Where is all my data going?
Musings from MWC Barcelona (2016)
Day 6 in Barcelona, I’m am homeward bound this afternoon after 3 straight days of leading “Security Expert” tours for GSMA at Mobile World Congress. There were 101,000 people from 204 countries present, it was time to clear my head. I woke up early, had a quick bite, and went for a walk with my camera. I have been wanting to enjoy waking up with the city since I arrived.
Tens of people in brightly colored vests directing departing attendees from the event to the subway stop each day. Interestingly enough, only one in every hundred and fifty or so follow their directions. People went with what they knew. The station they arrived on was in a different direction and that station would get them safely to their hotel. The lesson learned here is that human nature directs us to what is safe and familiar. “I arrive on a train from station A and I will depart from the same station” despite official guidance directing me elsewhere.
Phishing attacks are so successful for the same reason. It’s well known they have much higher success rates when the attempt appears to come from the familiar-someone known to the victim (ie; electricity provider, water works, a close friend or colleague.)
Talking about people that are familiar to me, I am beginning to wonder how strong (or just how weak) security is around contact details we collect on each other? Whether that detail is stored in an address book in your mobile device or in the “cloud.” In all likelihood, the security is not good enough. Contact data and personal details do a lot of moving on networks these days. Not only is such data on every device you have, but Google, Amazon, and just about every company you deal with has it as well. Data aggregators collect bits and pieces of this data when you surf websites, bring it together with other habits of ours on the web-then sell it for a profit.
Strengthening controls on the use of our data will be like a large construction project that is taking a little longer than expected to complete.
Consulting: Need independent analysis or security support? See AI & Cybersecurity Consulting.