Cybersecurity and privacy data tips

Presentation used for this meetup:

https://www.meetup.com/GDG-Bern/events/254329331/

Transcript

1. Security and Data Privacy tips 14 Sept 2018 A. Rosa Castillo Petre Tudor Adrian Tineo
2. Welcome • Who are you? • Scope – Why Security? – Why Privacy? • Agenda • Questions anytime
3. Email Account • Required for many services – Never public! (Blogs, forums, ...) • Strong password (later discussion) • Data Breach. Compromised? – haveibeenpwned.com • Sharing important files → better encrypt or compress with password – https://takeafile.com
4. MALWARE • Spyware – your computer is part of a botnet? checkip.kaspersky.com/ Adware, system monitors, tracking cookies, and trojans • How to detect it? → Antivirus – Anti-spyware programs: SpywareBlaster
5. MALWARE • Phishing – Banking, PayPal, Visa,... – Technical support – Also in Social media (facebook, twitter,...) – Easy to recognize • Analyze suspicious files and URLs – https://www.virustotal.com/#/home/upload
6. Phishing in Twitter
7. MALWARE • Ransomware – Block and payment • Use Antivirus • Protect your important files – Windows Defender • Make backups • UPDATE!!!!
8. RANSOMWARE
9. Email good practices • 2FA whenever possible • Strong privacy and security terms and conditions • End-to-end encription: – protonmail.ch – tutanota.com
10. Passwords management • Strong passwords – passphrases instead of passwords – Diceware method – Social engineering • Password managers – Password store – KeePass
11. Internet Browsing • Scams – http://scamanalyze.com/ • Malware • Tracking (spyware) – 3rd party trackers
12. Internet Browsing • Https • Review security and privacy configs • Private windows • Keep browser up to date
13. Internet Browsing • Search engines – Searchpage.com – Duckduckgo.com • Browsers – Firefox – Brave • Block 3rd parties
14. Internet Browsing • Browser extensions – Ublock origin – Decentraleyes • Opt out from personalised ads – Facebook – Google – Apple
15. Online transactions • Never use free wifi • Contact your bank about security options – 2 pass authentication (fixed security codes + dynamically generated code → phone) • Online profiles – AI algorithms
16. BREAK 15 minutes
17. Antivirus • Operative System – Detect latest recognized attacks • Smartphone – Android (to detect malicious apps) • Recommendations – BitDefender – Kapersky • Always UPDATE!!!
18. VPN • What is it? • Avoid censorship • Browse privately
19. Social Media • Online reputation → real reputation • Feeding the ML systems – Predictions (health insurance, IBM Watson) – You cannot remove your prints (GDPR) – Data sharing: Cambridge Analytica. • Social Engineering – Facebook publication:“We are having fun in Greece at this restaurant right now” = “Please go to my house in CH which is empty and steal everything”
20. Social Media • Check security and privacy settings • Download your data and review it (GDPR) • Social media != cheap backup • Delete Facebook App from your phone
21. Smartphone • Apps permisions – Review individual permissions – Review individual apps • Trusted sources (check App reputation) • Recommended apps – https://guardianproject.info/apps/ – Are you a journalist? → Haven
22. GDPR • General Data Protection Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regulation • „No personal data may be processed unless it is done under a lawful basis specified by the regulation or unless the data controller or processor has received an unambiguous and individualized affirmation of consent from the data subject. The data subject has the right to revoke this consent at any time.“
23. Users hate it
24. Product makers hate it • Big development effort, especially on the server side • Unclear interpretation of the regulation creates lots of uncertainties with possibly dire consequences • Lots of open points related to machine learning in particular How will the GDPR impact machine learning? - https://www.oreilly.com/ideas/how-will-the-gdpr-impact-machine-learning Don't let lawyers ruin your analytics - https://www.youtube.com/watch?v=yu1uK0FR5es
25. It breaks small businesses • „creates uncertainty and risk that I can't justify taking“ • „threatens website owners with fines of 4% of turnover or €20 million (whichever is higher)“ • „helps reinforce the dominance of Facebook, Google and Twitter“ https://www.streetlend.com/
26. Before GDPR • Trying to delete my account at a leading online service for a certain niche of freelancing professionals, serving thousands of customers worldwide • The time is July 2016
27. Adrian „I'd like to delete my account at <the_platform> and stop receiving notifications of <your_service>. The only option I could find was "close account" which does not allow me to log back in but does not seem to be the same as deleting the account. In fact, upon trying to log in again I get the message that the account is disabled, as opposed to saying that the user is unknown. Please, remove the account for user <my_email_address> completely and permanently, including all personal information at <the_platform>.“
28. Rebecca „Your account is disabled meaning that you won't receive any emails from <the_platform> anymore. If you choose to in the future you can email <the_platform> and we can activate your account again for you. There is no way to delete a person's profile account altogether at this time.“
29. Adrian „Thanks for getting back to me on this issue. However, that procedure is not satisfactory. I believe that, under EU regulation, I have the right to request that you delete all my personal information from your system and not just disable it. http://ec.europa.eu/justice/data-protection/ Please, do let me know if and when you can remove all my personal information, as kindly requested.“
30. Rebecca „My user account does not have permission to delete your personal information in your account and it is not possible for me to delete your account completely from our site. I'm sorry for the inconvenience.“
31. Adrian „It looks like you'll have to escalate the problem then. Please, do let me know if and when you can remove all my personal information, as kindly requested.“
32. Rebecca „No employee account has permission to delete information that is required in a profile. What I can do is enable your account again to allow you to change your information so it is no longer your name, devices, etc and then deactivate it again. Is that what you would like me to do?“
33. Adrian „Sorry for the trouble. However, I find it very unsatisfactory that you can't simply delete the account. I should have the right to have my personal information removed. It is standard industry practice. If you cannot delete the account yourself, then you may need to contact someone with the right priviledges. There must be a way, otherwise <the_platform> is not complying with standard regulation. Populating a profile with dummy data because it is not possible to delete a profile is just a subpar solution, again not to industry standards. If there really is no other way, I'll go for that, but then I am afraid I'll face some restrictions. Can I enter empty text fields? Probably not. Then I have to enter fake names and emails? This is seriously poor engineering on the part of <the_platform>, sorry. Again, I don't mean to cause trouble but I believe in my rights and I stand for my petition.“
34. Rebecca „I have put in a request to our IT team to delete your account. This is not something we do regularly but we have made an exception. I will follow up with you when I get confirmation that it's been deleted.“
35. Adrian „Thanks Rebecca. Looking forward to those news.“
36. Rebecca „I've just gotten confirmation that your account has been deleted.“
37. Adrian „Many thanks. Much appreciated. Have a good day.“
38. Users • Users are increasingly „assets“ rather than „customers“ • As such, processes and strategies are devised to optimize benefits drawn from those assets • We need protection • Laws are a way • There are other ways too, such as system design – Zero knowledge, end-to-end encrypted services
39. Tips • By giving consent users are turning into fully owned assets at the digital companies – Remember you can now revoke consent • Don't just tick all boxes blindly, some are not required – Designers spend hours fine tuning the presentation so that users are more likely to agree • Exercise your rights – Get the information that the system holds about you
40. Summary • Always UPDATE!! • Make BACKUPS!! • Strong Passwords, Antivirus, VPN,... • Use Social Media in an intelligent way – Think twice what you share • Nothing to hide (youtube) • Read this: https://www.watchyourhack.com/#cover-your-web