Privacy and Security with Rebecca Herold

Due to the coronavirus pandemic, we've rapidly changed the way we work, how we play, and how we're educated. This sudden shift leaves us and our families exposed to privacy and security risks we previously hadn't thought about or planned for. Listen up for any blindspots you might have. Our guest today is Rebecca Herold. Rebecca, also known as The Privacy Professor, has over 25 years of experience in system engineering, information security privacy, and compliance. She has authored 19 books with the 20th on its way. She has been a member of the NIST CyberSecurity IOT Development Team, and was an adjunct professor for Norwich University's Masters of Science in Information and Security and Assurance Program for 9 years. Today she will share with us her experiences with privacy and security and will also share things for you to keep in mind when using various apps and services. Show Notes: [1:06] - Rebecca started out as a systems engineer in 1988 and around 1990 got into system security and established security systems for banks. [3:50] - Rebecca created her own consulting company and began teaching as an adjunct professor at Norwich University. Her adjunct professor position helped her learn even more about the practicality and various needs in security. [6:40] - When you have a career in which you use technology that is constantly changing, it keeps things interesting. Rebecca has had to constantly adapt and learn. [7:20] - Risks don't go away. You just accumulate new ones that you have to keep addressing. That's something that many security and privacy practitioners forget. They keep up to date on new risks but sometimes forget the existing ones. [9:32] - Privacy tends to be an afterthought and we need to shift our thinking to start setting up security and privacy controls from the beginning. [12:30] - Throughout the COVID-19 pandemic, Rebecca has gotten a lot of questions from business owners regarding their employees and how to gain information on them to remain safe and help manage their self-insured expenses. [13:40] - Some business owners are trying to bypass doctors and healthcare professionals because they are self-insured. They also want to know where their employees have been to avoid them coming in with COVID-19. These are huge privacy issues. [16:24] - "COVID tracker apps" may be used by business owners to try to avoid their insurance rates going up. These examples show the problem with tracker apps not being used transparently. [17:01] - There are hundreds of these COVID tracking apps and some were built with privacy and security integrated but many were not. [18:24] - Always think about apps and what data they might be collecting. [19:23] - Rebecca gives examples of apps asking for information that is unnecessary for tracking COVID-19, such as your exact date of birth. [21:42] - There are situations where apps are being portrayed and communicated to users that privacy and security are built in, however a lot of privacy features have been overlooked. [22:22] - We need to get this pandemic under control and have insights, but we don't want to create other problems. There has to be a balance. What can we do to track this but keep people's privacy safe? [23:35] - Always ask yourself why is this information necessary when signing up for various apps and websites. [26:62] - If people are asking you for information and it's not necessary for the purpose in which you are using a service or product, you don't have to give it to them. [29:20] - Social media has a long way to go. They've been around a while, but they have to be the "latest and the greatest" to stay in business. [30:33] - With so many people working from home right now, people don't realize that their home environment is much different than the private and secure environment in the workplace. [31:40] - Zoom became the go-to site for online education and business meetings, but meetings are not always secure. [34:00] - Because you're participating in a meeting from home, other people involved can see the inside or outside of your home and may use that information maliciously. [35:40] - Rebecca shares examples of smart toys and apps being used maliciously. [37:50] - In your workplace, there are security measures in place and IT professionals available to make sure things are working smoothly. But that isn't the case at home. [39:01] - Part of Rebecca's job is to find open access points to demonstrate to clients how this information can be used. [41:10] - Rebecca shares the possibility of people accessing baby monitors and home security cameras through open access points. [42:39] - With remote learning going on, teachers and students need to have some basic training on privacy and security measures such as multi-factor authorization and understanding devices like Amazon Echo. [45:06] - Rebecca shares examples of smart toys and devices that are listening and recording data, even though they are advertised to only respond to key words. These types of devices should be shut off when students are learning from home. [46:52] - Social engineering is a big concern with online education and parents need to be aware of possibilities and educate their children. This could include strangers coming into contact through an online video conference or even sharing files. [48:34] - Privacy and security is a lot for people to learn in a very short period of time. [49:24] - The environment your child is learning in from home should be similar to the environment in their classroom. This is applicable to work-from-home environments as well. [50:15] - Rebecca shares an experience with the president of a South American country using video footage from the president's son with which people could gather many pieces of private information. [51:32] - There's so many possibilities that people don't think about before they naively show where they're at. [52:51] - When Rebecca shares herself through a webcam in her home office, she uses privacy screens to prevent people from seeing her home behind her. [53:40] - Rebecca recommends keeping your webcam disconnected until you need to use it because some apps are given access to your webcam that you may not realize. [54:22] - Taking a little bit of precaution will prevent you from someday saying "Why didn't I just do that?" when faced with a privacy problem. [56:09] - Rebecca Herold is currently in the final editing of a new book called Security and Privacy When Working From Home and Traveling, which spans 23 chapters of privacy, security, and compliance risks with real-world examples. Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review.  Links and Resources: Podcast Web Page Facebook Page whatismyipaddress.com Easy Prey on Instagram Easy Prey on Twitter Easy Prey on LinkedIn Easy Prey on YouTube Easy Prey on Pinterest Rebecca Herold on Twitter Rebecca Herold on LinkedIn Privacy Guidance Web Page Privacy Security Brainiacs Web Page Privacy Professor Blog Shodan Search Engine NIST - National Institute of Standards and Technology