Posts

Is CHIP & PIN Credit Card Security Worth $100M? (Are You Serious?)

,

I’ve had dozens of media requests for interviews and countless more email inquiries from people concerned about the Target data breach.  At first, everyone just wanted to know details of how it happened, how big the breach was, and what they should do about it if their credit cards were at risk.  Now that the initial shock of it is over, we are on to a bigger question:

How do we keep breach from negatively affecting so many Americans? 

Breach will always happen. If it’s digital, it’s hackable. It’s coming to light that the Target breach may have been due to the computer access an HVAC WORKER (no, not an entire company, an individual WORKER) had to Target’s systems. While there is no guaranteed way of preventing fraud, there is a pretty reliable answer out there, and it’s been around for decades.  That answer is for the US to finally catch up to more than 80 countries around the world and start using chip and PIN enabled credit cards, also known as EMV, smart cards, or microchip cards.

By placing microchips in credit cards, it makes it much harder for criminals to clone the cards than the relatively easy-to-crack magnetic stripes.  Chip cards take the cardholder information and turn it into a unique code for each transaction. They also often require additional authentication, such a personal identification number, or PIN. So in the case of the Target breach, the stolen data couldn’t be used to easily create duplicate credit cards, drastically reducing the value of the stolen data. The possibility for online abuse of the numbers (known as Card Not Present transactions) would remain a threat from the breach, but it would be a fraction of the problem (and solvable in other ways).

France has been using this technology since 1982, the UK since 2001, and Canada since 2007. In the first five years after the UK started using chip & PIN, fraud went down 70%.  In that same time period, the cost for fraud in the US had DOUBLED. It’s not that the technology is perfect, it’s that the increased security convinces criminals to target those who don’t use the technology (which to this point has only been, well, the United States). 

If there is such a great guarantee on fraud reduction by switching to chip and PIN cards, why is the US resisting it?  The answer:  MONEY.  Banks, credit card companies, and retailers have been caught in a battle of wills for many years now, with retailers not wanting to spend money on installing new chip-friendly card readers unless banks are committed to spending money on issuing new cards.

The cost of implementing the card system can be staggering. Target is expected to spend around $100 million to install new chip card readers in an effort to protect against cyber theft.

So is it worth $100 million to implement chip and PIN technology?

Without question. And even Target thinks so, or at least it did ten years ago when it was at the forefront of implementing chip & PIN technology.  From 2001-2004 they spent $40 million to adopt chip-based credit-card technology and installed 37,000 new point-of-sale terminals to handle chip cards across its U.S. stores.

Ultimately they backed out because their marketing strategy at the time just didn’t catch on with consumers and because it was taking “A FEW SECONDS” longer per customer to get through the line.  I don’t know about you, but I’d wait an extra two seconds in order to know my data is secure.  And I bet Target victims would take back the time it is taking them to change their credit card information with every online site or monthly automatic payment company their now-compromised card was used for.

To put the cost in perspective, $100 million is about $1.00 per Target breach customer. I bet the average credit card holder would be willing to foot the $1 bill to dramatically reduce their risk (even if it’s not a perfect solution). In fact, the cost of fraud gets passed on to customers anyway (higher credit card rates, higher retail prices), so why not spend that same money (or far less, in fact) on securing the transactions in the first place? 

  • A survey of 936 credit unions indicates the Target breach has cost credit unions an average of about $5.10 per card affected by the security lapse.  The Credit Union National Association said these costs most likely do not include any fraud losses, which are likely to occur later.
  • In 2012, the Ponemon Institute’s annual study showed the average cost of a data breach in the US is $188 per person notified.
  • For credit issuers, the average cost per record breached is set at $280.
  • Aite Group reports that card fraud in the U.S. already costs the card payment industry (primarily issuers) $8.6 billion a year.

 You tell me if it’s worth it! (Seriously, I want your thoughts and comments below)

How do we get there?

It seems crystal clear to me that fraudsters have gotten so sophisticated that we either need to join together (retailers, banks, and credit card companies) or we will fail to stop this trend of Mega-Breaches.  Pardon the pun, but clearly we have put the “target” on our own backs; criminals have increasingly focused on the US because we are so far behind.

James Dimon, CEO of J.P. Morgan Chase sees this as an opportunity for real change.  He said,  “All of us have a common interest in being protected, so this might be a chance for retailers and banks to for once work together, as opposed to sue each other like we’ve been doing the last decade.”

I see 4 overarching steps that need to be taken:

  1. Retailers, credit card processors, banks, VISA, MasterCard and American Express need to stop focusing on their own self-interest (profit) and start to work together for the common good. Of course, they won’t do this without incentive, so…
  2. Congress should create  a U.S. equivalent of the U.K. Card Association that sets policy and has the authority to fine those stakeholders who fail to act.
  3. In other words, we will need legislation to ensure that the “liability shift” dates projected for 2015 are met.  This means that if credit card companies have issued chip and PIN cards, but retailers have not installed machines to read them, the merchants would be held accountable for any losses due to fraud.
  4. Everyone needs to understand that there will be costs associated with the change, just like there are costs when you install a security system, a lock on a door or a vault in a bank.

Will chip and PIN cost retailers? Yes. Will chip and PIN cost banks? Yes. Will it cost consumers? Yes. Will it cost (in total) as much as the fraud resulting from even a single major breach like Target. NO. It’s time to start thinking about security from a long-term perspective, and long-term profitability will follow.

John Sileo is an author and highly engaging speaker on internet privacy, identity theft and technology security. He is CEO of The Sileo Group, which helps organizations to protect the privacy that drives their profitability. His recent engagements include presentations at The Pentagon, Visa, Homeland Security and Northrop Grumman as well as media appearances on Rachael Ray, 60 Minutes, Anderson Cooper and Fox Business. Contact him directly on 800.258.8076.

Cyber Security Expert John Sileo on Fox Money

Facebook knows what you said, EVEN IF YOU DELETE B4 POSTING!

delete keySelf-censorship on Facebook

Do you ever delete the words you type on Facebook before you hit post?

Have you ever started to type a status update that you thought was hilarious…until you realized your boss might not appreciate your 8th-grade humor? So what’d you do? You quickly hit the delete key and watched your comment disappear forever, right? Not exactly.

What if you are ready to make a snarky comment to Greg, the upperclass jerk who stole your high school girlfriend (and is about to get a divorce, ha ha), but decide to take the high road just before hitting the “post” button and instead, wish him well on his pending journey of love (despite the fact that it’s bound to fail)?

No harm done, right?  You never hit the post button, so no one ever saw it! Well, it turns out that’s not quite how it works in Facebook Land.

Sauvik Das, a Ph.D. student at Carnegie Mellon and summer software engineer intern at Facebook, and Adam Kramer, a Facebook data scientist, conducted a study of 5 million English-speaking Facebook users in which they studied aborted status updates, posts on other people’s timelines, and comments on others’ posts.  Specifically they looked at what they called “self-censored” texts, entries of more than five characters that were typed out, but not posted.

Now, let’s make it clear that the researchers did not reveal what the actual content of the posts they analyzed were – just how common it is for self-censorship to occur.  You see, Facebook stores information as you type, much like Gmail saves draft messages automatically as you type them.  In other words, it is definitely  possible for Facebook to store information on what you typed, whether you post it or not!

Why wouldn’t they want to see what you deleted – it’s the most honest version of what you think (and then think better of sharing as you step back a bit).

So far Facebook has not used the information for their own benefit, but they are very interested in it nonetheless.  As Das and Kramer put it: “Last-minute self-censorship is of particular interest to SNSs [social networking services] as this filtering can be both helpful and hurtful. Users and their audience could fail to achieve potential social value from not sharing certain content, and the SNS loses value from the lack of content generation.”  In other words, Facebook could be making money off of what you aren’t posting through lost advertising opportunities.

The lesson is a good one – be mindful of what you type on any social networking site, as it will always be somewhat public, permanent and powerful, EVEN IF YOU DELETE IT BEFORE POSTING. 

John Sileo makes privacy and security sticky, so that it works. He is the CEO of The Sileo Group, which helps organizations to protect the privacy that drives their profitability. His recent engagements include presentations at The Pentagon, Visa, Homeland Security as well as media appearances on 60 MinutesAnderson Cooper, Fox Business and The Rachael Ray Show. Contact him directly on 800.258.8076.

Identity Theft Speaker Shares Latest Statistics on Cost of ID Theft

id theft costI got my start as an identity theft speaker. I write and speak on the importance of being vigilant about protecting yourself from identity theft and online fraud from many angles: the stress of trying to reestablish your credibility, rebuilding relationships, regaining control of your personal information, perhaps even fighting to stay out of jail as I had to do. So while I’m an identity theft speaker, my motivation is always completely human. We as humans make flawed decisions about how we fail to prepare for things like identity theft. We as humans are the ones that make the difference in fighting this crime. As it turns out, our wealth is at risk.

According to the Bureau of Justice Statistics (BJS), there is one more important reason to be especially careful: financial implications.   In the latest National Crime Victimization Survey, identity theft cost Americans $10 billion more than all other property crimes.  To be exact, identity theft cost Americans $24.7 billion compared to just $14 billion for household burglary, motor vehicle theft, and property theft combined.  The $24 million is made up of direct losses (money thieves got by misusing a victim’s personal or account information) and indirect losses (such as legal fees and bounced checks), with the majority coming from direct losses.

Now, you wouldn’t dream of going off for the night and leaving your front door wide open, or leaving your car keys in plain sight, but how many of us do the equivalent with our identities? Do you surf on free WiFi at your favorite café, while in the airport or at your hotel? Have you locked down your smartphone with a passcode, limited location tracking and turned on the built-in privacy and security settings? Have you ever customized the share settings in your favorite social network? Maybe not.

Here are some key points from the BJS report:

  • 85% of theft incidents involved the fraudulent use of existing accounts, rather than the use of somebody’s name to open a new account.
  • People whose names were used to open new accounts were more likely to experience financial hardship, emotional distress, and even problems with their relationships, than people whose existing accounts were manipulated.
  • Half of identity theft victims lost $100 or more.
  • Americans who were in households making $75,000 or more were more likely to experience identity theft than lower-income households.

Identity thieves have also begun targeting smartphone and social media users, knowing that user ignorance and the learning curve associated with using sites make it easy to hit the bull’s-eye.

In addition, the increase in occurrences of data breaches puts us even more at risk.   Javelin Strategy & Research found that someone who is a victim of an online data breach becomes 9.5 times more likely to have their identity stolen.

For solutions to these and many other identity theft and data breach problems, check out identity theft speaker John Sileo’s book, Privacy Means Profit: Prevent Identity Theft and Secure Your Bottom Line.

John Sileo is an author and highly engaging speaker on internet privacy, identity theft and technology security. He is CEO of The Sileo Group, which helps organizations to protect the privacy that drives their profitability. His recent engagements include presentations at The Pentagon, Visa, Homeland Security and Northrop Grumman as well as media appearances on 60 MinutesAnderson Cooper and Fox Business. Contact him directly on 800.258.8076.

Target Data Breach Touches 40 Million In-Store Shoppers

, ,

If you are one of the 40 million customers who have used a credit or debit card at Target stores in the United States between November 27 and December 15, you’d better start checking your accounts for fraudulent activity.  Target confirmed that the data stored on the magnetic strip of cards (customer names, debit or credit card numbers, and card expiration dates) were taken, along with the three-digit security codes  (CVVs) often imprinted on the backs of cards.

The type of data stolen would allow thieves to create counterfeit credit cards and, if pin numbers were intercepted, would also allow thieves to withdraw cash from ATM machines.  Only in store purchases are at risk, so online shoppers need not worry.

Target spokeswoman Molly Snyder would not comment on how customers’ data were stored or encrypted prior to the attack, saying that would be part of the ongoing investigation.  Target immediately notified law enforcement authorities and financial institutions, and the issue is being investigated by the Secret Service and a third-party forensics firm.

This breach is one of the largest ever of American consumer data, nearly matching that of TJX (TJ Maxx and Marshalls stores), which experienced a data breach in 2007 that affected more than 45 million customers.  2013 has been a particularly bad year for breaches overall.  Overall, one in four Americans have been told that some personally identifiable information has been lost or compromised because of data breaches, according to a recent report from Experian, and the pace of attacks is expected to continue rising through 2014.

In a letter sent to Target customers, Target officials say those who have noticed irregular activity on their accounts should call the firm at 866-852-8680.  In addition, all Target shoppers should:

  1. Review their credit card activity online on a daily basis to monitor for suspicious activity.
  2. Set up automatic account alerts with your credit card provider to quickly detect any misuse of cards.
  3. Visit AnnualCreditReport.com to see if there are any newly established, fraudulent accounts set up.
  4. Cancel your credit card if they notice any suspicious behavior. If it’s a debit card, I would cancel it no matter what given that it connects directly to your bank account. Make sure to transfer balances, miles and to switch any auto-pay accounts to the new card.
  5. Freeze your credit with the 3 credit scoring bureaus.
  6. Consider ID Theft monitoring services to help you keep track of abusive behavior of your information online.

John Sileo is an author and highly engaging speaker on internet privacy, identity theft and technology security. He is CEO of The Sileo Group, which helps organizations to defend the data that drives their profitability. His recent engagements include presentations at The Pentagon, Visa, Homeland Security and Northrop Grumman as well as media appearances on 60 Minutes, Anderson Cooper and Fox Business. Contact him directly on 800.258.8076.

Interview with Reputation.com on Business Identity Fraud and Online Reputation

reputationcomDo you want to know how businesses can protect themselves and enhance their online reputations?

Would you like to know the answers to the following questions?  

  • Are businesses adequately protecting themselves online? If not, what more should they be doing?
  • What is business fraud and how does it differ from consumer fraud?
  • What should companies be thinking about when they get involved with social media?
  • What can businesses do to monitor their online reputation?
  • Should companies respond to everything negative said about them online? If not, what should they focus on?
  • Should businesses be paying attention to their employees online? If so, how can they do that in an ethical way?
  • What is the most important advice you would give a new business just starting to develop an online presence?

To learn the answers to these important questions, read the interview I recently did with Reputation.com.

Fighting Friendly Fraud (Webinar): 5 Insider Theft Secrets to Protect You

Do you know what’s behind the masks your employees may wear? A staggering number of businesses falter and even fail because someone on the inside – an employee, vendor or even a partner – steals money, goods, data or intellectual property from the organization. Will yours be one of them? Not if you learn about the warning signs of fraudsters and the weaknesses in your current hiring procedures.

The strongest indicator that your business is at risk? Denial. If you have ever said to yourself, “My people would never do that,” or “were too small to be worth a fraudster’s time”, you are caught in a cycle of self-delusional naiveté. Most inside theft happens at the hands of a “trusted” team member. In fact, insider theft and fraud aren’t generally committed by experienced criminals.

In John Sileo’s webinar (video above), he shares his own history of experiencing a fraudulent case of insider theft that destroyed his small business, cost him nearly $300,000 and almost landed him in jail. His story will serve as the framework for five insider secrets that will help you and your business avoid his fate.

In Fighting Friendly Fraud, you will learn:

  • 10 Fraud Early Warning Signs
  • What goes on inside the mind of a friendly fraudster
  • Why good employees sometimes make bad choices
  • 5 Universal truths that underlie most types of fraud
  • Simple, inexpensive controls you can put in place to discourage fraud
  • Deterrence tactics to discourage the most devious inside spies

If you learn these five lessons, it will save you from learning others the hard way!

Using an iPad to Your Competitive (and Secure) Advantage

If you received an iPad for the holidays (or already have one), you own the most powerful productivity tool invented in the last 20 years – it’s like command central for your life and work. I use the iPad as a step-by-step, centralized way to keep tabs on everything related to my business. Over a cup of coffee, I consume highly-relevant information (no Angry Birds at this point in the day) in a low-stress way simply by clicking through my iPad apps in a consciously prioritized order. I’m not actually taking action on anything at this point, just getting an overview of the appointments, current events, and communications that will make me more effective. That way, when I get down to work,  I know exactly what should get my attention. The routine is always the same, so I never have to remember what I need to do except to open my iPad before I officially start the day. The process takes me about 20 minutes, and by the time I get to work, my brain has sorted most of the information and knows where to start. Here’s how I consciously prioritize my apps (see screen shot):

  1. Calendar (iCal). I look at my calendar first to remind myself of appointments taking place that day.
  2. Project Planner (OmniFocus). I use OmniFocus to organize larger projects. It is a great way to do a brain dump of all of the little tasks that clutter my creative thinking. These project lists are shared with my team and give us a centralized way to track and prioritize our business.
  3. Event Management (eSpeakers and SalesForce). Because I speak professionally as my main source of revenue, I utilize an industry specific app called eSpeakers that tracks every aspect of my speaking engagements. In 30 seconds, I have a quick view of what speeches are on the horizon and what tasks need to be completed. Since this is a revenue center of my business, I want to keep very close tabs on what is taking place. SalesForce is for leads, accounts and contact management.
  4.  News (local paper, USA Today, Zite, Instapaper, NPR). Once I have a view of the day ahead, I skim the news (general and industry specific) to determine if there are any stories I need to pay closer attention to. This isn’t a complete reading, just to put it on my radar.
  5. Note Taking (Evernote). I use Evernote as a clearing house for all of the notes I take, whether it’s an article, random thoughts, etc. By keeping my note taking app close to the news apps, I record anything highly relevant.
  6. Social Networking (HootSuite). I use HootSuite to monitor my Facebook Fan Page, Twitter Feed and LinkedIn Profile. I might quickly post an interesting piece of current news in my field or an upcoming event or media appearance. I do NO personal updates at this point in the day. Business only.
  7. Email. Email always seems like the most important task, but I find it to be distracting. I leave it until last and simply read through all emails and flag them for later work. If they require more than a three word answer, I don’t use my iPad to communicate. I do this once I am sitting at my computer; in the meantime, my subconscious has generally come up with the necessary responses.
You get the point. When you have covered the critical items, close the iPad and go make breakfast. Let your brain mull it over and process what’s important and what’s a waste of time. Don’t continue to consume more information, spend the rest of your day acting on what you’ve already reviewed. This will keep you from information overload.
If you apply this method, your iPad desktop will look completely different, customized to your needs, industry and interests. The power here is in the cutomization of what makes you effective and efficient and the ritualization of the process. Instead of remembering 20 things, you remember one – open your iPad before your work day begins. Twenty minutes well spent can give you a sizable competitive advantage. Try it for a week and see what you think. If you have other ways that you leverage your iPad for work, share them in the comments below. And don’t forget to keep all of this mission-critical data out of the hands of identity thieves and competitors by following these 7 Simple Security Steps:

7 Simple Security Settings for Your iPad

  1. Turn On Passcode Lock. Your iPad is just as powerful as your laptop or desktop, protect it like one. Your iPad is only encrypted when you enable the passcode feature. (Settings/General)
  2. Turn Simple Passcode to Off. Why use only an easy to crack 4-digit passcode when you can implement a full-fledged alphanumeric password? If you can tap out short emails, why not spend 5 seconds on a proper password.
  3. Require Passcode Immediately. It is slightly inconvenient and considerably more secure to have your iPad automatically lock up into passcode mode anytime you leave it alone for a few minutes.
  4. Set Auto Lock to 2 Minutes. Why give the table thief at your favorite café more time to modify your settings to his advantage (to keep it from locking) as he walks out the door with your bank logins, emails and kid pictures.
  5. Turn Erase Data after 10 Tries to On. Even the most sophisticated passcode-cracking software can’t get it done in 10 tries or less. This setting wipes out your data after too many failed attempts. Just make sure your kids don’t accidentally wipe out your iPad (forcing you to restore from your latest iTunes backup).
  6. Use a Password Manager. Your passwords are only as affective as your ability to use them wisely (they need to be long and different for every site). Keeping your passwords in an unencrypted keychain or document is a recipe for complete financial disaster. Download a reputable password-protection app to manage and protect any sensitive passwords, credit card numbers, software licenses, etc. Not only is it safe, it’s incredibly convenient and efficient.
  7. Avoid Untrustworthy Apps. Not all applications are friendly. Despite Apple’s well-designed vetting process, there are still malicious apps that slip through the cracks to siphon data out of your device. If the app hasn’t been around for a while and if you haven’t read about it in a reputable journal (Macworld, Wall Street Journal, New York Times, etc.), don’t load it onto your system. 

It will only take a minute to implement these steps and will encourage thieves to move on to the next victim.

John Sileo is an award-winning author and speaks worldwide on the dark art of deception (identity theft, data privacy, social media manipulation) and it’s polar opposite, the powerful use of trust, to achieve success. He is CEO of The Sileo Group, which advises teams on how to multiply results and increase performance. His clients include the Department of Defense, Pfizer, the FDIC, and Homeland Security. Contact him on 800.258.8076 or learn more at ThinkLikeASpy.com.

Data Breach Expert Sileo Talks to Fox Business

, ,

Victim of a Cyber Attack? What You Should Tell Customers

By Donna Fuscaldo, Fox Business

It seems like every day consumers are learning of data breeches from companies like Sega, Sony and Google. Major corporations like these tend to have the funds and resources to recover from an attack, but for small businesses, that’s often not the case.

A slow response and lack of communication with customers are among the missteps many small businesses make when facing an attack, both of which can cause irreparable damage to the business.

“When consumers are a victim of ID fraud based on interaction with a small business, 1 in 3 never come back,” said Phil Blank, senior analyst for security and fraud at Javelin Strategy & Research.

While data breaches hitting major banks and corporations tend to dominate headlines, small businesses are increasingly becoming targets. Hackers like to prey on small businesses because computers and mobile phones tend to be used for both work and personal use, and many small businesses don’t have an IT staff monitoring and protecting operations.

According to Javelin, small business fraud totaled $8 billion in 2010. Of that, banks, merchants and other providers absorbed $5.43 billion of the loss while the cost to victims was $2.61 billion.

Although the first line of defense against an attack is to have proper procedures and policies in place, if it does happen, there are steps that need to be taken immediately to mitigate the impact. The experts advise owners’ first step should be to communicate with customers quickly.

“You don’t have a large amount of time between a hack and when you tell a client,” said Blank at Javelin. That doesn’t mean you have to tell clients within a day of it happening, but you shouldn’t wait a couple of months either. Blank said customers should be notified within a week of the hack. “If people know within a week they have the ability to do something about it.”

To ensure the small business is communicating correctly to the customers, John Sileo, founder of ThinkLikeASpy.com and a professional identity theft speaker, said a small business owner should get professional help, whether it’s a privacy lawyer or a company that deals with data breach responses.

Each state has different laws and regulations pertaining to data breaches and a data breach company will be well versed in the rules governing the states. “This is too big for a small business to handle internally,” said Sileo. “They could end up making some legal choices without knowing it that can get them in hot water.”

John Sileo is a data breach expert and data breach keynote speaker on identity theft, social media exposure, data breach and weapons of influence. Bring him in to motivate your employees to care about data security. Contact him directly on 800.258.8076.

5 Steps to Avoid Facebook Destruction in Business

, ,

How should my business balance the risks of social media with the rewards of this increasingly dominant and highly profitable marketing medium? That’s the very insightful question that a CEO asked me during a presentation I gave on information leadership for a Vistage CEO conference.

Think of your move into social media (Facebook/Fan/Business Pages, LinkedIn, Twitter, YouTube, etc.) like you would approach the task of helping your fifteen-year-old daughter prepare to drive on her own. You love her more than anything on earth and would do anything for her (just like you will go to great lengths grow your business), but that doesn’t mean you just hand her the keys. Trying to forbid or ignore the movement into social marketing is like telling your teen that they can’t get their license. It isn’t going to happen, so you might consider putting down the denial and controlling those pieces of change that are within your power. The task is to maximize the positives of her newly bestowed freedom while minimizing any negatives; the same is true in social media.

Here’s a simple plan to follow that will help keep you safe and productive:

  1. Understand the Risks & Rewards. Just like you need to know the risks of a teen driving (peer pressure, alcohol, inexperience, inferior equipment), you need to fully understand the risks of operating this powerful piece of equipment we call social media or social networking. Privacy Concerns: Users who fail to customize their Facebook privacy, security and sharing settings are giving away massive amounts of information to other Facebook users, Facebook Vendors (e.g., Farmville), Facebook itself and potentially competitors, thieves and social engineers. Over Exposure: You can share too much on Facebook, including posts, photos and videos that you later regret uploading. If done improperly or without thought, this can lead to increased risk of identity theft, reputation hijacking, burglary or fraud. Reputation Damage: AFLAC fired comedian Gilbert Godfrey as their spokesperson for making a negative comment about the insurance giant on his wall. How you and your employees use social media directly influences your reputation.  Account Takeover: Imagine a pornography crime-ring taking over your fan page for a day. It’s usually not this extreme of a case, but accounts are constantly being compromised and used for nefarious and illegal purposes (sending SPAM, peddling pornography, covering crimes). Just because there are risks doesn’t mean you abandon the medium. It means that you prepare for them, just like training your daughter to drive defensively, break properly on ice and make smart choices about who gets in the car.
  2. Define Your Destination. Many businesses that utilize social media don’t actually know why they are using it, other than it’s the thing to do. But using it effectively takes a huge time and knowledge investment, so make sure you define what you want to achieve before you invest. Are you there to make friends, to network, to increase visibility, reshape your reputation or improve customer service? Driving without a destination in mind might be fun, but it will ultimately get you nowhere.
  3. Choose the Right Equipment. Once you have defined your objective, you will have a better idea of which social medium to use (Facebook, Fan Page, Twitter, etc.). If your objective is to get your daughter safely from one place to another, you will choose a very different car than if you are trying to enhance her image with friends by buying a sports car. Trying to be part of every last social network means that you will use none of them effectively. Choose one or two platforms and take the time to perform the final two steps.
  4. Fasten Your Seat belt. An hour spent understanding and modifying the default privacy and security settings (which are very lax by default) on Facebook or another social site can save you and your organization tragic amounts of data loss and abuse. Our refusal as a society to take this simple, available step to protect our information is the equivalent of not fastening our seat belts while driving. Is it slightly inconvenient and a occasionally uncomfortable? Yes. Does it drastically increase your safety? Without question. With great power comes great responsibility, and we must start communicating that to others around us.
  5. Educate Your Driver. This knowledge, from awareness to customization, is only effective if it is passed on to others. You might know how to drive safely, but that doesn’t mean your daughter has picked it up by osmosis. The same is true inside of your organization; it’s not good enough for you do drive safely, the other members of the team must do the same – and not just for their own good, but because it also helps you be safe. After all, just like your daughter will ride in another teen’s car (and you want them to be well trained), your contacts will be handling your data in a social context (think of the picture of you at a St. Patrick’s Day party they consider posting) and need to know how to treat it.

There is nothing gained by ignoring or denying this social movement. It won’t be stopped and you will be part of it, either directly or indirectly. In turn, your business will be affected by how the employees and executives approach and even leverage the energy of social media. If you’re not out there educating your drivers, they are off doing it on their own anyway, seat belt-less and clueless.

John Sileo trains organizations on information leadership, including social media control, identity theft prevention and reputation management. His satisfied clients include the Department of Defense, FDIC, Pfizer and Homeland Security. To bring John in to speak to your organization, contact his staff on 800.258.8076 or watch him entertain audiences with vital content at www.ThinkLikeASpy.com.

Information Security Speaker: 5 Information Espionage Hotspots Threatening Businesses

, ,

You and your business are worth a lot of money, whether your bank accounts show it or not. The goldmine lies in your data, and everyone wants it. Competitors want to hire the employee you just fired for the thumb drive full of confidential files they smuggled out. Data thieves salivate over your Facebook profile, which provides as a “how to” guide for exploiting your trust. Cyber criminals are digitally sniffing the wireless connection you use at Starbucks to make bank transfers and send “confidential” emails.

Every business is under assault by forces that want access to your valuable data: identity records, customer databases, employee files, intellectual property, and ultimately, your net worth. Research is screaming at us—more than 80% of businesses surveyed have already experienced at least one breach (average recovery cost: $6.75 million) and have no idea of how to stop a repeat performance. These are clear, profit-driven reasons to care about who controls your data.

Information Espionage Hotspots

Here are 5 Information Espionage Hotspots that your business should address now:

  1. Lousy training. One of the costliest data security mistakes I see companies make is attempting to train employees from the perspective of the company. This ignores a crucial reality: All privacy is personal. In other words, no one in your organization will care about data security until they understand what it has to do with them. Strategy: Give your people the tools to protect themselves personally from identity theft. In addition to showing them that you care (a good employee retention strategy), you are developing a privacy language that can be applied to business. Once they understand opting out, encryption and identity monitoring from a personal standpoint, it’s a short leap to apply that to your customer databases and intellectual property. See the video above for an example of bridging the worlds of personal privacy and corporate data security.
  2. Human weakness. The root cause of most data loss is not technology; it’s a human being who makes a costly miscalculation out of fear, obligation, confusion, greed or sense of urgency. Social engineering is the craft of extracting information out of you or your staff by pushing buttons that elicit automatic responses. Strategy: Immunize your workforce against social engineering and poor decision making. Fraud training teaches your people how to handle requests for login credentials, passwords, employee and customer data, unauthorized building access and an office full of information whose disappearance will land you on the front page of the newspaper. The latest frontier that thieves are exploiting are your employees social networks, especially Facebook and LinkedIn. It is imperative that you have a well-thought-out, clearly communicated social networking policy that minimizes the risks of data leakage, reputation damage and trust manipulation. 
  3. Wireless surfing. There are two main sources of wireless data leakage: the weakly encrypted wireless router in your office and the unprotected wireless connection you use to access the Internet in an airport, hotel or café. Both connections are constantly sniffed for unprotected data being sent from your computer to the web. Strategy: Have a security professional configure the wireless router in your office. Here is your laundry list of things to ask her to do. She will understand the terminology: Utilize WPA-2 encryption or better; Implement MAC-specific addressing and mask your SSID; While she’s there, have her do a security audit of your network; To protect your connection while surfing on the road, purchase an encrypted high-speed USB modem from one of the major carriers (Verizon, Sprint, AT&T) and STOP using other people’s free/fee hotspots.
  4. Inside spies. Chances are you rarely perform a serious background check before hiring a new employee. That is short sighted, as most of the worst data theft ends up being an “inside job” where a dishonest employee siphons information out a “digital door” when no one is looking. Many employees who are dishonest now were also dishonest in the past, which is why they no longer work for their former employer. Strategy: Invest in a comprehensive background check using a product like CSIdentity.com’s SAFE before you hire instead of wasting much more money cleaning up after a thief steals valuable data assets. Follow up on the prospect’s references and ask for some that aren’t on the application. Investigating someone’s background jump starts your intuition and discourages dishonest applicants from the outset.
  5. Mobile data. In the most trusted research studies, 36-50% of data breach originates with the loss of a laptop or mobile computing device (smart phone, thumb drive, etc.). Mobility, consequently, is a double-edged sword; but it’s a sword that we’re probably not going to give up easily. Utilize the security professional mentioned above to implement strong passwords, whole disk encryption and remote data wiping capabilities. In addition, physically secure this goldmine of data down when you aren’t using it. Strategy: Utilize the security professional mentioned above to implement strong passwords, whole disk encryption, and remote laptop-tracking and data-wiping capabilities. Set your screen saver to engage after 5 minutes of inactivity and check the box that requires you to enter your password upon re-entry. This will help keep unwanted users out of your system. Finally, lock this goldmine of data down when you aren’t using it.

Your espionage countermeasures don’t need to be sophisticated or expensive to be effective. Targeting the hotspots above is a savvy, incremental way to keep spies out of your profit margins. But it won’t start working until you do.

John Sileo speaks professionally on identity theft, data breach and social networking exposure, and is the author of the newly released Privacy Means Profit. His clients include the Department of Defense, the FDIC, FTC, Pfizer and the Federal Reserve Bank. Learn more about bringing him in to motivate your organization to better protect information assets.