Collecting and storing personal information is necessary to perform certain tasks. Particularly business companies collect them to improve customer service. Youtube is a great example; they collect user data, such as videos you watch and search history, to recommend videos you might watch. There are also companies that collect information that’s really important and personal. For instance, insurance companies might collect your social security number to identify you, especially health and life insurance. When visiting websites, we often see an option pop out, asking if we want to accept cookies. This cookie is an example of how companies track your online activity. Even when you are using apps, you can see the ads are related to what you’re looking for. Or when you’re online shopping, you’ll find the things you add as favorites but didn’t buy last time have a discount. Organizations can’t sell customer’s personal information to any party, but there are still risks. Companies store and need to protect information from leaking due to all kinds of regulations (HIPAA, GDPR, etc.). But as the data increases, the difficulty of managing security also increases. Attackers develop new ways to breach security, such as sending an email with a link that has a virus; pretending to be someone that has access to the information, and so on. They need to develop and update security or else attackers can decrypt code easily. Physical damage to the storage device also can allow unauthorized access and data loss.
Hackers can apply special software that has the ability to guess usernames and passwords. They would also find flaws in companies’ software to access information and networks. Other than brute force attacks, they also apply psychological methods to deceive employees. For instance, they use pop-ups on websites to trick users into clicking the link. What’s more troubling is they can use stolen credentials to access even more information in other systems. Hackers target users with weak passwords, out of date software and firewalls. They either guess the right passwords and gain information, or they sneak malware into your system and steal data. They also mislead users to download malicious files by using outdated websites. There are examples of other types of data breach. For example, accidental internal breach is where an employee views files without authorization but has no intention to share them. On the other hand, intentional internal breach is when an employee views files without authorization and has intention to share them. Theft of storing devices is another kind of data breach. Storing devices often contain unencrypted information and are easier to gain access to if lost. So it’s best to encrypt content and have a backup. Encryption is a process transforming information to the phase that only certain authorized people can decode them. Backup is best to store it in a safe place and save information frequently, also don’t leave the device connected when you’re not backing up content.
For more information, visit the above links.