Magazine menu Close Magazine menu

Data and privacy

Latest stories

data transparency center

How transparency centers and open data processing practices help your business

  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.
trust customer privacy

You need these two ways to win customers’ data privacy trust

  • min read
    • Business sees trust in data privacy as a panacea. Companies that foster customer trust see more customer engagement and willingness to share valuable personal information. But what do we mean when we talk about trust in data privacy? What are privacy experts advising companies to do when they recommend building trust? It's one of the driving questions behind my book, The Intelligent Marketer's Guide to Data Privacy: The Impact of Big Data on Customer Trust. Most guidance around instilling trust doesn't adequately explain what trust is, or how to develop it. In researching companies that use privacy as a competitive advantage, I found two types of trust are key. First, customers must trust the company is competent and skilled in protecting their data. Second, they must trust the company's reasons for protecting their data are customer-centered. Although each type of trust is valuable alone, developing both is optimal for customer and business outcomes. Be capable of delivering what you promise The Oxford English Dictionary says trust is "belief in the reliability, truth, ability or strength of someone or something." This definition links trust with data privacy capabilities. For a company to position itself as strong on data privacy, it must have the skills and competencies to be effective in security and protection. For enterprises, this means having resources like data security teams or systems in place, and a talented chief privacy officer (CPO.) You should find it relatively easy to implement (and exceed) privacy regulations. For smaller firms, demonstrating responsible data handling across all interfaces and processes strengthens customer trust in your privacy capabilities. Trust in your company's data privacy abilities also involves your history with data protection. Strong claims about protecting customer data privacy seem suspicious if you've had a well-publicized data breach in the past. But my research found organizations that have suffered a data breach can recover trust by giving customers transparency and control. Ensure you're honest about past lapses when encouraging customers to trust your data protection capabilities following a breach. Be privacy-conscious for the right reasons Customers must also trust your data privacy position is for the right reasons. If trust in your ability to uphold privacy is the cold, rational side of trust, trust in your intentions is the warm, fuzzy side. Ways to build trust in your company's data privacy motivations are less clear and may take longer. This kind of trust is linked to reputation, so just one negative event can deteriorate it, with a long, hard road to redemption. My research found many prominent technology companies suffer from this deficiency in trust. Large firms with ample resources for strong data protections may not necessarily find customers like their privacy stance. For example, even before the Cambridge Analytica scandal, Facebook (now Meta) wasn't well regarded for its privacy practices. When companies like this talk about privacy, customers tend to distrust their reasons. This trust deficit around big tech may present opportunities for small or new tech companies to make a mark, differentiating themselves through customer-centered privacy values. Building customer trust is key to creating value through smooth exchange of personal information and building long-term, mutually beneficial relationships. Businesses of all sizes should pursue customer trust. But, before devoting resources to building trust in data privacy, your business must understand what trust involves. Trust implies distinct company behaviors and practices. Carefully managing trust and not taking for granted what trust you already have, is key to leading on privacy.

Could this voluntary charter fix data ethics in big tech?

  • min read
    • We know some people and businesses will, given the chance, use personal location data in unethical ways. When automotive cybersecurity experts Karamba Security posted a fake vehicle control unit online, they saw 25,000 attempted breaches in three days. Stalkers have used AirTag, Apple's coin-sized device for finding lost keys or other property, to track victims. Regulations like the EU's General Data Protection Regulation (GDPR) define minimum standards of data ethics, but the case for going further is strong. To that end, what can help those tech businesses who want to stay ahead of the data exploitation curve by upholding the highest data ethics standards? Learning to foresee the unforeseen International non-profit the Locus Charter promotes a higher standard of responsibility for professionals and businesses when it comes to location data. They want to avoid unforeseen privacy breaches by working out what can go wrong and pinpoint big problems before they're exploited. They champion public interest by showing businesses how to prevent unintentional harm. The charter is based on ten principles that balance moral behavior with economic benefit, like realizing opportunities and understanding impacts. Location data is one of many frontiers. As veterans of data policy in and out of government, the charter's founders want to be part of all kinds of data discussions. Automation challenging data ethics "The most important focus in data ethics is exploring the power granted by the accumulation of data so everyone can recognize how that power can be used and misused," Ben Hawes, Technology Policy Consultant and co-author of the Locus Charter, told me. He continues, "There's an assumption automated systems and digital technologies are always better. Economic pressures mean companies prefer the promise of greater productivity at all costs, which can be alarming when people are unaware of many potential data misuses, accidental or deliberate." "Some risks in business going digital crop up in all sectors," said Hawes. "We often see 'designer biases,' where developers center their own experiences, leading to alienating people who don't fit the same racial, economic or physical profile. Another issue is automation making back-end processes more complex until they're opaque. There are also sector-specific issues." With the digital world's size and potential, regulating the space is an uphill battle. New ways to exploit data are appearing faster than lawmakers can address them. Is self-regulation enough? Hawes doesn't support a relaxed approach to data ethics. "It's unwise to avoid oversight and critical regulation in the hope self-regulation may be enough, as it rarely is." A 'wild west' model is attractive for short-term gains by freeing emerging markets from red tape, but loose protections don't create conditions for long-term growth or stable markets, especially in an age of social pressure on brands to be ethical. Can whitewashing be cleaned up? With limited regulative authority, a non-profit trade initiative likely isn't eager to bicker with companies they're working with. Organizations like Locus may be better placed, approaching economic ethics from a collaborative angle. Of course, some companies are only interested in the PR boost of appearing ethical by whitewashing their marketing because they don't want to be the only ones following the rules in a competitive arena. They end up paying lip service alone, without taking the issues seriously. Hawes thinks despite this, there's still benefit in working in good faith. "To get ethically reluctant companies to behave well with data, is it better to give them the benefit of the doubt or be critical and accusing? I think, better to have a company aspire to a good standard, even if it's empty promises, because they can at least be held to those standards in some way." Less direct ways of influencing A cooperative strategy may create the best conditions in a self-regulating atmosphere. When ethics groups collaborate with business, they influence thousands of staff members, creating internal pressure for higher standards in the boardroom. It's also worth championing an ethical company for consumers looking to do the right thing with their money. Though strategies like these can't do it all, they have worked, motivating large companies to produce net-carbon zero plans and banks to create green investment options. But data misuse is not the same as pollution. "It's harder to see and analyze compared with other high-profile scandals, so it's hard to translate into a common grievance that can unite people," says Hawes. Will something have to go badly wrong for the world to take it seriously? Hawes considers, "If authorities avoid developing solutions until a problem causes substantial harm, they'll still need about a decade to develop tools that would be effective in this complex market. Governments should be working on this yesterday." In other words, have a fire extinguisher ready when playing with matches, rather than trying to invent one as your house burns down. Reforming data use culture The task of reforming fast-evolving data industries is daunting. Hawes' recommended method involves slowly, steadily establishing ethical practice as the norm. "The UK has the Digital Regulation Cooperation Forum for sharing information and approaches. It lets regulators gain knowledge of the risks data and digitalized business generate, so they can manage them sector by sector. We need a forum like that on an international scale," says Hawes. "Understanding risks like explainability, transparency and bias creates a foundation for building standards that address the problem and brings stability to the data economy." This pressure can also come from outside industry, and often flavors the expectations that filter into business. "More public debate on how we can avoid driving digital inequalities would go a long way," says Hawes. "This is particularly important in social media, which is the frontline of data ethics in many ways." While data privacy issues haven't seen the emphasis Hawes and his peers would like, they're eager to change the culture. Business can choose to be part of the solution and be heralded as ethical data use champions for their efforts.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
ethical data AI privacy

When AI goes low, go high: How ethical AI fights unethical AI

  • min read
    • "This is the world now. Logged on, plugged in, all the time,'' said Jason Clarke in 2015 movie Terminator: Genisys set in 2029. He might as well have been talking about today. Devices have become so integral that today's world wouldn't be possible without artificial intelligence (AI.) AI powers everything from smart homes to customer service to airport security. In Terminator, sentient artificial neural network Skynet sends robots back in time from 2029 to kill the humans who will, in the future, lead the resistance against it. Technology today might be quickly catching up to some aspects of Terminator's fictional 2029, but AI experts say we're a long way from evil, self-aware humanoid robots taking over the world. AI coming close to human intelligence is such a long way off that CEO of Allen Institute for Artificial Intelligence Oren Etzioni says it's "like being worried about overpopulation on Mars before we even have gotten a person on Mars." But there's more to AI than what science fiction shows us. Surveillance and cybercrime applications of AI are concerning, but AI can also strengthen systems and improve data privacy. Like in Terminator, real-life AI can be ethical or unethical. How can AI be ethical? As well as keeping databases and systems safe, ethical AI can influence human behavior, 'nudging' people to make better decisions. Geoff Webb, vice president for solutions, product and marketing strategy at AI-enabled payroll firm isolved, says, "We should expect to see greater use of AI not only to protect privacy, but to enhance ethical behavior. A good example is the use of AI to evaluate things like diversity and inclusion within a business. We'll see AI moving from protecting data to helping us see what that data means." "Businesses are looking to implement machine learning which gives them a smart, efficient and effective way of querying all of the data they hold about people and chop that data up in various ways that can be useful to them. But we need to recognize criminals can also make use of this," says David Emm, Principal Security Researcher at Kaspersky in audio series Fast Forward by Tomorrow Unlocked. Anonymizing and analyzing data more privately Companies collect mountains of data going about their business, and each of us generates data when we check a message from a friend, browse the internet or use an app to check the weather. Some of that data will be sensitive and confidential. To analyze that data, someone's had to look at it. But AI might be able to fix that. AI models can scrub data of identifying characteristics and draw conclusions from large data sets. Francesco Di Cerbo, AI privacy research lead at SAP Security Research, said, "It's like looking at blurred shadows of people. We can still see how many there are, their heights and postures, but not their faces. We can extract information like average and distribution of heights, but it will be hard to identify them. For example, an AI technique like Named Entity Recognition (NER) can detect a date in a sentence, but it might be an invoice date or birth date. Our models must know if that date is personal information. Once different pieces of information are detected in a sentence, we proceed to anonymization." Humans make mistakes. AI (mostly) doesn't. The weakest points of a database are always those where humans are involved. A Kaspersky survey found 46 percent of security incidents that led to business data being exposed were linked to employee error. AI could mean human operators don't need to see sensitive data, giving the processing and sharing of data stronger privacy and security. "AI tools can operate on the data without exposing it to humans. Analysis within platform means reduced risk of someone needing to copy it or print it, or accidentally exposing it," says Webb. "If the platform is secure, granting an AI tool access is often less risky than a human pawing through the data." AI can't be bribed into revealing healthcare data or details of a celebrity's divorce proceedings, for instance. It doesn't leave sensitive data sitting around on a desk or unsecured device. Ethical AI in cybersecurity In 1999, a 15-year-old hacked into NASA with the US Department of Defense, downloading software worth 1.7 million US dollars and shutting systems down for three weeks. Over two decades later, security systems are more sophisticated and harder to break into, but cybercriminals are smarter too. The days of teenagers hacking into government databases are gone – cyberattacks today are dynamic and customized. Traditional security can fail against targeted attacks, but AI can strengthen fortifications and respond more effectively to phishing attacks or breaches. Di Cerbo says, "Automatic defense approaches using AI are highly effective." AI is especially effective in password protection and user authentication. Defensive AI can rapidly detect and contain any emerging cyberthreats, and it's the best way to fight back when AI is part of the attack method. According to Capgemini's report AI in Cybersecurity, hackers use AI for more sophisticated attacks, including spear phishing Tweets – personalized Twitter messages sent to targeted users tricking them into sharing sensitive information. AI can send Tweets six times faster than a human, with twice the success. But while AI can be used for foul play, it also deters these attacks. "Alongside traditional methods, AI is a powerful tool for protecting against cybersecurity attacks," says Capgemini. AI can't do everything, but its potential is great AI is far from an alternative to all human oversight. AI programs have famously replicated human biases – from facial recognition systems not recognizing People of Color to AI recruitment tools not wanting to hire women. But well-designed AI can create a more secure online world, keep data safe and nudge humans towards more ethical behavior. "Security, privacy and compliance will remain business challenges because the counter-pressures are always changing – hackers develop new tools, new privacy expectations and legislation evolve," says Webb. "While businesses could try to manage these risks without AI, it would be complex and expensive. And the more humans involved in processes, the more likely human error or malicious activity will result in a breach," Webb continues. "AI tools can't do everything, but they can deliver better insight more quickly and with less risk of expensive and ugly data exposure." US technology historian Melvin Kranzberg's first law of technology famously says, "Technology is neither good nor bad, nor is it neutral." There may be no greater example of a technology more often called good, bad and non-neutral than AI, and perhaps fairly. So AI is what tech has always been. As in Terminator: Genysis, when good AI robots battle bad AI robots to save humans, today we see AI on both sides of the ethical fence. Using this power wisely isn't a question of if we use it, but how.
global regulations

INFOGRAPHIC: How GDPR changed the world, and privacy regulation’s future

  • min read
    • One piece of regulation has never before had such global impact as the EU Global Data Protection Regulation (GDPR.) It's firmly established data privacy in the public mind, giving extensive and unassailable rights and affecting behavior well beyond the EU's borders. GDPR legislation was a pioneer that other regions followed. The California Consumer Privacy Act (CCPA) came into force in 2020. The more expansive California Privacy Rights Act (CPRA) will replace it in 2023. While there is no federal nationwide data protection law in the US, all fifty states have regulated data safeguarding, disposal and breach disclosure. US data privacy is pointing towards giving consumers more rights. Africa and Asia, with few exceptions, have a way to go in privacy regulation. It may be fair to say data protection regulation follows economic and political development. But China has a different focus. Having enacted strong privacy regulation, it's regaining control of local Big Tech, starting with corporate dismemberment of Alibaba. It aims to control the massive amounts of data held by Chinese companies that may list overseas. New consumer expectations of data privacy GDPR and other regulations worldwide have raised awareness of privacy issues. There's a gap between what customers want and what businesses think customers want in their digital experience. Businesses think it's profiles (for example, offering relevant suggestions,) live help and price-matching. But consumers prioritize rewards, free shipping and data protection. Forced innovation is also good innovation Data protection is now front of mind for everyone. Many once saw security regulations as an innovation inhibitor adding friction to the customer experience, but now they're customer experience's new best friend. With today's cybercrime landscape, data protection has never had so much focus, driving the need for strong authentication. 3-D Secure is a great example. Ecommerce businesses saw the first version of 3-D Secure as an important tool for tackling fraud, but also the main culprit for customers not completing checkout. But the same businesses are finding the latest version, which includes new security features like biometrics, highly attractive for easier authentication across the whole customer experience. 3-D Secure's latest iteration links with new EU regulation's authentication requirements. Privacy expectations impact on cybercrime The COVID-19 pandemic has sped up changes in digital consumer behavior like never before. Security and fraud risk increased, triggering more stringent regulation. Ransomware gangs try to extort money from victims by encrypting their data, but also releasing it if the ransom isn't paid, adding data privacy insult to injury. Nations are stepping up to address ransomware, now the world's biggest cyberthreat. But it's early days. Attempts to reduce ransomware risk are sometimes surprising with little consensus on how to address it, like US proposals to make ransomware payments tax-deductible or, conversely, making paying a ransom illegal. Once a profitable niche, cyber insurance now struggles to stay afloat with increasing ransomware and skyrocketing demands. Emerging trends in data regulation and oversight Data protection and privacy regulations are now part of life. We also see several emerging trends. For example, increased data protection and privacy oversight; in the three years since GDPR, nearly half of UK businesses have been reported to the Information Commissioner's Office over breaches. With longstanding data breach disclosure laws in the US, a new bill could force businesses to report breaches faster. India has long deliberated its Personal Data Protection Bill (PDP.) We're also seeing financial and security regulations aligning. Financial services regulations now include extensive obligations overlapping with security. Penalties are no longer the sole domain of national data protection authorities but could come from any regulator. UK's Financial Conduct Authority fined Tesco Bank 16.4 million pounds sterling for failing to protect customers' accounts and not doing enough to prevent financial crime. And we see increased desire to control Big Tech. The most notable example started in China with Alibaba in 2019. New Chinese data protection regulation has more scope for oversight, as we saw with the crackdown on ride-hailing service Didi and others. China perhaps sees its companies listed overseas as a national security risk because foreign governments could scrutinize the massive amounts of data they hold. But there are other risks: Several shareholders sued Didi since their share price fell after regulatory crackdown. It's not just China wanting to rein in Big Tech and their data – security concerns led to Germany's data protection commissioner telling government organizations to shut down their Facebook pages. UK's draft Online Safety Bill proposes a new Big Tech oversight body to help tackle illegal and harmful online content. Another trend is increasing regulatory oversight of start-ups, especially in fintech. Stock trading app Robinhood must pay 30 million US dollars to the New York State regulatory body for cybersecurity and anti-money laundering failures. The Swedish financial regulator is investigating buy-now-pay-later firm Klarna for data privacy breaches. Coming soon: The data regulation to prepare for Data regulation laws are often challenged. In Europe in 2020, the Schrems II judgment invalidated Privacy Shield, the data-sharing mechanism between the EU and the US. Austrian activist Max Schrems scored a major win as his case questioning Facebook's legal basis to collect data was referred to the EU Court of Justice. Trump's US attempt to ban TikTok and WeChat shows this isn't confined to the EU. India's Reserve Bank banned Mastercard from issuing new credit and debit cards for not keeping to local data storage rules. Three years since GDPR came into force, regulators aren't standing still. In April 2021, the EU Commission published a draft proposal to regulate artificial intelligence in line with GDPR. With increased automation globally, this is one area to watch.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries