Why is this a thing

If criminals break into a company’s systems and steal their data, its called a data breach, taking lots and lots of data belonging to a company. They may then try to sell this data on some underground forums, where they might try and sell it to other criminal gangs, for their use.

But there are also, usually, good guy security researchers in those forums too, keeping an eye on things. If they come across some company’s data being trying to be sold, they may try to notify the company that there has been a breach as they may not be aware of it. Sometimes the security researchers find it difficult to get through to these companies to make contact with somebody that they can discuss this data breach.

How can using the security.txt file help

That’s where the security.txt file comes in. This is just a simple text file that contains some contact information for somebody in the security area or in IT. Somebody that would be reachable by email and maybe if you want to do it securely they may also include the public encryption key for the email to make sure that all communications are kept secured so that the security researchers can reach out and contact the company. They can use the contact address and get in touch there to report the data breach and maybe other vulnerabilities that they may have discovered.

Where can I find out more

So it’s always good to have this and it’s usually placed on your website in a well-known location. Here is the security.txt proposed standard.

So if you have a website, set-up this security.txt file for it.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

The post #WeekendWisdom 099 Using the security.txt file appeared first on L2 Cyber Security Solutions Ltd..

Why am I asking the question “Data Scraping or Data Breaches”?

In recent weeks, three of the large social media companies have had lots and lots of personal data exposed online by cybercriminals. Now these social media companies are claiming that these were data that were scraped from their services. That this information that is already in the public domain.

These may have been Data Scraping

In the case of Clubhouse which had 1.3 million records exposed and LinkedIn which had 500 million records exposed. Yes all of the data that was exposed is stuff that you can see on their platforms. You can see this information very publicly on their platforms. That’s a reasonable expectation. That’s what you use these sites for.

But my issue here is that LinkedIn and Clubhouse should have done much more. They could prevent data being exposed and scraped like that, in such mass quantities. That stuff can be slowed down. It can be made non-economical.

So yes, that was data scraping, maybe not really a data breach but more should have been done.

But this one is definitely a Data Breach

Facebook, which had 533 million records exposed, this is a different situation. They had my mobile number and I had only given it to them for the purpose of authenticating my log on and I had set it to not expose that information to the public. My mobile number was exposed to the public. So therefore that is a data breach, simple as.

Facebook are being disingenuous with their claim that this was data scraping.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 074 Data Scraping or Data Breaches appeared first on L2 Cyber Security Solutions Ltd..

Where is this coming from?

As I said last week, the Data Protection Commission had issued a report for 2020. I’ve had a chance to read through it now in a bit more detail. I really love looking at the case studies that they include there because these are real life events that have occurred.

One of them struck me as something that could occur anywhere.

What? A data breach of bank details??? That’s serious!

It was Case Study 15: Bank details sent by WhatsApp. What had occurred was that a customer of a financial institution had gotten in contact with them wanting to get a copy of their BIC and IBAN details. The member of staff that was dealing with the enquiry knew this person. So, because of that, they took a picture of the details on their personal phone and sent them by WhatsApp to the customer.

WhatsApp is encrypted, so it must be safe. Right?

But it turns out the details that they took the photo of were for somebody else. So, when the customer reported this incident to the bank, they realised this was a data breach. That customer had seen somebody else’s personal details.

How does a business prevent this type of issue?

This is simply a staff training issue. Staff need to be aware that they should always follow proper protocols when dealing with people’s personal details. To make sure that they provide the correct details to the correct person.

As I say it could happen to anybody. So use that example with your staff today.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 068 A Data Breach of Bank Details appeared first on L2 Cyber Security Solutions Ltd..

Yesterday the Data Protection Commission (DPC) in Ireland released their annual report for 2020 and I’ll just give a quick summary of its findings here.

What is the number 1 complaint that the DPC get?

The number one source of complaints for the third year in a row under the GDPR remains access requests. So, businesses out there are still having trouble giving people access to their data that they’re entitled to.

I always focus in the training to make sure that people get their access rights done properly. They have proper procedures in place to handle these requests from individuals.

Any figures for Data Breaches?

Over in regard to data breaches. The number of those reported to the Data Protection Commission has increased again by about 8% overall.

But the number one source of data breaches was unauthorised disclosures of personal data, which was up 12.5% over last year, to nearly 6,000 breaches, which is really, really significant.

Data Breaches caused by hacking were up about 40% and Ransomware incidents also doubled over last year. So, things are going the wrong way.

Is there any good news in the Data Protection Commission Report 2020?

Just to finish on a happy note. I was delighted to see that data breaches in regard to phishing have halved over last year. So that must mean people are getting really good training out there on how to spot dodgy emails.

So that’s it for this week. Lets be careful out there and we’ll talk to you again next week.

How can L2 Cyber Security help you?

We offer a full range of training programmes, which can be delivered online or in-person*.

L2 Cyber Security are also a partner of CyberRiskAware for online self-directed Cyber Security Awareness training and Phishing testing.

Contact us for more information at info@L2CyberSecurity.com.

*With appropriate social distancing and other health and safety measures adhered to.

Follow us on Social media:

Liam is available on Twitter, LinkedIn and Instagram.

Follow L2 Cyber on Twitter, LinkedIn, Instagram and Facebook.

© L2 Cyber Security Solutions

The post #WeekendWisdom 067 Data Protection Commission Report 2020 appeared first on L2 Cyber Security Solutions Ltd..