars were found to have over a dozen security vulnerabilities.
As always a busy month of new security patch releases, with Microsoft, Adobe, PHP, PGP, Google, Git, and Dell all releasing critical security updates to fix significant security flaws. Click the links for the full details.
Analysis of DDoS Attacks at Cloudflare, has revealed that while organisations in the UK have certainly upped their spending on DDoS mitigation, cyber-criminals are now responding by switching to Layer 7 based DDoS attacksSome interesting articles about the Welsh Cyber Security Revolution and a review of the NHS a year on from the WannaCry outbreak.
Reports of interest this month include the Thales Data Threat Report, which found UK businesses to be the most breached in Europe. The LastPass Psychology of Passwords Report which found 59% of people surveyed used the same passwords across multiple accounts, despite 91% of them knowing that using the same password for multiple accounts is a security risk. The 2017 Cylance Report stated the number of cyber-attacks on industries such as healthcare, manufacturing, professional services, and education rose by about 13.4% between 2016 and 2017.
IBM Release Application Developers Guidance to the GDPR (written by me)
NHS gets new Data Security and Protection Toolkit
European Directive NIS Comes into Force
Twitter Advises 330 Million Users to Change Passwords after Internal Leak
T-Mobile Website bug Exposed Personal Customer Data
UK Colleges Hit by 12 Cyber Attacks A Week
London Cyber Crime pair Jailed for £1m Phishing Scam
A Year after WannaCry, is NHS better prepared?
Scammers are using GDPR email alerts to Conduct Phishing Attacks
Microsoft Patches 70 Vulnerabilities for Windows IE/Edge, Exchange, Hyper-V & Chakra
PHP Programming Languages updated to Fix Multiple Bugs
Critical Vulnerabilities found in PGP/GPG, S/MIME
Multiple Flaws in TP-Link EAP Controller
Six Security Flaws discovered in Dell EMC RecoverPoint Devices
‘Roaming Mantis’ Malware is now 'Spreading across the Globe'
VPNFilter Malware Infects 500,000 Routers
Cyber-Criminals Switching to Layer 7 based DDoS Attacks
Thales Data Threat Report: UK Business theMost Breached in Europe
LastPass Psychology of Passwords Report
This entry was posted in adobe, apple, cyber security roundup, Data Breach, data protection, GDPR, Hackers, ibm, ICO, NHS, Twitter on June 1, 2018 by Dave Whitelegg.
Last week IBM developerWorks released a three-part guidance series I have written to help
Application Developers develop GDPR compliant applications.
The General Data Protection Regulation (GDPR) was created by the European Commission and Council to strengthen and unify Europe's data protection law, replacing the 1995 European Data Protection Directive. Although the GDPR is a European Union (EU) regulation, it applies to any organizations outside of Europe that handle the personal data of EU citizens. This includes the development of applications that are intended to process the personal information of EU citizens. Therefore, organizations that provide web applications, mobile apps, or traditional desktop applications that can indirectly process EU citizen's personal data or allow EU citizens sign in are subject to the GDPR's privacy obligations. Organizations face the prospect of powerful sanctions should applications fail to comply with the GDPR.
Part 1 summarizes the GDPR and explains how the privacy regulation impacts and applies to developing and supporting applications that are intended to be used by European Union citizens.
Part 2 provides guidance for developing applications that are compliant with the European Union’s General Data Protection Regulation.
Part 3 provides practical application development techniques that can alleviate an application's privacy risk.
This entry was posted in Application Security, appscan, Cloud Security, Data Breach, data protection, data retension, DPA, Encryption, enterprise security, GDPR, ibm, OWASP, Privacy, Security Awareness on May 31, 2018 by Dave Whitelegg.
The GDPR is the biggest privacy shakeup since the dawn of the internet and it is just weeks before it comes into force on 25th May. GDPR comes with potentially head-spinning financial penalties for businesses found not complying, so it really is essential for any business which touches EU citizen's personal data, to thoroughly do their privacy rights homework and properly prepare.
Sage have produced a nice GDPR infographic which breaks down the basics of the GDPR with tips on complying, which is shared below.
I am currently writing a comprehensive GDPR Application Developer's Guidance series for IBM developerWorks, which will be released in the coming weeks.
The GDPR: A guide for international business - A Sage Infographic
This entry was posted in data protection, GDPR, Privacy on March 8, 2018 by Dave Whitelegg.
Cyber Security Roundup for February 2018
February saw over 5,000 websites infected by cryptocurrency mining malware after a popular accessibility plugin called ‘BrowseAloud’ was compromised by hackers. This led to several UK Government and Councils websites going offline, including the Information Commissioner's Office, the Student Loans Company, and Manchester City, Camden and Croydon Council website. Symantec Researchers also announced that 'Crytojacking' attacks had increased 1,200% in the UK. Cryptojacking once involved the installation of cryptocurrency mining malware on users computers, but now it is more frequently used in-browser, by hacking a website and execute a malicious mining JavaScript as the user visits the compromised website, as with the case with the 'BrowseAloud' incident.
More than 25% of UK Councils are said to have suffered a breach in the last five years according to the privacy group Big Brother Watch, who said UK Councils are unprepared for Cyber Attacks.
There was a fascinating report released about Artificial Intelligence (AI) Threat, written by 26 leading AI experts, the report forecasts the various malicious usages for AI, including with cybercrime, and manipulation of social media and national news media agendas.
GDPR preparation or panic, depending on your position, is gaining momentum with less than 100 days before the privacy regulation comes into force in late May. Here are some of the latest GDPR articles of note.
Digital Guardian released an interactive article where you can attempt to guess the value of various types of stolen data to cybercriminals -.Digital Guardian: Do you know your data's worth?
Bestvpns released a comprehensive infographic covering the 77 Facts About Cyber Crime we should all know about in 2018.
On the international front, the Winter Olympic games were subjected to several cyber-attacks kicking websites and other services offline during the games. The UK government blamed Russia for the NotPetya attacks as part of an attack on the Ukraine. North Korea's nation-state allegedly backed APT37 (Reaper) is believed to be expanding its cyber-attack capabilities with an objective of causing disruption according to FireEye. An Open AWS S3 Bucket exposed the private information of thousands of FedEx customers, and Google reported it will longer label all HTTP websites at 'not secure' from July 2018.
February was yet another frantic month for security updates, which saw Microsoft release over 50 patches, and there were new critical security updates by Adobe, Apple, Cisco, Dell, and Drupal.
Government Websites, including ICO, Infected by Cryptocurrency Mining Malware
UK Councils are 'unprepared' for Cyber Attacks
'Cryptojacking' Attacks surge 1,200% in the UK
Open AWS S3 Bucket Exposes Private Information of Thousands of FedEx Customers
Winter Olympics hit with ‘Olympic Destroyer’ Malware during Opening Ceremony
Microsoft releases 50 Patches for IE/Edge, Windows, Office, ChakraCore & Flash
Adobe Releases Critical Security Update for Flash Player, as Exploited by APT 123
Apple Release patch for Telugu 'Text Bomb' bug that Causes System Crashes
Cisco Update eliminates DoS Vulnerability in Aggregation Services Router OS
Cisco releases a second fix for a Critical Vulnerability in ASA
Dell Storage Platform Security Bugs allows Root Access
Digital Guardian: Do you know your data's worth?
North Korea (APT37) expanding Cyber Attack capabilities, Intention is Disruption
Hackers could Obfuscate Malware through Code Signing and SSL Certificates
Avecto Microsoft Vulnerabilities Report 2017
The Global Cloud Data Security Study
2018 CrowdStrike Global Threat Report: Nation-State Cyber Attacks on the Rise
This entry was posted in adobe, APT37, Cisco, Cryptocurrencies, Cryptojacking, cyber crime, cyber security roundup, GDPR, ICO, microsoft, patching, petya on March 1, 2018 by Dave Whitelegg.
The new EU General Data Regulation will enter into force 25 May of this year. The GDPR contains rules concerning the protection of natural persons when their personal data are processed and rules on the free movement of personal data. The new regulation is not revolutionary but an evolution from the previous Data Protection Act 1998 […]
This entry was posted in data protection, Expert Views, GDPR, News_privacy, Scope, Tara Taubman-Barissian on February 8, 2018 by Tara Taubman-Bassirian.
Company preparations for GDPR compliance are (or should be!) in full swing with the 25th May enforcement date fast looming on the horizon. With that in mind, I found the following set of recent GDPR articles a decent and interesting read. The list was compiled by Brian Pennington of Coalfire, he has kindly allowed me to repost.
Eight Ways Board Directors Should Be Preparing for the GDPR Right Now
ISACA has pulled together a list of some of the main tips that can help any enterprise to tackle GDPR
Right to be Forgotten: Right Here, Right Now?
Get Ready For The EU’s Kafkaesque Data #Privacy Rules
It’s time to grow your brokerage through GDPR
A GDPR Survival Guide For Marketers
If you are after further GDPR swatting up, you could always read the actual regulation EU General Data Protection Regulation (EU-GDPR), and don't forget to read all the Recitilies.
If you have any offer GDPR related articles or blogs of note, please post in the comments.
This entry was posted in GDPR on February 8, 2018 by Dave Whitelegg.
2018 started with a big security alert bang after Google Security Researchers disclosed serious security vulnerabilities in just about every computer processor in use on the planet. Named 'Meltdown' and 'Spectre’, when exploited by a hacker or malware, these vulnerabilities disclose confidential data. As a result, a whole raft of critical security updates was hastily released for computer and smartphone operating systems, web browsers, and processor drivers. While processor manufacturers have been rather lethargic in reacting and producing patches for the problem, software vendors such as Microsoft, Google and Apple have reacted quickly, releasing security updates to protect their customers from the vulnerable processors, kudos to them.
The UK Information Commission's Office (ICO) heavily criticised the Carphone Warehouse for security inadequacies and fined the company £400K following their 2015 data breach, when the personal data, including bank details, of millions of Carphone Warehouse customers, was stolen by hackers, in what the company at the time described as a "sophisticated cyber attack", where have we heard that excuse before? Certainly the ICO wasn't buying that after it investigated, reporting a large number Carphone Warehouse's security failures, which included the use of software that was six years out of day, lack of “rigorous controls” over who had login details to systems; no antivirus protection running on the servers holding data, the same root password being used on every individual server, which was known to “some 30-40 members of staff”; and the needless storage of full credit card details. The Carphone Warephone should thank their lucky stars the breach didn't occur after the General Data Protection Regulation comes into force, as with such a damning list of security failures, the company may well have been fined considerably more by ICO, when it is granted vastly greater financial sanctions and powers when the GDPR kicks in May.
The National Cyber Security Centre warned the UK national infrastructure faces serious nation-state attacks, stating it is a matter of a "when" not an "if". There also claims that the cyberattacks against the Ukraine in recent years was down to Russia testing and tuning it's nation-state cyberattacking capabilities.
At the Davos summit, the Maersk chairman revealed his company spent a massive £200m to £240m on recovering from the recent NotPeyta ransomware outbreak, after the malware 'totally destroyed' the Maersk network. That's a huge price to pay for not regularly patching your systems.
It's no surprise that cybercriminals continue to target cryptocurrencies given the high financial rewards on offer. The most notable attack was a £290k cyber-heist from BlackWallet, where the hackers redirected 700k BlackWallet users to a fake replica BlackWallet website after compromising BlackWallet's DNS server. The replica website ran a script that transferred user cryptocurrency into the hacker's wallet, the hacker then moved currency into a different wallet platform.
In the United States, the Federal Trade Commission (FTC) fined toy firm VTech US$ 650,000 (£482,000) for violating a US children's privacy laws. The FTC alleged the toy company violated (COPPA) Children's Online Privacy Protection Rule by collecting personal information from hundreds of thousands of children without providing direct notice.
It was reported that a POS malware infection at Forever21 and lapses in encryption was responsible for the theft of debit and credit card details from Forever21 stores late last year. Payment card data continues to be a high valued target for cyber crooks with sophisticated attack capabilities, who are willing to invest considerable resources to achieve their aims.
Several interesting cybersecurity reports were released in January, the Online Trust Alliance Cyber Incident & Breach Trends Report: 2017 concluded that cyber incidents have doubled in 2017 and 93% were preventable. Carbon Black's 2017 Threat Report stated non-malware-based cyber-attacks were behind the majority of cyber-incidents reported in 2017, despite the proliferation of malware available to both the professional and amateur hackers. Carbon Black also reported that ransomware attacks are inflicting significantly higher costs and the number of attacks skyrocketed during the course of the year, no surprise there.
Malwarebytes 2017 State of Malware Report said ransomware attacks on consumers and businesses slowed down towards the end of 2017 and were being replaced by spyware campaigns, which rose by over 800% year-on-year. Spyware campaigns not only allow hackers to steal precious enterprise and user data but also allows them to identify ideal attack points to launch powerful malware attacks. The Cisco 2018 Privacy Maturity Benchmark Study claimed 74% of privacy-immature organisations were hit by losses of more than £350,000, and companies that are privacy-mature have fewer data breaches and smaller losses from cyber-attacks.
Meltdown & Spectre: Critical Intel, AMD and ARM Processor Vulnerabilities
ICO fines £400,000 fine on Carphone Warehouse following 2015 Data Breach
Forever 21 Blames Malware & Lapses in Encryption, for Payment Card Compromise
Major UK Infrastructure Cyberattack is 'When, not If' the National Cyber Security Centre
Hackers steal $400,000 (£290,000) BlackWallet Crypto-Currency after DNS Hack
US FTC fines VTech Toy Firm over Data Breach
Sensitive Medical Records on AWS (Cloud) Bucket found to be Publicly Accessible
Meltdown & Spectre Vulnerability & Patching Details
Microsoft releases 16 Security Updates for IE/Edge, .NET, SQL, Office, & Windows
Apple releases updates for Safari, iOS, watchOS and macOS
Adobe releases fix for Flash Player
CrossRAT: Advanced APT Undetectable Malware Globally Targeting all OS Platforms
CryptoMix Ransomware variant carries new ‘.tastylock’ Extension
Cyber Breach Trends Report: 2017 Cyber-incidents Doubled, 93% preventable
Carbon Black Report 2017 Threat Report
Netscout Annual Worldwide Infrastructure Security Report: DDoS Complexity Rising
Malwarebytes 2017 State of Malware Report: Spyware increasing
This entry was posted in AWS, bitcoin, Cryptocurrencies, cyber crime, cyber security roundup, data protection, GDPR, Hackers, intel, Meltdown, microsoft, Nation State, patching, Payment Card Fraud, ransomware, Spectre on February 1, 2018 by Dave Whitelegg.
Cyber Security Roundup for November 2017
One of the most notable data breaches disclosed this month was by Uber, given the company attempted to cover up the breach by paying off hackers. Over a year ago the transport tech firm was said to have paid £75,000 to two hackers to delete 57 million Uber account records which they had stolen. Uber revealed around 2.7 million of the stolen records were British riders and drivers. As a UK Uber rider, this could mean me, I haven't received any notification of the data breach from Uber as yet. The stolen information included names, email addresses, and phone numbers. Uber can expect enforcement action from regulators on both sides of the pond, the UK Information Commissioner's Office (ICO) said it had "huge concerns" about the breach and was investigating.
Jewson, Cash Converters, and Imgur all reported losing data due to hacks this month, while Equifax has reported suffering significant negative financial losses following their high profile hack of personal customer data. Equifax reported their net income had dropped by £20 million due to the hack, and their breach bill was coming in at a whopping £67 million.
November was a very busy month for security patches releases, with Microsoft, Apple, Adobe, Oracle, Cisco and Intel releasing a raft of patches to fix critical vulnerabilities. Apple even had to quickly release an emergency patch at end of November to fix a root access flaw reported in macOS High Sierra version 10.13.1. So just keep patching everything IT to ensure you and your business stays ahead of enterprising cybercriminals, the Equifax breach is a prime example of what can go wrong if system patching is neglected.
November also saw Open Web Application Security Project (OWASP) finally released an updated version to its Top Ten application vulnerabilities list, which is a ‘must know’ secure coding best practice for all software developers and security testers, especially considering that Akamai reported web application attacks had increased by 69% in the third quarter of 2017. Look out for an updated OWASP Top Ten IBM DeveloperWorks Guidance from me in December to reflect the updated list.
Uber paid off Hackers to delete the Stolen Data of 57 Million People
OWASP Top Ten 2017 Released: App Development Best Practice & Top Vulnerabilities
Jewson tells Customers their Data may have been Stolen
Cash Converters hit by Security Breach
Web Analytics may Jeopardise User Information and GDPR Compliance
Imgur Discloses years-old Data Breach that Compromised 1.7 Million Users
Hackers 'fool' iPhone X Face ID with a Simple Mask
Microsoft releases 20 Critical Security Updates for IE/Edge, Office, & Windows
Adobe releases fixes for 83 Security Vulnerabilities in Acrobat and Flash
Apple Addresses KRACK exploits in iOS and macOS Updates, and an Emergency Patch
US CERT issues warning on ASLR vulnerability in Windows 8 & 10
DDoS attacks have doubled in the six months, up 91% in the First Quarter of 2017
New Mirai variant back on the Radar after New Exploit Code Published
Akamai Q3 State of the Internet Security Report: WebApp Attacks up 69%
This entry was posted in adobe, apple, APT28, apt3, Cisco, Cobalt, cyber security roundup, Data Breach, data protection, DDoS, Equifax, GDPR, Hackers, Hacking, Malware, microsoft, Mirai, Nation State, patching, uber on November 30, 2017 by Dave Whitelegg.
December 2018 (7659)