data.bythebay.io: S. Srinivasan - Privacy Issues in Big Data Processing in light of Data Breaches
thank you very much briefly my full name is soon about some people call me srini short form of that I'm an associate dean and academic affairs and research and also distinguished processor of information systems in the school of business but my background is in mathematics and computer science I've been researching this topic of data breaches and recently have been focusing on many of the issues of privacy violations that happen because of the data breaches I will cite some examples for you to note in that area I will just briefly go or some material but I plan to stop in time I may have more slight but I will skip some of them so the main items will be looking at is what is big data processing how we can take some steps to protect the stored data I look at only five data breaches since 2030 there have been plenty all around the world but will only focus on some of them threat to privacy due to breaches some of them will be rather surprising for you to hear that how people could use that information of stolen data to find things that are not obviously ways to protect privacy and some suggested best practices for that what is big data processing big data encompasses data gathered from multiple sources that is the beauty of that so we are able to combine data from multiple sources and derive knowledge out of that information so that is the benefit of that data comes in structured and unstructured format especially when it is big data you cannot expect all of them to be in the format you want you need to take advantage of how it comes most important thing here is speed of processing that requires automated data processing speed requires automated data processing for example if you are trying to find something about jazz so look at this particular three different aspects of information coming from customer shares with a friend and some interest in jazz that is from an email our social media communication such as reveal interest in jazz the web searches the person does customer tweets about a recent jazz news so there are different sources but combining all these three things you can be very sure that this person has great interest in jazz therefore it becomes good topic for marketers to focus on this individual for products on jazz we have evolved in the way data has come about for us over a period of time initially we were just getting the agricultural age things automated in the agricultural sector provided plenty of opportunities around the world then it became Industrial Age us and UK primarily leading that effort then information age and now we are in the knowledge age so lot of information is coming so how do you derive knowledge out of that and take advantage of that quickly so that is the focus of that particular age we are looking at right now when in internet was developed by Tim berners-lee many many years ago his goal was to have a truly interconnected world but what we are finding today is a whole bunch of documents that are connected that is what you are finding so big data is going to enable you to have the true inter connection in couple of years is not there ready now it will take some more years to get that so this navigation currently that we are doing with all the linking we have is all by hypertext but big data I will help us move in the direction of true knowledge what are the big data benefits centralization of knowledge from multiple sources so you get data from several sources combined them derive data and use that for example I used to cite in my classes at a simple example whereby a customer who has interest in Mexican food happens to walk by that area so the Mexican food rest food store restaurant notices this person is close by very he processes the data and knows the interest of this person in Mexican food seems out of ten ten percent coupon because the person got the coupon around the lunchtime the person walks into the store because geolocation is turned on his friends also would know automatically where this person is so the chances are this restaurant will now get the benefit of this one individual coming in plus some more other individuals coming in also who otherwise would not have come you're you detect the benefit of this person's interest in that kind of food preference let us look at some specific types of information that are available which gets stolen very often one is PII personally identifiable information the scope of this is constantly changing there is no single agency that defines what is PII information such as a name address social security number date of birth phone number your email address they are all belonging to this category PII then phi2 different abbreviation expansions there it is called either personal health information or protected health information whatever it is it talks about your health history which is lot more sensitive think of the fact that if it is once we will then there is no taking back for example if somebody has some form of problems with AIDS they are taking some medication if that information leaks out it could cause the person's job situation as well as insurance situation so that is why it is extremely important to protect that it is predicted under HIPAA lots of penalties there if somebody violates that PCI which is very heavily breached when you hear about 30,000 60,000 records last they are all always related to PCI it is the payment card industry your credit card data it is sold in the dark web that is how Secret Service finds out in many cases there has been a breach and they go to the organization and tell them you have been breached in many cases the organization did not even know they had been breached so pci data is something very important to protect different types of data require different levels of protection it is not all uniform that is where the cloud service providers usually say that it is not our responsibility to protect your data because we do not know which is more sensitive to you so that is one excuse they provide by law all three types of data to be protected the severity of penalty is very heavy so organizations like chase bank pay millions of dollars in penalty for that I mentioned some of the fields that could go into API I one way to protect bi is to collect less what I find often is businesses are very cute curious to get data first and decide how they would use it instead if they think ahead of time what their application would be and collect the information relevant to that that would be one way of collecting less so what I find often is if you need only to know the age of a person in trying to sell some product there is no need to know the full date of birth so if you get the edge it is less sensitive than date of birth so your protection cast would go down same thing with address if you collect address address is highly important address information to protect if you just want to zip code only that is not that that severe information to protect so that is what the trade-off is so if you know what your application is for the collected data that would help commonly you find businesses using encryption encryption is the most common form of protection anytime you encrypt you have to decrypt make use of the data it is costly and time-consuming costly and time-consuming for example anytime you see HTTPS in the taskbar everything that leaves your computer protect encrypted it is totally not wanted all information gets encrypted for that reason later production could be accomplished using farm at preserving why farm at preserving encryption is important is there are many applications beyond the initial one you are using which will expect to have the same format for the data in order to use that for that reason you should be using farm at preserving encryption which is lot more expensive not traditional encryption another form of protection is access control if you don't let the individual first of all get in the chances are you will be able to protect your date are much better this is like stopping the key for the perimeter monitor all access through logs that is one way to go and check to see how the breach happen and who briefly so at least you will be able to do some forensics on that afterwards monitor all changes made to the data by users that is very useful to know simply because often you hear the explain I did not know who made the change I did make it so you hear that with customer service so this is the kind of thing that can be tracked by forensics investigation if you can monitor who makes a change to common types of protection give users only the minimum access they would need second give a person access and do not give the same person for everything that is needed to be done for example if the person is authorizing checks that person should not be the one who is signing the check there should be controlled separately if there are two different forms of controls that is much better another way I find lot of time is spent by administrators in access control aspects so if it is role based access it saves significant time of the administrator to focus on threat aspects threat aspects the one that I personally recommend now for use which is also not easy to do our cheap to do is behavioral analytics so keep that particular in mind when you or if you want to take ever take away from the stock behavioral analytics would be one of them think of Secret Service when Secret Service is having people protect the president very high value asset they have to constantly monitor that person's ability to not have any bad feelings about the individual he or she is protecting because if you notice around the world the people who have committed heinous crimes like that are the ones who have been personal bodyguards of high figures for example former Prime Minister of India was assassinated by his/her own bodyguard the governor of North West not Western Province in the Pakistan area was assassinated by his own bodyguard because he felt that this person made a statement that he did not agree with and he said he would be the martyr but the thing is they have access to the individual so that is why behavior analytic becomes very important to monitor what I also notice in the health care sector is this is also true for other sectors people with write privileges access the information so your system will not detect them to be intruders because they have all the privileges granted to them to access the system they may abuse the privilege get the information needed and then exfiltrate that that is when they are violating the policy of the organization so that is why behavioral analytics is very important to monitor to see people are using that properly again you should have different forms of protection for the level of data or protecting most sensitive data should be segregated and protected think you will notice that in many organizations financial information will not be part of your general network accounting would be separated from the rest of the network you would not find them in the same network that is one way to protect that so you have to have sensitivity of the information known to protect that access control matrix is another option access control matrix tells who can access what when and at what level of access they have is it read only even write rewrite edit all that aspect commonly model the administrators our wand of intrusion or any threat by alarms if there are too many alarms coming people who ignore the alarms if too many alarms are coming people will ignore the alarms so that is another thing to keep in mind when setting alarms what is most important to alert if we talk about these five data breaches quickly and then I will point out some of the things we are learning along that in the analysis of these data breaches the first one target what I noticed in target data breach analysis was target had a hitch rack vendor who was doing minimal work for target actually had his credentials breached the person was from Pennsylvania the companies in Minnesota he was doing some project management and electronic billing so when his credentials were stolen and used that person had initial access into the target Network but knowing the vulnerabilities inside the network he was able to take exploit further that is how they got in but the same technique was used in breeches in other organizations such as Home Depot and chase bank also so using third-party credentials we enter the network another thing is target install a very good detection system in the form of fire i mandy and technology which is very high quality expensive technology but they ignored all the alerts they got out of that so what is the point in spending that much money to get the alerts but not follow through to prevent the action so that shows policy violation their target see you had to design once this became public home depot when I read Home Depot's details on this one it was little bit disturbing they said we are a multi-billion dollar company you are talking about some investment in the form of security in millions of dollars not too many we are willing to take the heat when bad publicity comes we are willing to live with so that is the attitude they had on the security aspect here this was breached with a very similar way similar to target point-of-sale terminals were breached that is what the axis was hackers entered similar to target data breach was deducted by third parties prior to Home Depot acknowledge that that the third-party detection is very common most of the time it is secret service that detects that organization did not take security seriously that is what as my previous comment was it did not take security seriously thought is too much money to spend on that Chase Bank 76 million households and 7 million businesses are affected in the data theft this is orchestrated by a group of people from Israel who eventually got convicted three of them of actually four were convicted they couldn't find the fourth person only three are doing time only non financial data was stolen David we just detected by third part is similar to the other two let me move little bit further because I want to get to the solution that you can think of for that anthem us seven and seventy eight point eight million records were stolen again Social Security numbers which are all things that could be used for so remember soil is accurate number doesn't change it stays the same for you so even if they get one year credit monitoring it doesn't help they can still come after you for identity theft later only thing here we notice is anthem did not encrypt stored data I would point out in this regard paypal not only encrypt data but uses something called salt so with that level of encryption it is very difficult to breach that is why paypal doesn't get breached another thing is you might have heard about Ashley Madison bridge in Ashley Madison they did encrypt but they encrypted it by making everything in the lower case so that made it simple to detect the original passwords by brute force today's technology is there to brute force it so OPM is another area that got breached but this is more sensitive this OPM breach is more sensitive why if a far agency gets hold of this information they can try to match the spice working for American government in foreign countries simply by noticing that CIA maintains its list of people coming through the security check differently from the rest so let us say that they have all the names of the people who have been detected by this bridge like China has this this is a attributed to China they match that list against the employees working in a particular foreign embassy they will notice that these people do not have their name in this other list that right away tells them these people are not people who went through the regular security check which means they are very likely CIA because all the people doing sensitive work are all security cleared that is what they will detect that in fact US government had to remove slowly some of the spice that they were working as embassy officials both in Russia and China because of this bridge so it is not only life-threatening for them but also very difficult for them to stay in that position doing their job what do we notice in these breaches week access control non-use of two factor authentication and I can expand a little bit further on the two-factor authentication again snapchat CEO here that person's information was stolen they knew fully well that when a phone call comes to that person the person will not answer the phone on your cell phone it will go into the voicemail which they can turn activated them get hold of so they basically took a chance and send that I am resetting the password so the security control said we are going to contact you by phone so the phone call came it automatically went to the voicemail so in the Y smell they had the code they had to put in they put the code in and got the password reset for this see you were simply because that is the practice people follow so that is why stolen data becomes very critical in knowing that another aspect that before I go further in here I will summarize when somebody gets a stolen data they are more authentic to you because telling information you know that makes it more convincing that this person is more legitimate trying to get information out of you so you are more willing to share information so stolen data becomes more critical for that reason I will move some from of this look at the cost of breach health care is the most breached area I gave a talk on this in another location the reason healthcare gets more richness most hospitals are nonprofit they don't invest as much as other organizations are in protecting data a u.s. is the most heavily breached country so where next one would be England when you look at the privacy in the United States there are 47 different state laws only three states do not have any requirement of notification they are Alabama New Mexico and South Dakota excluding that all other states of notification requirements but the problem is if your data is encrypted you do not have to notify there is an exception for that if you look at the data like I mentioned in Ashley Madison case it's all encrypted therefore first of all they are foreign government a foreign business is located in Toronto so they are excluded from this notification requirement but most important is when data is breached then somebody gets heard of financial information and healthcare information they are going to come back after you and then say blackmail now you tell me this information otherwise I'm going to release this to your wife that you cheated on her I am talking Ashley Madison in particular like that so that is that is the kind of problems people could face when threatened with lock this is another one b ec business email compromised look at that particular one here a very legitimate looking email comes from the sea were to the CAF for telling that i am doing a secret negotiation for a takeover of a business immediately send two hundred thousand dollars or something to this particular person he will contact you an email comes the CFO sense what I am pointing out is use other means available for you to communicate with the center if the center you see you you might be seeing the see you in the hallway as to see you or don't think it is just secret for Public Communication outside they don't check because it said it is secret it is still a secret so they sent the 200,000 this in the 200,000 out then few days later it says yep we have now finalized the negotiations we are going to go public before we go public we want you to transfer 20 million dollars again that fellow doesn't talk to the CEO the CFO transverse the money how did I get that the hackers print extraordinary amount of time researching about your organization they know who you see you are who is here for what kind of communications you prefer how do you communicate when you talk outside knowing all that information they come after you and then do that a more specific form of this is called the apt advanced persistent threat but that is knowing lot more information about you but the hackers do a lot of homework before they start attacking you how can you protect that there are laws one way to protect his store less use encryption limit access control maybe sure some of the recommendations I would like to suggest for best practices I think time is up now i will stop I have several more / but they will all be available through the organization's website so I stop now and answer any questions you may have thank think there's a question it seems like the better algorithms money gets more the direction yes his question was non-pii YPI is so sensitive to protect and are there ways to not even store that kind of information by D anonymizing the individual to start with the question for that is most businesses prefer to keep that information in plain text readable format not anonymize that identity of the individual which means they have to create a new ID for that person in order to refer to that information there is a cast so instead of spending it extra money they would rather use it in plain text format it is one way that happened there is another way in which the span detector can also find it that requires the server part using some special technology that is available today it has been installed in about forty percent of the US businesses not everywhere so there are tools available to protect that but expensive cost is the issue anything else thank you