In my opinion, sensitive personal data concerning individual users who set up profiles, collected on social media portals, are not fully secure. This is confirmed by the occurrence of data leaks, data theft by cybercriminals.
In connection with the above, the issue of information security on the Internet is becoming an increasingly global problem and therefore, in the global approach, institutions and security systems for the transfer of information on the Internet should be developed. The security of information on the Internet can refer to many aspects of data security both at the level of central state institutions and international organizations as well as the security of personal data of individual citizens, sensitive data of citizens collected on various websites, including social media portals.
The improvement of risk management and information security systems at the supranational level is also a key issue. Technological companies managing social media portals on the one hand try to improve data security systems about users setting up accounts on social media portals. On the other hand, it is also important to cooperate with key, central data security institutions on the Internet that operate transnational. This is important from the point of view of improving information security systems on the Internet in order to limit the possibility of using social media portals by cybercriminals operating transnational, using various social engineering techniques.
Please, answer, comments.
I invite you to the discussion.
Best wishes
We can start with compliance techniques: all national and transnational standards (GDPR etc.), local standards for personal data.
Hi Dariusz
I completely agree with your point that social media portals are not fully secure. For too long, global giants, especially in the social media arena, have been far too cavalier with the personal data of their users, happy to harvest, and sell, this data for their own ends. For years, they have been happy to ignore the impact that poor security has had on users' personal and private data. The principal reason for this has been that achieving good security and privacy is not a trivial challenge, which in corporate speak means to do it properly is extremely expensive. They have long taken the view that if users are stupid enough to disclose all manner of personal and private information to friends and family, particularly considering that many of these 'friends' they do not even know, then why should theese organisation be too bothered about achieving proper security and privacy.
Thanfully, new regulations, such as the EU GDPR are going to force them to start taking some serious positive steps to improve their approach to security and privacy. The GDPR has some serious teeth, with the potential for fines of up to 20 million Euros or 4% of global turnover for every single breach. Jurisdiction is global for this regulation, meaning all companies anywhere on earth who hold details of ANY EU resident will be liable to comply. There is no doubt that in certain jurisdictions, enforcement might turn out to be a challenge. However, over time this is likely to gather more impetus globally.
For example, as a direct result of the GDPR, the California Consumer Privacy Act quietly slipped into law, granting California's 40 million plus residents the same rights as the GDPR for Eu citizens. It will likely only be a matter of time before other jurisdictions follow suit.
On the first day of GDPR going live, Facebook and Google were sued for a total of $8.8 billion for privacy violations. Regulators for many of the 28 EU member states were not ready, or even appointed at that stage, and there is no doubt that once they start enforcing compliance properly, we will see some serious action.
Obviously, everyone involved should be taking a much more robust approach to security and privacy, not just the social media companies, but also the users too. For example, users need to carefully consider their privacy settings to ensure they do not inadvertently leak private data. Also, they should consider the use of very robust personal passwords, and should be wary of using questionable wifi services when out and about - coffee shops, shopping malls, hotels and airports are notorious for being frequented by people sniffing traffic or even setting up fake wifi sites to harvest personal information, including passwords.
Clearly, everyone needs to share some responsibility to ensure this problem becomes much less of a burden for society as a whole. And in particular, the social media giants need to be more socially responsible and accountable.
Best regards
Bob
Portals are businesses. Personally Identifiable Information (PII) of consumers is not of their main concern at all. Dr. Bob Duncan is right - " … new regulations, such as the EU GDPR are going to force them to start taking some serious positive steps to improve their approach to security and privacy." The question is as to whether it is sufficient enough to effectively reduce PII breaches of millions of consumers around the world.
To a large extent, Identity and Access Management technologies (IAM) aren't fully adequate to the present security challenges. Providing elective choices to consumers in choosing either a password, or a PIN along with a biometric authentication factor like a face recognition (as it is implemented by Microsoft in the latest operating system Windows10) provides a wrong sense of security. Those knowledge-based authentication factors have a quite high entropy leakage per an authentication session, and are one of the key sources of PII breaches. Face recognition is easily eliminated by just veiling with a piece of paper the photo-eye on a laptop. Hence, eventually after almost two decades of the alarming outcry of the governments, security professionals, and consumers, we are still staying with vulnerable technologies against a variety of criminal organizations.
Most concerned and damaged by the current weakness of IAM in securing PII are governments and consumers. Businesses will tolerate the current status as long as it doesn't affect their profits. Several percent of profit spent for punitive damages they will absorb and consider just as a cost of having business. Penalties within 10-20% will wake them up. Currently, businesses afraid to tighten authentication requirements due to the fears that many consumers will cancel their accounts and move to their competitors, who have less restricting authentication requirements. Hence, punitive punishments of businesses ought to be commensurate with an expected loss of business due to fled consumers.
There is an objective difficulty in developing better authentication technology. An acceptable authentication factor is to satisfy three key requirements - high security, good usability, and low total cost of ownership. Each of those criteria contradicts to either one or both of the remaining requirements. Situation may change only under condition, when part of the cost will be absorbed by businesses, governments, and partially by consumers. In those three requirements the wait of security and usability have to be dominating ones, whereas the cost requirement is to be subordinated as much as possible. This seems to be the only path to consumers' security.
- Badges
- Science topic