Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Data Privacy. Show all posts
TA558
Data Privacy malware Microsoft Office Steganography TA558

New SteganoAmor Attacks Employ Steganography to Target Organizations Globally

 


An exposé has brought to light an intricate operation engineered by the TA558 hacking group, known for its previous focus on the hospitality and tourism sectors. This new offensive, dubbed "SteganoAmor," employs steganography, a technique of concealing malicious code within seemingly harmless image files, to infiltrate targeted systems worldwide. Positive Technologies, the cybersecurity firm behind the discovery, has identified over 320 instances of this attack affecting various organisations across different sectors and countries.


How SteganoAmor Attacks Work

SteganoAmor attacks start with sneaky emails that look harmless but contain files like Excel or Word documents. These files take advantage of a weakness in Microsoft Office called CVE-2017-11882, which was fixed in 2017. When someone opens these files, they unknowingly download a Visual Basic Script (VBS) from a source that seems real. This script then fetches an image file (JPG) that hides a secret payload encoded in base64 format.


Diverse Malware Payloads

The hidden payload serves as a gateway to various malware families, each with distinct functionalities:

1. AgentTesla: A spyware capable of keylogging, credential theft, and capturing screenshots.

2. FormBook: An infostealer malware adept at harvesting credentials, monitoring keystrokes, and executing downloaded files.

3. Remcos: A remote access tool enabling attackers to manage compromised machines remotely, including activating webcams and microphones.

4. LokiBot: Another infostealer focusing on extracting sensitive information from commonly used applications.

5. Guloader: It serves as a downloader in cyberattacks, distributing secondary payloads to evade antivirus detection.

6. Snake Keylogger: Snake Keylogger is malware designed to steal data by logging keystrokes, capturing screenshots, and harvesting credentials from web browsers.

7. XWorm : It functions as a Remote Access Trojan (RAT), granting attackers remote control over compromised computers for executing commands and accessing sensitive information.


To evade detection, the final payloads and malicious scripts are often stored in reputable cloud services like Google Drive. Additionally, stolen data is transmitted to compromised FTP servers, masquerading as normal traffic.


Protective Measures

Despite the complexity of the attack, safeguarding against SteganoAmor is relatively straightforward. Updating Microsoft Office to the latest version eliminates the vulnerability exploited by the attackers, rendering their tactics ineffective.


Global Impact

While the primary targets seem concentrated in Latin America, the reach of SteganoAmor extends worldwide, posing a significant threat to organisations globally.


As these threats are taking new shape and form, staying aware and implementing timely updates remain crucial defences against cyber threats of any capacity. 


Read more »
Technology
Biometric Security Data Privacy Facial Recognition KYC Technology

Is Facial Biometrics the Future of Digital Security?

 



Within the dynamic sphere of digital technology, businesses are continually seeking innovative solutions to streamline operations and step up their security measures. One such innovation that has garnered widespread attention is facial biometrics, a cutting-edge technology encompassing face recognition and liveness detection. This technology, now available through platforms like Auth0 marketplace, is revolutionising digital processes and significantly enhancing security protocols.

What's Facial Biometrics?

Facial biometrics operates by analysing unique facial features to verify an individual's identity. Through face recognition, it compares facial characteristics from a provided image with stored templates for authentication purposes. Similarly, face liveness detection distinguishes live human faces from static images or videos, ensuring the authenticity of user interactions. This highlights the technology's versatility, applicable across various domains ranging from smartphone security to border control measures.

Streamlining Digital Processes

One of the key benefits of facial biometrics is its ability to streamline digital processes, starting with digital onboarding procedures. For instance, banks can expedite the verification process for new customers by comparing a selfie with their provided identification documents, ensuring compliance with regulatory requirements such as Know Your Customer (KYC) norms. Moreover, facial biometrics eliminates the need for complex passwords, offering users a secure and user-friendly authentication method. This streamlined approach not only strengthens security but also improves the overall user experience.

A Step-Up In The Security Measures

Beyond simplifying processes, facial biometrics adds an additional layer of security to business operations. By verifying user identities at critical junctures, such as transaction confirmations, businesses can thwart unauthorised access attempts by fraudsters. This proactive stance against potential threats not only safeguards sensitive information but also mitigates financial risks associated with fraudulent activities.

Embracing the Future

As facial biometrics continues to gain momentum, businesses are presented with an array of opportunities to bolster security measures and upgrade user experiences. Organisations can not only mitigate risks but also explore new possibilities for growth in the digital age. With a focus on simplicity, security, and user-centric design, facial biometrics promises to redefine the future of digital authentication and identity verification.

All in all, facial biometrics represents an impactful milestone in the realm of digital security and user convenience. By embracing this technology, businesses can achieve a delicate balance between efficiency and security, staying ahead of unprecedented threats posed by AI bots and malicious actors. However, it is imperative to implement facial biometrics in a manner that prioritises user privacy and data protection. As businesses work out the digital transformation journey, platforms like Auth0 marketplace offer comprehensive solutions tailored to diverse needs, ensuring a seamless integration of facial biometrics into existing frameworks.


Read more »
Privacy Regulations
Account security Cyber Security Data Privacy data security Google Google Account Privacy Regulations

Posthumous Data Access: Can Google Assist with Deceased Loved Ones' Data?

 

Amidst the grief and emotional turmoil after loosing a loved one, there are practical matters that need to be addressed, including accessing the digital assets and accounts of the deceased. In an increasingly digital world, navigating the complexities of posthumous data access can be daunting. One common question that arises in this context is whether Google can assist in accessing the data of a deceased loved one. 

Google, like many other tech companies, has implemented protocols and procedures to address the sensitive issue of posthumous data access. However, accessing the digital assets of a deceased individual is not a straightforward process and is subject to various legal and privacy considerations. 

When a Google user passes away, their account becomes inactive, and certain features may be disabled to protect their privacy. Google offers a tool called "Inactive Account Manager," which allows users to specify what should happen to their account in the event of prolonged inactivity or after their passing. Users can set up instructions for data deletion or designate trusted contacts who will be notified and granted access to specific account data. 

However, the effectiveness of Google's Inactive Account Manager depends on the deceased individual's proactive setup of the tool before their passing. If the tool was not configured or if the deceased did not designate trusted contacts, gaining access to their Google account and associated data becomes significantly more challenging. 

In such cases, accessing the data of a deceased loved one often requires legal authorization, such as a court order or a valid death certificate. Google takes user privacy and data security seriously and adheres to applicable laws and regulations governing data access and protection. Without proper legal documentation and authorization, Google cannot grant access to the account or its contents, even to family members or next of kin. 

Individuals need to plan ahead and consider their digital legacy when setting up their online accounts. This includes documenting login credentials, specifying preferences for posthumous data management, and communicating these wishes to trusted family members or legal representatives. By taking proactive steps to address posthumous data access, individuals can help alleviate the burden on their loved ones during an already challenging time. 

In addition to Google's Inactive Account Manager, there are third-party services and estate planning tools available to assist with digital asset management and posthumous data access. These services may offer features such as data encryption, secure storage of login credentials, and instructions for accessing online accounts in the event of death or incapacity. 

As technology continues to play an increasingly prominent role in our lives, the issue of posthumous data access will only become more relevant. It's crucial for individuals to educate themselves about their options for managing their digital assets and to take proactive steps to ensure that their wishes are carried out after their passing. 

While Google provides tools and resources to facilitate posthumous data management, accessing the data of a deceased loved one may require legal authorization and adherence to privacy regulations. Planning ahead and communicating preferences for digital asset management are essential steps in addressing this sensitive issue. By taking proactive measures, individuals can help ensure that their digital legacy is managed according to their wishes and alleviate the burden on their loved ones during a difficult time.
Read more »
Travel Safety
Cyber Security Data Privacy Juice Jacking Travel Safety

The Hidden Danger of Public USB Charging Stations: What You Need to Know

The Hidden Danger of Public USB Charging Stations

Whether you’re at the airport, a café, or a shopping mall, you’ve probably encountered those convenient public USB charging stations. They seem harmless, right? After all, they’re just there to help you power up your devices while you wait for your flight or enjoy a coffee.

But what if these seemingly innocent charging stations could be harboring a hidden danger? The FBI thinks so, and they’ve issued a warning to travelers: avoid using public USB charging points. Let’s dive into why and how you can protect yourself.

The Juice Jacking Threat

Imagine this: You’re waiting at the airport gate, and your phone’s battery is running low. You spot a free USB charging station, plug in your phone, and breathe a sigh of relief. But what if that charging station isn’t as innocent as it appears?

Juice jacking is a cyber threat where hackers exploit public USB ports to introduce malware and monitoring software onto your device. These malicious programs can steal your personal data, including credit card information, passwords, and sensitive documents. Suddenly, that innocent-looking charging station becomes a gateway for cybercriminals.

How Does Juice Jacking Work?

Here’s how the juice-jacking attack unfolds:

Compromised Ports: Hackers tamper with the USB ports on public charging stations. They might install tiny devices that mimic charging cables but are actually data transfer tools.

Invisible Intrusion: When you plug your phone into one of these compromised ports, it starts charging as usual. However, in the background, malware silently infiltrates your device.

Data Theft: The malware gains access to your phone’s data, including contacts, messages, and sensitive files. Worse yet, it can capture your keystrokes, potentially revealing your login credentials.

Spyware Deployment: Some sophisticated attackers even deploy spyware that allows them to monitor your activities remotely. They can track your location, intercept messages, and eavesdrop on calls.

Protecting Yourself

Now that you know the risks, here’s how you can safeguard your devices:

Carry Your Own Charger: Instead of relying on public USB ports, bring your own charger and USB cord. It’s a small inconvenience that can save you from potential data theft.

Use Electrical Outlets: Whenever possible, opt for electrical outlets over public charging stations. While it might be less convenient, it significantly reduces the risk.

Inspect the Port: Before plugging in, examine the USB port. Look for signs of tampering, such as loose connections, unusual devices, or visible damage.

Consider USB-C Cables: USB-C cables are less susceptible to juice jacking because they don’t transfer data by default. They only charge your device, minimizing the risk of malware infiltration.

Wireless Charging: If your phone supports wireless charging, use it. Wireless chargers don’t require physical connections, eliminating the risk altogether.

Read more »
USA
Data Privacy Federal Agencies Privacy surveillance Technology Threats USA

Controversial Reverse Searches Spark Legal Debate


In a growing trend, U.S. police departments and federal agencies are employing controversial surveillance tactics known as reverse searches. These methods involve compelling big tech companies like Google to surrender extensive user data with the aim of identifying criminal suspects. 

How Reverse Searches Operate 

Under Reverse Searches Enforce Agencies order digital giant companies such as Google to give them vast reservoirs of user data. Under this law, these agencies have the power to demand information related to specific events or queries which include: 

  • Location Data: Requesting data on individuals present in a particular place at a specific time based on their phone's location. 
  • Keyword Searches: Seeking information about individuals who have searched for specific keywords or queries. 
  • YouTube Video Views: A recent court order disclosed that authorities could access identifiable information on individuals who watched particular YouTube videos. 

In the past, when law enforcement needed information for an investigation, they would usually target specific people they suspected were involved in a crime. But now, because big tech companies like Google have so much data about people's activities online, authorities are taking a different approach. Instead of just focusing on individuals, they are asking for massive amounts of data from these tech companies. This includes information on both people who might be relevant to the investigation and those who are not. They hope that by casting a wider net, they will find more clues to help solve cases. 

Following the news, critics argue that these court-approved orders are overly broad and potentially unconstitutional. They raise concerns that such orders could force companies to disclose information about innocent people unrelated to the alleged crime. There are fears that this could lead to prosecutions based on individuals' online activities or locations. 

Also, last year an application filed in a Kentucky federal court disclosed that federal agencies wanted Google to “provide records and information associated with Google accounts or IP addresses accessing YouTube videos for a one-week period, between January 1, 2023, and January 8, 2023.” 

However, it did not end here, the constitutionality of these orders remains uncertain, paving the way for a probable legal challenge before the U.S. Supreme Court. Despite the controversy, federal investigators continue to push the boundaries of this contentious practice.
Read more »
patient information
affected patients Cyberattack Data Breach Data Privacy data security notification letters Ontario hospitals patient information

Ontario Hospitals Dispatch 326,000 Letters to Patients Affected by Cyberattack Data Breach

 

Five hospitals in Ontario, which fell victim to a ransomware attack last autumn, are initiating a mass notification effort to inform over 326,000 patients whose personal data was compromised.

The cyber breach on October 23, targeted Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital.

While electronic medical records at all affected hospitals, except Bluewater Health, remained unscathed, personal health information stored within their systems was unlawfully accessed. Subsequently, some of this pilfered data surfaced on the dark web.

A collective statement released by the hospitals highlights that approximately 326,800 patients were impacted, though this figure might include duplications for individuals seeking medical care at multiple sites.

The hospitals have undertaken a meticulous data analysis process spanning several months to ensure comprehensive notification of affected patients. For those whose social insurance numbers were compromised, arrangements for credit monitoring will also be provided.

The hospitals confirm that their notification strategy was devised in consultation with Ontario’s Information and Privacy Commissioner. Expressing regret for the disruption caused by the cyber incident, the hospitals extend their apologies to patients, communities, and healthcare professionals affected.

Apart from the hospitals, TransForm, a non-profit organization overseeing the hospitals’ IT infrastructure, was also affected by the ransomware attack. Despite the disruption to hospital operations and data breach affecting certain patient and staff information, the group opted not to meet ransom demands, based on expert advice.
Read more »
Technology
AI technology Compliance Data Privacy Data Usage Microsoft privacy protection Privacy Regulations Privacy Tools Technology

Microsoft's Priva Platform: Revolutionizing Enterprise Data Privacy and Compliance

 

Microsoft has taken a significant step forward in the realm of enterprise data privacy and compliance with the expansive expansion of its Priva platform. With the introduction of five new automated products, Microsoft aims to assist organizations worldwide in navigating the ever-evolving landscape of privacy regulations. 

In today's world, the importance of prioritizing data privacy for businesses cannot be overstated. There is a growing demand from individuals for transparency and control over their personal data, while governments are implementing stricter laws to regulate data usage, such as the AI Accountability Act. Paul Brightmore, principal group program manager for Microsoft’s Governance and Privacy Platform, highlighted the challenges faced by organizations, noting a common reactive approach to privacy management. 

The new Priva products are designed to shift organizations from reactive to proactive data privacy operations through automation and comprehensive risk assessment. Leveraging AI technology, these offerings aim to provide complete visibility into an organization’s entire data estate, regardless of its location. 

Brightmore emphasized the capabilities of Priva in handling data requests from individuals and ensuring compliance across various data sources. The expanded Priva family includes Privacy Assessments, Privacy Risk Management, Tracker Scanning, Consent Management, and Subject Rights Requests. These products automate compliance audits, detect privacy violations, monitor web tracking technologies, manage user consent, and handle data access requests at scale, respectively. 

Brightmore highlighted the importance of Privacy by Design principles and emphasized the continuous updating of Priva's automated risk management features to address emerging data privacy risks. Microsoft's move into the enterprise AI governance space with Priva follows its recent disagreement with AI ethics leaders over responsibility assignment practices in its AI copilot product. 

However, Priva's AI capabilities for sensitive data identification could raise concerns among privacy advocates. Brightmore referenced Microsoft's commitment to protecting customer privacy in the AI era through technologies like privacy sandboxing and federated analytics. With fines for privacy violations increasing annually, solutions like Priva are becoming essential for data-driven organizations. 

Microsoft strategically positions Priva as a comprehensive privacy governance solution for the enterprise, aiming to make privacy a fundamental aspect of its product stack. By tightly integrating these capabilities into the Microsoft cloud, the company seeks to establish privacy as a key driver of revenue across its offerings. 

However, integrating disparate privacy tools under one umbrella poses significant challenges, and Microsoft's track record in this area is mixed. Privacy-native startups may prove more agile in this regard. Nonetheless, Priva's seamless integration with workplace applications like Teams, Outlook, and Word could be its key differentiator, ensuring widespread adoption and usage among employees. 

Microsoft's Priva platform represents a significant advancement in enterprise data privacy and compliance. With its suite of automated solutions, Microsoft aims to empower organizations to navigate complex privacy regulations effectively while maintaining transparency and accountability in data usage.
Read more »
User Security
Cyber Security Data Privacy Email Spoofing Phishing emails User Security

Google Strengthens Gmail Security, Blocks Spoofed Emails to Combat Phishing

 

Google has begun automatically blocking emails sent by bulk senders who do not satisfy tighter spam criteria and authenticating their messages in line with new requirements to strengthen defences against spam and phishing attacks. 

As announced in October, users who send more than 5,000 messages per day to Gmail accounts must now configure SPF/DKIM and DMARC email authentication for their domains. 

The updated regulations also mandate that bulk email senders refrain from delivering unsolicited or unwanted messages, offer a one-click unsubscribe option, and react to requests to unsubscribe within two working days. 

Additionally, spam rates must be kept at 0.3%, and "From" headers cannot act like to be from Gmail. Email delivery issues, such as emails being rejected or automatically directed to recipients' spam folders, may arise from noncompliance. 

"Bulk senders who don't meet our sender requirements will start getting temporary errors with error codes on a small portion of messages that don't meet the requirements," Google stated. "These temporary errors help senders identify email that doesn't meet our guidelines so senders can resolve issues that prevent compliance.” 

In April 2024, we will start rejecting non-compliant traffic. Rejection will be gradual, affecting solely non-compliant traffic. We strongly recommend senders to utilise the temporary failure enforcement period to make any necessary changes to become compliant, Google added. 

The company also intends to implement these regulations beginning in June, with an expedited timeline for domains used to send bulk emails starting January 1, 2024.

As Google said when the new guidelines were first released, its AI-powered defences can successfully filter roughly 15 billion unwelcome emails per day, avoiding more than 99.9% of spam, phishing attempts, and malware from reaching users' inboxes. 

"You shouldn't need to worry about the intricacies of email security standards, but you should be able to confidently rely on an email's source," noted Neil Kumaran, Group Product Manager for Gmail Security & Trust in October. "Ultimately, this will close loopholes exploited by attackers that threaten everyone who uses email.”
Read more »
User Privacy
Car manufacturers Data Breach Data Privacy Smart Cars User Privacy

Here's How Smart Card Are Tracking Your Private Data

 

Smart cars are already the norm on our roads, thanks to increased connectivity and technological breakthroughs. However, beneath the slick exteriors and technological capabilities is a worrisome reality: your vehicle may be spying on you and documenting every step, including your private life. A recent study undertaken by the Mozilla Foundation revealed the alarming truth about how much personal data automakers collect and share.

The study analysed 25 different car brands and concluded that none of them passed consumer privacy criteria. Surprisingly, 84 percent of automakers have been found to review, share, or even sell data collected from car owners. The private data gathered significantly exceeds what is required for the vehicle's features or the car brand's relationship with its drivers. 

Six automakers go to alarming lengths to gather personal data about their drivers, including their driving habits, destinations, genetic makeup, and even their favourite music. This was discovered by Mozilla's research. Nissan even goes so far as to include "sexual activity" in the data it gathers, and in their privacy policy, Kia freely admits that it may collect data on your "sex life." 

According to Kia's privacy statement, it is allowed to handle "special categories" of data, which include private information on racial, religious, sexual, and political affiliations. The scope of data collecting goes beyond the in-car systems and includes linked services as well as external sources such as internet radio services and navigation apps. 

This massive amount of data isn't just dangling around; it's being utilised to develop profiles and draw conclusions about you, from your intelligence to your preferences. As the car industry embraces connectivity and autonomous driving, sales of services such as music and video streaming, driver assistance, and self-driving subscriptions are expected to increase. Carmakers can maximise profits by collecting more customer data through these services. 

Even Tesla, despite its dominance in the electric vehicle sector, failed Mozilla's security, data control, and AI tests. Tesla has previously been criticised for its privacy procedures, including cases in which staff exchanged recordings and photographs captured by customer car cameras. 

As the automotive sector evolves, concerns regarding data security and personal privacy grow. It remains to be seen if automakers will take the necessary safety measures to safeguard your personal information as the smart car revolution advances. In the meanwhile, it's critical to keep informed and cautious about the negative aspects of smart cars.
Read more »
Online Security
CISOs Cyber Security Data Privacy Digital Literacy Generative AI IP addresses Online Security

What Are The Risks of Generative AI?

 




We are all drowning in information in this digital world and the widespread adoption of artificial intelligence (AI) has become increasingly commonplace within various spheres of business. However, this technological evolution has brought about the emergence of generative AI, presenting a myriad of cybersecurity concerns that weigh heavily on the minds of Chief Information Security Officers (CISOs). Let's synthesise this issue and see the intricacies from a microscopic light.

Model Training and Attack Surface Vulnerabilities:

Generative AI collects and stores data from various sources within an organisation, often in insecure environments. This poses a significant risk of data access and manipulation, as well as potential biases in AI-generated content.


Data Privacy Concerns:

The lack of robust frameworks around data collection and input into generative AI models raises concerns about data privacy. Without enforceable policies, there's a risk of models inadvertently replicating and exposing sensitive corporate information, leading to data breaches.


Corporate Intellectual Property (IP) Exposure:

The absence of strategic policies around generative AI and corporate data privacy can result in models being trained on proprietary codebases. This exposes valuable corporate IP, including API keys and other confidential information, to potential threats.


Generative AI Jailbreaks and Backdoors:

Despite the implementation of guardrails to prevent AI models from producing harmful or biased content, researchers have found ways to circumvent these safeguards. Known as "jailbreaks," these exploits enable attackers to manipulate AI models for malicious purposes, such as generating deceptive content or launching targeted attacks.


Cybersecurity Best Practices:

To mitigate these risks, organisations must adopt cybersecurity best practices tailored to generative AI usage:

1. Implement AI Governance: Establishing governance frameworks to regulate the deployment and usage of AI tools within the organisation is crucial. This includes transparency, accountability, and ongoing monitoring to ensure responsible AI practices.

2. Employee Training: Educating employees on the nuances of generative AI and the importance of data privacy is essential. Creating a culture of AI knowledge and providing continuous learning opportunities can help mitigate risks associated with misuse.

3. Data Discovery and Classification: Properly classifying data helps control access and minimise the risk of unauthorised exposure. Organisations should prioritise data discovery and classification processes to effectively manage sensitive information.

4. Utilise Data Governance and Security Tools: Employing data governance and security tools, such as Data Loss Prevention (DLP) and threat intelligence platforms, can enhance data security and enforcement of AI governance policies.


Various cybersecurity vendors provide solutions tailored to address the unique challenges associated with generative AI. Here's a closer look at some of these promising offerings:

1. Google Cloud Security AI Workbench: This solution, powered by advanced AI capabilities, assesses, summarizes, and prioritizes threat data from both proprietary and public sources. It incorporates threat intelligence from reputable sources like Google, Mandiant, and VirusTotal, offering enterprise-grade security and compliance support.

2. Microsoft Copilot for Security: Integrated with Microsoft's robust security ecosystem, Copilot leverages AI to proactively detect cyber threats, enhance threat intelligence, and automate incident response. It simplifies security operations and empowers users with step-by-step guidance, making it accessible even to junior staff members.

3. CrowdStrike Charlotte AI: Built on the Falcon platform, Charlotte AI utilizes conversational AI and natural language processing (NLP) capabilities to help security teams respond swiftly to threats. It enables users to ask questions, receive answers, and take action efficiently, reducing workload and improving overall efficiency.

4. Howso (formerly Diveplane): Howso focuses on advancing trustworthy AI by providing AI solutions that prioritize transparency, auditability, and accountability. Their Howso Engine offers exact data attribution, ensuring traceability and accountability of influence, while the Howso Synthesizer generates synthetic data that can be trusted for various use cases.

5. Cisco Security Cloud: Built on zero-trust principles, Cisco Security Cloud is an open and integrated security platform designed for multicloud environments. It integrates generative AI to enhance threat detection, streamline policy management, and simplify security operations with advanced AI analytics.

6. SecurityScorecard: SecurityScorecard offers solutions for supply chain cyber risk, external security, and risk operations, along with forward-looking threat intelligence. Their AI-driven platform provides detailed security ratings that offer actionable insights to organizations, aiding in understanding and improving their overall security posture.

7. Synthesis AI: Synthesis AI offers Synthesis Humans and Synthesis Scenarios, leveraging a combination of generative AI and cinematic digital general intelligence (DGI) pipelines. Their platform programmatically generates labelled images for machine learning models and provides realistic security simulation for cybersecurity training purposes.

These solutions represent a diverse array of offerings aimed at addressing the complex cybersecurity challenges posed by generative AI, providing organizations with the tools needed to safeguard their digital assets effectively.

While the adoption of generative AI presents immense opportunities for innovation, it also brings forth significant cybersecurity challenges. By implementing robust governance frameworks, educating employees, and leveraging advanced security solutions, organisations can navigate these risks and harness the transformative power of AI responsibly.

Read more »
User Data Leak
App security Apple criticism Apple Security Data Breach Data Privacy iPhone iPhone Features Personal Data User Data Leak

Is iPhone’s Journal App Sharing Your Personal Data Without Permission?

 

In the digital age, where convenience often comes at the cost of privacy, the Journal app stands as a prime example of the fine line between utility and intrusion. Marketed as a tool for reflection and journaling, its functionality may appeal to many, but for some, the constant stream of notifications and data access raises legitimate concerns. 

While the Journal app offers a seemingly innocuous service, allowing users to jot down thoughts and reflections, its behind-the-scenes operations paint a different picture. Upon installation, users unwittingly grant access to a wealth of personal data, including location, contacts, photos, and more. This data serves as fodder for the app's suggestions feature, which prompts users to reflect on their daily activities. For those who engage with the app regularly, these suggestions may prove helpful, fostering a habit of mindfulness and self-reflection. 

However, for others who have no interest in journaling or who simply prefer to keep their personal data private, the constant barrage of notifications can quickly become overwhelming. The issue extends beyond mere annoyance; it touches on fundamental questions of privacy and consent in the digital realm. Users may find themselves grappling with the realisation that their every move is being tracked and analyzed by an app they never intended to use beyond a cursory exploration. 

Moreover, the implications of this data collection extend beyond the confines of the Journal app itself. As Apple's Journaling Suggestions feature allows for data sharing between journaling apps, users may inadvertently find their personal information circulating within a broader ecosystem, with potential consequences for their privacy and security. 

Fortunately, there are steps that users can take to regain control over their digital lives and mitigate the impact of unwanted notifications from the Journal app. Disabling Journaling Suggestions and revoking the app's access to sensitive data are simple yet effective measures that can help restore a sense of privacy and autonomy. Additionally, users may wish to reconsider their relationship with technology more broadly, adopting a more discerning approach to app permissions and data sharing. 

By scrutinising the terms of service and privacy policies of the apps they use, individuals can make more informed decisions about which aspects of their digital lives they are comfortable surrendering to third-party developers. Ultimately, the Journal app serves as a poignant reminder of the complex interplay between convenience and privacy in the digital age. While its intentions may be benign, its implementation raises important questions about the boundaries of personal data and the need for greater transparency and control over how that data is used. 

As users continue to grapple with these issues, it is incumbent upon developers and policymakers alike to prioritize user privacy and empower individuals to make informed choices about their digital identities. Only through concerted effort and collaboration can we ensure that technology remains a force for good, rather than a source of concern, in our increasingly connected world.
Read more »
User Safety
AI Scams Canada Cyber Fraud Data Privacy User Safety

Authorities Warn of AI Being Employed by Scammers to Target Canadians

 

As the usage of artificial intelligence (AI) grows, fraudsters employ it more frequently in their methods, and Canadians are taking note. According to the Royal Bank of Canada’s (RBC's) annual Fraud Prevention Month Poll, 75% of respondents are more concerned with fraud than ever before. Nine out of 10 Canadians feel that the use of AI will boost scam attempts over the next year (88%), thereby making everyone more exposed to fraud (89%).

As per the survey, 81 percent of Canadians think that AI will make phone fraud efforts more difficult to identify, and 81 percent are worried about scams that use voice cloning and impersonation techniques. 

"With the recent rise in voice cloning and deepfakes, fraudsters are able to employ a new level of sophistication to phone and online scams," stated Kevin Purkiss, vice president, Fraud Management, RBC. "The good news is that awareness of these types of scams is high, but we also need to take action to safeguard ourselves from fraudsters.”

The study also discovered that phishing (generic scams via email or text), spear phishing (emails or texts that appear authentic), and vishing (specific phone or voicemail scams) were among the top three types of fraud. More than half also report an increase in deepfake frauds (56%), while over half (47%) claim voice cloning scams are on the rise. 

Prevention tips

Set up notifications for your accounts, utilise multi-factor authentication whenever possible, and make the RBC Mobile App your primary banking tool. Keep an eye out for impersonation scams, in which fraudsters appear to be credible sources such as the government, bank employees, police enforcement, or even a family member. 

Some experts also recommend sharing a personal password with loved ones to ensure that you're conversing with the right individual. 

To avoid robo-callers from collecting your identity or voice, limit what you disclose on social media and make your voicemail generic and short. Ignore or delete unwanted emails and texts that request personal information or contain dubious links or money schemes.
Read more »
Threat Landscape
Business Security CISO Cyber Security Dark Web Data Privacy Threat Landscape

Here's Why Tracking Everything on the Dark Web Is Vital

 

Today, one of the standard cybersecurity tools is to constantly monitor the Dark Web - the global go-to destination for criminals - for any clues that the trade secrets and other intellectual property belonging to the organisation have been compromised. 

The issue lies in the fact that the majority of chief information security officers (CISOs) and security operations centre (SOC) managers generally assume that any discovery of sensitive company data indicates that their enterprise systems have been successfully compromised. That's what it might very well mean, but it could also mean a hundred different things. The data may have been stolen from a supply chain partner, a corporate cloud site, a shadow cloud site, an employee's home laptop, a corporate backup provider, a corporate disaster recovery firm, a smartphone, or even a thumb drive that was pilfered from a car.

When dealing with everyday intellectual property, such as consumer personal identifiable information (PII), healthcare data, credit card credentials, or designs for a military weapons system, knowing that some version of it has been acquired is useful. However, it is nearly hard to know what to do unless the location, timing, and manner of the theft are known. 

In some cases, the answer could be "nothing." Consider some of your system's most sensitive files, including API keys, access tokens, passwords, encryption/decryption keys, and access credentials. If everything is carefully recorded and logged, your team may find that the discovered Dark Web secrets have already been systematically deleted. There would be no need for any further move.

Getting the info right

Most CISOs recognise that discovering secrets on the Dark Web indicates that they have been compromised. However, in the absence of correct details, they frequently overreact — or improperly react — and implement costly and disruptive modifications that may be entirely unnecessary. 

This could even include relying on wrong assumptions to make regulatory compliance disclosures, such as the European Union's General Data Protection Regulation (GDPR) and the Securities and Exchange Commission's (SEC) cybersecurity obligations. This has the potential to subject the organisation to stock drops and compliance fines that are avoidable. 

Establishing best practices

You must keep a tightly controlled inventory of all of your secrets, including intricate and meticulous hashing techniques to trace all usage and activity. This is the only way to keep track of all activity involving your machine credentials in real time. If you do this aggressively, you should be able to detect a stolen machine credential before it reaches the Dark Web and is sold to the highest bidder.

Another good strategy is to regularly attack the Dark Web — and other evil-doers' dens — with false files to add a lot of noise to the mix. Some discriminating bad guys may avoid your data totally if they are unsure if it is genuine or not.
Read more »
Technology
Artifcial Intelligence Data Privacy Databases Hacks Robust security Technology

Simplifying Data Management in the Age of AI

 


In today's fast-paced business environment, the use of data has become of great importance for innovation and growth. However, alongside this opportunity comes the responsibility of managing data effectively to avoid legal issues and security breaches. With the rise of artificial intelligence (AI), businesses are facing a data explosion, which presents both challenges and opportunities.

According to Forrester, unstructured data is expected to double by 2024, largely driven by AI applications. Despite this growth, the cost of data breaches and privacy violations is also on the rise. Recent incidents, such as hacks targeting sensitive medical and government databases, highlight the escalating threat landscape. IBM's research reveals that the average total cost of a data breach reached $4.45 million in 2023, a significant increase from previous years.

To address these challenges, organisations must develop effective data retention and deletion strategies. Deleting obsolete data is crucial not only for compliance with data protection laws but also for reducing storage costs and minimising the risk of breaches. This involves identifying redundant or outdated data and determining the best approach for its removal.

Legal requirements play a significant role in dictating data retention policies. Regulations stipulate that personal data should only be retained for as long as necessary, driving organisations to establish retention periods tailored to different types of data. By deleting obsolete data, businesses can reduce legal liability and mitigate the risk of fines for privacy law violations.

Creating a comprehensive data map is essential for understanding the organization's data landscape. This map outlines the sources, types, and locations of data, providing insights into data processing activities and purposes. Armed with this information, organisations can assess the value of specific data and the regulatory restrictions that apply to it.

Determining how long to retain data requires careful consideration of legal obligations and business needs. Automating the deletion process can improve efficiency and reliability, while techniques such as deidentification or anonymization can help protect sensitive information.

Collaboration between legal, privacy, security, and business teams is critical in developing and implementing data retention and deletion policies. Rushing the process or overlooking stakeholder input can lead to unintended consequences. Therefore, the institutions must take a strategic and informed approach to data management.

All in all, effective data management is essential for organisations seeking to harness the power of data in the age of AI. By prioritising data deletion and implementing robust retention policies, businesses can mitigate risks, comply with regulations, and safeguard their digital commodities.


Read more »
Technology
Algorithm Artificial Inteligence Content Creators Data Privacy Social Media Technology

Where is AI Leading Content Creation?


Artificial Intelligence (AI) is reshaping the world of social media content creation, offering creators new possibilities and challenges. The fusion of art and technology is empowering creators by automating routine tasks, allowing them to channel their energy into more imaginative pursuits. AI-driven tools like Midjourney, ElevenLabs, Opus Clip, and Papercup are democratising content production, making it accessible and cost-effective for creators from diverse backgrounds.  

Automation is at the forefront of this revolution, freeing up time and resources for creators. These AI-powered tools streamline processes such as research, data analysis, and content production, enabling creators to produce high-quality content more efficiently. This democratisation of content creation fosters diversity and inclusivity, amplifying voices from various communities. 

Yet, as AI takes centre stage, questions arise about authenticity and originality. While AI-generated content can be visually striking, concerns linger about its soul and emotional depth compared to human-created content. Creators find themselves navigating this terrain, striving to maintain authenticity while leveraging AI-driven tools to enhance their craft. 

AI analytics are playing a pivotal role in content optimization. Platforms like YouTube utilise AI algorithms for A/B testing headlines, predicting virality, and real-time audience sentiment analysis. Creators, armed with these insights, refine their content strategies to tailor messages, ultimately maximising audience engagement. However, ethical considerations like algorithmic bias and data privacy need careful attention to ensure the responsible use of AI analytics in content creation. 

The rise of virtual influencers, like Lil Miquela and Shudu Gram, poses a unique challenge to traditional content creators. While these virtual entities amass millions of followers, they also threaten the livelihoods of human creators, particularly in influencer marketing campaigns. Human creators, by establishing genuine connections with their audience and upholding ethical standards, can distinguish themselves from virtual counterparts, maintaining trust and credibility. 

As AI continues its integration into content creation, ethical and societal concerns emerge. Issues such as algorithmic bias, data privacy, and intellectual property rights demand careful consideration for the responsible deployment of AI technologies. Upholding integrity and ethical standards in creative practices, alongside collaboration between creators, technologists, and policymakers, is crucial to navigating these challenges and fostering a sustainable content creation ecosystem. 

In this era of technological evolution, the impact of AI on social media content creation is undeniable. As we embrace the possibilities it offers, addressing ethical concerns and navigating through the intricacies of this digitisation is of utmost importance for creators and audiences alike.

 

Read more »
Technology
AI Data Privacy Hyper-Personalization Retail Industry Technology

Hyper-Personalization in Retail: Benefits, Challenges, and the Gen-Z Dilemma

Hyper-Personalization in Retail

Customers often embrace hyper-personalization, which is defined by customized product suggestions and AI-powered support. Marigold, Econsultancy, Rokt, and The Harris Poll polls reveal that a sizable majority of consumers—including 88% of Gen Zers—view personalized services as positive additions to their online buying experiences.

Adopting hyper-personalization could increase customer engagement and loyalty, and benefit retailers' bottom lines. According to a survey conducted in the United States by Retail Systems Research (RSR) and Coveo, 70% of merchants believe personalized offers will increase sales, indicating a move away from mass market promotions.

Adopting Hyper-Personalization

Hyper-personalization has drawbacks despite its possible advantages, especially in terms of data security and customer privacy issues. Retailers confront the difficult challenge of striking a balance between personalization and respect for privacy rights, as 78% of consumers worldwide show increasing vigilance about their private data.

Privacy and data security issues

Strong data privacy policies are a top priority for retailers to reduce the hazards connected with hyper-personalization. By implementing data clean rooms, personally identifiable information is protected and secure data sharing with third parties is made possible. By following privacy rules and regulations, retailers can increase consumer confidence and trust.

Retailers should take proactive measures targeted at empowering customers and improving their experiences to take advantage of the opportunities provided by hyper-personalization while resolving its drawbacks.

Customers can take control of their communication preferences and the data they share by setting up preference centers. Retailers build trust and openness by allowing customers to participate in the customizing process, which eventually improves customer relations.

Measurement and tracking of customer sentiment are critical elements of effective hyper-personalization campaigns. Retailers should make sure that personalized experiences are well-received by their target audience and strengthen brand loyalty and trust by routinely assessing consumer feedback and satisfaction levels.

In the retail industry, hyper-personalization is a paradigm shift that offers never-before-seen chances for revenue development and customer engagement. However, data security, privacy issues, and customer preferences must all be carefully taken into account while implementing it. 

In the digital age, businesses can negotiate the challenges of hyper-personalization and yet provide great customer experiences by putting an emphasis on empowerment, transparency, and ethical data practices.


Read more »
User Data
Blogger Security Data Privacy Open AI Technology User Data

WordPress and Tumblr Intends to Sell User Content to AI Firms

 

Automattic, the parent company of websites like WordPress and Tumblr, is in negotiations to sell training-related content from its platforms to AI firms like MidJourney and OpenAI. Additionally, Automattic is trying to reassure users that they can opt-out at any time, even if the specifics of the agreement are yet unknown, according to a new report from 404 Media. 

404 reports Automattic is experiencing internal disputes because private content not intended for the firm to save was among the items scrapped for AI companies. Further complicating matters, it was discovered that adverts from an earlier Apple Music campaign, as well as other non-Automatic commercial items, had made their way into the training data set. 

Generative AI has grown in popularity since OpenAI introduced ChatGPT in late 2022, with a number of companies quickly following suit. The system works by being "trained" on massive volumes of data, allowing it to generate videos, images, and text that appear to be original. However, big publishers have protested, and some have even filed lawsuits, claiming that most of the data used to train these systems was either pirated or does not constitute "fair use" under existing copyright regimes. 

Automattic intends to offer a new setting that would allow users to opt out of training AI systems, however it is unclear if the setting will be enabled or disabled by default for the majority of users. Last year, WordPress competitor Squarespace launched a similar choice that allows you to opt out of having your data used to train AI.

In response to emailed questions, Automattic directed local media to a new post that basically confirmed 404 Media's story, while also attempting to pitch the move to users as a chance to "give you more control over the content you've created.”

“AI is rapidly transforming nearly every aspect of our world, including the way we create and consume content. At Automattic, we’ve always believed in a free and open web and individual choice. Like other tech companies, we’re closely following these advancements, including how to work with AI companies in a way that respects our users’ preferences,” the blog post reads.

However, the lengthy statement comes across as incredibly defensive, noting that "no law exists that requires crawlers to follow these preferences," and implying that the company is simply following industry best practices by giving users the option of whether or not they want their content employed for AI training.
Read more »
United States
Cyber Attacks Data Privacy Healthcare Breach Ransomware Gang United States

BlackCat Ransomware Linked to UnitedHealth Subsidiary Optum Hack

 

A cyberattack against Optum, a UnitedHealth Group company, was linked to the BlackCat ransomware gang and resulted in an ongoing outage that impacted the Change Healthcare payment exchange platform. 

Customers were notified by Change Healthcare earlier this week that due to a cybersecurity incident, some of its services are unavailable. The cyberattack was orchestrated by alleged "nation-state" hackers who gained access to Change Healthcare's IT systems, according to a statement made by UnitedHealth Group in an SEC 8-K filing a day later. 

Since then, Optum has been posting daily incident updates on a dedicated status page, alerting users to the fact that most services are temporarily unavailable due to Change Healthcare's systems being offline to contain the breach and prevent future damage. 

"We have a high level of confidence that Optum, UnitedHealthcare and UnitedHealth Group systems have not been affected by this issue," Optum stated. "We are working on multiple approaches to restore the impacted environment and will not take any shortcuts or take any additional risk as we bring our systems back online.” 

Links to BlackCat 

Change Healthcare has been holding Zoom calls with partners in the healthcare sector to share information regarding the cyberattack since it affected its systems. 

One of the individuals involved in these calls informed a local media source that forensic experts participating in the incident response had linked the attack to the BlackCat (ALPHV) ransomware gang (Reuters first reported the Blackcat link on Monday).

Last week, another source informed BleepingComputer that one indicator of attack is a critical ScreenConnect auth bypass vulnerability (CVE-2024-1709), which is being actively used in ransomware attacks against unpatched servers. 

Tyler Mason, vice president of UnitedHealth Group, stated that 90% of the impacted pharmacies had put new electronic claim procedures in place to deal with Change Healthcare issues, but he did not confirm if BlackCat was the root of the attack. 

"We estimate more than 90% of the nation’s 70,000+ pharmacies have modified electronic claim processing to mitigate impacts from the Change Healthcare cyber security issue; the remainder have offline processing workarounds," Mason stated. "Both Optum Rx and UnitedHealthcare are seeing minimal reports, including less than 100 out of more than 65 million PBM members not being able to get their prescriptions. Those patients have been immediately escalated and we have no reports of continuity of care issues.” 

8,000 hospitals and other care facilities, as well as more than 1.6 million doctors and other healthcare professionals, are under contract with United Health Group (UHG), a health insurance provider with operations in all 50 states of the United States. With 440,000 employees globally, UHG is the largest healthcare corporation in the world by sales ($324.2 billion in 2022).
Read more »
Virtual Private Network
Cyber Security Data Privacy Network Server Online Security Virtual Private Network

Everything You Need To Know About VPN

 


In an era where our daily lives intertwine with the digital world, the internet becomes both a companion and a potential threat, understanding the role of Virtual Private Networks (VPNs) is key to safeguarding your online experience. Whether you're working remotely, enjoying a coffee shop's Wi-Fi, or travelling, a VPN functions as a dependable safeguard against potential security risks.


What is a VPN? 

A VPN, or Virtual Private Network, is your online security guard. Its purpose is to create a secure, private tunnel over the internet, encrypting your data and protecting it from prying eyes. This extra layer of security is especially crucial given the internet's initial design prioritising data transfer reliability over privacy.


How does it work? 

Imagine your computer wanting to visit a website like ZDNET. Instead of sending unprotected data, a VPN encrypts it and sends it through a secure tunnel to a VPN server. This server then decrypts the information, establishing a safe connection between your device and the destination, ensuring your data remains confidential.

There are two main types of VPNs. Corporate VPNs connect private networks within the same organisation over the internet, securing data transmission. Consumer VPNs, offered as a service, protect your data transmission to the provider's data centre, enhancing security, especially on public Wi-Fi.


When should you use a VPN? 

Whenever you're away from your secure home or office network and using public Wi-Fi, a VPN is your go-to. It adds an extra layer of protection against potential snoopers on open networks, especially when accessing services with personal information.

Choosing the right VPN service matters. While free VPNs exist, they often come with privacy risks. Some are even set up by malicious entities to harvest personal data. Opting for a reputable paid VPN service is a safer choice.

However, a VPN does not serve as an infallible solution for privacy. While it secures your connection, it does not have the capability to prevent websites from tracking your activities. Users are advised to maintain vigilance regarding potential privacy infringements that may extend beyond the scope of the VPN.


Concerned about your computer slowing down? 

Advancements in CPU performance have effectively mitigated the impact of data encryption and decryption processes. However, network performance remains susceptible to the quality of public Wi-Fi and the geographical location of the VPN server. 

Certain VPN services may impose limitations on usage, such as data caps or speed restrictions. These restrictions are often associated with free services. Therefore, opting for a dependable paid service that aligns with your specific requirements becomes imperative.

In the domain of online security, VPNs play a pivotal role. Whether safeguarding sensitive work data or ensuring privacy on public networks, a comprehensive understanding of VPN fundamentals empowers users to traverse the internet securely. It is advised to make informed choices, stay updated, and consider your VPN as a reliable tool for online protection.


Read more »
U.S. Census Bureau
Artificial Intelligence Data Privacy Healthcare Healthcare Data Synthetic Data Technology U.S. Census Bureau

Synthetic Data: How Does the ‘Fake’ Data Help Healthcare Sector?


As the health care industry globally continues to collapse from staff-shortage, AI is being hailed as the public and private sector’s salvation. With its capacity to learn and perform jobs like tumor detection from scans, the technology has the potential to prevent overstress among healthcare professionals and free up their time so they can concentrate on providing the best possible treatment.

However, AI requires its data to be working perfectly in order operate efficiently. If the models are not trained properly on comprehensive, objective, and high-quality data, it could lead to insufficient outcomes. This way, AI has turned out to be lucrative aspect for healthcare institutions. However, it is quite challenging for them to gather and use information while also adhering to privacy and confidentiality regulations because of the sensitivity of the patient data involved.

This is where the idea of ‘synthetic data’ come into play. 

Synthetic Data

The U.S. Census Bureau defines synthetic data as artificial microdata that is created with computer algorithms or statistical models to replicate the statistical characteristics of real-world data. It can supplement or replace actual data in public health, health information technology, and healthcare research, sparing companies the headache of obtaining and utilizing real patient data.

One of the reasons why synthetic data is preferred over the real-world information is the privacy it provides. 

Synthetic data is created in a way that maintains the dataset's analytical usefulness while replacing any personally identifying information (PII) with non-identified numbers. This ensures that identities cannot be traced back to particular records or used for re-identification while facilitating the easy usage and exchange of data for internal use.

Using fake data as an alternative for PII ensures that the organizations remain true to their guidelines such as GDPR and HIPAA throughout the process. 

In addition to protecting privacy, synthetic datasets can assist save the time and money that businesses often need to spend obtaining and managing real-world data using conventional techniques. Without needing businesses to enter into complicated data-sharing agreements, privacy legislation, or data access restrictions, they faithfully reproduce the original data.

Caution is a Must At All Stages

Even though synthetic data has a lot of advantages over real data, it should never be treated carelessly.

For example, the output may be less dependable and accurate than anticipated and could have an impact on downstream applications if the statistical models and algorithms being used to generate the data are faulty or biased in any manner. In a similar vein, a malicious actor could be able to re-identify the data if it is only partially safeguarded.

Such case can happen if the synthetic data include outliners and unique data points, such as a rare disease found in a small number of records. It may be connected to the original dataset with ease. Re-identifying records in the synthetic data can also be accomplished by adversarial machine learning techniques, particularly in cases where the attacker has access to both the generative model and the synthetic data.

These situations can be avoided by using techniques like differential privacy – to add noise to the data – and disclosure control in the generation process in order to add alteration and perturbation of the information. 

Generating synthetic data could be tricky and may as well result in compromise of transparency and reproducibility. Researchers and teams are thus advised to take the aforementioned approach without running the same risks, and constantly seek to document and share the procedures used to produce synthetic data.  

Read more »
Subscribe to: Posts (Atom)