Menu

homepageonly

credit freeze equifax hack how to breach innovis

Why you should consider a credit freeze – EquiFax hack

, , , , , , , , , 0

Now that Equifax has disclosed the hack of 143 million American’s personal records, there is no longer any hope of keeping our data private.  You are an identity theft victim, you just don’t know it yet. 

I’ve long said that every big-name company has been hacked; they just haven’t disclosed it yet.  This is just common sense.  In even a single computer, there are thousands of cyber attack vectors and known vulnerabilities.  Once you grow to 10,000+ employees, multiple sites, and custom business applications, the amount of risk becomes unmanageable.  Even with full time cyber-security departments, I’ve never seen any network secure more than 95% of their known vulnerabilities at any given time.

Then you add the undisclosed vulnerabilities, which professional hackers collect like shiny baubles, and basically any enterprise network can be hacked.

Bottom line:

Your personal information; my personal information; everyone’s personal information is available for sale on the dark web.   If you aren’t a victim yet, credit a limited number of criminals, not best practices.

Credit freeze options

If you don’t plan on opening a new credit account soon, consider placing a credit freeze on yourself for each of the four agencies.  Transunion, Equifax, Experian, and Innovis.

The credit freeze makes it impossible for companies (like banks) to look up your credit score.  Generally, if a company can’t see your credit score, they won’t open a new credit account.  This protects you against the classic credit-theft attack: opening a new credit card or loan in your name, spending the balance, then leaving you with the bills.

If you apply for a credit freeze, then want to open a new legitimate account, you can still do this – but you will need to contact the credit agency and ask for a temporary un-freeze.  Both the freeze and un-freeze can cost money, depending on what state you live in.  (States have legislated that the credit agencies MUST offer this service, or else they wouldn’t, and as part of the legislation, a fee was specified.  In Maryland, it is $5).  It can take a day or two to un-freeze your account.

What about the theft of my credit card number?

A credit freeze will not protect you against having your credit card number stolen and used for purchases.  Your bank is already trying to protect you against this by issuing new cards when it detects strange activity.  You should also check your monthly statement and protest any charge that you don’t recognize.

 

How do I request credit freezes?

Navigate to each of the credit agencies (helpful links below) and go through their process to request a freeze.   When I tried it today, only one agency (TransUnion) required me to pay the $5 fee.  Kudos to the rest for being ?responsible?  (this is hard for me to say… I feel great anger toward these agencies since they have used our data without permission and only introduced consumer safeguards when forced to by laws).

 

Equifax

https://www.freeze.equifax.com

 

Experian

https://www.experian.com/freeze/center.html

 

TransUnion

https://www.transunion.com/credit-freeze/place-credit-freeze

 

Innovix

https://www.innovis.com/securityFreeze/index

 

 

cybersecurity CMMC DoD NIST 800-171 compliance nist 800-53

GDPR Consulting – What you need to know

, , , , 0

What is GDPR?

GDPR stands for General Data Protection Regulation (Regulation (EU) 2016/679).

Who does it apply to?   Any organization (non-profit, for-profit, government) which controls or processes data belonging to EU residents.

When does it happen?  The regulation goes into effect 25 May 2018.  9 months away.

What is it?  11 chapters and 99 articles of laws governing how data is collected, processed, protected, distributed, requested, transferred, provided, and deleted.

Overview of regulation: You must catalog the location and flows of all regulated data, both in your organization and in vendor/partner organizations.  Then you must create technical processes to handle regulated situations, such as opt-in permission before collecting data; a customer requesting a copy of all held information; a customer requesting a deletion of all their information; or a regulator requesting proof that you performed these actions.  Then you must test and train these processes to ensure they work in an efficient manner.

Why was it enacted?  As a fix.  The last significant legislation on the topic was from 1995—before the introduction of the Internet and cloud computing changed the way our data is used.

What you need to do

Determine if GDPR applies to your organization.

Do you have EU resident data in your system?

  • Your company sells goods or services to EU customers.
  • You are an IT provider. Some customers store regulated data on your servers.
  • Your marketing department has web analytic data and customer databases which includes the EU.
  • You run a popular website which sends out newsletters and hosts discussion forums.

Determine if you need help with this task.

  • Do your current staff have the time, knowledge, technical skill, and process development background to make your organization compliant before May 2018?

Start now. May is coming up!

 

Consultant?  Consider Kieri Solutions

Amira Armond, the president and CEO of Kieri Solutions, has the precise experience needed to prepare your organization for GDPR.

Technical:  15 years of experience with servers, networking, databases, websites, and system integration.  As systems architect, holds an understanding of the entire organization’s computer systems and data flows.

Process: Certified Project Management Professional, with a Masters in Business.  During her career, she has created thousands of technical procedures and lead the implementation of new systems.

GDPR:  Has studied the hundreds of pages of regulation and understands (as best as any one can) the requirements and necessary actions.

 

Contact us for a free data flow analysis and plan:  info@kieri.com  1-(301) 253-5150

 

 

 

 

References

FieldFisher Lawyer blog: Detailed analysis of what personal data is included in GDPR

FieldFisher Lawyer blog:  GDPR is about actions, not compliance

Deloitte Analysis: New processes required by GDPR

The entire GDPR regulation, formatted for viewing online

Server Upgrade Cybersecurity Consultant SAN Netapp Frederick

Is your IT person holding the network hostage?

, , , , , , , , , , 0

Problems with your PC Support and IT staff

“Step 1: Change all the passwords…”

This is an inside joke for IT professionals.  It refers to job security.  If you are the only person who has the keys, your management will think twice before they fire you.  With that level of job security, you can close the door and go back to playing computer games.

As a business owner, you need to stay in control of your computer system!  The best way to do this is to demand documentation and account best practices from your computer staff.

Standard IT department documentation should have this information (at minimum):

  • A visual diagram of major systems (such as servers, network equipment) listing their purpose, how they are connected, and network addresses to administer them.
  • “Administrator” level usernames and passwords for each piece of network equipment, server operating system, and major application (such as your website and email).
  • Printouts or backups of configurations for each major program and equipment, so that if your IT guy gets run over by a bus (or quits suddenly), a new person can see how it should work.

Account best practices should be followed:

  • If a system allows you to create more than one administrator account, each IT staff should have their own account, named to identify the owner (example: jsmith).
  • Generic “administrator” or “root” accounts should not be used if named accounts are available.
  • Generic “administrator” or “root” accounts should have unique, complex passwords that few people know.

These two best practices are important for protecting yourself against criminal IT people as well as outside hackers.

Here are four reasons why:

  1. Access logs can be reviewed periodically or after a security incident to see which account performed the action.  Generic accounts always leave the question of “who was actually logged on?”
  2. IT people are much less likely to do improper things if their personal account is associated with it.
  3. If an IT person leaves the company, you can disable their personal accounts easily without hurting anything.
  4. And you are more likely to notice if new administrator accounts are created, or there is unusual access by the “administrator” / “root” account (symptoms of outside hackers).

 

And the obvious business pitch:  If you are having trouble with your staffing, want to supplement them, or don’t have an IT department at all, consider Kieri Solutions.  We support businesses near Frederick, Baltimore, and Gaithersburg MD with a variety of IT and cybersecurity services.