Have you hugged your fears today?

I was in a conversation the other day with many of my peers at an interesting roundtable headed by the Cowen Group. I was asked to help David Cowen lead a conversation about a myriad of topical ideas and challenges that many high-level leaders across a diverse list of industries faced today. As you might imagine, we heard about the challenges of perennial favorites like inability to find talented people, limited budgets, lack of C-level support for projects, and on and on. Naturally, more newsworthy topics like Big Data, social media, DropBox, the Cloud, and consumerization of IT, rightly caused particular concerns for most people due to the perception of loss of control over the network and the Corporate data. What I interpreted as the underlying tone of what most people said, and what hung in the air, though, was a thin, but pervasive mist of fear.

At the end, David asked a select few of us to summarize what we thought the take-aways were. As the speakers summarized their thoughts on what they heard that morning, I quickly rewrote my summation based on a small gem I heard David say earlier in the discussion: ‘encourage curiosity.’ My parting thoughts went something like this:

I have heard talk of a number of new, unknown and unproven technologies like the Cloud, Big Data, and ‘Bring your own device’, that have pervaded (invaded, really) our workplace.  And the common underlying tone that I hear amongst us is one of fear.

Now, maybe because I am a perpetual optimist, and a ‘glass half full’ guy, but I can’t help but suggest that a reasonable, and in fact only possible option is to embrace the fear that confronts us. Encourage the uncertainty. Welcome the Black Swan events that disrupt the melancholy of day-to-day existence.

Why? It is this ambiguity, this insecurity and dissonance to our comfort that otherwise makes life tolerable. Makes it bearable. Makes it worthwhile. The shock to the system of the unexpected and unknown is what drives humanity forward to betterment of us all. It is a cultural cold shower that everyone needs from time-to-time.

In the very beginning of the 20^th century, as new some entrepreneurs thought about what improvements could be made to transportation, the contrived thinking was more akin to ‘building a faster horse’ than to Henry Ford’s ideas of creating an assembly line, interchangeable parts and installment selling which really transformed the industry.

In the early ‘80s, Jack Valenti, head of the Motion Picture Association of America lobbied against the creation of the VCR. Valenti actually said, in front of Congress no less, that the “VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone.” Yet, what did the VCR eventually do the movie industry? It saved it! Imagine how much better off the industry might be today of the fear of that new and unknown technology was embraced rather than discouraged.

So that is why my parting thought was to say, we should embrace the fear we all fear everyday at work of the unknown. We should also encourage those who work for us who talk of bleeding edge technologies and radical concepts like “I know we don’t do it this way here today, but...”, and promote their curiosity. Reward it, in fact.  If humanity is to be driven forward, it will take more than just a few us.

Changes in the world of Privacy: Big and Small

As I was preparing for an upcoming panel discussion on recent privacy issues affecting the Corporate world, I thought about two areas of relevancy for most organizations: micro and macro changes in the realms of privacy and security. See if you agree.

The major, though subtle, micro change in privacy and security world in recent times I’ve observed is the loss of power that the mighty IT organization used to have.  Remember back in the day when  IT’s world was gospel. If they said you couldn’t have this program, you didn’t get it; if they said there was no way you could access that web site, you didn’t get there. Use your own device in the office?!?! For work???!! Fugeddaboutit.

Nowadays though, it is more apparent than ever that IT has less power to say ‘no.’ Which of course causes many headaches for the IT department who must deal now temper the tension and traditional IT resistance of allowing unknown/untrusted devices into the inner sanctum. The risks are obvious and myriad. These risks have led many organizations to firmly resist the trend of consumerization by restricting the umpteen amount of variety of hardware that every C-level executive and their brother bring to their cubicles. 

In other ways, the fact that the fulcrum of power has now swung to the employee is a good thing, as I have argued in previous posts. It is the era of consumerization. This surge of employee power forces the IT department now to be collaborative, and no longer allows the department to be filled with ‘V.P.s of No’. I argue that regardless of the formal or informal position of the IT department, or even the company policy in general, this faction of users is growing and is in fact disintermediating the IT department by working around them to get their devices to work at work. And here’s why: people’s personal world and professional world are drifting closer and closer together with the traditional lines separating the two becoming blurrier than ever.

For most business people, the mobile phone is now the mobile office, for example. The ultimate objective of consumerization is simply work and personal life converged onto a single device. It’s all about productivity via familiarity of the toolset. Think about how life was 15 years ago: you had use of all the great technology and software at work. When you came home, all you had was some stripped down versions of that machinery and applications – toys, really.  Today, the scenario is reversed: employees who have state-of-the art technology at home can’t reconcile the fact that when they come to work they have a Windows XP machine, or worse, that takes 2 days to boot up.  Pent-up user demand should not be underestimated, and consumerized IT can be the Holy Grail of employee satisfaction if deployed properly.

A parallel phenomenon that is also of note is the reassignment of power away from companies and into the hands of the consumer, particularly the power to decide strategy and business approach. Very recent examples of companies making a 180 degree about face on a business decision are reminiscent of the introduction of New Coke April 1985, and then the very public reversal back to Classic Coke.

While the reintroduction of Classic Coke after the debacle of New Coke took 77 days before the company announced their mistake, many recent example of the power of the people (largely amplified with the vehicle of social media) are taking less time. Consider the Bank of America notice to start charging customers $5 for the privilege of using a debit card with the Bank for purchases – retracted in a month after the ensuring uproar; and Verizon reversed its plan to charge cell phone users $2 fee for one-time credit or debit card payments by phone or on the company’s Web site – retracted after one day!  Now that’s power. (And stupidity on the part of the Corporation’s marketing department.)

Of the most prevalent macro change I see in the privacy and security space must be the convergence to the center of the historically very different privacy and security models of the European Union and of the United States. It used to be that the U.S. cared only for security and very little of privacy (after all, we still have no national or federal privacy law), while the countries of the E.U. cared almost exclusively about the individual’s privacy, and no focus on security (there is, for example, no breach notification requirements in the E.U. data privacy laws.)

Now I see a slow, deliberate convergence toward the common middle as both parties realize the benefit and practicality of the other parties approach and model. Though the disparity of the two camps privacy and security laws are still world’s apart, within the next 3 years – due in large part to both the recently issued FTC privacy best practices report, and the publication of the E.U.’s Data Protection Directive proposed revisions - the world will soon finally agree on the proper blend of both privacy and security controls to benefits of all customers, consumers and employees on both continents.

Doth Privacy Professionals protest too much?

If you didn't know any better and as a point of reference only considered recent pronouncements of what online social media sites search engines and mobile phone apps are doing with your data, you may just be frightened enough to go back to using smoke signal and carrier pigeons to communicate with the outside world.

There exists however a dichotomy of realities. On one hand, privacy professionals like me feel it is our God-given duty as the more informed of the two parties to relay and convey the risk and (apparently few) rewards of living in a digital world. (Just like you expect valid financial advice from your accountant; she knows more than you, you hope.) You can’t pick up any newspaper, magazine or online article without being threatened with identity Armageddon by the use of facebook, Google, Angry Birds, Hootsuite, Pandora, Yelp...and on and on and on. At what point do privacy experts stop being valued advisors and move toward simply being paternalistic and saving us from ourselves? Or worse: becoming crybabies?

We as users of technologies (me included) profess to care about our privacy, but the reality of the situation is that we generally do in practice the opposite of what we say. We have even given out our passwords and usernames to "researchers" for free chocolate. ISACA, a global information security association, recently published a survey that indicated 43% of people do not read the agreements on location-based apps before downloading them, and of those who do read the agreements, 25% believe these agreements are not clear about how location information is being used. (What is not really made clear in the statistics is how many of the users who read how their data is being used, still downloaded the app? More than 43%, I’ll bet.) Released late last week, the latest edition of the Angry Birds franchise was downloaded 10 million times in its first three days. How many people read the privacy policy, do you think? Every Apple iPhone update I have ever received on my phone has presented the policy and terms of use in no less than 60 pages.

It is probably the case that we have become desensitized to the news of our data being hacked, stolen or misused which has resulted in the inertia of most people to these events. When you are the recipient of a half-dozen of these "we lost a backup tape" or "a laptop was stolen" letters, and there is not an immediate 'sky is falling' event which follows, one becomes complacent; we start to ignore everything about the warnings, even when we should not. That state of being is called 'habituation.' According to www.animalbehavavioronline.com (how’s that for a source!), habituation is "an extremely simple form of learning, in which an animal, after a period of exposure to a stimulus, stops responding. In the nervous system, sensory systems may stop, after a while, sending signals to the brain in response to a continuously present or often-repeated stimulus."

Politicians even now feel the need to publically bully technology firms since it is easy work for them and it makes it seem like Washington is actually doing something. With approval rates for Congress at historic lows, politicians feel the need to get as much visibility as possible, even if it means digressing into areas about which they have no knowledge, expertise or clue. (I wonder - has every problem facing Congress already been solved that they now have to worry about what the iFart app does with my personal information?!)

The facts of the situation are this: use of facebook or Google is not mandatory (really, they're not!); you can still switch back to Friendster, Bing and MySpace if you'd like. Here's a corollary illustration. I recently had a bad experience with a car brand and dealer. When my lease came up for renewal, not only did I not purchase that car, but I did not and will not buy another car from that dealer. In fact, I won't even buy the same brand of car because that dealer is the only one for that brand in a 50 mile radius, so I would have to take my car to that dealer. So what did I do? Actually, what did I not do? I did not ask government to regulate or step in to review this lousy dealer, I voted with my feet and took my business elsewhere.

It is true in most professions around the world that we tend to create and discuss ideas only within our professional bubble; at best, instead of just talking about bacon for breakfast, you may move to turkey bacon. It is rare if the discussion ever moves to dim sum. The same ideas, solutions and concepts are debated by and for the same people. So when a person or people in your group doth protest too much, he or she may be really only doing so for the benefit (or entertainment) of just the same circle of colleagues he or she interacts with.

Consumer Privacy Rage Hits the Pundit Himself!

Really? Sorry. I know I sound like a 14 year-old but it's best I could come up with when I saw this request from an app on my iPhone. The application, Hipstamatic, is one my my favorites and one of the more innovative photo taking app in the Apple store, yet it represents a lot of what is at the core of privacy complaints that even non-privacy wonks can relate to and experience personally.

I was very disappointed to see the window below when I tried to use my Facebook credentials to sign in (never a good idea) to the Hipstamatic account log-on that I had forgotten.

You can see the requested credentials that the app is asking for. But the really shocker, and indicative of the very privacy issue that more and more consumers are starting to awake to and protest against, is the is in the highlighted section at the bottom and the perceived need for access to my data even when I'm not using the application!

Is there anything left to say but, Really? ('WTF?' was a non-starter. My boss might be reading this blog)

The Most Egregious (and refreshingly honest) Privacy Policy You May Ever Read

This is an actual Privacy Policy excerpted in in all of its full glory from the website, http://skipity.com, a Google-like search engine.

 

If nothing else, this policy should win an award for its 'emperor has no clothes' approach to privacy (or a lack thereof).

 

I would ask "How much worse is this approach of pure and unadulterated honesty in advertising, versus the usual unfair and deceptive practices we have seen with some of the most sophisticated and privacy savvy web companies in the world?  Read on and enjoy...

 

 

 

 

Privacy Policy

Sua sponte: Hereto within, both for consideration and exemplification in abeyance subject to adjudication pro se and terms whereto superseding justifies the underscore until res judicata thuslyrelieving ALL satisfactions. All parties hereby agree to wit habeas corpus.

We firmly believe that privacy both inconsequential and unimportant to you. If it were not, you probably would not have a Facebook, Twitter, or LinkedIn account: and you certainly wouldn't ever use a search engine like Google. If you're one of those tin-foil-hat wearing crazies that actually cares about privacy: stop using our services and get a life.

We agree with Mark Zuckerberg when he pithily opined "The age of Privacy is Over."

Our privacy policy is a reflection of this conviction. Therefore, to satisfy the absurd privacy requirements of various legal entities (and so you understand exactly where you stand with us) we are pleased to present our privacy policy:

1. We are the company that cares about your privacy. Specifically, while most other companies are concerned with protecting your privacy, we care about profiteering and violating it when expedient or useful.

2. You may think of using any of our programs or services as the privacy equivalent of living in a webcam fitted glass house under the unblinking eye of Big Brother: you have no privacy with us. If we can use any of your details to legally make a profit, we probably will.

3. We will track and log everything we can about all the dirty (and clean) things you do and like with cookies, GPS, secure connections and or whatever technology exists today or becomes available at any time in the future.

4. By using any of our services, you grant us permission to surgically implant a tracking microchip of our choosing in your body and sell all collected information to the highest bidder . . . and to all other bidders. You also agree to regular updates and reinstalls of said device entirely at our discretion for up to 50 years after the end of your natural life.

5. If the opportunity arises to sell or otherwise use this or any information, data or meta data about you or your world, we will jump at that opportunity like a pitbull on a fresh steak

6. Please email us to tell us some of your secrets. We may, at our sole discretion (or lack thereof), broadcast, reveal, sell, manipulate, or otherwise use these secrets, or any information we collect to our benefit whenever, wherever, and however we choose.

7. We are right now looking at you through your webcam. Do you always move your lips like that when you read? We also recorded what you were doing last week and are sending the video to (you know who). If the prior statements are not true, it's because in addition to everything else, we reserve the right to lie to you, and you agree to believe us and hold us harmless for any and all such lies. Furthermore, if we are not recording everything you're doing through your webcam, it's either because we haven't figured out how, you're just not that interesting, or both.

8. We are serious about all of the above. So don't go trying to sue us later with some nonsense like "I thought that was all satire." All your privacy are belong to us. We mean it.

9. Cookies: We like chocolate chip cookies. You agree to furnish any employee or associate of our company with fresh chocolate chip cookies upon request. That's the price of using our programs and or services (in addition to any other price we come up with).

10. Spam. You agree that nothing we do with the access and information you grant to us shall be called Spam: even if it is. We prefer the term "bacon", because . .. mmmmmmmm bacon.

Thats' it! So Go Ahead and try Skipity:
skipity

My 12 Privacy Resolutions for 2012

1. Unsubscribe from all e-mails and newsletters you don't read, never read anymore or never actively signed up for. Your e-mail address is just going to be sold to other marketers or mailing lists anyway so start to cut down on the clutter.

2. Update and strengthen your passwords that you use for critical, financial and other data heavy websites.

3. Stop updating everyone on your location via smartphone apps. No one really cares and you're just letting thieves know you are not home so they can rob you.

4. When putting mail in the mailbox for the Postman to pick up, don't lift the flag to indicate that there is mail in the box. The mailman will find it anyway. Leaving the flag up tells ID thieves that you have some mail that may contain some interesting personal data.

5. Pay all of your bills online. C'mon, it's 2012.

6. Stop using your debit card to make online or offline purchases, or buy gas; use a credit card only. Using a debit card gives a thief direct access to your checking account, making it difficult to prove fraud, and preventing you from taking advantage of consumer protection laws that most credit cards offer.

7. Do an exhaustive Google search on your self to see what information is out there so you can see what the blogosphere is saying about you, if anything.

8. Make sure the "Do not track" option is checked in your browser's setting.

9. If you haven't already, start to integrate the concept of 'privacy by design' into your business and/or IT development processes; don't try bolting it on once the process or application is complete and ready to be rolled out.

10. Formalize and publicize a social media policy within your company so everyone knows what the rules are.

11. Formalize and publicize your position on consumerized IT within your company, again, so everyone knows what the rules are.

12. Finally realize that there is no such thing as 'free' on the internet. No free iPads or dinner coupons to Cheesecake factory, or trips to Disney World. Stop clicking on those offers or accepting the links on Facebook. And no, you are not really the 1,000,000th visitor(!!!) to a site and have not really won anything. Pass it on.

'Security Through Obscurity' shows lack of maturity

My last post for 2011 will be about a favorite and common topic amongst security professionals: the art and technique of ‘security through obscurity.’  Anyone and everyone in the privacy and security fields knows about this and I am sure that 95% of the readers have knowingly used this approach to protect data and other assets (the other 5% are probably lying).

Simply put, the ‘security through obscurity’ control, if you will, is making some weakness so discreet, subtle or inconspicuous that you are hoping that a user or bad guys does not find the loophole or back door, intentionally or otherwise. I am not talking here about unanticipated ways to defeat your explicit and obvious controls that the developers or programmers could have never contemplated; I am talking about the “ignore that man behind the curtain” ones. Exactly the ones that little Toto sniffing under a curtain uncovers….Like the empty police car on the side of the highway. Or like stating that your password complexity requirements are 9 characters that must consist of 1 lower case letter, 1 number, 1 special character and 1 upper case letter. And then not enforcing the policy.

I got to thinking about this when I recently thought about a line in a Gnarls Barkley song, “Smiley Faces.” The line was “Was knowing your weakness what made you strong?” Now I have asserted in the past that a secret is only a secret if it remains between a minimal amount of people; when the world knows it, it becomes as useful, and valuable as yesterday’s newspaper. And if you would make (most) private data held by governmental institutions and corporations easily available to any one, acquiring it would mean nothing since it cannot be readily misused, like it can be today. In the security context, knowing that the weakness exists in your application/program/website is the strength you need to resolve the fault proactively. And in the future, you can build in ‘privacy by design’ rather than trying to bolt on security after the fact. Always an ugly outcome, both aesthetically and from a user experience.

My point here is that relying on the ‘security through obscurity’ approach, to any degree, for information protection shows an overall lack of sophistication and maturity in your security process and program. I realize that many companies take this approach because it is cheap and fast to deploy – building in proper controls takes time and money. Ultimately, though you will have two choices when you decide to take a path toward security: you can either pay now or pay later. You pay now by making the investment in proper coding controls and preventative measures; you pay later when someone finds the weakness/hole in your program, application or website and posts it on YouTube and then you have re-engineer the code all over again, making double work. In my opinion, paying now lays the groundwork in your organization for both a respect for security and privacy considerations as a corporate value, and for a discipline of doing the right thing right now.

Make a New Year’s resolution then to avoid the temptation of at least one venial sin this year as you think about your security program and policies in 2012– the sin of sloth.

Happy New Year!