« A Behavioral Analysis Unit assessment of a APT unsub | Main | Is Jotform a poster child for domain shutdown overkill? »

Monday, 06 February 2012

Privacy Awareness 101: Five easily remembered rules for protecting privacy

Tweet
Privacy is a topic we love to talk about but make little effort to practice.

Practicing privacy is in fact hard to do. Not only is the Internet is an information sharing medium, it is strongly commercially influenced as well.  Commercial interests are well served by gathering data about user interests and behaviors: targeted marketing, promotions and even product evolution all benefit from private data collection. (For clarity,  "private data" in this post includes personal identifying information, details about one's personal life, purchasing and personal interests...)

The ART of Collecting Private Data

Generally, we distinguish whether private data collection is beneficial, harmful or intrusive to users by assessing whether it satisfies accountability, responsibility, and transparency criteria (See "ART" inset at right). Unsurprisingly, public and comercial interest groups have conflicting views of how accountable, responsible and transparent data collection must be.  

Conflicts over privacy have become too routine and they often follow a similar course. A data collector publishes or changes a privacy practice and is criticized as behaving intrusively (Facebook, Google), or a third party discloses a data collecting behavior that is condemned as abusive (CarrierIQ). Privacy advocacy groups raise awareness and either insist on change or lobby for legislation that would require greater transparency and accountability from data collectors.  

In parallel, grass roots efforts by online safety and awareness raising organizations and experts advise users of privacy threats. These are valuable but they often follow the same methods and practice that the plethora of virus or malware removal articles do: lots of "what is..." and "how to..." but with little "why".

ART

Consent.
Is the user asked to consent to the collection and use of private data?

Notice.
Is the user aware that
private data are being collected?

Purpose.
Why are private
data being collected?

Extent of use.
How will the collected data be 
used, by whom, for how long?

Remanence.
What will be done with the
data when it is no longer useful?

While answering the "how" they fail to capitalize on the opportunity to drive home basic or first principles for private data protection. These are lost amid the many detailed explanations for adjusting privacy settings, installing browser plugins, and similar measures. Bombarding users with information overly complicates awareness raising.  

Simplify the privacy message

Think of these principles as you prepare privacy awareness messages or training:

  1. Sharing is the opposite of "keeping private". There is no corollary to whispering a secret to a friend in cyberspace. Once you share or disclose any bit of information in cyberspace it is potentially public and will remain so forever.
     
  2. "Free" almost always comes at a cost to your privacy. Data collectors and social pressures make the temptation to accept free service in exchange for giving up personal data extremely hard to resist. If you can't resist, at least enter the contract with eyes wide open: there are virtually no circumstances where a giveway, free access or free use of an Internet service or social media site comes free.    
     
  3. Knowledge is power. Boring as they may be, read the terms of use (terms of service) and privacy policies, at least to the point where you know whether you are consenting to third party sharing of your private data, conceding copyrights to your work, or agreeing for your private data (including photos) to be used for marketing purposes.
     
  4. Respect for private data is critical to any commitment to share you make. Do some homework. Be confident that the party whom you are about to trust will respect your privacy before you share any information.

  5.  Choose what you share wisely. There's no substitute or privacy setting that can  compensate for poor judgment. Ultimately, you are accountable or responsible for the benefits or harm resulting from what you say, share or reveal.

Encourage those you train, family members, and friends to take ownership of private data.

If you enjoyed this post, you may want to read There Are Only Three True Privacy Threats.

Posted at 11:23 AM in Stop Think Connect |

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

Privacy goes beyond just your personal privacy. Many of us are charged with protecting the privacy of employees, co-workers, and customers. I have written a series of articles on monitoring your "online footprint" through Google Alerts. Please feel free to check out the articles.

The most recent article is at http://caffeinesecurity.blogspot.com/2012/01/monitoring-for-leaked-company-documents.html and contains links to the previous articles.

Posted by: Ken | Wednesday, 08 February 2012 at 01:03 PM

The comments to this entry are closed.

Find me on Mastodon and Facebook

Spotlight Posts

  • FTC's proposed Trade Regulation Rule on Impersonation of Government and Businesses is important for #infosec
    M3AAWG comments on the FTC's proposed rule Trade Regulation Rule on Impersonation of Government and Businesses is available. I was one of the contributors to the comment. In the comment, M3AAWG "suggests additional regulatory solutions and best practices to complement the goals of this rule, such as clarifying the scope of the rule to include the use of domain names in impersonation schemes and the use of technologies that enable impersonation" and the important role that Whois plays in investigating impersonation and fraud. Several reports that my Interisle colleagues and I published are cited in the comment, along with the...
  • Cybercrime Information Center reports sharp increases in phishing attacks, unique domains reported in August-October 2022 time period
    A recent ebb in domain names reported for phishing created some euphoria in the domain industry. With phishing activity, as with tides, ebbs are invariably followed by flows. In their August- October 2022 Quarterly Phishing Activity, the Cybercrime Information Center observed a 40% increase in phishing attacks and a nearly 20% increase in unique domain names reported for phishing.
  • Cybercrime Information Center's YouTube Channel
    My colleagues and I at Interisle have created a YouTube channel to complement the quarterly reporting and studies of cybercrime we host at the Cybercrime Information Center. Our goal is to share, in a few minutes, the findings and insights from our research in a format that's easily accessible and shareable, informative, and entertaining. The inaugural videos provide 2-5 minute summaries of our annual Phishing and Malware Landscape studies. We'll continue to produce videos of our annual studies. If you like what you see, leave us a comment.
  • Malware Landscape 2022: unabated malware growth, continued exploitation of IoT devices
    My colleagues at Interisle and I have published a study, Malware Landscape 2022: A Study of the Scope and Distribution of Malware. The study, which analyzed 2.5 million records of distinct malware events from May 2021 to April 2022 collected by the Cybercrime Information Center, explains what malware was most prevalent, where malware was served from, and what resources criminals used to pursue their attacks.
  • New TLDs are coming #Dangerclose.
    A Domain Name Wire post, Time to pay attention to the next round of new TLDs, begins with an ominous: They’re coming. Eventually. While not as dramatic or enduring as Arnold Schwarzenegger's "I'll be back", the reporter cites policy activity at ICANN as evidence that new TLDs are coming. Eventually. In a September 2019 post, and in response to the ICANN memorandum, Readiness to Support Future Rounds of New gTLDs, I asked, Has enough been done to study and rectify the concentration of security threats in the new TLD space? In that post, I quoted correspondence from ICANN's security advisory...

Search

My Photo

Categories