When an online shopping site suffers a data breach, you'll get a warning to change your password. If your bank is hacked, they'll send you a new credit card. The real problem occurs when a business authenticates you using personal data that can't be changed, like your SSN or birthdate. A new whitepaper from NSS Labs examines the use of static and dynamic information for authentication, and offers businesses advice for improving security.
The SSN was never meant as a personal identifier. The report notes that the equivalent identifier in the UK is never used for authentication. Once your SSN is revealed in a breach, it's forever compromised. And that's a problem.
Some businesses attempt to protect customers by storing only the last four digits of the SSN. It turns out that this isn't very effective. The first five digits aren't random; they're based on when and where you first applied for your SSN. A research project from five years ago analyzed data from the government's "Death Master File" and devised an algorithm to predict those first five digits. With just two attempts they managed 60 percent accuracy. If cybercrooks already have the last four digits, your SSN is pwned.
Date of birth is another datum that just can't be changed. The report notes that place of birth, gender, and citizenship may also be used for authentication, and also can't be changed. It goes on to state that "Enterprises and governments should refrain from using these attributes for online security purposes, although historically they have been considered confidential."
Consumers need to use different strong passwords for all secure sites, and businesses need to help, not hinder, this effort. The report advises all businesses to allow long passwords and remove any restrictions on what characters can be used. It's very discouraging when a website rejects the super-secure password generated by your password manager.
Users who've forgotten their passwords can often re-authenticate by providing answers to one or more security questions. Asking for publicly-available information like the customer's hometown or mother's maiden name is a huge mistake. Businesses should allow customers to define their own questions, and customers should craft questions that no outsider could answer. The report doesn't say this, but if you're confronted with a bad security question, I advise that you supply an answer that's untrue yet memorable.
Advertisers and online businesses constantly profile consumers in many different ways. They look to identify loyal customers, bad credit risks, even figure out who's healthy and who's not. Your shopping habits might determine whether or not you get a discount coupon, or which advertising pitch hits your browser.
The exact same thing happens in the shady world of cyber-crime. Every data breach gives the bad guys more data, and by combining results from overlapping breaches they can create very accurate profiles. The whitepaper suggests that such profiles already exist for "millions of users."
Advice for Business
The whitepaper offers a number of suggestions for online businesses. It advises storing only the necessary minimum of personal data, and storing nothing at all for a one-time transaction. Businesses should avoid storing sensitive data as plain text; in particular they should store password hashes, not passwords. They should also allow users to terminate accounts, thereby wiping out all personal data from the system, including data stored in backups.
Businesses should assume a data breach will happen. The report notes that of the ten biggest breaches in the last decade, half occurred in 2013. Preparation for a breach includes setting up an alternate communication channel for every user, in case the primary channel is breached. Businesses should proactively reach out after a breach, and implement methods to re-authenticate at-risk users, such as creating challenge questions based on actual user activity.
The full whitepaper, titled "Why Your Data Breach Is My Problem," offers a wealth of useful and actionable information, and it's surprisingly readable. Have a look.
Like What You're Reading?
Sign up for Security Watch newsletter for our top privacy and security stories delivered right to your inbox.
Thanks for signing up!
Your subscription has been confirmed. Keep an eye on your inbox!Sign up for other newsletters