Magazine menu Close Magazine menu

Data and privacy

Latest stories

trust customer privacy

You need these two ways to win customers’ data privacy trust

  • min read
    • Business sees trust in data privacy as a panacea. Companies that foster customer trust see more customer engagement and willingness to share valuable personal information. But what do we mean when we talk about trust in data privacy? What are privacy experts advising companies to do when they recommend building trust? It's one of the driving questions behind my book, The Intelligent Marketer's Guide to Data Privacy: The Impact of Big Data on Customer Trust. Most guidance around instilling trust doesn't adequately explain what trust is, or how to develop it. In researching companies that use privacy as a competitive advantage, I found two types of trust are key. First, customers must trust the company is competent and skilled in protecting their data. Second, they must trust the company's reasons for protecting their data are customer-centered. Although each type of trust is valuable alone, developing both is optimal for customer and business outcomes. Be capable of delivering what you promise The Oxford English Dictionary says trust is "belief in the reliability, truth, ability or strength of someone or something." This definition links trust with data privacy capabilities. For a company to position itself as strong on data privacy, it must have the skills and competencies to be effective in security and protection. For enterprises, this means having resources like data security teams or systems in place, and a talented chief privacy officer (CPO.) You should find it relatively easy to implement (and exceed) privacy regulations. For smaller firms, demonstrating responsible data handling across all interfaces and processes strengthens customer trust in your privacy capabilities. Trust in your company's data privacy abilities also involves your history with data protection. Strong claims about protecting customer data privacy seem suspicious if you've had a well-publicized data breach in the past. But my research found organizations that have suffered a data breach can recover trust by giving customers transparency and control. Ensure you're honest about past lapses when encouraging customers to trust your data protection capabilities following a breach. Be privacy-conscious for the right reasons Customers must also trust your data privacy position is for the right reasons. If trust in your ability to uphold privacy is the cold, rational side of trust, trust in your intentions is the warm, fuzzy side. Ways to build trust in your company's data privacy motivations are less clear and may take longer. This kind of trust is linked to reputation, so just one negative event can deteriorate it, with a long, hard road to redemption. My research found many prominent technology companies suffer from this deficiency in trust. Large firms with ample resources for strong data protections may not necessarily find customers like their privacy stance. For example, even before the Cambridge Analytica scandal, Facebook (now Meta) wasn't well regarded for its privacy practices. When companies like this talk about privacy, customers tend to distrust their reasons. This trust deficit around big tech may present opportunities for small or new tech companies to make a mark, differentiating themselves through customer-centered privacy values. Building customer trust is key to creating value through smooth exchange of personal information and building long-term, mutually beneficial relationships. Businesses of all sizes should pursue customer trust. But, before devoting resources to building trust in data privacy, your business must understand what trust involves. Trust implies distinct company behaviors and practices. Carefully managing trust and not taking for granted what trust you already have, is key to leading on privacy.
data transparency center

How transparency centers and open data processing practices help your business

  • min read
    • Data processing centers are already a crucial part of digital business, and transparency centers – although less widespread – are becoming part of that picture too. But the two can be confused or poorly understood. Enterprises wanting to make sure they're protecting their security in the best way possible will want to get to the bottom of this. Here, we'll take an in-depth look at both, examining their different purposes and what your business should consider when using each as part of its security practice. What data processing centers do Data processing centers hold servers and computers that process your business's information. Increasingly, data processing centers are separate from the data-owning business's premises for safety, security and cost-effectiveness. According to Market Prospects Insights, "Data center operations include installing and maintaining network resources, ensuring data center security, and monitoring systems responsible for power and cooling." Speaking of power and cooling, more businesses are now thinking about the environmental impact of data processing. Thankfully, data processing needn't cost the earth. You can seek out data processing centers powered by renewable electricity, either in a country where grid power comes mostly from renewable energy, like Norway, Brazil or New Zealand. Or, process your data with a company that powers their data center by buying electricity only from renewable sources. Why data center location matters Regulation can also impact where businesses choose to process their data. You'll need to know how laws in the territory you and your customers are in could affect your data security. A third factor influencing where you process your data may be company values. At Kaspersky, we use two data centers in Zürich, Switzerland to store all threat-related data from our product users in Europe, North and Latin America, the Middle East and several Asia-Pacific countries. We chose Switzerland because of its long history of neutrality, as part of our Global Transparency Initiative (GTI.) What transparency centers do Wondering what next-level trust between businesses looks like? You may soon have the opportunity to examine your software supply chain in a new level of detail. Outside the open-source software movement, software source code is usually a closely guarded trade secret. But increasingly, front-runners realize that finding ways to safely and securely let partners and clients inspect their code helps build the trusting relationships businesses need to thrive. Communications giant Huawei established its first transparency center in Brussels in 2019. Huawei explains what they hope to achieve with their center: "Through the Cyber Security Transparency Centre, we plan to increase communication and collaboration with security professionals, governmental agencies, customers and other industry stakeholders, in order to develop a secure and trusted digital environment." Microsoft opened transparency centers in Brussels and Redmond, Washington in 2014 to 2015 as part of its Government Security Program (GSP.)  Matt Thomlinson, Vice President of Microsoft Security highlighted how transparency centers can contribute to better economic outcomes for all: "Only by increasing confidence in digital solutions […] can Europe ensure that every citizen, business and government feels the benefits of the digital revolution." Kaspersky started creating transparency centers in 2017 and now has seven, in Zürich (Switzerland,) Madrid (Spain,) São Paulo (Brazil,) Woburn (USA,) Tokyo (Japan,) Singapore and Kuala Lumpur (Malaysia.) We welcome customers and partners, including authorities responsible for cybersecurity, from anywhere in the world to visit these centers. How Kaspersky customers can use our transparency centers We suggest clients visit a transparency center if they want to know more about our data security, privacy and management practices, encryption methods or supply chain risk management. When customers visit our centers, we have experts on hand to give any technical information about our source code and technologies. We have three levels of access, like the beginner, intermediate and advanced slopes on a ski field – designed to allow a broader range of client visitors to get something out of the experience. They could rebuild our source code to ensure it matches publicly available modules, and read what independent auditors – including a Big Four accounting firm – have said about us in recent security reports. While few businesses have transparency centers today, others are adopting similar ideas. Showcase centers, for example, let customers try out the firm's latest tech and in some cases, securely review code. UK-based telecommunications multinational BT established a showcase center for its financial services products, where their customers learn more about their products – especially security features. Today, businesses must understand where and how their data is processed and ensure processing conforms with regulation and their organization's values. Find out what opportunities you have to better understand what's happening with your data. If you have an opportunity to visit a transparency center or other facility that lets you get up close and personal with the code of organizations in your supply chain, take up the offer – regardless of which ski slope you're on.

Could this voluntary charter fix data ethics in big tech?

  • min read
    • We know some people and businesses will, given the chance, use personal location data in unethical ways. When automotive cybersecurity experts Karamba Security posted a fake vehicle control unit online, they saw 25,000 attempted breaches in three days. Stalkers have used AirTag, Apple's coin-sized device for finding lost keys or other property, to track victims. Regulations like the EU's General Data Protection Regulation (GDPR) define minimum standards of data ethics, but the case for going further is strong. To that end, what can help those tech businesses who want to stay ahead of the data exploitation curve by upholding the highest data ethics standards? Learning to foresee the unforeseen International non-profit the Locus Charter promotes a higher standard of responsibility for professionals and businesses when it comes to location data. They want to avoid unforeseen privacy breaches by working out what can go wrong and pinpoint big problems before they're exploited. They champion public interest by showing businesses how to prevent unintentional harm. The charter is based on ten principles that balance moral behavior with economic benefit, like realizing opportunities and understanding impacts. Location data is one of many frontiers. As veterans of data policy in and out of government, the charter's founders want to be part of all kinds of data discussions. Automation challenging data ethics "The most important focus in data ethics is exploring the power granted by the accumulation of data so everyone can recognize how that power can be used and misused," Ben Hawes, Technology Policy Consultant and co-author of the Locus Charter, told me. He continues, "There's an assumption automated systems and digital technologies are always better. Economic pressures mean companies prefer the promise of greater productivity at all costs, which can be alarming when people are unaware of many potential data misuses, accidental or deliberate." "Some risks in business going digital crop up in all sectors," said Hawes. "We often see 'designer biases,' where developers center their own experiences, leading to alienating people who don't fit the same racial, economic or physical profile. Another issue is automation making back-end processes more complex until they're opaque. There are also sector-specific issues." With the digital world's size and potential, regulating the space is an uphill battle. New ways to exploit data are appearing faster than lawmakers can address them. Is self-regulation enough? Hawes doesn't support a relaxed approach to data ethics. "It's unwise to avoid oversight and critical regulation in the hope self-regulation may be enough, as it rarely is." A 'wild west' model is attractive for short-term gains by freeing emerging markets from red tape, but loose protections don't create conditions for long-term growth or stable markets, especially in an age of social pressure on brands to be ethical. Can whitewashing be cleaned up? With limited regulative authority, a non-profit trade initiative likely isn't eager to bicker with companies they're working with. Organizations like Locus may be better placed, approaching economic ethics from a collaborative angle. Of course, some companies are only interested in the PR boost of appearing ethical by whitewashing their marketing because they don't want to be the only ones following the rules in a competitive arena. They end up paying lip service alone, without taking the issues seriously. Hawes thinks despite this, there's still benefit in working in good faith. "To get ethically reluctant companies to behave well with data, is it better to give them the benefit of the doubt or be critical and accusing? I think, better to have a company aspire to a good standard, even if it's empty promises, because they can at least be held to those standards in some way." Less direct ways of influencing A cooperative strategy may create the best conditions in a self-regulating atmosphere. When ethics groups collaborate with business, they influence thousands of staff members, creating internal pressure for higher standards in the boardroom. It's also worth championing an ethical company for consumers looking to do the right thing with their money. Though strategies like these can't do it all, they have worked, motivating large companies to produce net-carbon zero plans and banks to create green investment options. But data misuse is not the same as pollution. "It's harder to see and analyze compared with other high-profile scandals, so it's hard to translate into a common grievance that can unite people," says Hawes. Will something have to go badly wrong for the world to take it seriously? Hawes considers, "If authorities avoid developing solutions until a problem causes substantial harm, they'll still need about a decade to develop tools that would be effective in this complex market. Governments should be working on this yesterday." In other words, have a fire extinguisher ready when playing with matches, rather than trying to invent one as your house burns down. Reforming data use culture The task of reforming fast-evolving data industries is daunting. Hawes' recommended method involves slowly, steadily establishing ethical practice as the norm. "The UK has the Digital Regulation Cooperation Forum for sharing information and approaches. It lets regulators gain knowledge of the risks data and digitalized business generate, so they can manage them sector by sector. We need a forum like that on an international scale," says Hawes. "Understanding risks like explainability, transparency and bias creates a foundation for building standards that address the problem and brings stability to the data economy." This pressure can also come from outside industry, and often flavors the expectations that filter into business. "More public debate on how we can avoid driving digital inequalities would go a long way," says Hawes. "This is particularly important in social media, which is the frontline of data ethics in many ways." While data privacy issues haven't seen the emphasis Hawes and his peers would like, they're eager to change the culture. Business can choose to be part of the solution and be heralded as ethical data use champions for their efforts.
trust transparency

Transparency isn’t about your business – it’s about your customers

  • min read
    • Our new digitalized business environment relies on trust. We trust our technology, brands, partnerships and more. Many things can help build trust, like our long-term relationship with a brand or the strength of its reputation. When it comes to tech, when we don't understand how something works or how it handles our data, we trust less easily. So, when it comes to winning trust, transparency helps – like clear verification and risk mitigation measures. Do users care about transparency? In 2021 Kaspersky published its research with over 15,000 adults in 23 countries on their attitudes to online privacy in its report, Consumer appetite versus action: The state of data privacy amid growing digital dependency. We found most of these consumers expected greater transparency about how their data was handled, with 62 percent saying they worry their online activities are constantly tracked by websites or services they use. A similar proportion (63 percent) said they felt transparency of technologies and companies was necessary for digital transformation. Do businesses think the same? International Data Group (IDC) predicted at the end of 2021 that by 2025, half of the world's top 2,000 public companies would be employing more diverse data scientists with the intent to improve customer trust. But what about the other half? Edelman Trust Barometer has studied trust in business, governments, media and other organizations for over 20 years, now with over 36,000 respondents in 28 countries. In 2021, the study found falling levels of public trust in media and government. People felt institutions are not addressing their concerns around job loss, climate change and cybersecurity. The study notes, "We see an even greater expectation of business to lead as trust in government continues to spiral." Taking action on trust and transparency Kaspersky's Global Transparency Initiative (GTI) is now five years old. We've invested many hours and much resource in it because we believe openness and transparency are crucial for cybersecurity. What does GTI involve? We've opened Transparency Centers in several countries and taken a range of actions to be more transparent with our customers, from making our source code available for public review to relocating part of our cyberthreat-related processing infrastructure to Switzerland. Here's more on how the initiative is evolving. We also have a bug bounty program, generously rewarding security researchers who report a vulnerability in our products. Building business cyber-resilience through learning In a digital world, business must be cyber-resilient. Any compromise to IT infrastructure can lead to business loss. As part of our GTI, Kaspersky is helping its partners and customers gain the tools and knowledge to protect themselves and choose reliable software. Our Cyber Capacity Building Program, available online and offline, helps businesses, academia and government organizations to learn skills to ensure the security and integrity of integrated third-party applications and identify and manage cybersecurity risks. We developed GTI as thought leadership – we hope that the rest of our industry will follow suit. But it also protects our biggest asset – our users and their trust. We want to share our experience, expertise and knowledge with the widest audience possible. Because transparency isn't about us, it's about our customers.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
supply chain attacks

Why cybercriminals love to attack supply chains, and how to stop them

  • min read
    • The bigger the business, the more suppliers. And as businesses use more and more internet-connected devices like printers, point-of-sale terminals and even air conditioning, cybercriminals have more ways in. One way to stop cyberattacks is to invest in cyber defenses like software, people and training. Most large enterprises know they could be targets and have prioritized cybersecurity. So, many cybercriminals have turned to compromising smaller businesses that supply larger businesses to get to their real target. Tomorrow Unlocked's video Target the Supply Chain looks at supply chain attacks and how to prevent them, with supply chain attacks expert Eliza-May Austin, CEO and co-founder of  th4ts3cur1ty.company (That Security Company.) What is a supply chain attack? A supply chain cyberattack is when cybercriminals compromise a smaller supplier of a larger business, intending to eventually attack the larger business. These attacks aren't new, but they're becoming more common and harder to detect. In Target the Supply Chain, Austin explains how cybercriminals stole 40 million people's card details from US retail giant Target. It started when an employee at Target's air conditioning supplier clicked a link in a phishing email, injecting malware into their system. In 2017, Kaspersky researchers found a 'backdoor' in the server management software hundreds of large businesses use. When activated, the backdoor let attackers steal data. Researchers notified the suppliers, NetSarang, who pulled down the compromised software and replaced it with a clean version. Sometimes, there is no clean version. Noushin Shabab, Senior Security Researcher at Kaspersky, says supply chain attacks can start in software development. "Cyberattackers can compromise software by getting inside software used by developers. That way, malicious code can end up on many businesses' networks." How to protect against supply chain attacks Austin's start-up works with suppliers to larger corporations to 'harden' (better protect) their whole supply chain from attack. She says, "We can prevent about 80 percent of attacks with basic cyber-hygiene. Make sure your software and hardware is up-to-date. Limit your 'attack surface' – if something needn't be online, don't put it online. Audit passwords, making sure they're complex. Have two-factor authentication. Employees can be the weakest link in a company, but with good cybersecurity training, they can be the strongest." Threat hunting also helps prevent supply chain attacks. Kaspersky's Nikolay Pankov says, "A sophisticated targeted attack can implant malware and stay under the radar for a long time. To prevent those attacks, you need experienced threat hunters." As getting these skills in-house can be challenging at the best of times, using a targeted attack discovery service is a good option for businesses of all sizes. Cybercriminals are nothing if not flexible and adaptable. They've adapted to growing cybersecurity awareness in enterprises by compromising smaller suppliers. But by using their growing cybersecurity awareness, larger companies can protect themselves even more by looking further afield and working with their smaller suppliers to protect both businesses.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries