Making the move to using location-based analytics can be a big decision for your business.

On one hand, using this technology can unlock powerful insights.

Knowing how people move through your facility, how long they are there, and where they came from provides you with critical information to improve the customer experience and become more efficent in your operations.

On the other hand, tracking your customers’ movements can open your business up a whole new set of decisions about how to use and collect user data.

With new regulations about consumer data privacy, knowing what’s allowed — and what’s right — when it comes to collecting data can be confusing.

By opting to use A2 Analytics from Archetype SC, for location-based tracking and insights you can avoid these concerns. Here’s a look at how our technology compares to most when it comes to data privacy:

How most technologies use data

Whenever a consumer downloads a new app or signs up for a service, businesses put terms and conditions in place to cover all their bases in a legal sense.

For many applications and technologies, this giant wall of text states that the consumer will have data entrusted to the company, including some Personally Identifiable Information (PII) that the company owns and can do with it what they want.

Most consumers breeze right through the terms and conditions, scrolling to click “Agree” without taking the time to fully understand what they’re subjected to in exchange for the service.

Because the company owns their data, these consumers may have PII, location data, or anything gleaned from their device sold by the service they use.

How data privacy is changing

With regulations like GDPR and the California Consumer Privacy Act going into efffect in recent years, consumers are more in tune than ever with how companies use their data.

For businesses not in compliance, there are heavy penalties and sanctions that force the issue of data privacy to be at the forefront of dealings with consumers.

Thanks to these actions, users are becoming more likely opt out of having their data shared, and are now aware that they have the right to see what a company has done with their information.

Even as businesses move to update privacy policies and introduce more transparency in their data usage, many — including those in the location-based tracking space — have been slow to adapt.

How A2 Analytics handles data privacy

A2 Analytics uses passive sensors to pinpoint devices within a given area, but does not capture any Personally Identifiable Information (PII) in the process.

Using location data, combined with cloud computing and machine-learning algorythms, A2 Analytics gives a holistic look at the movement of people via the signals put off by their devices.

It cannot, however, capture information like phone numbers, contact information, or any other associated information about the owner of the signal.

Because A2 Analytics uses anonymized data, it is able to provide insights about the movement of individuals in a facility without the need for opt-in or an app on the users devices. This allows for higher capture rates, typically above 85% of all individuals in the space.

This high capture rate allows for highly accurate information about your space with minimal impact on an audience.

Cybersecurity incidents, like data breaches or ransomware attacks, have impacted nearly every industry. Hospitals, colleges, even city governments have fallen victim to cyber-attacks, many occurring because of a simple vulnerability that was exploited by a hacker.

There is a ransomware attack every 14 seconds. With more than 1 billion U.S. passengers traveling through airports in 2019, your network is open for business, to both good and bad actors.

How can your airport do more to beef up its cybersecurity measures to help keep cybercriminals at bay?

Vet your vendors (and airlines!)

While you may have control of the cybersecurity measures within your staff, you probably have less influence over your vendors and airlines using your facility. Whether it’s a concessionaire or the largest airline in the world, vetting those outside sources to ensure they’re not introducing cybersecurity vulnerabilities to your airport is a critical step in the onboarding process – and should be done regularly to ensure standards are maintained.

One of the most prolific data breaches to date, the Target breach of 2013, occurred due to a third-party vendor introducing a vulnerability, which led to 70 million stolen records and a 46 percent drop in profits for Target.

Controlling the Airport of Things

With the boom in connected devices and the expectation from passengers that those devices will work end-to-end on their travels, more opportunities for network intrusion exist than ever before.

Combining the need for connectivity with the increasingly sophisticated tools cybercriminals deploy could spell disaster for your facility. With more travelers using your systems and introducing vulnerabilities, the systems you need for daily operations, like access and departure control and security cameras, could be at risk of downtime or being hacked.

The aviation industry utilizes complex infrastructure with integrations into a number of systems that require constant protection. Introducing vulnerabilities from the outside, or via insider threat, could put your airport on lockdown.

Perform regular Vulerability Assessments

Archetype SC’s Security Risk and Vulnerability Assessment (SRVA), is a tool that uncovers network vulnerabilities that could be exploited by a cybercriminal, allowing your organization to take a proactive approach to its cybersecurity. SRVA allows our security experts to look at your network as a hacker would see it, finding areas that are susceptible to attack.

A SRVA is a multi-pronged approach to vulnerability scanning, consisting of an internal scan, external scan, interviews with key staff, and qualitative assessment of your security posture. Combining these elements into a deliverable report broken down by severity provides your airport with a remediation plan to shore up areas of weakness.

Our current global health situation and resulting efforts to slow the spread has resulted in an unprecedented number of people working remotely. Technology is a great enabler to allow us to continue to be productive, but remote work presents new challenges and risks that need to be considered.

Cybercriminals are presented with millions of new targets, and users don’t have the ability to simply walk over and ask IT what to do in a situation.

Archetype SC is proud to offer a free consultation to help your business determine what tools, policies, and procedures your business needs to make it through the current situation.

To help with the transition, we have compiled a list of tools we use or recommend for making remote work easier and less risky from a cybersecurity perspective. As an added benefit, many of the tools have special offers in place to help you get started fast.

Note: Each month, the security experts at Archetype SC chime in on trending stories in cybersecurity to help you stay in the know about how to stay safe in your business and in your daily life. For more updates on cybersecurity news as it happens, follow us on LinkedIn, Facebook or Twitter.

Taking advantage of the panic around the Coronavirus is just the next step for cybercriminals.

Coronavirus-themed domain names are 50% more likely to be malicious and have already infiltrated some notable organizations, including Johns Hopkins University, with a tracking map to follow the spread of the virus. The map features a downloadable-link that is compromised and will infect users with malware.

Similarly to the hand-washing information given out by medical professionals, cybersecurity experts are stressing the importance of following best practices for what users click, download, and visit online.

As the spread of the Coronavirus cancels more events and prevents large crowds from gathering, it may also force employees to work from home. Doing so for physical safety and security is important, but could also open up your business network to cybersecurity issues.

Since the World Health Organization classified COVID-19 as a pandemic, businesses, including Google, have moved to remote work. For a tech giant, this move is easy, as employees are set up to work remote on a regular basis and have contingencies in place.

For traditional businesses that work strictly from an office environment, the change could expose critical business data to cybercriminals.

Putting multi-factor authentication in place to ensure correct access, refreshing your company’s phishing training, and implementing network standards for employees’ home networks should all be done before rolling out a remote option.

A pair of cybersecurity employees that attended RSA Conference 2020 in February have tested positive for the Coronavirus, or COVID-19.

Both employees worked for Exabeam Inc., a California based SIEM provider. One of the individuals lives in Connecticut and began experiencing symptoms soon after leaving the conference, leading to his hospitalization.

Information about the other individual is unknown.

“While we cannot confirm whether they contracted COVID-19 prior to, at or after the conference, if you came into contact with our staff, please be vigilant in monitoring yourself for symptoms,” Exabeam said in a release.

The RSA Conference draws more than 35,000 individuals to the San Francisco area where cybersecurity is at the crux of discussion. This year, many organizations opted not to send employees to the conference or to refrain from shaking hands.

Small businesses are the target of cyber attacks.

In terms of preparation, this may be news for some business owners.

In 2019, 58% of cyber attack victims were businesses with fewer than 250 employees or small businesses. Often, small businesses find themselves broiled in cyber attacks because of a “too small” mentality. Many business owners think they are too small to fall victim to a data breach and have budgets that are too small to combat the problem.

As data breaches and hacks have advanced, so has the need for proper security measures to protect business data.

• The problem: Human error accounts for 25% of data breaches and represents one of the largest weaknesses in security for most businesses.
• The solution: Regular training to recognize ransomware, phishing, and general security protocols are critical in the “all hands on deck” approach to security employed by small businesses.

• The problem: Poor passwords create one of the largest vulnerabilities for businesses, as more than 70% of passwords are recycled from other accounts.
• The solution: Implementing multi-factor authentication protects accounts by requiring more than just login credentials. Using a text message, tokens, or biometrics adds an additional layer of security to accounts.

• The Problem: There were 10.5 billion malware attacks in 2018; antivirus software detects over 350,000 pieces of malware daily.
• The Solution: Antivirus software has been around for a long time but is still effective. While no antivirus software is 100% effective, having a platform in place can help detect and prevent malicious attacks.

• The Problem: Ransomware attacks lock your data and demand money, with companies paying an average of $84,116 to recover data in Q4 2019.
• The Solution: Backing up your data from devices and the cloud locally and to an off-site server will protect your business from potential ransomware and system crashes.

• The Problem: More than 80% of organizations do not have a plan for privileged access management, leading to double to breaches.
• The Solution: Ensuring the data that runs your business is not open to all employees by using identity and access management technologies will mitigate risk when a data breach occurs.
  Critical business data should not be accessible to all employees.

• The Problem: 68% of data breaches take months, not days, to uncover for businesses, creating a larger impact and more expensive recovery.
• The Solution: Network monitoring tracks the entire IT infrastructure of an organization, providing an early warning system of potential threats.

• The Problem: More than 60% of companies have experienced some form of data breach over the past two years, making it a when not if scenario for most businesses.
• The Solution: Creating an incident response plan organizes your employees to help recover from a breach and return to normal working conditions.

• The Problem: One in every three data breaches is the result of a vulnerability that should have been patched.
• The Solution: A vulnerability assessment can provide your organization with the knowledge of how a hacker would gain access to your network, giving you a head start to shoring up issues before they are exploited.

---

---

---

---

---

In late February, two cybersecurity researchers happened upon one of the largest non-password protected email databases on the web.

Bob Diachenko and Vinny Troia of the website SecurityDiscovery.com, found the online database of email addresses and personal information with more than 150GB of data, totaling over 800 million records with limited-to-no security. Their astounding find rooted back to the email validation service company Verifications.io.

In the database, Verifications.io had three folders titled "businessLeads," "Emailrecords," and "emailWithPhone," with each making up millions of records. "Emailrecords" had nearly 800 million alone, while the other two folders had more than 4 million and 6 million, respectively. In addition to email addresses, "Emailrecords" also contained zip codes, phone numbers, addresses, gender, and date of birth information.

Diachenko alerted Verifications.io of the breach via a ticket on the company's website, which prompted the removal of the database from the web and a response from the company stating no personally identifiable information had been included in the records.

Verifications.io is an email validation service for marketing companies, which works by keeping records of deliverable emails and vetting addresses against a company's email list. The service will send an email to an address to see if it will be delivered or bounce back, then keep a record of active addresses for companies to utilize with marketing email campaigns. These services keep marketing companies from being flagged as spam by sending multiple emails in a short timeframe.

Protecting your email address is as simple as routinely changing the account password with a strong credential, using a secure email service, and selecting obscure (or false) information about yourself for security questions.

If you have concerns around business email security, contact Archetype SC's security team to set up a consultation for SRVA, our security assessment tool that can scan your network for vulnerabilities that could be exploited by cybercriminals.