Data security is most important requirement to the customers or user. If the organisation wants to run a business successfully, they need to give surety of data protection as it gives customers the assurance that their data is being collected, processed, and transferred through secure mechanism. Data is most critical and important for businesses of all sizes, from a small start-up to a global conglomerate and so is data privacy.

Data is information processed by a computer system and stored in a system known as server. This information may be in the form of text, image, documents, audio clips, software programs, patents, financial information, secret information, health data, personal information or other types of data.

Every organisation collect data with different mediums either by old traditional method or by modern digital methods. Be it hospitals, banks, companies, government departments etc data is everywhere. Processed data is known as information.

Sometimes a set of data can formulate a sensitive information, so Data privacy is a mechanism to maintain our privacy online, because information is a highly value asset and sought-after commodity by malicious users and cyber criminals. As an end user it is very essential to know what is happening with our online information, what can be done with the data or who all can have access to it. Users often give their consent and allow companies to track and store their data can have disastrous results, so one should have a say in the matter.

Normally organisation focus on the risks originated hackers and cyber criminals, however this is much more than this. Protecting your data privacy is as significant as managing your data security.

Firstly, and fore mostly, Data Privacy is an arm of data security and its motive is to safeguard the data from unauthorized access. Data privacy aims to the proper handling of information based on its significance-

• Regulatory requirements and data privacy laws
• Consent of the data owner
• Privacy Notice
• About the public expectation of privacy.

Main objective of Data privacy is to safeguard the users’ data as per the regulations and users’ rights. Main factors to consider are:

• How to collect and share the data legally
• Whether to data can be shared with the third parties and identification of the third parties with whom data can be shared.
• Adhering to the regulatory compliance and laws limits such as-HIPPA (Health Insurance Portability and Accountability Act), GDPR (The General Data Protection Regulation), GLBA (The Gramm-Leach-Bliley Act), CCPA (The California Consumer Privacy Act), ECPA (Electronic Communications Privacy Act 1986),Personal Information Protection and Electronic Data Act (PIPEDA) and so on. Different countries have different data protection regulations and all these regulations have their own set of rules and legislation pertaining to a specific area, purpose, and type of companies or individuals.

In a nutshell this means protection of critical user information primarily PII (personally identifiable information) of an individual:

PII consists of: – 

• Full Name,
• Address,
• Contact details,
• Date of birth,
• Social Security Number
• Bank Account Number
• Driving License Number
• Some more personal information such as an-
• • IP address,
  • Profile photo,
  • Social media post,
  • Financial Information
  • Medical Information
  • Location
  • And many based on regulatory compliance.

Importance of Data Privacy and Data Security for Business

 Data privacy and security helps in protection of customer’s data privacy.

It helps reduction of the number of information security incidents like data breaches that an organization can suffer.

• It is helpful in maintaining, improving and retaining brand value of the business.
• It is helpful in safeguarding the business from hefty penalties for violating the rules. Regulators impose huge penalties in case of data breach which could be few thousand dollars or a big part of revenue generated, and it’s different for various types of data breach incidents.
• Data sharing will be limited and identification of third party would be done on prior basis according to the risk level of data.
• It saves the organisations from the theft of data by hacker or cyber criminals, that can cause enormous monetary losses
• Data privacy limits the access of customer’s critical data and hence safeguarding the right of customers to be free from uninvited surveillance
• This helps the organisations to keep track of their data breach records and organisations can learn lesson in order to avoid future recurrence.
• Now a days most of the business run on customer’s critical data safeguarding the privacy expectations should be priority of the organisation.
• It helps the organisations from loss of revenue.
• It is also provided competitive advantages to business.
• Last but not the least it is helpful in adherence to the strict policies of how PII is collected, accessed, protected, and erased.
• Data security and privacy controls are helpful in enhancing company’s reputation and built customer trust.

Importance of Data Privacy for Users

• It provides assurance from unauthorised access of data.
• It will keep customers personal, health and financial information safe.
• It generates a trust value for the customer.
• It provides a legal right to the end user or customer to challenge the company in case of any data breach.
• Data can only be collected by receiving consent from the users.
• Companies which collect the data provides data security guarantee to the end user.

Tips and Tricks to help protect your personal data

Data privacy is such an important issue, nowadays many government organizations and companies spend a good part of their revenue each year to help protect their data—which could include your PII (Personally identifiable information)—from exposure. As an end user may not be able to implement high end security solutions to safeguard their personal data, however there are inexpensive ways whichyou can take to help protect your data. Below are a few suggestions:

• Use strong passwords for your online accounts also avoid having same password for multiple accounts. Change password on regular basis.
• Chane the default password for your home network devices, especially Wi-Fi device. A weak password is easy to guess and any unauthorized person can connect to your network with malicious intent.
• Avoid clicking on any random link received via mail or message, these can have malicious links which will give access of your device to cyber-criminal who could eavesdrop your network traffic including personal data.
• Don’t ever share your personal details like bank account number, credit card detail, social security number, Aadhar card number etc over call.
• Avoid writing your personal details like phone number and address at public platform unless necessary. This could sometimes be very dangerous if accessed by any cyber criminal.
• Avoid sharing too much personal information on social media platform.
• Always use security setting on social media accounts, which you can always secure your accounts by changing in Privacy settings. Always keep your social media count in most private mode in order to avoid disclosure of personal information.
• Use VPN (Virtual Private Network) for online activities, however avoid the freeware for financial transactions.
• Share your personal details over the websites which are using encryption.
• Carefully shred all the personal document, receipts, bank statements and your courier packaging as well before discarding.
• Use genuine software on your system.
• Install antivirus and anti malware.
• Always keep firewall on.

Data Protection regulations and laws of different countries are developed and designed in order to maintain the data privacy of the citizens of that particular country. There are many countries where data privacy is already in place, however there are countries where there are no such laws. Having a framework for data privacy and security will definitely safeguard the critical information. A set of defined roles and responsibilities, network security controls like firewalls, secure configurations, Intrusion detection and prevention systems, monitoring, logging the activities, having proper procedures and processes in place of conducting any activity like access provision, de-provisioning, change management, patch management, backup management, privilege access management, physical security management etc certainly provide a more secure environment to data and information systems. Expectation and responsibilities of third-party service providers also plays critical role in data security. Technical controls should be according to the organisations risk appetite and relevant regulations.

Although cyber criminals are inventing new techniques to intrude into the networks but using encryption techniques will help the data in non-readable formats.

 Data is the most precious asset for both organisation and customer, a vigilant consumer and an organisation with adequate resources, diligent employees, regular monitoring, proper governance, periodic reviews can safeguard their information assets and maintain data privacy and security.

#Keywords,-Data security, data privacy, encryption, Cybercriminals, hackers, GDPR,HIPPA,GLBA , CCPA , ECPA ,PIPEDA, password protection, network security, patch management,

]]> http://www.cyberlaws.org/crypto-currency-is-secured-by-using-cryptography-techniques/ Thu, 18 Mar 2021 10:14:29 +0000 http://www.cyberlaws.org/?p=649 Cybersecurity in Cryptocurrency Business

A crypto currency as the name suggest is a secured virtual or digital currency. Crypto currency is secured by using cryptography techniques, which makes it highly secure and nearly impossible to forge or replicate. Crypto currencies are based on block chain technology on decentralized networks—a distributed ledger enforced by a disparate network of computers.

As crypto currencies become more popular worldwide, there’s concern that cyber criminals or hackers will try to use them to masquerade their illegitimate activities in other platforms, particularly when it comes to laundering funds.

The digital currency using principles of cryptography to secure transactions. Where the regulators and governments are still trying to figure out appropriate legal structures and business norms governing crypto currencies., hackers and cybercriminals are finding intelligent ways to exploit that window of opportunity by identifying the vulnerabilities in crypto currency business.

 Since Cyber Security of crypto currency is a concerning issue and it is obvious that the cyber security industry has to significantly consider crypto currency security and the issues surrounding it. The crypto currency being untrack able and irreversible transactions leads to many potential issues for consumers and organizations alike who occupy crypto currency.

Despite the cyber security threats and risk, many individuals still want to participate in the crypto currency market and would want to acquire it – few of them are technology enthusiasts who would want to be the part of new wave of technology and another big number is of those who wants to become a millionaire in quick span of time. If you’re either of the category of those people, these tips may help secure your crypto currency account.

There are few To Do’s on which the security experts agree to keep crypto currency out of the hands of cyber criminals or hackers-

Use of Hard Wallets

The first and foremost thing to consider is to keep cyber security the topmost priority, since an individual’s private key is the way to access crypto currency, therefore it’s essential to keep it safe. Do not keep your keys online in safeguard yourself. One may use a hardware wallet — an item that looks like a USB and contains their private code. Your key will be kept in an encoded format in hardware wallets and one can simply plug the wallet to your system in case of any transaction, code will always remain in the device and hence there will be hardly any chance that it would be accessed or stolen from your system by cyber criminals or any other unauthorised users. One can make duplicates of the wallets which can be kept another safe place, so that there would be a backup always available with you. It is highly recommended to use crypto currency hard for the strong security.

Use unique and strong Passwords/Passphrases:

Use of strong passwords will help to keep crypto currency security safer, the passwords/passphrase used for crypto currency accounts should not resemble any passwords/passphrases utilized for other types of logins. Passwords should always be considered as security and not as a convenience. Long and complex phrases with digits and letters and special characters that would be impossible to guess are recommended to use. A good password should be non-guessable by cybercriminals or hackers. Avoid using personal information like name, age, date of birth and spouse name as password. Also don’t share too much personal information online. Try to remember your password, in any case if you want to stored it at some place, better to keep it offline and out of reach from any unauthorised person.

Create Separate encrypted email accounts

Next recommendation is to create a separate encrypted email account for the communication regarding crypto currency. There are ample of secured and encrypted email services which offers free accounts which are often best to use, one can get extra premium features by paying a small amount which enhances the security of the account. Commonly free available email servers can be easily compromised and can leave important information accessible to unauthorized personal or cyber criminals. Having a separate encrypted email account which is not connected to other types of activities especially social media, keeps confidential & critical information and communication separate from each other and less prone to cyber-attack.

Use Ad Blocker Software:

Use of ad blocker software for computers and devices utilized for crypto currency is vital, now a days many anti-viruses are providing ad-blocking services. The ad blocker features on the browsers shall also be enabled for extra security. Keeping your systems free of malware and other types of cyber-attacks automatically reduce the risk. Restarting the computer and cleaning the cookies after each is highly advisable in conjunction with the software.

Validate the URL:

While you are dealing with crypto currency it is very important to validate the URL (Uniform Resource Locator) of the site you were utilizing before entering any critical information. Phishing attacks are very common attacks regarding crypto currency websites. Avoid clicking on any link received on mail or message without verifying it. Phishing attacks can be avoided by confirming the web address is correct address associated with the desired account or platform.

Unlike paper-based currencies which are controlled by governments, crypto currencies or digital currencies are fully decentralized and operate independently of any regulation. Crypto currency is still not regulated in many countries, so there are no security audits assessments or controls when it comes to crypto currency systems, In spite of that a lot of media coverage and high returns are luring customers to invest in it. The security risks, however, are real and that can be financially disastrous for those who don’t pay attention towards them and not keen to know how to safeguard themselves from the dangers associated with digital currency.

Crypto currency is certainly providing an ease of use and globalisation of currency, however the improper and insure   can lead to a catastrophic result. Technology if not used properly can results into disaster.

Undoubtedly, acquiring crypto currency is both extremely interesting and filled with risk. Knowing what the threats are and how to safeguard digital assets will help you make an informed decision to determine if investing in digital currency is the right choice for you or not.

Keywords: Cryptocurrency, cybersecurity, digital currency, cybercriminals, hackers, password protection, ad-blocker, digital keys, cyber attacks.

During the current era, both big companies and small start-ups, are using Information Technology for ease of doing business, however it makes them vulnerable for Cyber-attacks. So, it becomes necessary for them to use Cyber security professionals e.g. CISO (Chief Information Security Officer) in order to protect information assets. ,It goes without saying  that information security activities in any organization consume more resources than ever before. Cyber criminals (Hackers) are becoming better all the time, and staying ahead of them is getting tougher. However, it’s not just more zero-day attacks by sophisticated criminals; competitors, growth of the organization, elevated infrastructure complexity and new compliance requirements also desire more cyber defence staff, adequate time and right technology to avoid becoming a victim of a cybersecurity breach.

In earlier days security was primarily focused on physical access to facilities and resources, or adding layers of logical controls to protect business application and data. However, security concerns of the present era don’t fit into this old traditional way anymore. Security concerns impact every aspect of an organization’s operations and should be an integral driver of strategic planning, along with all decision for future expansions.

Since cyberattacks have become smarter and more sophisticated at exploiting vulnerabilities, with the availability of many open-source tools it is easier for hackers to launch new attacks every other day. For the organizations and start-ups cyber security shall be a proactive program rather than a reactive which is to be launched at the time of cyber-attack. Thus, information security is an integral part of organizational strategic growth. It is just as important as goodwill, financial turnovers and product quality.

What is Chief Information Security Officer(CISO) and Virtual Chief Information Security Officer(V-CISO) ?

Top management team should be aware of the impact of lack of information security on their organization’s profitability and durability. A shortage of information security in the organization could result in heavy fines for non-compliance, punitive rulings after finding liability or negligence, or a loss of customers and partners after a confidence-shattering breach. There is a big risk of underestimating information security and it is too big to ignore.

In order to address the growing awareness of information security’s importance to strategic planning, many larger organizations and start-ups include a Chief Information Security Officer (CISO) at the executive level. Chief Information Security Officer is the executive who is responsible of Information security and cyber security compliance in the organization.

Many a times companies cannot afford the cost of having own CISO because of the huge salary range. There are situations where the organizations including start-ups need a CISO , but the budget doesn’t allow for a full-time person in that position.

However, there is a cost effective alternative. Organizations specially start-ups that lack the budget for a full time CISO can opt for an outsourced solution: The Virtual CISO, or V-CISO.

A Virtual-CISO is a information and cyber security expert who uses the expertise  of his/her years of industry experience to help organizations and start-ups  by developing and managing the implementation of the organization’s information security program in order to attain various government and non-government compliances. At a high level, V-CISOs help to build the organization’s security strategy, implementation and its management as well.

Organization’s internal security staff may work and report to V-CISO in order to strengthen the information security and cyber security framework and make it more impactful. In addition to this, the V-CISO is usually expected to be able to present the organization’s state of information security to an organization’s board, management team, auditors, or regulators.

Benefits of having a V-CISO

A V-CISO is generally a cybersecurity professional who works part-time basis offering information security services to multiple organizations at a time, working for several throughout any year. This gives organizations a flexibility to hire part-time CISO on requirement basis.

The V-CISO fills several needs through different types of services, including:

• Information Security and Cybersecurity guidance to management executives in order to adhere compliance guidelines
• Information Security architecture guidance
• Incident management including response
• Governance plans
• Cyber Security readiness assessment
• Compliance alignment recommendations (for ISO 27001,RBI Guidelines for banks ,NBFC, HIPAA, GDPR, PCI-DSS, CCPA and may more)
• Remediation prioritization
• Business Continuity Planning and Disaster Recovery Plans and DR drills.
• Identification of scope and objective for the information security compliance
• Risk management (risk identification and treatment)
• Vendor risk management
• Coordination of audits by regulators or customers

Why you organization need a Virtual CISO?

If your organization needs more information security compliance -related guidance at the management level, consider whether a V-CISO would be a good potential option. If you are a a start-up and your budget won’t support a CISO, you might need a V-CISO .If any of the below mentioned scenarios  are similar to  your situation, your organization might need a Virtual -CISO.

• If you are start-up and are really unaware whether you’re vulnerable to cyber security breaches: If your organization hasn’t yet assessed its information security risk, you might need a V-CISO to initiate and support that process.
• Your organization has been breached and no one from your team was able to detect the attack: Post-breach investigations and recommendations often lead to organizational leadership remodelling. One of those remodelling includes information security member of the executive suite. If this is the case, you might need a V-CISO.
• If you are a start-up dealing with critical customer data: In this case if you don’t want to hire a full time CISO, you need to have a V-CISO in order to safeguard your information assets and avoid high penalties because of non-compliance of various regulations
• Important or major changes have occurred that could impact security: If your organization is having mergers or acquisition, security risk should be assessed. Any significant outside influences, such as a global pandemic or natural disaster, which could impact business continuity as well all information security. If your organization doesn’t have anyone who can guide during these times and ensure security is not compromised you might need a V-CISO.
• If your organization wanted to share the workload for the existing CISO: Changes to the organization scope or environment, including new regulatory compliance requirements, may increase the demands of a CISO beyond their current capability. If your existing CISO requires helping hand, you might need a V-CISO.

There could be multiple reasons to have a V-CISO for your organization. An experienced V-CISO will provide valuable guidance and customised solutions as per your organizational needs. As well as it will save you from the burden of paying salary of a full-time CISO.

How to find a right V-CISO?

If you are struggling in your day-to-day information security requirements V-CISO would be a beneficial to your organization, and decided to have one. The very next step is how find the right one. A good amount or research and investigation can help you. Online reviews and existing customers feedback can help you to find a good fit, knowledgeable V-CISO for your organization.

The general process for engaging a V-CISO generally flows like this:

• Set up an initial consultation meeting (commonly one hour at no charge)
• The V-CISO delivers a proposal of scope of work including high-level information security readiness, proposed services and costs
• You may accept or reject the proposal, and then moves forward

• If you decide to engage a V-CISO, then negotiate an agreement that meets your requirements. If you need periodic gap and risk assessment and remediate report, make sure that is explicitly mentioned in the agreement deliverables.
• An agreement with a V-CISO can be set up for a hourly, monthly or quarterly basis . Make sure that you are getting the services you are paying for.
• A V-CISO can be an affordable and flexible approach to adding extensive information security experience and wisdom to your management team. If a V-CISO is a good fit, it can help your organization to identify and safeguard the weak links which could lead to aggressive cyberattacks.

#Key words- CISO,Virtual CISO, VCISO,vCISO, ISO 27001,GDPR,RBI, cyber security, information security, compliance, hackers, cyberattacks.

HOW SOCIAL ENGINEERING IS USED IN PERSONAL INFORMATION STEALING?

In this digital era where almost everyone is using mobile and computes for ease of access, information stealing has also become a very serious issue. Information can be stolen by using different methodologies, social engineering is one of them. Every other day we read about victims of Social Engineering who either has lost confidential data or money over call or mail.

What is Social Engineering?

Social Engineering is a kind of art where the Hacker tries to steal critical information of victim by socialising with him or her. Have you ever received any unknown call asking your personal details like date of birth, marriage date or sometimes the confidential information like your bank PIN or OTP, then one or other way you would have been faced the wrath of Social Engineering technique of information stealing.

Let’s discuss how Hackers steal data from publically available information of yours or make you fool to share your critical information.

CASE ONE:

The best way to perform is to use the publicly available information from different social networking sites where users put their confidential information like Date of Birth, Contact Number, areas of interest, the place where they live, where they visit and many more. By using such lucrative information Hackers predict the password easily and can access sensitive data of yours. Most of the users use the password which they could remember easily like their name, spouse name or combination of some names and dates, which is very easy to predict. So one should not to share his or her personal information on social media which can be exploited later on.

CASE TWO:

Phishing is the method of stealing information which is very popular. In this case Hackers act as a trustworthy source and try to extract critical information like passwords, credit card information through mails, texts, sms etc. By using this method hacker’s gather information very easily, they will just host a similar looking web page where if the victim put their credentials such as passwords it will be received by hackers and the web page will then redirected to original website. The best way to detect these kind of attack is to check the URL of the website where you are inserting your data and never put your credentials or make payment received on mobile through untrustworthy sources.

CASE THREE:

Vishing, which is Voice phishing where hackers will call you and pretend as a genuine source like Bank Executive etc and will try to extract information like password or OTP of the user. This is one of the most common scam prevalent in many developed countries as well. Here, malicious people called hackers takes advantage of unawareness of users and gather the information and use it for making online payments or other kind of malicious activities.

One should never share personal   details over call, remember no financial institute will ask for your password or OTP.

CASE FOUR:

Another technique where Hackers use Social networking techniques to befriend the target to collect critical information. This is a very easy and popular way to extract critical information without much efforts, here malicious user tries to exploits emotions or needs of the victim and mostly pose as opposite gender or any job agency etc. One should be very careful while sharing their personal and professional information over social media, rather no one should share any critical data online to non-trustworthy sources.

CASE FIVE:

Many people often tend to write down important information like contact details, bank pins, passwords etc. on a piece of paper and later forget to destroy it. This information can be used by hackers to steal information. Information from airline tickets, courier packets from online shopping, electricity or telephone bills  can also be misused because it contains information like Address and Phone number, what else a hacker needs. Dumpster diving is one of the very famous method where hacker extract information from improperly destroyed garbage dumps.

Any paper bounded information should be properly destroyed before dumping it, if possible use shredder to destroy paper bound information so it cannot be reused

The best way to safeguard yourself from social engineering attacks are

Share minimalistic personal information on social media, if possible one should not share any personal information online.

Try to avoid weak password, which are easily guessable, always use strong password which is a combination of special characters and numbers. Don’t use a password for so long, change passwords frequently. And one more thing try to avoid same password everywhere.

Beware of the link you are clicking, pay attention to the websites you are visiting. Never put your information on the websites which doesn’t look genuine. Always use websites which are using ‘HTTPS’ instead of ‘HTTP’ in the URL

Never use public network or public computers for accessing your bank accounts. Public computers are very easy to hack, it can have malware which can capture keystrokes and thus your passwords. Hackers at Public places like airport or railway station might be intercepting the traffic and can capture your credentials.

Don’t ever share your important information like passwords over call, you never know who is listening to you and can misuse the credentials.

Be cautious while you are typing the passwords, shoulder surfing can reveal your password to malicious users.

A camera at public place might be capturing your keyboard entries so be cautious while using your credentials at public places

Always destroy the piece of paper which contains critical information before dumping it, if possible never write down your passwords on paper and don’t ever share it in messages.

Use a good quality of antivirus which can detect the phishing pages and keep your computer firewall on

Hackers always try to find our news methods to steal information, the best way to safeguard yourself to be aware all the time while you are dealing with sensitive information like passwords or bank details. One can attend “Cyber Security Awareness Sessions” in order to learn different methods or techniques of social engineering used to fool the victims and thus will be able safeguard yourself.

Remember prevention is better than cure. One should always be vigilant about their surrounding and know about kind of repercussions can happen because of social engineering. Few good habits can help to safeguard you from online frauds.

#tags: cyber security, digital, online media,

#Keywords: Social Engineering, Online frauds, Phishing, Vishing, Dumpster diving, Cyber Security, Information Security.