Like colorful autumn leaves blowing in the wind, the month of October - National Cyber Security Awareness Month - blew past so quickly that many entrepreneurs blinked, and it was gone. Building a company can get extremely busy, but smart businesswomen recognize that setting aside some time to take precautionary measures now is a brilliant way to transition from a season of fright to a season of giving thanks. After all, cyber security is something we can all feel grateful about.
Unless you are a privacy professional or tech ninja, it is not always clear (1) who should take action, (2) what information should be protected, or (3) how to implement cyber security. Here, Parazim provides comprehensive techniques and guidelines entrepreneurs can implement and use on a daily basis for personal and company-wide data protection.
WHO NEEDS CYBER-SECURITY?
Entrepreneurs tend to procrastinate about addressing issues they are aware of but are not yet imminently facing. Unfortunately, this bad habit is unhelpful, because the issue becomes much harder to resolve after the harm is done. Taking proactive measures to guard against data theft is necessary because of the potentially serious consequences and threat of lasting damage.
The massive Equifax data breach in May, 2017 suggests that no one is safe from cybercriminals. Even the most well equipped companies are vulnerable. This breach is considered one of the most significant data breaches in recent history since it includes highly sensitive information such as credit cards numbers, SSNs and other personal identifying data. Information of more than 143 millions of American customers was compromised.
According to Breach Level Index, a global database that tracks data breaches and measures their severity based on number of records compromised, the type of data, the source of the breach, how the data was used, and whether or not the data was encrypted, data theft is a fast-growing problem for individuals as well as large corporations and organizations. The frequency of stolen data records is an astounding 60 records stolen per second, 3,578 records stolen per minute and 214,693 records stolen per hour. With the increased frequency of data theft and its global expansion, every entrepreneur is in the zone of risk.
WHAT INFORMATION SHOULD A SAVVY ENTREPRENEUR PROTECT?
Before diving into privacy and cyber security measures, it's important to first understand what information is sensitive and vital to protect. Under current U.S. laws and regulations, the following are examples of some types of information collected that will require special handling and protection:
-personally identifiable information (PII) including an individual’s name or initials, birthdate, Social Security number (SSN), driver’s license number,financial data, email address, location data
-personal information related to medical history, criminal convictions, sexual orientation, political and religious affiliation.
Even if some types of information are not defined by law as PII but will help lead to a particular individual (home address, personal correspondence, private photos), it is still wise to be careful about sharing such information on the Internet. Social networks provide an outstanding opportunity to steal personal information to use it for criminal purposes. For example, when people take photos with geotags and post them on Facebook, burglars and stalkers will know such person is not at home and where they are at. In addition, another example is that before posting photos of boarding passes prior to a flight, remember that someone could use this information to change your flight details or cancel the tickets. It is important to keep in mind that every time you publish a photograph on a social network site, you surrender privacy. Usually information associated with user preference is used for targeted advertisements only, but social network platforms where such information is posted know just about everything about you. It is your own responsibility to evaluate what data you will keep private and what you will share.
In addition to personal information, smart entrepreneurs should focus on protecting sensitive business information, and this includes anything that might pose a risk to the company if discovered by competitors or the general public. Examples of this include the company’s trade secrets, financial data, acquisition plans, or customer information.
Finally, a key way to separate PII from other more public information is to establish whether an enforcement action is available in the event that a data breach occurs. If SSN, birthdate, credit card information is breached, for example, a person can be substantially harmed. Thus, they can file a complaint with the State Attorney General, the Federal Trade Commission (FTC), and also sue the wrongdoer for damages.
HOW SHOULD AN ENTREPRENEUR TAKE ACTION?
Do not borrow a policy from someone else's website. You may be held liable for copyright infringement or this policy may have no practical application to your business.
Do not draft the policy yourself, unless you are a professional. It may be very beneficial to hire an expert at writing policies within your industry.
Protecting Yourself and Your Company
Smart entrepreneurs should also focus on taking preventative measures now to protect personal and business data from a security breach. Even though organizations that you deal with have a duty to secure any data collected from you, it does not always happen because things can go wrong. You can, however, take steps to strengthen your own defenses against data breaches.
Here is a non-exhaustive list of data protection methods in alignment with FTC:
Use password protection for all business computers and devices and require employees to have unique user names and strong passwords that they change regularly (every three to four weeks is optimal).
In order to create strong, secure passwords, use uppercase and lowercase letters, special characters symbols, and random numbers. Use different passwords on different accounts.
Make sure your software and operating systems on computers and mobile devices are up to date. Install updates to operating systems and antivirus software as soon as possible.
Secure access to your network with firewalls, remote access through properly configured Virtual Private Networks, and Wi-Fi networks that are secure and encrypted.
Train your employees to ensure they understand your data protection practices and their importance.
Give your SSN and other sensitive data only when it is absolutely required.
Monitor credit reports at one, two, or all three of the major credit reporting agencies — Equifax, Experian, and Transunion.
If possible, use an identity protection service such as Identity Guard, Life Lock, or ID Shield.
Evaluating Whether a Breach Occurred
Even after taking precautionary measures to protect her data, an entrepreneur may wonder from time to time whether her information is secure. One option to alleviate stress associated with the threat of a potential data breach is participating in personalized data monitoring. Entrepreneurs can monitor their account balances, statements, and credit reports to ensure no one is trying to open an account under their name. Plus, organizations can ensure they have strong intrusion detection systems in place to identify unauthorized access into systems containing personal data. It is a reasonable practice to periodically check the website of a company you are doing business with to determine whether any data has been compromised. In most cases, U.S. based companies are obligated to notify their customers and other parties about a hacking incident, so data breaches are usually disclosed via a company press release to major media networks.
After its cyber security incident, Equifax offered its customers a free monitoring service called Trusted ID Premier. This program includes five separate offerings that allow users to monitor their credit files along with SSNs, freeze their credit reports, and search suspicious websites for user SSNs. While enrolling in the program, make sure you are on a secure computer and an encrypted network connection. Upon enrollment, the website will tell you if you have been affected by the Equifax breach. According to Equifax, customers who sign up for the credit-monitoring service do not waive their rights to take part in a class action lawsuit against them. If you are using Equifax, you may want to enroll in this program. You have until January 31, 2018 to register.
Here is a non-exhaustive list of actions to help determine whether a breach has occurred:
Check your credit report by visiting annualcreditreport.com
If you find suspicious activity on an account, visit IdentityTheft.gov. This is the government’s free resource for reporting and recovering from identity theft. The website will provide you with a personal, interactive recovery plan tailored to your individual needs.
Report all identity theft to the FTC.
Notify the IRS if you are a potential tax fraud victim.
Consider placing a credit freeze on your credit reports, which will make it harder for someone to open a new account in your name. This action will not, however, prevent a thief from making charges to your existing accounts.
Consider placing a fraud alert on your files. This will warn creditors that you may be an identity theft victim and require them to take precautions if someone seeks credit in your name.
Monitor your existing credit card and bank accounts closely for charges you don’t recognize.
Remember, regardless of your industry, securing sensitive information and complying with privacy regulations is now a top concern for everyone. The need to take proactive measures has never been greater for today's entrepreneur.
Are you a female entrepreneur in need of legal solutions to launch or grow a successful business enterprise? Parazim can help! Our mission is to elevate and champion the most effective, extraordinary, and powerful women in the world. Our breakthrough habitude of "women helping women" leads to invaluable resource sharing and building strong allies so every female is 100% empowered to reach her highest potential. Get connected today - email email@example.com or visit www.parazim.com for more information.
Harmony Oswald, Esq. is licensed to practice law in the state of California. She is the Founder and Managing Attorney at Parazim. To learn more about Harmony Oswald, Esq. and her 2017 leadership book for women click HERE. The above article does not create an attorney client relationship. It provides information only and should not and cannot be construed as legal advice. For more information, please contact firstname.lastname@example.org.