Monthly Archives: March 2023

Personal Identifiable Information (PII) is defined as: Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.

Personally identifiable information (PII) is information that, when used alone or with other relevant data, can identify an individual.

PII may contain direct identifiers (e.g., passport information) that can identify a person uniquely, or quasi-identifiers (e.g., race) that can be combined with other quasi-identifiers (e.g., date of birth) to successfully recognize an individual.

Understanding Personally Identifiable Information

Advancing technology platforms have changed the way businesses operate, governments legislate, and individuals relate. With digital tools like cell phones, the Internet, e-commerce, and social media, there has been an explosion in the supply of all kinds of data.

Big data, as it is called, is being collected, analyzed, and processed by businesses and shared with other companies. The wealth of information provided by big data has enabled companies to gain insight into how to better interact with customers.
However, the emergence of big data has also increased the number of data breaches and cyberattacks by entities who realize the value of this information. As a result, concerns have been raised over how companies handle the sensitive information of their consumers. Regulatory bodies are seeking new laws to protect the data of consumers, while users are looking for more anonymous ways to stay digital.

Sensitive vs. Non-Sensitive Personally Identifiable Information

Sensitive PII

Personally identifiable information (PII) can be sensitive or non-sensitive. Sensitive personal information includes legal statistics such as:

• Full name
• Social Security Number (SSN)
• Driver’s license
• Mailing address
• Credit card information
• Passport information
• Financial information
• Medical records

The above list is by no means exhaustive. Companies that share data about their clients normally use anonymization techniques to encrypt and obfuscate the PII, so it is received in a non-personally identifiable form. An insurance company that shares its clients’ information with a marketing company will mask the sensitive PII included in the data and leave only information related to the marketing company’s goal.

Non-Sensitive PII

Non-sensitive or indirect PII is easily accessible from public sources like phonebooks, the Internet, and corporate directories. Examples of non-sensitive or indirect PII include:

• Zip code
• Race
• Gender
• Date of birth
• Place of birth
• Religion

The above list contains quasi-identifiers and examples of non-sensitive information that can be released to the public. This type of information cannot be used alone to determine an individual’s identity.

However, non-sensitive information, although not delicate, is linkable. This means that non-sensitive data, when used with other personal linkable information, can reveal the identity of an individual. De-anonymization and re-identification techniques tend to be successful when multiple sets of quasi-identifiers are pieced together and can be used to distinguish one person from another.

Safeguarding Personally Identifiable Information (PII)

Multiple data protection laws have been adopted by various countries to create guidelines for companies that gather, store, and share the personal information of clients. Some of the basic principles outlined by these laws state that some sensitive information should not be collected unless for extreme situations.

Also, regulatory guidelines stipulate that data should be deleted if no longer needed for its stated purpose, and personal information should not be shared with sources that cannot guarantee its protection.

Cybercriminals breach data systems to access PII, which is then sold to willing buyers in underground digital marketplaces. For example, in 2015, the IRS suffered a data breach leading to the theft of more than a hundred thousand taxpayers’ PII.

Using quasi-information stolen from multiple sources, the perpetrators were able to access an IRS website application by answering personal verification questions that should have been privy to the taxpayers only.

How PII Is Stolen

Many thieves find PII of unsuspecting victims by digging through their trash for unopened mail. This can provide them with a person’s name and address. In some cases, it can also reveal information about their employment, banking relationships, or even their social security numbers.
Nowadays, the Internet has become a major vector for identity theft. Phishing and social engineeringattacks use a deceptive-looking website or email to trick someone into revealing key information, such as their name, bank account numbers, passwords, or social security number. It is also possible to steal this information through deceptive phone calls or SMS messages.

Tips on Protecting PII

While it is not possible to fully protect yourself, you can make yourself a smaller target by reducing the opportunities to steal your PII. Experian, one of the top three credit agencies, lists several steps that you can take to reduce your surface area.
For example, a locked mailbox or PO box makes it harder for thieves to steal your mail and removing personal identification from junk mail and other documents makes it harder for identity thieves to associate a name with an address. Also, avoid carrying more PII than you need—there’s no reason to keep your social security card in your wallet.
Likewise, there are some steps you can take to prevent online identity theft. Data leaks are a major source of identity theft, so it is important to use a different, complex password for each online account. Always encrypt your important data, and use a password for each phone or device. It is also a good idea to reformat your hard drive whenever you sell or donate a computer.

Hackers harvest, weaponize and sell corporate and personal passwords in order to obtain financial reward, damage reputations, steal intellectual property, or for other illegal undertakings. According to cyber security researchers, 80% of hacks involve the theft or reuse of employee passwords.

This is in no small part due to lack of employee education and corporate negligence. Within your organization, advocate for a concerted, company-wide effort around password security and password protection. Here’s how. Share the following password best practices with your peers, clients and prospects.

Password security best practices for everyone

This list starts with password fundamentals that most people are acquainted with and gradually transitions into more sophisticated password security best practices.

1. Passwords should be 8-12 characters long. Use a mix of letters, numbers, and symbols.
2. Vary with upper case and lower case letters (in applicable languages).
3. Avoid recycling the same password across multiple accounts.
4. After 90 days, rotate passwords.
5. Consider a password manager. Password managers function as digital books of passwords, locked by a master key. If a cloud-based password manager sounds eerie, consider using a local password storage program on your computer (Roboform or PasswordSafe).
6. Prioritize longer passwords. The longer the password, the stronger the password.
7. Avoid using real words within passwords, as hackers can deploy dictionary attacks, which systematically throw every word in the dictionary against an account’s login portal.
8. Complicate your answers to password security questions; avoid using the name of your spouse, children, relatives or pets, as these answers can often be found on your social media profile or elsewhere online.
9. Check to see whether or not your passwords have previously been stolen. You can use Mozilla’s Firefox Monitor and Google’s Password Checkup tool to determine which of your email addresses and passwords have been compromised in a data breach. Have I Been Pwned is another good password checker option.
10. Secure your phone with a strong password, fingerprint or facial recognition software.

Password security best practices for IT teams

1. Limit incorrect login attempts to 5 or fewer.
2. Allow passwords to be 64 characters long or longer, rather than limiting the length to 10 characters.
3. Apply password encryption. Password encryption offers additional protection.
4. Implement multi-factor authentication. Multi-factor or two-factor authentication prevents hackers from accessing your portals or network after cracking simple passwords.
5. Deploy privileged access management software for employees with access to sensitive data.
6. Ensure that your organization uses up-to-date anti-malware and vulnerability management solutions.
7. Adopt the practice of changing corporate account passwords after an employee leaves the enterprise.
8. Avoid accessing accounts as ‘root’ or ‘administrator.’ Use your own login and switch user (SUDO) or “run as” in order to execute administration commands.
9. Consider disabling root login.Establish password audits. Track your employees’ compliance with the organization’s password security policy. An audit will monitor password modifications in order to ensure compliance. It will also highlight and correct weak access points.
10. Send employees password best practices reminders. Employees usually have good intentions, but may forget to update passwords, or to otherwise comply with an organization’s password policy. Send employees email notifications reminding them of policies, best practices and the need to rotate passwords ahead of their expiration.

In summary

The stakes are high and the security risks are real. With a compromised password, a hacker could instantly halt your business’s productivity, sink profits, crash your stock price, and engender real-world harm.

Applying password security best practices is as much a choice as locking the doors at night. Keep your people, processes, technologies, partners, clients and IP secure by ensuring that everyone puts password security best practices into action.

Operationalizing behavioral changes can be tough for employees and IT teams alike. But the rewards are worth it and portend to a bright future.

What is Passwordless Authentication?

Passwordless Authentication is an authentication method that allows a user to gain access to an application or IT system without entering a password or answering security questions. Instead, the user provides some other form of evidence such as a fingerprint, proximity badge, or hardware token code. Passwordless Authentication is often used in conjunction with Multi-Factor Authentication (MFA) and Single Sign-On solutions to improve the user experience, strengthen security, and reduce IT operations expense and complexity.

The Problem with Passwords

Today’s digital workers rely on a wide variety of applications to perform their jobs. Users are forced to memorize and track a dizzying array of frequently changing passwords. Overwhelmed by password sprawl, many users take risky shortcuts like using the same password for all applications, using weak passwords, repeating passwords, or posting passwords on sticky notes. Bad actors can take advantage of lax password management practices to mount cyberattacks and steal confidential data. In fact, compromised account credentials are a leading cause of data breaches.

Simple authentication methods that require only username and password combinations are inherently vulnerable. Attackers can guess or steal credentials and gain access to sensitive information and IT systems using a variety of techniques, including:

• Brute force methods – using programs to generate random username/password combinations or exploit common weak passwords like 123456
• Credential stuffing – using stolen or leaked credentials from one account to gain access to other accounts (people often use the same username/password combination for many accounts)
• Phishing – using bogus emails or text messages to trick a victim into replying with their credentials
• Keylogging – installing malware on a computer to capture username/password keystrokes
• Man-in-the-middle attacks – intercepting communications streams (over public WiFi, for example) and replaying credentials

Passwordless Authentication Reduces Risk and Improves User Satisfaction

Passwordless Authentication strengthens security by eliminating risky password management practices and reducing attack vectors. It also improves user experiences by eliminating password and secrets fatigue. With Passwordless Authentication, there are no passwords to memorize or security question answers to remember. Users can conveniently and securely access applications and services using other authentication methods such as:

• Proximity badges, physical tokens, or USB devices (FIDO2-compliant keys)
• Software tokens or certificates
• Fingerprint, voice or facial recognition, or retina scanning
• A mobile phone application

Passwordless Authentication is typically deployed in conjunction with Single Sign-On, so an employee can use the same proximity badge, security token, or mobile app to access all their enterprise applications and services. Passwordless Authentication is also often used as part of a Multi-Factor Authentication solution, where users are forced to provide multiple forms of evidence to gain access to enterprise applications and systems. For example, to access a mobile phone app, a remote user might be required to tap a fingerprint sensor and enter a one-time, short-lived SMS code sent to their phone.

The latest MFA solutions support adaptive authentication methods, using contextual information (location, time-of-day, IP address, device type, etc.) and business rules to determine which authentication factors to apply to a particular user in a specific situation. Adaptive MFA balances convenience with security. For example, an employee accessing an enterprise application from a trusted home computer might be required to provide only one form of authentication. But to access the application from a foreign country over an untrusted WiFi connection, the user might also have to enter an SMS code.

Passwordless Authentication Benefits

Passwordless Authentication provides a variety of functional and business benefits. It helps organizations:

• Improve user experiences – by eliminating password and secrets fatigue, and providing unified access to all applications and services.
• Strengthen security – by eliminating risky password management techniques and reducing credential theft and impersonation
• Simplify IT operations – by eliminating the n.eed to issue, secure, rotate, reset, and manage passwords.

What is OwnID?

Rooly Eliezerov is a serial entrepreneur in the digital identity space, currently the Co-founder of OwnID, the passwordless identity platform. Prior to OwnID, Rooly co-founded Gigya, which was acquired by SAP. Gigya leads the Customer Identity and Access Management (CIAM) market, managing over a billion digital identities for the largest organizations in the world. The book ‘The Digital Identity Crisis’ by Rooly Eliezerov was published by Wiley and Sons in March 2018.

In this superb interview, co-founder of OwnID, Rooly Eliezerov, provides a behind-the-scenes look at his new, innovative startup’s smartphone-based, biometric passwordless authentication technology. OwnID aims to transform how people log into their accounts, and to drive advances in the digital identity ownership arena.

Decentralized solutions like OwnID pave the way towards a self-sovereign identity and hyper-personalized user experiences. Discover how the identity management landscape is evolving, and see what the future might hold.

Tell us about the OwnID story

Dor and I, the founders of OwnID, are part of the founding team of Gigya, the Customer Identity and Access Management (CIAM) platform that was acquired by SAP in 2017 for $350 million. After the acquisition we felt that identity management is an unfinished business and that there needs to be a more transformational approach to identity. We joined forces with some other bright minds from Gigya and raised our seed round with the main Gigya investor Mayfield. So, the band is back together for Act 2.

Why biometrics as opposed to another sign-in methodology?

Our concept is that ‘the phone is the key’. In the same way my phone can unlock my car and house door, it can unlock anything else digital. Fortunately, phones are locked with a secure biometric mechanism, and therefore what we have here is frictionless Two Factor Authentication (something you have + something you are). We believe it’s much better than old school auth mechanisms like magic links, SMS code and definitely a password. Better means: easier to use and more secure.

Tell us about the technology behind the product?

We are utilizing WebAuthn and FIDO2. Therefore, our product is completely web based. It enables websites accessing the lock mechanism of the user’s phone (both iPhone and Android). But our product goes beyond the core technology. It addresses many use cases (e.g. phone temporarily not available, phone is lost, phone doesn’t support biometrics, user already has an account with a password etc.)

How do organizations add passwordless to their customer identity processes?

A big advantage of OwnID is the ease of implementation. OwnID is an add-on to a given site’s existing system. Sites that wish to add OwnID’s passwordless can keep their existing registration and login forms, and just add the OwnID button side by side with their password field, which enables the users to authenticate using their phone’s biometrics. If user is browsing their desktop or any other device, when clicking this button, a QR code will be presented, the user will scan it with their phone which will prompt their phone’s FaceID/fingerprint, and the desktop will be logged in.

What impact is the OwnID technology having?

Many more users register and login when they can do it with their phone biometrics. It’s just easier. See how it’s done on Nestle and Delonghi. These two of OwnID’s largest clients report an increase in both registrations and logins to their sites and are constantly deploying OwnID to additional properties around the globe.

What key principles do you think about in protecting your users’ data?

Our key principle is: don’t keep data in a single place, but rather, distribute it. Therefore, we don’t store any user data in our database. We don’t even have a user data base. Our technology keeps the user auth keys on the user’s phone. We place a public key for each user in the database of the website we are serving, and we match a signature that is generated by the user’s phone to the public key. For each website the user has different keys.

What business insights would you like to share with other business leaders?

Our business approach is adoption driven. We believe that elegant solutions are not enough. As a matter of fact, our product strategy is strongly influenced by the go-to-market strategy. This is why we chose to offer our solution as an add-on and not a reap-and-replace solution. We also believe in making everything as frictionless as possible – frictionless for the end-user, frictionless for the developer and frictionless even for the business decision maker. Whatever you offer should be the most sensible thing to do across all parties.

Your perspectives on the future of identity management?

In 2018, Wiley published a book I wrote titled ‘The Digital Identity Crisis’ where I cover all aspects of digital identity and where I think it’s headed. My conclusion is that personal data will continue to expand and create value, but to keep it private we’ll need to have a mechanism that enables each individual to be the owner of their digital identity, so each of us controls and knows exactly how her or his data is being used.