Cybersecurity Blog

What is the difference between cybersecurity and data privacy, and how do they work together? Read on for our final post of Data Privacy Week. Thanks again to the National Cybersecurity Alliance for allowing us to partner with them in an effort to resource people with tools to protect their data.

What Is Data Privacy?

The sheer volume of data generated about you and your activities online is staggering, which is why data privacy has become a defining issue of our digital age. Even if you don’t care very much, thousands of businesses across the globe pay top dollar to learn about you through this data.

Your online data can be categorized in certain ways. First, there is personal information like your name, birthdate, and Social Security number. There is also important information about you like your medical records and credit card numbers.

Then there is data about what you do online, like what websites you visit, what products you buy online, and who you communicate with on social media. This data can be extremely granular, like how many seconds you spend looking at a webpage before clicking to something else. Advertisers and other businesses prize this sort of data because they can better target ads and products toward you.

Often, this data is anonymized when sold, meaning an advertiser won’t know the specific name of the person who clicked on a link. But a cross-section of data about you can be added together to try to personalize ads to you. Data privacy, then, is the right to keep your data private. Understand that you cannot keep all of your data private from everyone – the IRS, for example, must know how much money you make, or you will face unpleasant consequences. However, you should know your data privacy rights and, when you can, make choices to only share your data when you feel it is appropriate.

Is Data Privacy the Same as Cybersecurity?

Data privacy and cybersecurity are different fields, but they go together. Data privacy revolves around rules, guidelines, and your own personal choices about who has access to your data, and how much access they have. Cybersecurity is focused on preventing and solving threats like hackings, malware, and online scams.

Bad actors often exploit cybersecurity vulnerabilities, though, to get data – it is that valuable. A lot of cybersecurity is about keeping your data safe. Data privacy, on the other hand, is about your right to keep your data safe, especially from those who aren’t cybercriminals, like websites and businesses.

Why Is Data Privacy Important?

You might be thinking that all your data is already out there, who cares who sees it? Why do I care if an advertiser knows what shoes I just bought through social media?

Think about this: have you ever been creeped out after using a search engine and then suddenly all the ads on the websites you visit are about the thing you searched? Do you want unscrupulous marketers to have your phone number so they can call you constantly?

There is probably some data you really don’t want others to have full access to, like your emails. However, if you don’t pay attention to your data privacy, you might download a program or plug-in that scans your email for data and sells it to advertisers. Even if the plug-in provides a decent service, like easily allowing you to unsubscribe from promotional emails, you might think twice about giving the service total access to your email inbox if you know that they sell your data.

With technology, there is always a trade-off between privacy and convenience. A maps app, for example, needs to know your current location to give you directions. In many cases, though, you can choose how much data you want to share. This is where knowing about data privacy can help you make decisions and form habits.

Finding peace of mind by being more aware of your data privacy is worth it.

January 22-28, 2023 is Data Privacy Week. To celebrate, we are partnering with the National Cybersecurity Alliance to spread awareness and resources about online privacy.

Your data is valuable. Even if you don’t agree, many organizations and groups would pay top dollar for it and they don’t all have your best interests in mind. But you have the power to take charge of your data. This is why we are excited to celebrate the second ever Data Privacy Week!

The goal of Data Privacy Week is to spread awareness about online privacy. We think data privacy should be a priority both for individuals and organizations. Our goal is twofold: we want to help individuals understand that they have the power to manage their data and we want to help organizations understand why it is important that they respect their users’ data.

Data Privacy For Individuals

All your online activity generates a trail of data. Websites, apps, and services collect data on your behaviors, interests, and purchases. Sometimes, this includes personal data, like your Social Security and driver’s license numbers. It can even include data about your physical self, like health data – think about how a smartwatch counts and records how many steps you take. While it’s true that you cannot control how each byte of data about you and your family is shared and processed, you are not helpless.

Here are some simple, easy tips that will help you manage your data privacy:

1. KNOW THE TRADEOFF BETWEEN PRIVACY AND CONVENIENCE.

Nowadays, when you download a new app, open a new online account, or join a new social media platform, you will often be asked for access to your personal information before you can even use it. This data might include your geographic location, contacts, and photos.

For these businesses, this personal information about you is tremendously valuable — and you should think about if the service you get in return is worth the data you must hand over, even if the service is free. Make informed decisions about sharing your data with businesses or services. Is the service, app, or game worth the amount or type of personal data they want in return? Is the data requested even relevant for the app or service (that is, “why does a Solitaire game need to know all my contacts”)?

 2. ADJUST THE SETTINGS TO YOUR COMFORT LEVEL

For every app, account, or device, check the privacy and security settings. These should be easy to find in a Settings section and should take a few moments to change. Set them to your comfort level for personal information sharing; generally, we think it’s wise to lean on the side of sharing less data, not more.

3. PROTECT YOUR DATA

Data privacy and data security go hand-in-hand. Along with managing your data privacy settings, follow some simple cybersecurity tips to keep it safe. We recommend following the Core 4:

• Create long (at least 12 characters), unique passwords for each account and device. Use a password manager to store each password – maintaining dozens of passwords securely is now easier than ever.
• Turn on multi-factor authentication (MFA) wherever it is permitted – this keeps your data safe even if your password is compromised.
• Turn on automatic device, software, and browser updates, or make sure you install updates as soon as they are available.
• Learn how to identify phishing messages, which can be sent as emails, texts, or direct messages.

Data Privacy For Organizations

Respecting the privacy of your customers, staff, and all other stakeholders is critical for inspiring trust and enhancing reputation. By being open about how you use data and respecting privacy, you can stand out from your competition. Communicate clearly and concisely to the public what privacy means to your organization, as well as the steps you take to achieve and maintain privacy.

Here are a few steps toward building a culture of respecting data at your organization:

1. CONDUCT AN ASSESSMENT

Assess your data collection practices. Make sure the personal data you collect is processed in a fair manner and only collected for relevant and legitimate purposes. Understand which privacy laws apply to your business, and remember you will have to think about local, national, and global regulations.

2. ADOPT A PRIVACY FRAMEWORK

Research how a privacy framework can work for you. A privacy framework can help you manage risk and create a culture of privacy in your organization. Get started by checking out the following frameworks:
NIST Privacy Framework
AICPA Privacy Management Framework
ISO/IEC 27701 – International Standard for Privacy Information Management

3. EDUCATE EMPLOYEES

Your employees are the frontlines toward protecting all the data your organization collects. Create a culture of privacy in your organization by educating your employees of their and your organization’s obligations to protecting personal information.

January 22-28, 2023 is Data Privacy Week. To celebrate, we are partnering with the National Cybersecurity Alliance to spread awareness and resources about online privacy. Our posts next week will focus on managing online privacy for both individuals and organizations, as well as the differences between cybersecurity and data privacy and how they work together. To get us ready, here are a couple of short videos with interesting statistics on how individuals and organizations approach data privacy!

Do You Know?

Respect Customer Privacy

This week we welcome our friend and colleague Matt Chiodi to the blog. Matt has over two decades of security leadership experience and is currently the Chief Trust Officer at Cerby. He’s an expert on Zero Trust, and we’re glad to have him as a guest contributor to our blog.

Zero Trust is a set of principles that assumes a breach is likely to occur and that no data, application, asset, or service should be trusted by default. IBM Security found in a 2021 study that when appropriately implemented, Zero Trust can reduce the cost of security breaches by 43%. Zero Trust is a proactive security strategy that helps organizations protect their data and applications by verifying the identity of users, devices, and applications and monitoring their behavior.

The traditional approach to cybersecurity, which assumes that assets and applications inside a network are trusted because they belong to the company, is no longer working. The number of publicly disclosed breaches in 2022 exceeded 4,100, making it clear that the old approach is no longer effective. The problem with the traditional approach is that it focuses on building a wall around the network. This doesn’t work since most employees work in hybrid environments where traditional controls cannot be applied. Today’s attackers are also using sophisticated techniques to bypass these walls and gain access to the network.

One of the critical benefits of Zero Trust is that it can be highly effective when applied correctly. However, there are some situations where it may not be the best approach. For example, with employees, Zero Trust can be counterproductive. Research from cybersecurity company Cerby found in their latest report, State of Employee Trust, that 60% of employees said applications being blocked negatively affected how they felt about their company. To gain employee trust, security and IT teams need to revisit many security tools used in most enterprises.

An overreliance on enforcement-based controls, such as blocking, banning, and denying employee use of employee-preferred applications, can erode employee trust. These measures can negatively impact employee satisfaction and productivity, as they impede their ability to do their job efficiently. Moreover, if employees feel their employer doesn’t trust them, it can negatively affect employee engagement and morale. An interesting finding from the Cerby report found that if empowered to choose the applications they use for work, 39% of employees said they would be willing to take a 20% cut in pay. This finding sheds light on what many employers fail to realize: applications are intimately tied to how people get their work done and their job satisfaction level.

One can use a combination of Zero Trust principles and enrollment-based controls to achieve the best of both worlds. Enrollment-based controls take a different approach and incentivize employees to make security-conscious decisions by providing them with tools and processes that help them work more efficiently and productively. With this approach, security and IT teams can create an environment with something in it for both the employee and employer.

The bottom line is clear for leaders who want to build high-performance organizations for shareholders and employees: Zero Trust is only for applications and data, not employees. Organizational leaders must take tangible steps to build trust daily if they want the highest quality products, continuous improvement, and innovation.

Matt Chiodi has over two decades of security leadership experience and is currently the Chief Trust Officer at Cerby. Prior to Cerby, he was the Chief Security Officer of Cloud at Palo Alto Networks. Chiodi is a frequent blogger, podcaster, and speaker at industry events such as RSA. He is also on faculty at IANS Research.

Merry Christmas and Happy New Year from all of us in the Cybersecurity Education Program!

This holiday season, we’ve partnered with the National Cybersecurity Alliance to let you know about a few online shopping trends and to give you some tips about how to stay safe online while buying gifts for everyone on your list.

Generally, experts seem to believe that the average American is going to spend less this year – though pandemic restrictions have largely lifted, we’ve entered a new season of economic uncertainty. This means every dollar is even more important, which is why we want to help you protect your hard-earned cash from the scammers and hackers that pop up every year. Here is what we think is cheerful and what we think is coal-worthy for shopping online this holiday season:

Cheerful

Keeping an eye on your bank statements
Your first line of defense against identity theft and fraud is to pay close attention to your financial records, like bank statements and credit card transactions. You can usually follow this data up-to-the-minute online. Flag any suspicious activity (like being charged for a purchase you didn’t make) and contact the institution immediately.
Knowing how much items should cost
When shopping online, have a general sense of how much the items you want to buy should cost. Not only will that make you a comparison shopping extraordinaire, but you can also get a sense if an online store has prices that are too good to be true. In these cases, you might pay less, but then you might get an item that doesn’t match the description, is a counterfeit, or you might pay and not get any item at all! A little bit of research can help protect you.
Making a cybersecurity list, checking it twice
1. Protect each account with a unique, complex password that is at least 12 characters long – and use a password manager!
2. Use multi-factor authentication (MFA) for any account that allows it.
3. Turn on automatic software updates, or install updates as soon as they are available.
4. Know how to identify phishing attempts and report phishing to your email provider or work.

Coal-worthy

Shopping on public wi-fi
Public wi-fi and computers are convenient, and sometimes necessary to use. However, public wi-fi is not very secure – you shouldn’t ever online shop or access important accounts (like banking) while connected to public wi-fi. If you must buy a few gifts online while away from your home or work network, use a VPN (virtual private network) or mobile hotspot.
Grinch Bots
Last year, a record number of so-called “Grinch Bots” were recorded. These are automated programs that quickly buy up popular toys, sneakers, or other items and then resell the item for a huge mark-up to real people. Of course, buying supposedly new items on a resale market opens you up to an increased risk of fraud and counterfeit goods. The best way to defang Grinch Bots is to refuse to buy from them, and to only buy items from vendors you can verify.
Sharing more than you feel comfortable with
While you need to share data to make a purchase online, you should be wary of any retailer that is requesting more information than you feel comfortable sharing. Oftentimes, you don’t need to fill out every field, and you shouldn’t if you don’t want to. If an online store requires you to share more information than you want, find another retailer on the internet – or in real life!

And here’s a handy infographic that summarizes it all. Have a safe and happy holiday season!

This post was written by Xavier Zepiora, Junior cybersecurity major at Messiah University.

I recently read an article detailing how cloud attacks are becoming more common these days, and that these attacks are a result of misconfigured cloud settings. A team from Cado Security studied three different cloud attacks that have been impacting businesses. In this post, I’ll share a brief synopsis of each attack and how they confirm a need for more education regarding cloud security.

The first piece of malware the team came across is called DoH because it uses DNS queries over HTTPS. This attack is happening on serverless environments provided by AWS. Sending DNS queries over HTTPS means that they are encrypted and can’t be viewed by AWS security services. The malware also sends thousands of HTTPS string requests, so that EDR services do not detect it. This attack is primarily used for cryptomining but could be used in other ways as it uses command and control methods to operate.

The second piece of malware primarily targets cloud providers in Asia and blends into their UNIX-based systems. The malware uses timestamp manipulation to hide from detection. It has primarily been used for cryptojacking which is when someone else’s resources are used to mine cryptocurrency for the attackers.

The third is a group known as Watchdog which has been in operation since 2019. They have been performing cryptojacking attacks and find vulnerable cloud services through mass scans. They are also known for using steganography for avoiding detection.

These attacks are all only being used for crypto development right now but there is nothing stopping attackers from using the same methods to run other kinds of attacks on cloud systems. This shows the need for cyber security professionals to understand cloud security better, as well as IT professionals working at small companies that outsource to the cloud. If all three of the leading attack frameworks right now are a result of poor configuration, it means we need more cloud education.

This post was written by Senior Cybersecurity major, Ryan Donat.

I was recently invited, along with Dr. David Bibighaus, to present a series of workshops at CV YOU day, an event created and hosted by Cumberland Valley High School. The day is designed for high school students to explore various careers, hobbies, wellness strategies, and more. Thirty-minute workshops take place throughout the day for students to attend in order to find out more about their fields of interest, along with a College and Career Fair.

Dr. Bibighaus and I presented six workshop sessions on Cybersecurity as an industry as well as what it looks like in the educational setting at Messiah. Dr. Bibighaus discussed his extensive career in the field. He shared that he started out being an engineer and hated it, but then later discovered what his interests were as his career developed. He told some interesting stories from his journey, such as being part of the first team catching hackers for the Air Force, and how he led military red cell scenarios. He advised students to pursue what they are interested in, but to start with a broad education so that they can specialize later as their interests develop.

I then shared my route to majoring in cybersecurity, then explained my coursework and studies by showing an ethical hacking demonstration. Next, I taught on the Confidentiality, Integrity, and Availability triad by asking students questions about how they would disrupt a company with infinite access to a company’s computers and networks. I finished up by explaining what I would tell my 18-year-old self if I had the chance.

We finished each presentation by giving time for questions, where the students asked a lot of thought-provoking questions. It was a great event and we enjoyed our time with everyone. Special thanks to all the students, as well as to teachers Keith Ensminger, Robert Newara, and Jay Yohe. And thank you for having us, Cumberland Valley High School!

The Messiah University Cyber Center welcomed 40 attendees to a Lunch and Learn on November 30. The event gathered cybersecurity industry experts, local businesses, and Messiah cybersecurity students and faculty for a shared meal and a time of connection, along with a lively panel discussion on cyber-related topics. Guest panelists included Matthew Chiodi of Cerby, Christina Martin of Highmark Health, Nate Shea of SecureStrux, and Devin Chwastyk of McNees Wallace & Nurick. The event concluded with a special tour of the Cyber Center SOC, provided by SOC interns and Messiah’s Director of Information Security .

Special thanks to all in attendance for making this event a successful time of networking and learning from one another. The industry leaders in attendance brought encouragement and expert advice regarding careers in the cybersecurity field. Students came away excited about the possibilities for their future.

The Cybersecurity Education Program is planning another Lunch and Learn in the spring of 2023.

Dr. Scott Weaver, Associate Professor of Computer Science at Messiah, presented at the 5th annual International Conference of Education, Research and Innovation (iCERi 2022) in Seville, Spain on November 7-10, 2022. The title of his presentation was “Introducing Project-Based Learning and Real-World Methodologies and Tools Earlier in the Software Development Curriculum”.

Abstract: Software development requires the ability to solve problems, an understanding of how to apply development methodologies within a context, and the ability to select and utilize the tools of the trade. Therefore, graduates entering the software development profession are expected to have a portfolio of development practices and tool experience. Project-Based Learning (PBL) is often used in capstone courses where students focus their attention on a project designed to provide a cumulative experience solving a real-world problem. A critical element of the capstone experience is applying industry standards for software development and utilizing industry tools to execute their project. Preparing students to use industry standards and tools earlier in the curriculum prepares them to focus their learning in the capstone course on fine tuning their skills and delivering a high-quality product versus learning the mechanics of using industry methodologies and tools. The study analyzes student cohorts over six years, tracing their course work through select core curriculum, and the impact of early introduction to Project-Based-Learning on their later course work and overall educational experience. Our results demonstrate that earlier introduction of project-based learning with industry tools have led to improved academic performance in upper-level courses, more sophisticated capstone projects and increased perceptions of professional preparedness.

Bio: Before coming to Messiah University, Dr. Weaver spent seven years in the computer industry as a program analyst and consulting, and nine years teaching mathematics and computer science at Mechanicsburg Area High School. He was pivotal in developing the Cybersecurity Education Program at Messiah, and currently teaches Data Communications & Networking, and Web Development: Client Side.

.