Privacy and technology

Uit de inleiding:

“In opdracht van ABN AMRO heeft Heliview Research & Consultancy onderzoek gedaan naar de impact van Cloud Computing op de Nederlandse ICT-sector (dienstverleners en softwarebedrijven). Dit rapport bevat een analyse van de vraag- en aanbodzijde van de zakelijke ICT-markt. Zit er een gat tussen vraag en aanbod? Op basis van de conclusies uit de analyse presenteren wij onze belangrijkste aanbevelingen voor de ICT-sector.”

(Source: advotheek.nl)

Uit ‘Waarom dit boekje?’:

“Deze maand kreeg Facebook een Big Brother Award toegekend als organisatie namens Bits of Freedom voor het schenden van de privacy van haar gebruikers. Wij zijn en velen met ons, van mening dat dit onterecht is. […] Onze boodschap is dat de gebruiker zelf de grootste schender van haar privacy is. De blog leidde tot veel bijval, maar het meest gehoorde commentaar is dat het voor niet iedereen duidelijk is hoe je dit moet instellen. Gelijktijdig, onafhankelijk van elkaar, hadden we de handdoek opgepakt en waren begonnen met een artikel over hoe je je privacy moet instellen op Facebook. Om allebei geen dubbel werk te doen hebben we de handen ineen geslagen. Daarom dit kleine boekje waarmee iedereen zelf zijn privacy beter kan beschermen.”

(Source: privacynieuws.nl)

From ‘Our mission’:

“Not everyone can read legalese. Websites ought to have clearer, more transparent, and simpler privacy policies. One important step in this direction is a simple way of summarizing a privacy policy’s features, to make it easy to see how a website will use and protect user data. Inspired by Creative Commons and the Mozilla Privacy Icon Project, we have designed a set of icons, as well as simple descriptions, to describe common features of privacy policies. Additionally, we have built a generator to make it easy for websites to add these icons to their own sites. To further encourage awareness, we have reviewed several popular websites’ privacy policies, so that users can see for themselves how they fare.”

(Source: webwereld.nl)

From the introduction:

“Cyber security is increasingly regarded as a horizontal and strategic national issue affecting all levels of society. A national cyber security strategy (NCSS) is a tool to improve the security and resilience of national infrastructures and services. It is a high-level, top-down approach to cyber security that establishes a range of national objectives and priorities that should be achieved in a specific timeframe. As such it provides a strategic framework for a nation’s approach to cyber security. To assist the EU Member States in the important task of developing and maintaining a successful national cyber security strategy, ENISA is developing a Good Practice Guide. The guide will present good practices and recommendations on how to develop, implement and maintain a cyber security strategy. This paper presents some of the preliminary findings from the project that is developing the guide. It includes a short analysis of the current status of cyber security strategies within the European Union (EU) and elsewhere; it identifies common themes and differences, and concludes with a series of observations and recommendations.”

From ‘What we found’:

“After reading the policies and answering comprehension questions, 36% of Facebook users and 37% of Google users surveyed will change their behavior. Of the options presented in the survey, most Facebook users plan to change their privacy settings and be more careful posting information in the future. Google users indicated they’d take a number of actions, including changing privacy settings and clearing search history. Fifty percent will use Google less, while only 35% will use Facebook less. Google users may be more apt to reduce their use, since there are viable alternatives to many Google services (e.g., Bing, Worio and MapQuest). Facebook users don’t have the same luxury. Today, no alternative social network of similar scale exists.”

(Source: automatiseringgids.nl)

Uit ‘Managementsamenvatting en aanbevelingen’:

“Gemiddeld verliest de Nederlandse werknemer 7,6% van de tijd werkzaam met een PC door slecht functionerende ICT en door gebrekkige digitale vaardigheden. Dit probleem lijkt bij medewerkers noch leidinggevenden op het netvlies te staan.”

(Source: frankwatching.com)

From the overview:

”[…] The Pew Internet Project and Elon University’s Imagining the Internet Center invited experts and other Internet stakeholders to offer their predictions on the future of mobile payments, and what people’s “wallets” might look like in 2020. Overall, a majority of these respondents supported the scenario that by 2020 most people will have embraced and fully adopted the use of smart-device swiping for purchases they make, nearly eliminating the need for cash or credit cards. These experts feel that the explosive growth in the use of smartphones and other mobile devices, combined with the convenience, security, and other affordances of mobile payments systems, makes these systems an obvious choice to replace established modes of payment in day-to-day commerce.”

(Source: security.nl)

From the abstract:

“Payment systems that allow people to pay using their mobile phones are promised to reduce transaction fees, increase convenience, and enhance payment security. New mobile payment systems also are likely to make it easier for businesses to identify consumers, to collect more information about consumers, and to share more information about consumers’ purchases among more businesses. While many studies have reported security concerns as a barrier to adoption of mobile payment technologies, the privacy implications of these technologies have been under examined. To better understand Americans’ attitudes towards privacy in new transaction systems, we commissioned a nationwide, telephonic (wireline and wireless) survey of 1,200 households, focusing upon the ways that mobile payment systems are likely to share information about consumers’ purchases.”

(Source: privacylives.com)

From ‘Data breach notifications’:

“During 2011 my Office received 1167 data security breach notifications from 186 different organisations. This is a 300% increase in the numbers reported on in 2010 when we received 410 notifications. In 2009, before the introduction of the Code of Practice, the number of breach reports received by my Office was 119. As I stated in my Annual Report in 2010, I do not see this as an actual increase in the number of breaches occurring, rather a raised awareness of the need to notify my Office of a data security breach. […] 75% of reported breaches related to errors in postal mailing […]. In most cases, the breaches involved either multiple letters in the same envelope or a page relating to another individual incorrectly attached to a letter. These data security breaches are usually explained by human error. This shows that a large number of data security breaches could be prevented by simply taking a moment to examine documents prior to posting.”

(Source: privacylives.com)

From the executive summary:

“Symantec blocked more than 5.5 billion malicious attacks in 2011; an increase of more than 81% from the previous year. This increase was in large part a result of a surge in polymorphic malware attacks, particularly from those found in Web attack kits and socially engineered attacks using email-borne malware. Targeted attacks exploiting zero-day vulnerabilities were potentially the most insidious of these attacks. With a targeted attack, it is almost impossible to know when you are being targeted, as by their very nature they are designed to slip under the radar and evade detection. Unlike these chronic problems, targeted attacks, politically-motivated hacktivist attacks, data breaches and attacks on Certificate Authorities made the headlines in 2011.”

(Source: security.nl)

From the introduction:

“This report contains the results of the study of the state of the Russian cybercrime market in 2011. It examines the main risks associated with various types of hacker activities, analyzes the main trends in the development of the Russian cybercrime market, estimates the shares and the financial performance of the Russian segment of the global cybercrime market, and forecasts market trends for this year.”

(Source: security.nl)

From ‘NCC findings’:

“Negligible personal data was found on the memory sticks and mobile telephones. In the case of hard drives: 38% of the devices had been wiped of data; 14% were damaged/ unreadable; 37% contained nonpersonal data; 11% contained personal data.”

(Source: security.nl)

From the document:

“The Office of the Privacy Commissioner of Canada (OPC), and the Offices of the Information and Privacy Commissioners (OIPCs) of Alberta and British Columbia have worked together to develop this document with the goal of providing consistent guidance on what it means to be an accountable organization. It is intended for organizations subject to our respective private-sector privacy legislation and outlines what we expect to see in a privacy management program. […] This document outlines what we think are the best approaches for developing a sound privacy management program, for organizations of all sizes, in order to meet obligations under applicable privacy legislation. This document is not a “one-size-fits-all” solution, however. Each organization will need to determine, taking into consideration its size, how best to apply the guidance found here to develop a privacy management program.”

(Source: hldataprotection.com)

From 1. Overview:

“Cyber-criminals are increasingly using automation to carry out their attacks on web applications. This phenomenon has several reasons:

• Automatic tools enable an attacker to attack more applications and exploit more vulnerabilities than any manual method possibly could.
• The automatic tools that are available online save the attacker the trouble of studying attack methods and coming up with exploits to applications’ vulnerabilities. An attacker can just pick a set of automatic attack tools from the ones that are freely available online, install them, point them at lucrative targets, and reap the results.
• These tools use resources (like compromised servers that are employed as attack platforms) more efficiently.
• Automatic tools open new avenues for evading security defenses. For example, such a tool can periodically change the HTTP User Agent header that is usually sent in each request to an application and that may be used to identify and block malicious clients. As another example, sophisticated automatic tools can split the attack between several controlled hosts, thus evading being blacklisted.”

(Source: security.nl)

Uit het jaarverslag:

“In alle sectoren (van hightech-instellingen tot de overheid) kunnen medewerkers in alle hiërarchische lagen (van secretaressen tot directeuren) doelwit zijn van spionage. Daarbij wordt de veiligheid van gebruikte communicatiemiddelen en digitale systemen stelselmatig overschat. Bovendien investeren inlichtingendiensten doelgericht op persoonlijke voorkeuren of zwakheden van personen die zij selecteren om inlichtingen te verkrijgen. [Paragraaf 3.2.] Naast onderzoek en ontwikkeling heeft de AIVD in 2011 presentaties verzorgd over de kwetsbaarheid van het gebruik van gsm’s. De demonstraties hebben laten zien dat een gsm met relatief beperkte inspanning en tegen relatief lage kosten is af te luisteren. Het is daarom van belang om bewust stil te staan bij informatie die via de telefoon gecommuniceerd wordt en zo nodig een beveiligd toestel te gebruiken. [Paragraaf 6.4.]”

(Source: security.nl)