With all the data breaches in past years like Equifax, Oracle Solaris, Sony, Home Depot, and many others just to name a few, there is one big question that keeps coming up. Is your data safe? The answer is not as simple as you might think.
Data Privacy vs Data Security
Before understanding if your data is safe, you should first know the difference between data privacy and data security. Data security is the actual security of your data while data privacy is the governance of that data, meaning how data is collected, handled, and shared.
Best Practices To Help Secure Your Data
Because of all the breaches and security vulnerabilities these days, you unquestionably need to keep the security of your data in mind. To do this you should do a couple things that will help you sleep better at night.
1. Encrypt Data
Whenever possible encrypt your data so it’s harder to steal and even harder to read.
2. Protect Passwords
Using a password vault app will help protect your passwords by encrypting them locally. It also helps you not have to remember one hundred passwords because it will auto-fill yours on web pages.
3. Apply Software Security Updates to Close Identified Vulnerabilities
Make sure you are up to date on your latest software updates to guarantee you have the latest versions of both the security and the software.
4. Backup Data To an Encrypted External Source
Using an encrypted drive outside of the loop will confirm your data is secure. And, you will have a backup if anything happens to your main drive source.
5. Don’t Store Social Security Numbers
When storing data in databases, try not to store whole social security numbers if possible. Storing the last four digits of your social is generally all that’s necessary.
6. “Hash and Salt” Stored Passwords
“Hashing and salting” passwords is one of the methods used for password security on websites. Hashing is a one-way transformation turning the password into a string. Salting is adding bits of data intermittently into the hashed password, making it much more secure. Once you have the password hashed you will then encrypt that field. You can reverse the encryption with a field called the authenticator to decrypt the data using a symmetric key. This creates much more security around those fields.
Remember, you need to know who has access to your data so you can better protect yourself. If you think any of your passwords will be publicly transmitted freely to corporations, be sure to change them all immediately even if they are encrypted.
It is more important than ever to protect yourself, especially with all the breaches in the past. One of the single best ways to do this is to encrypt your data. There are many different types of data encryption, from asymmetric to symmetric.
Data encryption is designed to mask your data so that it is more difficult to read. The data is scrambled using an algorithm that has different levels of complexity. This is done through a key cipher pairing. In the case of asymmetric encryption, the originating part will keep the private key. A private key is a password that is generated with an algorithm. Usually, these are very long and contained inside a file. The private key is kept securely in a safe place very few individuals have access to, while the individual who is receiving the data will get the public key. The public key is generated very similarly to the private key. The main difference is that this key will be available for public consumption. When you combine the two you can unlock the encryption, like two halves of a password.
Asymmetric data encryption involves using a public key and private key which are mathematically linked to each other. You can use either key to encrypt the data. However, to decrypt it you will need both. This method is normally used by multiple users over open networks such as the Internet.
Symmetric data encrypt involves using a private key to encrypt and decrypt the data. This method is quicker and is generally used in closed networks. As if the key gets out, they can get through your encryption, such as with a breach.
Once you choose the method of encryption, you will need to choose from the many different standards. The three major encryption types are DES, AES, and RSA.
Started in the 1970s, DES encryption is no longer considered to be an acceptable form because it is easily hackable. It encrypts 56 bits at a time. There is a new version of this called 3DES which does 3 56-bit blocks of data per 56-bit block, so they encrypt the same block three times. This is a slower method due to the multiple times you must pass each block.
Advanced Encryption Standard is one of the most secure forms of encryption. AES uses a symmetric key structure so you will need a key to decrypt it. It comes in 128, 192, and 256 forms for blocks are each corresponding bit sizes.
Rivest-Shamir-Adleman or RSA. This is the most common form of encryption when using a public key. This is the slowest form of encryption and is not recommended for large or numerous files.
Data Security Bad Habits
While we covered the best practices earlier in this blog, there are also bad habits to avoid. These habits can lead to much easier data sniffing and can put you at risk. With that in mind, I’ve collected a small list of these habits you should avoid if at all possible.
1. Poor Password Strength
Ensure your password is at least 8 characters with numbers and special characters throughout. Using a word is discouraged but if combined with special characters and numbers it can be more secure.
2. Check Email Sources
Phishing happens all the time in email. The email list gets sold to individuals or companies which live off stealing data or money from those who aren’t paying attention. So, always check the sending email address. If an email looks too good to be true, it probably is.
3. Know Who You Are Talking To
Another form of phishing is talking to people. For example, someone you don’t know contacts you and tells you that they are from a company you do know. If they start asking for things like your password or security questions then you should start to question their legitimacy.
With everything that is going on in the world, it is important to protect yourself and your work environment. You can easily do this by adding a little encryption to the world, along with identifying the rights of your data. With the different data protection standards that are currently out there and upcoming, you can trust that there are plenty of options to choose from. You just must identify the right options for you. If you would like any help choosing an option and starting the privacy process for your company or organization, reach out to us.