PROTECTING YOUR DATA: WHO IS RESPONSIBLE?

Does a corporation have the sole responsibility of protecting its user’s data?

There are several different factors to consider when thinking about protecting your data. The subject can be complex and usually involves multiple parties.

Let’s begin with a simple thought exercise. Think about how much personal information you share on a day-to-day basis, online or otherwise. Consider who and what you interact with; applications, devices, websites, humans, corporations, etc. How much time do you spend thinking who has access to your data and what they could do with it? What are some of the things that you do to ensure you are protecting your valuable information?

Let me ask you this: who is responsible for securing your personal information? The answer might be obvious; you are responsible for securing your own data and ensuring it is not being used incorrectly or being shared with unknown or unwanted third parties.

So what happens when we move this thought exercise to the corporate world? You quickly realize that the amount of personal data being used by an organization during normal operations becomes staggering, almost unfathomable. Keep in mind that many people within a corporation can potentially have access to sensitive information, not to mention the potential for outside users to access these same assets, unassisted or otherwise.

Of course, it is understood that corporations invest countless resources on matters regarding their data security. IT administrators install the latest antivirus software, raise firewalls, deploy encryption technology, and also periodically run vulnerability tests. But are they the only ones responsible for a company’s data security and protecting a user’s data?

How much responsibility do other internal users have in protecting the information? Even if you employ all of the procedures mentioned above, every single user in your organization is a potential entry point for hackers.

It is clear that corporations and individual users have a shared responsibility in securing personal information. An organization can have the most effective data security strategy, employ the best IT security personnel and deploy the most advanced security technologies available, but if an individual user is careless with how they access this information, it becomes a foundational weakness, one that can also be exploited.

What are some of the most significant threats that an organization faces when handling your information?

The highly respected cybersecurity firm Symantec published the “Internet Security Threat Report” in February 2019. You can read the full report here (fair warning, you will not be sleeping well tonight!) but these are some of the report’s “highlights” (“frightlights”; can we make this a thing?) for 2018:

Messaging Attacks

• 48% of malicious email attachments in 2018 were MS Office files; up from 5% (!) in 2017.
• Employees of small organizations were more likely to be hit by email threats—including spam, phishing, and malware—than those in large organizations.
• 55% of emails received in 2018 were categorized as spam.
• In 2018, 1 in 3,207 emails was a phishing email.
• Microsoft Office users are the most at risk of falling victim to email-based malware.

Mobile Attacks

• 1 in 36 mobile devices used in organizations was classed as high risk or had high-risk applications installed. This included devices that were rooted or jail-broken, along with devices that had a high degree of certainty that malware had been installed.
• Mobile ransomware infections increased by 33% from 2017
• The U.S. was the country worst affected by mobile ransomware (63% of all infections), followed by China (13%) and Germany (10%).

Web Attacks

• In 2018, 1 in 10 URLs analyzed was identified as being malicious, up from 1 in 16 in 2017.
• Web attacks on endpoints increased by 56% in 2018.
• By December 2018, more than 1.3 million unique web attacks on endpoint machines were being blocked every day.
• Formjacking (the use of malicious JavaScript code to steal payment card details and other information from payment forms on the checkout web pages of eCommerce sites) was one of the biggest cybersecurity trends of the year.
• On average, 4,800 websites were compromised via formjacking code every single month in 2018.
• More than 3.7 million formjacking attempts on endpoint devices were blocked in 2018.