Privacy? Seriously?

I have been looking a lot at privacy lately.  At a professional level, I want to provide value in this area by making sure that my organization is compliant with relevant privacy laws.  At a personal level, I feel like my privacy erodes on an hourly basis with the nearly weekly data breaches of companies that I use on a regular basis. 

So how do we resolve this conundrum?  First of all, don't panic!  You don't have to live in a shack in the woods herding goats to protect yourself (although some days, I think this might be a nice option).  I think the good old detective controls come into play, in addition to some still proactive useful ones.  The key, at least to me, is a balance that won't make you crazy.

The controls are simple:

1) Get a credit card you can use for purchases (online and in person).  It doesn't seem to be better one over another any longer, so just get one that you monitor frequently for oddball transactions.  Then commit to reviewing it.  As soon as you get something, dispute it and get a new number.

2) Keep your passwords different for different services and secure them in a key safe.

3) Keep your personal information OFFLINE.  I have a dear friend who posts every single place she goes at all times.  It's kind of cool to know what she is up to, but (sorry) I don't trust privacy settings of sites.  They change too frequently and you never know what glitch will happen that exposes your info.

4) Keep you online presence fairly limited.  Since you will ignore step 3 because you like to interact with everyone else in your social circle, then focus on a site so you can monitor it.

The last step is really just to make sure that you keep breathing.  Its pretty easy to panic, but there are some things in life you can't control.  You can either never leave your house or you can just monitor what you can, limit the threat vectors (to throw a security term in the mix) and keep on going.

Quick check:  breathe in, breathe out. 

See?  I knew you could do it!

Sent from my iPad=

Promises, promises

"Let's do lunch!"

"I will make that happen"

"I can get that to you by Friday"

I bet either you've said that or heard that recently.  If you said it, did you deliver?  Nothing is more irritating than having something promised to you, then the commitment is not met.  Then you have to nag the person mercilessly until they provide it.  So, did you promise something and then not deliver it, and now you are being nagged?

An instant way to build trust is to deliver on your promises.  No matter how little, following up on something you said you'd do will pay off handsomely in the long run.  The key to  this; however, is not over-promising. We tend to automatically spit things out like: "of course I can do that in 24 hours!"  when our brain truly knows that we can't in fact do that in a week.  There is no shame in taking more time to provide a realistic estimate rather than promising to do something then not doing it.

Even worse, if you can't make your commitment, don't ignore the promisee!  Communicate a clearly revised deadline with plenty enough notice so that they can reasonably adjust whatever may rely on the output of your task.  Again, I don't care how small you think the promise is, the person you committed to may think that it is much more important.

Lastly, if you can't do it, then say so!  How often would you have appreciated a real answer versus a tap dance?  As infosec professionals, being honest and ethical is part of the job description.  If our partners can't believe and trust in our work and ourselves, then why would they want to work with us?  Think about the traits of people that you like to work with: I bet one of them is delivering on their promises.  We must be the examples if we are to succeed, so start practicing now!

For a little more on this topic, here is a good article.