{"65457":{"#nid":"65457","#data":{"type":"news","title":"Georgia Tech Expert Gives Tips on Safeguarding Against Data Theft","body":[{"value":"\u003Cp\u003E\u003Cem\u003ENick Feamster, assistant professor at Georgia Tech\u0027s \nCollege of Computing and researcher at the Georgia Tech Information \nSecurity Center offers his expertise on the Epsilon data breach and what\n users and custodians can do to protect their data.\u003C\/em\u003E\u003C\/p\u003E\u003Cp\u003EThe\n Epsilon data leak incident was serious, as it exposed a large number of\n people to an attack called \u0022spear phishing,\u201d whereby an attacker \ntargets specific users or organizations with attempts to steal personal \ninformation.  However, it is also important to realize that this \nincident could have been much worse. Many third-party organizations, \nranging from identity management companies  and large cloud service \nproviders, like Google, have aggregated large amounts of our personal \ninformation in one place, making us increasingly vulnerable to the type \nof attack we saw with Epsilon, whereby a single breach can result in the\n compromise of a large amount of user data.  \u003C\/p\u003E\u003Cp\u003EThere are two big \nlessons we should take away from this incident.  First, we must raise \nour own awareness about where our data is stored and become more \ncognizant of how we might be making ourselves vulnerable to these types \nof incidents by allowing data about us to be aggregated in just a few \nplaces.  Second, we need better security tools: software will remain \nvulnerable, and compromise is inevitable.  \u003C\/p\u003E\u003Cp\u003EAlthough this may be \none of the largest data leaks we have seen in U.S. history, this is not \nthe first instance of a very serious data leak. In the past, we have \nseen data leaks involving the breach of more sensitive information, \nincluding credit card numbers and even Social Security numbers.  Facing \nthe stark reality that these compromises are likely to continue and \nworsen, we must develop better tools for prevention (i.e., making it \ndifficult for attackers to access data once they have compromised a \nsystem) and auditing (i.e., figuring out exactly what data has been \nbreached, when, and by whom).\u003C\/p\u003E\u003Cp\u003EHere are some quick tips on what users can do to minimize the damage that a data breach can have on them.\u003C\/p\u003E\u003Cp\u003E1.\n Safeguard passwords for sites that hold a lot of your data.  In \nparticular, do not use the same password for a site like Google as you \nmay use for other sites.  This may at least reduce the risk that a \nbreach of your password on another site would result in your password on\n a \u0022higher value\u0022 site also being cracked.\u003C\/p\u003E\u003Cp\u003E2. Try not to store \ninformation related to your identity in these services.  Specifically, \nusers might want to be particularly careful about documents that contain\n Social Security numbers, birthdates, credit card numbers, passwords to \nother accounts (such as bank accounts), and other information.\u003C\/p\u003E\u003Cp\u003E3. \nBe aware of phishing attacks, and pay particular attention to any \nrequest to \u0022reset\u0022 your password on a high-value site.  These sites, as a\n general rule, will never send you a link by email asking you to enter \nyour password. Pay particularly close attention to any message that \ncomes via email asking you to click on a link where you are asked to \nenter a password.\u003C\/p\u003E\u003Cp\u003E4. Be on the lookout for suspicious login \nactivity patterns to your account.  Sites such as Google provide \ninformation about where on the network your account was last accessed \nfrom (there is typically a link at the bottom of the website for this). \n You might want to periodically check this information, to make sure \nthat you recognize the places where your account has been accessed.\u003C\/p\u003E\u003Cp\u003E5.\n Take note of what sensitive data you may have stored in these services.\n  If a data breach occurs, you will want to assess the worst-case \nscenario and take measures to protect yourself from fraud or identity \ntheft.  (For example, if you did have any documents with addresses, \nbirthdates or sensitive information stored in these services, you may be\n more vulnerable to identity theft.)\u003C\/p\u003E\u003Cp\u003EIn addition to things that \nusers can do, there is also a serious need for more extensive protection\n against data leaks in the enterprise space.  Software will continue to \nbe vulnerable, and there will be users who will inevitably not take \nthese recommendations.  We do need better mechanisms to provide \nsafeguards against these types of breaches in the event that a \ncompromise does occur. \u003C\/p\u003E\u003Cp\u003EThis is an active area of research in my \ngroup here at the Georgia Tech Information Security Center where we are \ndeveloping various technologies to combat data leak threats.\u003C\/p\u003E","summary":null,"format":"limited_html"}],"field_subtitle":"","field_summary":[{"value":"\u003Cp\u003ENick Feamster, of the Georgia Tech Information Security Center in the College of Computing, offers his expertise on the Epsilon data breach and what users and custodians can do to protect their data.\u003C\/p\u003E","format":"limited_html"}],"field_summary_sentence":[{"value":"Nick Feamster offers his expertise on the Epsilon data breach and what users and custodians can do to protect their data."}],"uid":"27310","created_gmt":"2011-04-08 09:29:40","changed_gmt":"2016-10-08 03:08:30","author":"David Terraso","boilerplate_text":"","field_publication":"","field_article_url":"","dateline":{"date":"2011-04-08T00:00:00-04:00","iso_date":"2011-04-08T00:00:00-04:00","tz":"America\/New_York"},"extras":[],"hg_media":{"65456":{"id":"65456","type":"image","title":"Nick Feamster","body":null,"created":"1449176831","gmt_created":"2015-12-03 21:07:11","changed":"1475894579","gmt_changed":"2016-10-08 02:42:59","alt":"Nick Feamster","file":{"fid":"193222","name":"091201R007_0.jpg","image_path":"\/sites\/default\/files\/images\/091201R007_0.jpg","image_full_path":"http:\/\/tlwarc.hg.gatech.edu\/\/sites\/default\/files\/images\/091201R007_0.jpg","mime":"image\/jpeg","size":4993716,"path_740":"http:\/\/tlwarc.hg.gatech.edu\/sites\/default\/files\/styles\/740xx_scale\/public\/images\/091201R007_0.jpg?itok=Ic7pXWaY"}}},"media_ids":["65456"],"groups":[{"id":"1183","name":"Home"}],"categories":[{"id":"153","name":"Computer Science\/Information Technology and Security"}],"keywords":[{"id":"654","name":"College of Computing"},{"id":"9223","name":"computer security"},{"id":"12709","name":"epsilon"},{"id":"10567","name":"Georgia Tech Information Security Center"},{"id":"2254","name":"gtisc"},{"id":"10637","name":"nick feamster"},{"id":"166941","name":"School of Computer Science"}],"core_research_areas":[],"news_room_topics":[],"event_categories":[],"invited_audience":[],"affiliations":[],"classification":[],"areas_of_expertise":[],"news_and_recent_appearances":[],"phone":[],"contact":[{"value":"\u003Cp\u003E\u003Cstrong\u003EGeorgia Tech Media Relations\u003C\/strong\u003E\u003Cbr \/\u003ELaura Diamond\u003Cbr \/\u003E\u003Ca href=\u0022mailto:laura.diamond@comm.gatech.edu\u0022\u003Elaura.diamond@comm.gatech.edu\u003C\/a\u003E\u003Cbr \/\u003E404-894-6016\u003Cbr \/\u003EJason Maderer\u003Cbr \/\u003E\u003Ca href=\u0022mailto:maderer@gatech.edu\u0022\u003Emaderer@gatech.edu\u003C\/a\u003E\u003Cbr \/\u003E404-660-2926\u003C\/p\u003E","format":"limited_html"}],"email":["david.terraso@comm.gatech.edu"],"slides":[],"orientation":[],"userdata":""}}}