Today marks the ninth annual Data Privacy Day; the purpose of which is to raise public awareness and advocate data protection and privacy best practices.
Over the last year we've seen many high profile breaches, which involved eBay, JPMorgan, and most recently Sony Pictures Entertainment – so it is very clear that now more than ever that both individuals and companies need to be incredibly aware of the dangers that come as a result of neglecting data protection.
"A reactive approach to security breaches just won't cut the mustard anymore. In an increasingly connected world, with the Internet of Things moving from buzzword to reality, businesses need to proactively monitor their data flows to prevent costly data breaches. However, many large organisations still wait for something to go wrong before addressing the flaws in their security strategies; a move that backfired in some of the most infamous security breaches of 2014.
"This year's Data Protection/Privacy Day is more important than ever. According to a report by the Identity Theft Resource Center, 2014 saw a 24.8 percent increase in reported breaches compared with the previous twelve months. It's not for a lack of legislation either. While perhaps not perfect, there are strict laws in place to protect data. So what's going wrong?
"While penalties for failing to comply with legislation are an incentive, in itself compliance is not the silver bullet – PCI DSS is testament to that. Today's information security landscape is plagued with vulnerabilities that leave companies, and all too often the personal information of individuals, exposed to the potential of a breach.
"Instead, what's needed is a fresh approach to network and application security that helps to remove some of the gaps, both internal and external, that lead to data leaking out.
h malware attacks and other vulnerabilities allowing hackers to gain entry unnoticed. Companies need to layer their defences to ensure that they limit what users can see once within the walls of the trusted network, based on who they are and other important variables, and then control what they can do with sensitive information.
Be smart about your passwords: This means you should refrain from using the same password across multiple accounts. By doing this you prevent cross pollination – where cyber criminals use the same password details to facilitate data breaches across multiple organisations. Of course with so many online accounts and different passwords to remember, it's challenging to remember a different one for each, so even better would be to replace these with One-Time Password (OTP) authentication. In my opinion, there's no such thing as a strong password – static passwords all carry the risk of being hacked. OTP technology is the strongest protection for users. It can generate highly secure one-time passwords to authenticate users, often they will just have to remember a PIN number in order to retrieve a new password.
Free Wi-Fi: You know the saying, there's no such thing as a free lunch? I like to think it's the same with Wi-Fi. I recently demonstrated in a 5 News investigation how easy it is to hack into a coffee shop's free Wi-Fi and gain access to the devices connected to it and view their email addresses, bank account details and other locations they connect to the internet to – be that home or work. All this without their knowledge. Therefore, people must be more cautious about connecting to public Wi-Fi and the security risks of doing so.
Mobile security: Mobile devices are becoming a popular target for hackers. This is hardly a surprise given so many of us have between 1 and 3 of them, and they are increasingly used to store sensitive work files and personal information. The challenge with these devices is that because they connect to the cloud, data ends up being stored in multiple places (the cloud, the mobile, etc.) and this gives the hackers multiple attack points to use. Therefore, unless security controls are in place and companies understand the location of where the data is being stored; there is a greater risk that these devices or their data could be breached.