With social media, even innocuous comments can add up to a data breach
Connecting state and local government leaders
The intentional disclosure of innocuous information to unintended audiences is an emerging risk that comes with the new generation of social networking and collaboration tools. When enough of this data is correlated, that can become a dangerous breach.
Social networking and collaboration tools have become standard in the workplace. Members of a younger workforce expect to have this technology available to keep them connected whenever and wherever, and even older managers accept that the tools have become integrated into the business process.
However, these tools also are redefining our idea of the data breach, says Ian Glazer, a senior analyst who examines identity and privacy strategies at the Burton Group. “A lot of networking tools are great tools for disclosure,” he said at a recent discussion about identity breaches hosted by TechAmerica.
People already are familiar with the danger posed by hackers who compromise accounts and using them to spam, attack or phish the victims’ friends. And there also is the danger of posting potentially embarrassing information on a site without stopping to think that the entire world is watching. But what Glazer was talking about is the intentional exposure of innocuous personal and business information.
That information is harmless by itself and useful for keeping friends and colleagues updated about plans and activities. But if enough of this data is accumulated and correlated, it can become enlightening and perhaps dangerous intelligence, he said.
Enterprise collaboration and scheduling tools can make available large amounts of information about corporate projects and priorities. Social networking sites can reveal personal details that can be leveraged elsewhere. Travel plans made though online services can be inadvertently shared with “friends.” Location-aware applications can tip off to strangers where you are.
Little of this type of information is considered personally identifiable information of the kind that individuals and organizations currently try to protect. But when put together, it can tell a lot about who you are and what you are up to, Glazer said.
Personal information mined from public sites can be used to guess passwords or to answer challenge questions for accessing sensitive accounts. Knowing from travel plans or location-aware applications that someone is in Bangkok or Baltimore can help a bad guy convincingly spoof a remote connection. Knowing what kinds of meetings a department or workgroup is having and where its members are traveling can provide telling hints about plans and goals.
It requires some effort to gather enough innocuous data and analyze it for patterns before real intelligence is produced. However, this type of information is so lightly protected -- and data mining and analysis tools can handle much of the drudge work automatically -- that sifting the gold from the dross can become cost-effective and profitable.
“People are becoming more creative, with more strategies for combining information,” said Dan Steinberg, an associate at Booz-Allen Hamilton.
Because of the amounts of data available to those willing to look for it, Glazer declared knowledge-based authentication dead, calling it “a waste of time.” This means replacing user names, passwords and challenge questions with multi-factor authentication that includes tools such as biometrics, certificates and tokens for accessing anything sensitive.
But no amount of technology by itself will adequately secure individuals and organizations against this evolving threat, Glazer warned.
“What worries me is that technologists believe they have the sole solution for these problems,” he said. “Technology can’t solve these risks. This is human behavior.”
Saying “no” to new networking and collaboration technologies in the workplace is not an option. The tools are here, workers expect to take advantage of them, and new ones tend to be introduced into the workplace before IT administrators are aware of them and appropriate policies can be put in place. What is required to protect organizations from the leakage of innocuous data are a recognition that the threat exists and a set of technology-neutral policies on how such data is used.