Data breeches. Closing the barn door after the horse is out

[bobcat]

Hearing of data breeches on a regular basis is very unsettling to us all, just knowing that your information is out there and was supposed to be secure. Then after the breech is discovered, you hear of the company establishing tighter protocols and enhancing security systems to prevent it in the future. Even the FTC has recognized that there is no such thing as perfect security, and that security is a continuing process of detecting risks and adjusting one’s security program and defenses.

All technology comes with an "access versus authorization mechanism" trade-off. As technology evolves, that tension evolves along with it. It's like putting a "burglar proof" padlock on your front door, and just waiting for a smarter burglar to come along. It's mainly just a social contract that says: "This is mine, please stay out".

Cybersecurity failures involving what should be sacrosanct health information have become so frequent and common that we are becoming collectively desensitized to them. There are 853 hacking investigations listed on the Health and Human Services Breach Portal website alone that have happened in the last 24 months (I checked) (U.S. Department of Health & Human Services - Office for Civil Rights).

All the AI and quantum cryptography we can dream of cannot solve cybersecurity. There is no "set it and forget it" option. Simply acknowledging that there is no such thing as being completely cybersecure and that technology is complicated does nothing to fix what is a pretty poor state of affairs. So what do we do, just roll over and accept that our sensitive information is a few keystrokes away from public knowledge.

It seems that we can't just keep throwing technology at cybersecurity or pretending that it's a technology issue. Cybersecurity is about people. So what do we do?

 

[Aunt Bea]

I’m not sure how many secrets I have left.

IMO there is still a great deal of security in being a part of the herd in these massive data breaches.

Sort of hiding in plan sight or like the odds of hitting the lottery.

So far I‘ve been fortunate that I haven’t been singled out and none of my personal accounts have been compromised.

We might be better off to set our secrets free and concentrate on restricting access to update or transact using things like two factor authentication, password managers, facial recognition, etc…

I suppose that no matter what we do we can never eliminate the challenge/thrill that seems to drive some hackers.

 

[HoneyNut]

Cybersecurity is about people. So what do we do?

That's a good question, undoubtedly a lot of bad people in the world. Though even a lot of the 'good' people (aka corporations) are scamming us in legal ways (I wish we'd establish standards and ratings that would be useful for buying clothing or ordering other items).

I've gotten two letters (or was it three? hmm) this year that my data was involved in data breaches and so I've frozen my three credit bureau reports just as a precaution, and I get free monitoring for a year.

But so far the only effect of my data leaking was from the ticketmaster data breach that exposed peoples' phone numbers, ever since that I get a lot of spam phone calls. I've learned not to answer them, and somehow my phone also has learned to screen suspicious phone numbers by asking them to identify themselves, not letting them ring through and then telling me I had a call from that number and they did not respond to being screened. So then I know to add them to the blocked numbers.

 

[hawkdon]

I;ve had 3 or 4 letters too, att, local hospital, some others, but
I just give up trying to sort it all out.....I keep hearing that a
VPN is good to prevent problems, anyone know about it??

 

[fuzzybuddy]

Humans are sly, crafty, critters, who have an unfillable determination to rip others off.

 

[Trila]

I;ve had 3 or 4 letters too, att, local hospital, some others, but
I just give up trying to sort it all out.....I keep hearing that a
VPN is good to prevent problems, anyone know about it??

I'm in the same boat as you, constantly getting notifications of a "possible" data breach. Between Dio and I, we now have 7 different credit monitoring accounts. Some are for 12 months, some are for 24 months.

I can't use the same email address for over lapping monitoring accounts, so I've had a open new email addresses, too. I now have 5 different email addresses!!!

It's all so frustrating!!!

 

[HoneyNut]

VPN is good to prevent problems, anyone know about it??

I'm not expert, but I don't think a VPN would help at all against data breaches. It would help if you use unsecured websites. I always make sure I'm at a secure website (and since I've started using a chromebook it also checks that).

I think VPNs are good if you want to control the IP address that you are "coming from".