Major Target For Hackers In 2024 Is Your Retina Scans From Your Eye Doctor

If Your Password Is Stolen; Create a New One. What If Your Retina Scan or Fingerprint Is Stolen? Kiss Your Privacy Good-bye! Major Target For Hackers In 2024 Is Your Retina Scans From Your Eye Doctor

A retail store’s ability to authenticate customers by scanning their unique ear or retinal patterns may seem like something out of a sci-fi movie, but this type of identification technology isn’t fictional.

5 Questions To Ask Your Crypto-Currency Or Traditional Accountant About Their Cyber Security

OPM Director Katherine Archuleta Resigns After Massive Personnel Data Breach Including 5.6 Million Fingerprints

A Hospital Hit By Hackers, A Baby In Distress: The Case Of The First Alleged Ransomware Death

HCA Healthcare (11 Million) Patient Data Stolen And For Sale By Hackers

Pentagon Being Investigated For One Of The Most Dangerous Intelligence Breaches In Decades

SEC Hack Proves Bitcoin Has Better Data Security

Blockchain Storage Offers Security, Data Transparency And immutability. Get Over it!

Nostr Allows Bitcoiners To Build-Out A Decentralized, CENSORSHIP-RESISTANT Social-Media!!

It’s called biometric authentication, and it has grown in popularity as traditional username and password systems for identity protection have led to flaws in data privacy and security.

“Biometrics means moving away from [passwords and personal identification numbers] and using human-related characteristics, because physiological and behavioral patterns are unique to you as an individual and can be used as a better identifier,” Shiraz Saeed, practice leader in Starr Companies’ cyber risk division, said during a panel discussion at the 2018 PLUS Cyber Symposium held last week in Chicago, Ill.

Biometric authentication can include systems such as Apple Pay’s touch ID, Apple’s thumbprint technology, Microsoft Windows 10 and Apple facial recognition technology or even recorded typing rhythm or rhythm of voice.

If someone steals your retinal scan, how do you get that back?

However, in attempts to achieve greater security, is information privacy becoming an even bigger issue?

Major Target For Hackers In 2024 Is Your Retina Scans From Your Eye Doctor

CyberSecurity Newsflash!

During the panel, Saeed shared a quote from Barry Steinhardt, associate director of the American Civil Liberties Union, in which Steinhardt told The Washington Post, “We are quickly moving to the point where law enforcement and the private sector will be able to identify us no matter where we go, no matter how anonymous we think we are.”

This comes as digital identity, or the way personal information is stored and secured in order to verify someone, has in the past largely related to the use of usernames, passwords, social security numbers and PINs, which can be cracked or stolen.

“Right now, in a world where everybody has lots of usernames and passwords, I read a statistic recently that says roughly 80 or more percent of folks use the same password over and over again,” said Ross Nodurft, vice president and risk management leader at One World Identity, during the panel discussion.

Biometrics Risks

One current concept to improve this is the use of biometrics, added panel moderator David Cole, partner at Freeman Mathis & Gary.

As one example, Saeed explained that he recently called his bank to do a transaction, and the bank informed him it would record his voice to use as a personal identifier going forward.

“At first, you think, ‘Oh wow. That’s cool because my voice is unique to me,’” he said. “But that inherently becomes the first flaw, because is that a unique thing? It’s public, actually.”

He explained that if an individual’s retinas are being scanned somewhere, or if someone can get a copy of another person’s ear pattern or fingerprint, in reality, it isn’t private like a password or a PIN.

He added that in order to understand biometrics from a regulatory or insurance perspective, it needs to be viewed as private information no different from someone’s name or address.

“The question is: What is the long-term impact of this?” he said. “If you lose your password, you can make a new one quickly. If someone steals your retinal scan, how do you get that back? That’s a question now that we’re talking about from a legal perspective about scanning and emotional distress.”

He gave another example in which many years ago, news outlets reported a man in Malaysia had his thumb chopped off by thieves attempting to get around his Mercedes’ thumbprint scan in order to steal his vehicle.

“Just think about that and the impact and ramifications on your insurance policy because this is now the cause of action,” Saeed said. “Ultimately, private information was stolen; it’s just off of his thumb rather than a server.”

Nodurft pointed back to the OPM hack, in which the social security numbers of 21.5 million people were stolen from government background investigation databases, according to NPR.

“In addition to that, many fingerprints were stolen off of OPM’s files,” he said. “So there are real world incidents of biometric data being stolen, harvested and put into big data pools that can be drawn upon.”

One way to combat this is through the use of multimodal biometrics, in which more than one biometric solution is used to authenticate individuals, he added.

“If you need my fingerprint, then you need to scan my ear, then you need to scan my iris, that’s a lot more work,” Nodurft said. “The idea of layering all of these attributes on top of each other is one of the ways that the technology industry is progressing and trying to tackle the identity crisis.”

That said, Saeed added that just like every technology, he believes it’s a double-edged sword.

“…there’s technology involved, and with every technology, there’s some sort of error,” he said. “We have to be careful about how much of that information we want to be released and what limitations we have to put on government and the corporate sector to protect ourselves from exploitation.”

Current Regulatory Framework

Indeed, one risk factor for insurance companies with the use of biometrics is an impending onslaught of regulations to try to address the challenges, Cole said.

Some laws already in place require businesses or entities collecting biometric information to provide notice to each person about what they’re collecting, how it will be used and how long it will be stored. These businesses and entities also have to obtain written consent and adhere to rules regarding the destruction of the data.

In fact, Illinois was the first state to implement a law regarding biometric data with its Biometric Information Privacy Act, which imposes specific fines and penalties related to the storage and use of that information.

Currently, there are three state laws that have been passed to address the collection and use of biometrics in Illinois, Texas and Washington.

While Texas’ and Washington’s laws are enforceable by the Attorney General, Illinois provided a private cause of action under its statute for biometrics laws.

“Under the Illinois law, we’ve seen dozens of class action lawsuits filed against businesses for not properly obtaining consent,” Cole said.

He gave one example of a group of restaurants that were using time clocks for employees to clock in and out of work with their thumbprint.

“That was a collection of biometric data for which the plaintiffs alleged that the company had not properly obtained their consent or provided the necessary disclosures,” he said.

“I also do employment law, so I know these sort of time systems are a common thing, and it would be easy to trip up and make those kind of mistakes if you’re not aware of the rules of compliance with these laws.”

Other regulations currently in place involving biometric data include the Genetic Information Nondiscrimination Act, an employment discrimination statute that’s enforced by the Equal Employment Opportunity Commission and regulates the collection and storage of genetic information by employers.

It requires employers to maintain that information in confidence in a separate file, and it cannot be disclosed unless for law enforcement purposes.

The Family Educational and Privacy Rights Act also has restrictions on the disclosure of biometric information that schools and educational institutions may have on their students.

“Now, most recently what we’re seeing are the state data breach notification laws incorporating biometric data into the definition of personally identifiable information (PII),” Cole said.

“Originally, these statutes were written in a way that said PII includes your name in combination with your social security number, date of birth or government ID or account number.”

However, as biometric data continues to be implemented as a way of authenticating others to gain access to their information, it is now becoming a part of PII.

This means that if an individual’s identity is compromised by way of biometric data, it triggers a notice obligation in the same manner as a social security number being hacked or stolen out of a business’ or entity’s system.

Blockchain Solution?

In addition to biometrics, another proposed solution for storing and securing data regarding digital identification is blockchain technology.

This is because blockchain consists of a series of blocks of data, with a secure key established as the only key that will unlock each block, explained Peter L. Miller, president and CEO of The Institutes, during the panel discussion.

The use of a different key won’t work, and the key becomes invalid if there are attempts to change components of the block.

“That means it’s pretty difficult to hack a blockchain, because [everyone involved in the blockchain] has a copy of the key and would all know,” Miller said, adding that while bitcoin is the first use case for blockchain and is considered public, he believes the way businesses will utilize this technology in the future is through a hybrid blockchain.

In a hybrid blockchain, everyone involved in the network knows everyone else, each participant has to be admitted to the network, the rules are well-established and the truth of the information is set through a consensus algorithm so that data can be shared with confidence, he said.

“We believe in it so much that we created an alliance of insurance organizations, which is really to bring blockchain technology to our industry through a consortium,” he said.

“Banks have started one, and you’ll hear about blockchain consortiums starting, because blockchain is simply about sharing data.”

That said, Nodurft cautioned companies to be careful about how blockchain is being used.

“One reason you have to be careful is because garbage in, and garbage out. You are going to build up an identity that’s either private or it’s wrong,” he said.

“So you have to be careful about what’s going in during the initial creation and verification when using blockchain for identity.”

He explained that if an entity wants to create a currency or identity through a private blockchain with controlled permissions about who can see information on the distributed ledger, there is a risk of corruption at the onset.

A distributed ledger is a database held and updated by each participant in a large network, rather than through one central authority.

“While there is quality of consensus-based rules and distributed sharing of information, there’s also the risk of people who own it corrupting the blockchain before you even get started,” he said.

However, he stated he believes there are good use cases for blockchain, whether through identity, financial transactions or contracts.

“I think where we’re headed is being able to securely own who you are, interact with a trusted entity on the other side, and do so in a way that your data is secure throughout,” he said. “I think blockchain fits in with the ability to have those trusted interactions across large ecosystems with large groups of people in a way that is verifiable.”

He added that this technology can lead to more efficient workers in the economy as ecommerce is driving more people online, and it is underpinned by two basic levers: the identity of the person interacting at the beginning and end of the transaction, which can be a corporation or an individual, and the data that person is using, which is either being transferred, stored, owned or housed.

“I’m not completely anti-use of these distributed ledger technologies, I’m just cautious about when and where they’re used. They’re not the end-all-be-all of technology solutions,” he cautioned. “Just go in with eyes wide open.”

Updated: 10-24-2022

EyeMed Vision Care LLC’s $4.5 Million Cyber Fine Shows Need For Ramped-Up Security

Penalty is the latest multimillion-dollar settlement as New York set to propose new rules.

EyeMed Vision Care LLC’s $4.5 million settlement last week over a New York cybersecurity probe is the latest signal regulators are turning up the heat on financial-services firms.

The New York State Department of Financial Services last week said its investigation found the insurance firm broke state rules by failing to implement multifactor authentication for its email system and allowing nine employees to share login credentials to the affected mailbox.

“Had these controls been in place, the July 1, 2020, cybersecurity event could have been prevented or been limited in scope,” NYDFS said.

The penalty is the second the vision-insurance company drew in New York state this year over the incident, in which a hacker breached its email system and accessed data from more than 2 million customers, including children.

EyeMed didn’t respond to requests for comment. The company has committed to “changes to its policies, procedures, systems, and governance structures,” NYDFS said.

State and federal agencies have ramped up cybersecurity enforcement in recent years as hacks disabling critical infrastructure or exposing consumers’ personal information have increased.

Cincinnati-based EyeMed previously paid $600,000 to settle a separate inquiry by New York Attorney General Letitia James, whose investigation found the phishing attack allowed the attacker to access data such as names, Social Security numbers, and medical diagnoses and conditions.

Last week’s consent order, one of three multimillion-dollar cybersecurity settlements NYDFS has reached in recent months, comes as the agency prepares to propose regulatory updates that some cybersecurity experts expect within weeks.

Current rules require financial-services firms to bolster their cyber postures, conduct periodic risk assessments and submit annual compliance certifications to the agency.

NYDFS’s pre-proposal amendments published in July appear more prescriptive, suggesting companies install additional security measures such as password vaults to protect privileged login credentials, said Erez Liebermann, a partner at law firm Debevoise & Plimpton LLP.

The eventual updates, coupled with pending federal regulations from the Securities and Exchange Commission, could push top executives to take a more active role in managing security, he said.

“It is raising and raising the accountability for cybersecurity to the C-suite and to the board,” Mr. Liebermann said.

Violating NYDFS cyber rules has been costly for some companies.

In August, the cryptocurrency trading unit of online brokerage Robinhood Markets Inc. paid $30 million to settle a probe over alleged violations such as an improperly staffed cyber team and inefficiently detailed security procedures.

Robinhood said at the time that it had made “significant progress” in improving such measures.

Cruise Operator Carnival

Corp. and its subsidiaries agreed in June to pay NYDFS $5 million after the regulator found several security lapses related to four cyber incidents between 2019 and 2021, including two ransomware attacks. The company, which falls under NYDFS’ purview because it is licensed to sell insurance, declined to comment.

At EyeMed, company officials failed to conduct a risk assessment as required by New York state, rendering invalid the company’s cybersecurity certifications with NYDFS from 2018 to 2021, the regulator said.

As part of a consent order, the company must conduct a risk assessment within 180 days and within 60 days thereafter submit a plan for how it will improve its security measures.

Major Target For Hackers In 2024 Is Your Retina Scans From Your Eye Doctor

Related:

Related Articles:

Vast Troves of Classified Info Undermine National Security, Spy Chief Says

Your Questions And Comments Are Greatly Appreciated.

Leave a Reply Cancel reply