blocking big brother · •install ad blocker •scrub tracking information periodically. social...
TRANSCRIPT
2017NewYorkStateCyberSecurityConference
Pleasedonotre-distributeorre-usethispresentationwithoutthepermissionofthepresenters.
BlockingBigBrother:ProtectingYourPrivacyOnline
ToddBraselMicheleWarner
Aboutyourpresenters• MicheleWarner,JD• SeniorConsultant• [email protected]
• ToddBrasel,SSCP,GWAPT,PMP
• PrincipalConsultant• [email protected]
“… andI’mnotan
attorney…”
“I’mnotactingasanattorney…”
Whatwe’llcovertoday• Whyisyourdataimportant?• Makingbetterchoicesaboutwhatinformationyoushare• Basicstrategyandtacticsforprotectingyouronlineprivacy
Whois“BigBrother?”
Imagineaworld…
Howweusuallythinkaboutprivacy
Security->howtokeepinformationsafeandconfidential
Privacy->appropriatecollectionanduseofinformation
Butdowethink aboutprivacy?
WeundervalueourowndataHowwethinkaboutourdata Howothersseeit
Theprivacytug-of-war
YourData
Execorders
State&Federallaws
TechCompanies
Dataconsumers
Consumeragencies
You
OrderinggroceriesandprivacyWhatyousee
Whatdataconsumerssee
Orderingcoffeeandprivacy
CascaraLatte$4.95
Female,DOB6/10/92
42.685,-73.841
Shortrunthismorning
AndroidOS
Chromebrowser
8min20svisit
PlayingfavsongbyAdele
HomeWifi networkiscalled“bethrox”
UsuallygetsamochalatteonWednesday
(Datapotentiallyavailabletoanapp)
Onamoreseriousnote…• Whatmightyoubuyonanimpulse?Whenyou’rehappy?Whenyou’redepressed?• Howmuchdatawillbeenoughtomakeafoolproofcaseagainstyou?• Shouldyoubedetainedforquestioning?
PrivacyStrategy?
Approachtoaprivacystrategy
Makeinformeddecisions
CompartmentalizeMonitorleaks
InformedDecisions• Thinkabouthowotherscoulduseyourdata• Doyouneedtosharethis?• Doyouneedtobelongtothatsite?• Whatprivacypoliciesareineffect?• Wherewillyourdatabestored?• Whohasaccesstomydataandunderwhatconditions?• Aretherechildren(yours/others)inthephoto?
“Red”datacategory
• Name• Primaryaddress• Birthdate• Driver’slicense• Imagesofyou• Answerstosecurityquestions
“Yellow”datacategory
• Phonenumber• Primaryemailaddress• Cityofresidence
“Green”datacategory
• Secondaryphonenumber• PObox• Secondaryemailaddress• Giftcardnumbers
Knowwhereyourdatawillbestored
StudyPrivacyPoliciesHowdoIfindtheseandwhatamIlookingfor?• PrivacyPolicieswillbeposted• WhatrightsdoIhavetomyinformation?• Whatcanthecompanydowithmyinformation?• Whatinformationcantheycollectonme?• Whocantheygivemyinformationto?• Canmyinformationbesold?• Dotheygiveittothegovernment?Doesthegovernment
needasubpoenatogetit?
Carefullydecidewhen,wheretoshare• Doyouneedtobeonthatsiteorusethatservice?• Whoelsemaybeinvolvedwiththeinformation?• Whatdoesthissayaboutme?• Ismychildinvolved?AretheyOKwithit?
Compartmentalize• Unlinkaccounts• Separateyouridentities• Workvspersonaldevicesandaccounts
Monitoruseofyourdata• Googleyourself• Checkyouraccountfromdifferentviewpoints• Reviewyoursettings• Scrubyouraccountofextraneousinfo• Usehaveibeenpwned andotherservices
Examples• WebBrowser• SocialMedia
PrivacyandWebBrowsers
Sameadcodeondifferentsites
Cookie+URLsenttoadvertiser
Howmanytrackers?
PrivacyandWebBrowsers• Compartmentalize• Useprivate/incognitobrowsing• Changebrowsersettings• Usedifferentbrowsers/profilesfordifferentpurposes
• Monitor• Installadblocker• Scrubtrackinginformationperiodically
SocialMediaand"BigBrother"Policeandgovernmentagencies
SocialMediaand"MiddleBrother"Whatyousee Whatdataconsumerssee
SocialMediaand“LittleBrother”Whatyousee Whatyourcontactssee
SocialMediaand“UnexpectedBrother”
PHOTODIGITAL KIDNAPPING
Summary
Think
beforeyoushare!
Makeinformeddecisions
CompartmentalizeMonitorleaks
Anyquestions?