Position Paper 2: Data Breach Prevention

Although the internet has shown to be stable enough to hold large and steadily increasing amounts of data, the access to this information is based on a cloud system, a non-physical means of storage, that could become corrupt, lost, or even stolen at any time. When dealing with large, tech-dependent companies, the need for strong data security is imperative. To provide protection over your personal information, both retailers and consumers are often required to provide pseudonyms, more commonly known as usernames, and a password that you will use to gain access each time. Unfortunately, the idyll dream for this concept does not involve that time you accidentally forgot to log out of an account, when you answer that anonymous phone call that recorded your voice, or the guy who peaked over your shoulder while you were typing in your password. There is also little to no insurance for the infamous hacker whose evolution has proven to be a profession. According to Malwarebytes, “hacking refers to activities that seek to compromise digital devices such as computers, smartphones, tablets, and even entire networks.”  Another term for a hacker would be a social engineer or they would be practicing “social engineering” by using “psychology to trick the user into clicking on a malicious attachment or providing personal data.” There is a lot to look out for when attempting to collect data over the internet and keeping it safe, but what is your plan for after you experience a data breach? Digital Guardian took to their blog, Data Insider, to comprise a panel of security experts in order to provide tips on the best practices and to help you find your next steps:

The panel consists of 30 participants linked below:

Oleksandr Maidaniuk Jay Botelho Andrew Avenessian Jason Maloni Stephen Ward Robert Ellis Smith Eran Sinai Arnie Bellini Nasir N. Pasha Scott Dujmovich

Jibey Asthappan Darren Guccione Andrea Eldridge Reg Harnish Johnny Lee Engin Kirda Michael Fimin Alan Baker Greg Kelley Fred Menge

Adam Roth Matt Malone Jason Nielsen Ashish Mohindroo Lee McKnight Anne P. Mitchell Edsard Ravelli Bill Rosenthal J. Wylie Donald Jon Schildt

Chatbots are quickly becoming a norm among businesses to interact with customers. A chatbot is a computer program designed to mimic the conversation of a human being via text or voice messages. You can command or ask a question to the chatbot, and the chatbot will respond or perform the requested action. Chatbot mimics human conversations with the help of artificial intelligence (AI) techniques such as Natural Language Processing (NLP), image and, audio and video analysis. One of the most exciting features of chatbot is that it learns from the mistakes (past interactions) and become intelligent and smarter over time. Although chatbots offer numerous benefits to businesses and customers, there are several security threats associated with the use of chatbots. With advances in security solutions, attacking server infrastructure is not an easy task. Thus, hackers are now turning to attack the chatbots (as a proxy). Since chatbots exhibit human-like communication, they can be an excellent proxy for carrying out cyber-attacks that defraud victims for hacker profit, or just for fun and amusement. Hackers can attack a chatbot and turn it into an “evil bot.” cWatch explained that “The ultimate goal would be to scan the other bots in the network for possible vulnerabilities that could later be exploited. Once the bot service or framework protecting the user data gets compromised, it could lead to data theft.” A few forms of active protection against chatbots have been developed like two-factor authentification (2FA) which can be easily seen with e-mail and smartphone programming, behavorial analytics where your personal data is compromised for research (with your permission of course), biometrics like Apple’s Touch and now Face ID, and artificial intelligence (AI). These methods target the issues of authentication and encryption through slightly more complex technologies that chatbots are vulnerable to. Another way to secure chatbots and prevent hacking attempts is by using self-destructing messages. This is a proven solution, usually used by banking and all kind of financial chatbots. When sensitive data is sent through a chatbot, it can delete that confidential message forever from the system after a specific period of time. This way, the chatbot, user and the company that uses the chatbot can be sure that all the data and information will be secured and untracked.

The future lies in the hand of technology, and what we want to know is: “Do these cybersecurity protection methods actually work?

In May of 2017, Stanford University’s IT came in contact with a ransomware attack software called “WannaCry” that had made newspaper headlines by infecting thousands of computers all over the world. Stanford somehow was able to ward off thousands of ransomware-laced emails from a campaign going by the name of “Jaff”. The university reported that “Stanford’s first and most important cybersecurity standard is to keep systems fully up to date with the latest software patches. University IT routinely patches 70,000 systems throughout campus, a service that has prevented countless cyber incidents over the past 13 years. This fundamental practice, along with the university’s email security solution, network firewalls, and a heightened awareness of phishing among community members protected us from these two large scale ransomware campaigns.” Stanford also offered the advice to routinely backup your data so that if you are impacted by a hack or an infection, you can safely restore your files without resorting to ransom payment.

As successful as a case may seem, this does not exclude anyone from the dangers of security breaching. Stanford set a high bar for the precautions that should be taken considering that over 300 universities in the US alone were targeted by 9 Iranian hackers according to WIRED’s list of The Worst Cybersecurity Breaches of 2018 So Far. There was also the Russian hacker infiltration and “probing United States power companies” where there was evidence of Russian actors having “direct access to an American utility’s control systems.” Most of the volatile situations that have pierced secured information have seemingly been caused by the sharing of personal information, passwords, and codes with some sort of malicious intent in mind. The most pivotal advice that I could reciprocate would be to “understand the root of the issue”, a statement made by cyber security expert Jay Botelho, so that you can find and execute the proper solution.