Airports are often in the news for flight delays, long lines, and unruly passengers, not for cybersecurity incidents. When hacks and data breaches occur, they often have a big impact and affect many passengers.

How are facilities that move hundreds of millions of individuals from location to location protecting the precious data provided by passengers?

97% of global airports have security issues

In a study of the 100 largest airports in the world, ImmuniWeb found that 97 have major issues ranging from vulnerabilities in applications to exposure on the Dark Web. Testing using freely available online tools like SSL security and mobile application tests shows that these large airports are vulnerable and can be exploited by a novice hacker.

Foreign airports are taking security seriously

While ransomware and other cybersecurity issues have taken municipalities, schools, and hospitals by storm, many international airports have worked diligently to create an environment of cybersecurity. Israel’s Airports Authority blocks more than 3 million attempted system breaches each day and has created a security operation center (SOC) to help combat the issues.

U.S. based airports are susceptible to incidents

Over the past year, U.S. airports have faced cybersecurity incidents, including a hack of the U.S. Customs system. In August, a nationwide outage that impacted the processing of international travelers was linked to a cyberattack, but an attack was never confirmed by the agency. The outage delayed flights and caused long wait times at security checkpoints around the country.

Atlanta’s Hartsfield-Jackson International Airport took a proactive approach when the city was embroiled in a ransomware attack in 2018, shutting off the public Wi-Fi to prevent the spread of malicious software. The busiest airport in the world in terms of passenger traffic, Hartsfield-Jackson International Airport’s staff took the precaution to protect its data.

Both instances show how a cyber attack, or just the threat of an attack, can impact domestic airports and government agencies.

---

---

---

---

---

In the world of cybersecurity, antivirus is often seen as the first line of defense to prevent, detect, and remove malware from endpoints. While the job of antivirus is pretty straightforward, there are many options to serve this purpose for personal and business users.

From PC Protect to McAfee, the market is flooded with software options, but only one company is wholly created in the United States — PC Matic.

Starting in the research and development phase and moving to implementation and support, PC Matic is all-U.S. based and has been since its inception in 1999. Starting as PC Pitstop and morphing into PC Matic, the company began as a computer performance forum and found its footing in cyber threat prevention.

Today, PC Matic is used for personal computers, businesses, and in the government to provide antivirus and ransomware prevention to millions of endpoints across the globe.

What can PC Matic do?

Within its offerings, PC Matic has three consumer products and enterprise products to fit the needs of businesses. On the consumer side, PC Matic offers its flagship product, PC Matic, along with PC Magnum and Optimize.

PC Matic is the standard security product, providing malware and ransomware protection. PC Magnum helps keep private files and data from falling into the wrong hands by scanning, cleaning, and removing caches, cookies, histories, and downloads. Optimize is a new and improved version of the former PC Pitstop technology, which is designed to improve computer performance.

In its enterprise offerings, PC Matic PRO offers cloud-based endpoint security and remote management with real-time whitelisting to block unwanted and unsafe programs from working on your machines. More than 100,000 businesses trust PC Matic PRO, which has scanned over 100 million applications and PCs with its technology.

What does PC Matic PRO provide for businesses?

PC Matix PRO offers a complete solution for businesses, using whitelisting, patch management, and traditional anti-malware protection and cleaning. Its whitelist keeps businesses secure by using real-time updates to deny access to any blacklisted programs.

In extensive testing, the PC Matic PRO whitelist has produced 99.99% good file accuracy and blocks more unique and old threats than blacklists and heuristic detection. In addition, proactive whitelist technology is a strong opponent to ransomware, as it is the only solution to completely block ransomware before it can encrypt business data.

Why use PC Matic?

As an antivirus and antimalware solution, PC Matic has brought home numerous awards as a market leader, most innovative product, editor’s choice, ransomware prevention, and cyber defense awards.

In a crowded market, PC Matic has garnered excellent reviews from PC Mag, CNET.de, and PC Magazine. It has been called “an effective antivirus and system optimization tool. It did quite a good job in my malware-blocking test,” by PC Mag.

PC News Magazine said, “With PC Matic, you never have to worry about performance, speed, and maintenance of your PC ever again as it handles it all.”

Since the very first product transaction, customer information has been a valuable commodity.

Today we understand that personal information — so much more than we ever dreamed — IS the product for sale. Everything we do and every place we go can be captured and sold.

Information is so valuable, in fact, that it is targeted each and every day by bad actors with bad intentions.

For evidence of how common compromised personal information has become, look at HaveIBeenPwned.com, which has recorded more than 9.3 billion accounts exposed in the past 6 years (2 billion in 2019 alone).

But despite the overwhelming reality of the figures we face, many continue to misunderstand the vast risk landscape and the very definition of what it means to be targeted.

Whether it’s the innumerable accounts and profiles we need to function in today’s society, the third-parties encouraging us to share our locations, create digital libraries and offer up our DNA or just the need to access free Wi-Fi and charge our devices in public places, our data is at risk all day, every day.

Some people simply succumb to the belief that defense is futile, and they likely have already been exposed, while others fumble with a lack of knowledge on how to protect themselves. But regardless of whether you choose to fight it or ignore it, the truth is that the risks are VERY real.

Perhaps nowhere are these risks more evident than for employers trying to deal with their employees’ poor habits when it comes to cybersecurity.

No matter how much time and money is dedicated to systems and software, if human behavior is ignored, the problem will not only persist, it will intensify.

Here are some of the growing number of signs that the link bewteen individual behavior and cybersecurity is growing for 2020 and beyond:

We’re moving on from 2019 and are saying goodbye to a decade that saw some of the largest cyber attacks on record, the rise of the Internet of Things, and ever-expanding budgets needed to stay out front of new cybersecurity threats like ransomware.

Looking forward, the year 2020 and the decade it kicks off sees the world of cybersecurity in a period of transition. As security incidents, breaches, and hacks garner more attention around the globe, awareness of cyber crime is at an all-time high. Businesses, governments, and other enterprises are beginning to ask the right questions about cybersecurity to begin proactive defense, rather than reacting following a security incident occurs close to home.

Kicking off the Year of the Rat, we anticipate that the cybersecurity world will still have to battle with ransomware, data privacy will become a much larger issue in the U.S., and data breaches will rock the headlines once again.

Ransomware will continue to expand

Ransomware took the world by storm in 2019, with attacks on government agencies, hospitals, colleges, and a wealth of other industries dotting the headlines. Municipalities like Albany, NY and Baltimore, Md. were hit individually, while more than 20 towns in Texas and multiple Florida cities paid out large sums, from hundreds of thousands of dollars into the millions, to regain access to their systems and data last year.

Cybercriminals won’t stray from what works, so expect even more ransomware attacks in 2020 – and not just large scale businesses. As governments and large enterprise begin to craft plans to prevent ransomware in their ranks, cyber criminals will begin to look at other vulnerable businesses. While the six-figure payout of a larger corporation is a great reward, there are plenty of “small fish” that are just as attractive as targets of cyber criminals.

Data privacy takes center stage

The California Consumer Privacy Act represents a radical shift in how companies deal with consumer data in the United States. With the new regulations, which go in place on New Year’s Day and will be enforced starting July 1st, companies must be more transparent with what consumer data they gather, how it is stored, and make “reasonable” efforts to maintain security measures.

Adherance with CCPA regulations will be buzzworthy early in 2020, as companies move to update privacy policies to reflect the new standards.

Read this blog for more information on CCPA.

Traditional passwords will begin to phase out

Passwords are an easy target for hackers, mostly due to the human element. People don’t want to create multiple complex passwords using a unique combination of letters, numbers, and characters. Passwordless authentication will be the next fad in the password world, replacing multi-factor authentication as the next buzzphrase.

Passwordless authentication can be made up of a variety of things, from hardware tokens to biometric authentication. One thing is for sure with the future of passwords – removing the human element will help secure the practice.

Third-party vendors cause multiple large data breaches for major corporations

This one feels more obvious than anything, as third-party vendors have caused some of the largest data breaches in history. Year after year, major data breaches happen because of vulnerabilities introduced by third-party vendors, yet major corporations continue to do a poor job of vetting their vendors.

According to the Ponemon Institute, third-party vendors account for more than 50% of all data breaches and a breach caused by an outside entity costs twice as much as an internally sourced breach.

In 2020, taking the time to vet your vendors and factoring their cybersecurity shortcomings into your risk assessment will be critical to keeping your name from the breach headlines.

With every passing year, society becomes more and more reliant on technology and we share an increasing amount of our personal data online. Of course, this means that now more than ever that you should be wary of how your data is being handled and that the need for secure networks and applications is at its peak.

As we are rapidly approach the end of the year — and the decade — we’d like to take a minute and look back at a few of the big stories that have dominated the conversation in the cybersecurity industry this year. From data breaches and new privacy laws to ransomware at the local government level and supply chain attacks here’s a look back at what made 2019 in cybersecurity such an interesting year.

1. Data breaches cause havoc

Again in 2019, a number of data breaches made news, both due to the high-profile companies they affected and the sheer number of accounts with leaked information.

According to the RiskBased Data Breach QuickView Report 2019 breaches as a whole were up 33 percent since last year, while the number of records involved in the breaches grew a staggering 112 percent to more than 7.9 billion records.

A few of the most newsworthy breaches involved companies like Doordash, First American Financial, Epic Games — creators of the popular Fortnite video game.

The Fortnite data breach, which occurred Jan 12, 2019, involved a flaw in the login system, and gave hackers the ability to impersonate real people and make purchases for in game currency on their own accounts using someone else’s credit card information that was stored on their accounts and even listen in on their in game chat conversations. Epic Games, has not stated how many people were affected by said breach, but with over 200 million registered users and around 80 million users logging in each month that’s a terrifying number of individuals that could be affected.

Also, in late February, two cybersecurity researchers happened upon one of the largest non-password protected email databases on the web.

If all that has you a bit concerned about how you may have been affected by these breaches, you can do a quick search on the Have I Been Pwned website, and you will get a list of how many times your personally identifiable information (PII) has been found online.

2. New data privacy regulations

Potentially the biggest news in security and data privacy this year was the California Consumer Privacy Act (CCPA). Though it is not set to take effect January 1, 2020, security professionals and those throughout the technology space spent plenty of time and effort preparing for a sweeping new set of laws that affords its residents information on what personal information has been collected on them.

Much like the General Data Protection Regulation(GDPR), which was implemented by the European Union in 2018, this act will reach well beyond the confines of California and effect businesses across the U.S.

Compliance with the CCPA forces businesses with at least $25 million in annual revenue that earn more than 50% of business revenue from selling personal data to be more transparent with data collected on consumers. It also allows consumers to hold businesses accountable for their treatment of consumer information.

Learn more about CCPA and what you should be doing to prepare for it, by clicking here.

3. Ransomware attacks on local governments

Malware attacks are nothing new, but as ransomware attacks continue to grow the risk of these attacks has extended to new niches and different industries.

In, 2019 the poster child for the growth of this type of attack was the rise in notable incidents of ransomware being used against local government entities.

In all, there were more than 70 state and local government ransomware attacks this year affecting groups including Philadelphia Courts First Judicial District, Cleveland Hopkins International Airport and several municipalities in Florida and Georgia.

According to security giant McAfee this type of attack saw an increase of 118% in the first quarter of 2019 alone.

One of the highest-profile ransomware attacks this year and possibly in history is the ransomware attack on the city of Baltimore. Effecting the entire city of Baltimore’s police surveillance cameras, utilities payment systems, phone and email outages until the found a paper-based workaround, this attack showed just how crippling a lack of cybersecurity preparation can be.

4. Supply Chain Attacks

A relatively new type of attack that has risen to the forefront of cybersecurity concerns in 2019 are supply chain attacks, which targets third-party software vendors.

To users these attacks look like legitimate software updates from a trustworthy provider, but they are actually compromised and push out malware to users.

One of the biggest supply chain attacks is the NotPetya attack that occurred in 2017, targeting the Ukrainian government and costing the world over 10 billion dollars in total damages.

This year, two of the world’s top technology providers fell victim to supply chain attacks this year, with Asus and Microsoft infecting millions of customers through attacks where hackers used legitimate updates as the means of distribution.

Since 2018 experts have seen a 78% in this type of attack, which is scary considering there is no “quick fix” way to prevent these attacks — the only way to protect yourself is thorough vetting of your supplier network and even then risks still exist.

5. Android Malware

This year had its fair share of attacks on our devices, including a growing number on mobile phones.

Over the past year, experts have seen a 50% increase in attacks on mobile devices — with Android users being particularly susceptible to malware and other hacks.

Due to the continued growth huge increase in 2019, more and more hackers are using malware to try and steal banking information, login credentials, and even take over your phone.

‘Tis the season for holiday gatherings, work parties, and family obligations, making it all too easy to forget about cybersecurity.

During the hustle and bustle of the holiday season, cybercriminals are on the prowl, looking to dupe the unsuspecting masses with scams to steal personal information, financial data, and other sensitive information.

How can your organization and its employees ensure your holidays are happy and your data remains protected?

Don’t use public Wi-Fi for sensitive information

Wi-Fi connections that are public can be accessed by anyone, thus leaving those networks open for fraudsters to pillage your data. In the era of online shopping via cell phones and tablets, more personal information like names, addresses, bank accounts, and credit cards are shared without a thought of encryption or security. Don’t open your wallet to cybercriminals by using public Wi-Fi to transmit your most valuable data.

Only use verified websites

Website security is a critical component to keeping your data safe, regardless of what deal you’re hunting. Trusted websites should have “https” at the beginning of the website and a lock image near the address bar, showing that the page is secure and encrypts all information that it is transmitting. Without encryption, your data is an open book for hackers.

Change your passwords

This might seem like the simplest activity that doesn’t hold much weight, but your login credentials open the door for cybercriminals to infiltrate a network or open accounts in your name. Even if you haven’t been breached in the past, which is unlikely, using the same login credentials across accounts is a recipe for disaster. Work to have unique passwords for all of your accounts, using software like LastPass to help create and store information. Many hacks come from credential stuffing attacks, where a hacker will use information stolen from previous breaches to try and infiltrate other accounts.

Be suspicious of email links

Yes, everyone gets thousands of emails around the holidays with promises of big sales, epic savings, and an opportunity that is too good to pass up. How often do you check to see that the sender is actually a representative of the business? Oftentimes, phishing scammers can make an email look identical to a legit one from your favorite brand, then include dummy links that lead you away from the savings and sales. Be ultra-careful to avoid falling down a phishing hole this holiday season.

We hope your holidays are a wonderful time spent with friends and family, not trying to recover accounts, change passwords, and replace compromised cards. Take an extra step in your security and enjoy the most wonderful time of the year!

The popular food delivery service, DoorDash, uncovered "unusual activity" with a third-party vendor and found that some of its user data were breached.

Outside security experts confirmed to DoorDash that nearly 5 million consumers, independent contractor drivers, and retailers who used the platform on or before April 5, 2018, were affected by the breach. Data accessed could include profile information like names, email addresses, delivery addresses, order history, phone numbers, and some password information. Additionally, the last four digits of credit cards used by consumers were exposed, but not the entire card number.

Drivers and retailers on the platform also had the last four digits of their bank account number exposed, but the information is not sufficient to make any changes to an account. Approximately 100,000 drivers also had their drivers' license numbers exposed in the breach.

DoorDash has taken steps to increase its overall security and has added additional layers of security to improve protocols around user data.

Using outside vendors within your business can open you up to different vulnerabilities that can lead to breaches and other security issues. When vetting vendors, establishing a baseline of security is a critical step to ensure your business, data, and customers are protected.

January 2020 will bring changes to data privacy and security rules for businesses operating within, or interacting with residents of, the state of California.

The California Consumer Privacy Act is the first of its kind in the U.S. It represents a sweeping set of laws that affords its residents information on what personal information has been collected on them, with whom it has been shared, how to delete it, and how to prevent the sale of such data. Compliance with the California Consumer Privacy Act will force businesses to be more transparent with data collected on consumers while simultaneously allowing consumers to hold businesses accountable for their treatment of consumer information.

What is the California Consumer Privacy Act? 

Although it’s called the California Consumer Privacy Act (CCPA), the regulations have wide-ranging impacts in the United States and beyond. Much like GDPR in the European Union impacted American companies and consumers, so too will the California Consumer Privacy Act.

To fall within the jurisdiction of the California Consumer Privacy Act, businesses must work in the state of California or collect personal information on residents of the state. Additionally, businesses must fall under one of the following criteria:

• Have at least $25 million in annual revenue
• Possess data on more than 50,000 consumers, households, or devices
• Earn more than 50% of business revenue from selling personal data

Those businesses not meeting the above-listed criteria will not be largely impacted by the CCPA, but those meeting even just one of those have a lot of work to do.

The California Consumer Privacy Act is broad in scope, substance, and enforcement, covering new forms of data like internet browsing history, metadata, and IP addresses. It also redefines what a sale of data “looks” like, stating that data does not have to be given in exchange for money, but expands the definition to include anything “valuable” to the holder of the data. Essentially, trading data for goods or services are covered under the California Consumer Privacy Act.

Companies looking to comply with the California Consumer Privacy Act will not find a wealth of information within the act itself. In fact, there is no roadmap to compliance given by the state, rather just some general ideas of what businesses will be required to do and timeframes around those actions.

What does my business need to do?

First: don’t panic.

The California Consumer Privacy Act goes into law on January 1, 2020, but you’ve got plenty of time to determine what compliance looks like for you. Six steps are recommended for immediate implementation in order to make compliance easier:

• Update Privacy Policies
  • Much like the rush of updates and emails that came after the European Union’s GDPR regulations took effect in 2018, privacy policy updates and their accompanying notification emails will likely flood our inboxes in 2020.
  • Update your privacy policies and notices to account for the necessary additions of what personal information is collected or sold, along with providing information about opt-outs from the sale of personal data.
  • Create either a policy to specifically cover California residents to couple with current policies; or create one wholesale policy to cover all consumers.
• Update Data Stores and Business Processes
  • Included in the California Consumer Privacy Act regulation is the requirement to maintain a data inventory to track data processing activities such as:

• • • • Business processes
      • Third parties with data access or transferal of data to third parties
      • Products, devices, and applications that process consumer personal data

• • The data inventory or database must track every consumer right’s request.
• Implement Procedures to Maintain Consumer Rights
  • Certain consumer rights have been guaranteed by the California Consumer Privacy Act, including the rights of access, request, notice, and knowledge about personal data gathered by businesses. Consumers will be afforded the power to see and remove:

• • • personal information collected,
    • the sources from which the information is gathered,
    • the purpose for gathering the information,
    • the categories of other parties with which the data was shared, and
    • the specific personal information gathered about the consumer by the business.

• • Businesses may provide personal information to a consumer at any time but do not have to provide requested information more than twice in a 12-month time frame.
• Update Security Measures
  • • An easily overlooked regulation of the California Consumer Privacy Act is the responsibility of the business to protect personal data with “reasonable” security. For many organizations, this includes performing a risk analysis and remediating high-risk vulnerabilities to maintain a baseline of security.
• Make Changes to Third-Party Agreements
  • Third-party data processing will need an updated contract with requirements including:

• • • creation of vendor data inventories,
    • use of due diligence questionnaires,
    • providing records of the processing; requiring the syncing of consumer response processes; requiring onsite assessment and auditing; and requiring mapping of the specific data elements shared with each third party, including designating those transfer that qualifies as selling.
• Train Employees on the New Regulations
  • At a minimum, any employee handling consumer inquiries for data collection and personal information must be informed of all requirements.
  • It is recommended that more in-depth training on the California Consumer Privacy Act occur at all businesses dealing with the new regulations.

Penalties for Non-Compliant Businesses 

Under the California Consumer Privacy Act, penalties are based upon unauthorized access incidents – be that breaches, exfiltration events, theft, or unauthorized disclosure due to poor security procedures and practices.

Fines will range from a maximum fine of $2,500 per violation for non-civil cases and a maximum of $7,500 for each violation in suits brought by the California Attorney General.

The intent is a critical component of each fine category, as the $2,500 fine is for non-intentional violations, while the $7,500 would be the maximum for intentional actions.

What are my next steps?

The California Consumer Privacy Act is more intensive than GDPR, requiring companies to take additional steps to ensure customer data is secure.

Most companies will need to consult with experts in data management, cyber security, and network security to ensure all aspects of the California Consumer Privacy Act are met before the regulations go into place.

The penalties and potential for embarrassment from a breach are strong and place an extraordinary amount of responsibility on businesses to keep data safe.

A partner like Archetype SC, with expertise in data, cyber security, and database management, is an excellent resource to answer questions and provide consultations on California Consumer Privacy Act compliance.