Keeping Privacy in 2024: What Are the Options?

Online privacy is a concern as old as the internet. Views on it keep shifting, from an emphasis on anonymity and mistrust in the 90s and early 00s through the reversal ushered in by the dawn of social media to today’s complicated situation. Interestingly, the modern netizen’s digital footprint and online privacy concerns are both significant.

What can you do to tip the scales and boost your privacy more? Here are some actions to consider and steps to take.

Encrypt Your Files

Robust cybersecurity will make it much harder for criminals to access your personal information, but no solution is foolproof. Encrypting your files ensures that anyone who gets their hands on them without consent can’t do anything with the contents. You should encrypt all sensitive local files and keep backups on a reputable cloud storage platform that also uses encryption.

Switch to a Secure Browser

Browsing the web can be among the greatest risks to your privacy (but don’t we all do that daily?). You don’t even have to expose any private details explicitly. Merely using a search engine and visiting some websites can be enough for advertisers to assign you a buyer persona or guess your demographics & interests.

Secure web browsers enhance online privacy in multiple ways. Most importantly, they don’t collect and share data on you. They’ll also default to secure search engines and provide tools like ad blockers to enhance and anonymize your experience. Finally, secure browsers support extensive configuration options that help maintain your privacy by regularly cleaning the history & cache along with more in-depth website permission management.

Use a VPN

VPNs take your internet security and privacy a step further. They encrypt your entire connection – not just browser traffic – so their protection extends to streaming, gaming, and any other online activity. They use secure tunnels to send data to and from servers anywhere in the world. This makes your requests untraceable since they become disassociated from your real IP address.

You might have thought about the VPN vs Tor differences. VPNs are similar to the Tor network, but there are differences. They encrypt the traffic between you and a single company-owned server, unlike the multiple relays Tor traffic has to go through. Browsing with a VPN is faster yet equally secure due to this configuration. Unscrupulous providers might log and sell your data, but reputable ones have regular audits and don’t keep records.

Communicate More Safely

Privacy isn’t at risk only when you use vulnerable networks or have to fill forms out with personal information. We give far too much away in casual conversation, much of which happens publically and on social media. Rather than just using private chats for more sensitive topics, you should consider moving them to a secure communication platform altogether.

Platforms like Signal, Telegram, and WhatsApp employ end-to-end encryption for all your exchanges. That ensures only you and the recipient know the contents of each message since decryption only takes place at the two endpoints.

If you have any questions regarding privacy and different platforms, you can ask or search on Reddit, which is valued for its privacy as well. Many people on Reddit create posts comparing products in the same category, like a VPN comparison table with all the providers.

You should also consider switching to a privacy-focused email tool. Signup doesn’t require personal details and your correspondence benefits from end-to-end encryption. You can password-protect emails so only recipients you give the password to can read them, even if they don’t use the same client. Finally, you can set emails up to delete themselves after a while.

Secure Your Passwords

Everything measure we’ve listed so far safeguards your privacy by addressing system limitations and your bad habits. What about the consequences of others’ mistakes? Data breaches can expose billions of passwords and other sensitive details, providing hackers with access to accounts you thought were secure.

Password managers tackle several related challenges with ease. They can replace any current password with a more robust and distinctive one and store this information in an encrypted vault. Sophisticated ones let you autofill login credentials and work across multiple devices.

Some managers will alert you of a password breach. More importantly, they can prevent stolen passwords from accessing associated accounts by providing multifactor authentication.

Change Your OS

While it might be radical for someone used to Windows or MacOS, switching to Linux will assuage many of your privacy fears. It’s open-source, so the community scrutinizes the code and fixes security issues fast. Linux collects no telemetry or user data that companies could use to profile you.

There are many distros to choose from, some of which focus entirely on privacy. Linux isn’t particularly popular for desktop use, so viruses that affect it are almost non-existent.

Conclusion

Stating that individuals’ online privacy is under threat is no exaggeration. The AI boom we’re in the midst of will only make matters more challenging. Some legislation is already in place, and governments are scrambling to create a legal framework for this rapidly evolving and uncharted situation. Not much will come of it if you don’t take securing your privacy into your own hands. Now you know how.

 

4 Best Practices for Protecting Healthcare Data

Cyber threats and data breaches are not limited to big tech companies or enterprises. Healthcare systems are one of the main targets of cybersecurity attacks due to the importance and sensitivity of their data. Threats to this data can be disastrous for all individuals involved and even pose life-threatening risks. Healthcare sectors must look beyond physical safety to reduce risks related to digital data and implement robust data management and security practices.

Patient data is the most sensitive and targeted resource available to healthcare sectors. Data protection practices like network protection, access management, encryption, and implementing Zero Trust security healthcare architecture are vital to safeguarding this critical information.

Practices for Protecting Healthcare Date:

Protecting healthcare data includes protecting it when it transfers, at rest, or in use. To do that efficiently, healthcare security professionals must adopt modern data protection practices. These practices should be compliant to deal with the ever-growing cybersecurity threats. Following practices can help healthcare sectors ensure data protection:

1. Utilise Access Management Frameworks

Proper access management is a security measure to control who and how many resources each user or device can access, depending on authorisation and authentication. This practice only allows users with permission to access healthcare data, networks, and other resources. These controls help protect healthcare data from malicious third-party attacks.

Limited access controls ensure that any data breaches are easy to backtrack to their source. Some frameworks to implement when managing access controls are:

IAM

The Identity and Access Management (IAM) framework guarantees that all individuals accessing the cloud are appropriately authenticated and authorised. This framework includes a wide range of policies and tools to ensure that all access to the resources is managed and monitored.

Role-Based Access Control

This access control approach allows user access based on their role and job within the system. Access is restricted depending on authority, work responsibility, and job competency to ensure that no malicious user can access the data from inside or outside.

2. Implement Zero Trust Architecture

Implementing The Zero Trust security framework is one of the best practices to secure healthcare data. It provides stern access controls to healthcare data based on continuous identity verification for accessing each application or segment on the server. This framework always assumes the presence of breaches and restricts activities unless authorisation is confirmed. Some essential security components comprising this framework are:

Multi-Factor Authentication (MFA)

A data breach can result from stolen credentials that give malicious third parties free access to all sensitive information. Multi-factor authentication verifies the user’s identity, trying to access healthcare data from several sources like OTP and fingerprint recognition, making it a great security solution against unauthorised access.

MFA adds an extra layer of protection to staff’s accounts. Upon entering their account credentials, identity verification is required in the form of a code sent to their mobile phone, a fingerprint scan, or a one-time password.

Never Trust, Always Verify Approach

Never trust approach re-authorises and re-authenticates the user privilege every time they try to assess a segment of the server. This approach is more effective in tackling breaches than least privilege, which gives access to all the healthcare data resources once the user verifies. Zero Trust enforces and monitors privileges every step of the way.

Micro segmentation

The Zero Trust framework separates the health sector’s system into multiple segments or applications. This restricts even an authorised user of the network from accessing all the data. Authorisation is required to access each segment separately. This reduces damage to the whole healthcare data system by decreasing the attack surface for cyber-attacks.

Continuous Diagnosis and Mitigation (CDM)

Healthcare sectors have a huge number of connected devices as they are starting to adopt internet-enabled medical devices and equipment. Medical staff and treatment procedures are also shifting towards the Internet of Medical Things (IoMT) for accurate diagnosis. CDM is the security component of the Zero Trust framework that provides visibility and ensures the compliance of these healthcare devices with security requirements. It also provides threat intelligence and network activity logs.

3. Proper Data Storage and Monitoring

Data storage on physical hardware and devices is prone to many vulnerabilities. A proper security system with protected data storage and monitoring ensures that potential threats to healthcare data are identified, and even if the data is compromised, it is rendered useless to malicious third parties. This is achieved through:

Monitoring

A security framework that monitors all incoming and outgoing traffic from the system enables healthcare sectors to inspect all users and devices that access healthcare data and resources. Intrusion detection & prevention actions are also possible through traffic monitoring. Real-time monitoring of all data traffic prevents malicious users from moving huge amounts of sensitive data out of the system without being noticed.

Encrypting Data Storage

All healthcare data should be encrypted inside the storage. This approach provides added security to the data by encoding its contents. This ensures that even if sensitive data is compromised, it is not exploitable by third parties.

4. Data Protection through Cloud

Cloud services approach data security effectively by taking proper protection measures and risk management tactics to ensure that all data is safeguarded. Moving healthcare data to the cloud and applying proper access policies to this data is an efficient approach to healthcare data protection.

Cloud Data Backup

Data stored on the cloud can also be a form of backup to ensure health sectors work continuity even after a cyberattack.

Remote Access

Shifting healthcare data to the cloud effectively lets doctors and staff access this critical information from anywhere if the situation requires it. Many healthcare services are also switching to remote support allowing people in need to get in contact with healthcare professionals remotely. Such an approach requires protective measures to ensure safe communication.

Threat Protection Strategies

Cloud services use protective strategies like access controls, firewalls, and gateways to ensure that all access to healthcare data is protected from third-party intrusions.

Conclusion

Healthcare sectors are vulnerable to cyber threats due to a lack of security measures to protect their sensitive data. Cyber-attacks can result in corruption, theft, and manipulation of critical client information, endangering many lives. Implementing these best healthcare practices ensures the implementation of good security hygiene and the protection of data.

Protect Your Sensitive Data With These Super Useful Guidelines

Sensitive data is defined as any information that is protected against unwarranted disclosure. If you’re running a business in the information era, chances are you’re collecting sensitive information. Company data, employee information, and customer records are all targeted by cyber criminals on a regular basis. In 2021 alone, Americans lost nearly seven billion dollars to cybercrime.

This number is expected to grow. The following will explore a few things you can do to help protect your company’s sensitive data.

Of course, every industry has its own specifics when it comes to data. It’s a good idea to do further research into your particular field and see what sorts of cybercrime disproportionately target businesses within your industry and of your size.

Password Education

If you have staff that accesses company accounts or devices while working from home or within the office, it’s important to educate them about proper password selection. A good password is much more difficult to hack than a poor password. You can even increase your security by setting new password parameters. You can require your staff to update their password at regular intervals; this way if someone you don’t want accessing company data ends up figuring out a password, they have only a short time frame within which it could help them access company information.

Restrict Administrative Privileges

Limit who within the company is able to make changes to your network that could potentially break-the system. Part of security involves reducing risk, and the fewer people who can damage your network, the less likely you are to experience network damage due to employee error. Of course, you need to balance this with allowing employees to do their job without having to jump through unnecessary hoops or feeling like they’re micromanaged. The right amount of access is going to vary from company to company.

Email Hacking

One of the most common ways that hackers and cybercriminals gain access to company information is through email hacking and scams. Part of your staff training should include proper examination of emails to determine whether the sender can be trusted or not. Email security involves everyone who is using a work email account, not just your security team.

Conduct Regular Backups

One of the ways that data breaches can cost companies money is by damaging or stealing data. If you have a backup of all your important information, you know that you’ll be able to get your hands on the stolen information again. Ideally, you want an encrypted and offline backup in addition to a cloud-based backup. Digital backups help protect you from data loss in the event of a fire, flood, or even a coffee incident. Physical backups help protect you from data loss in the event of cybercrime.

Antivirus Software

No matter what digital devices you use within your company, antivirus software can help keep you safe. This kind of software will scan any applications or program installation requests before they launch for dangers. This can help catch any problems that slip past your staff in the form of email attachments or other forms of cyber attacks.

Keep Things Updated

You know when you get those messages about updating your software? It turns out those are really important. Often, updates are created by companies when vulnerabilities in their systems have been discovered. Updates can improve weak points in a program’s security that are known. If software companies know there’s a flaw, chances are hackers also know there’s a flaw. If you don’t update, you’re leaving your devices with big openings.

Continuity Plan

Just like you are taught fire drills in school, it’s a good idea for you to practice data breaches at work. When a cybercrime happens, it’s vital that you’re able to act quickly and salvage all that you can. A plan of action can help keep you prepared in the event that something goes wrong security-wise. This can help you protect your financial standing, business brand, customers, and employees.

Conduct Regular Risk Assessments

Hackers are always studying and finding new ways to breach data security systems. This means you need to regularly examine your security measures. Something that worked six months ago might be obsolete now, and the only way you’re going to figure that out is if you constantly revisit your security system and any space it has for improvement. Be sure to read up on the latest cybercrime news as part of this process.

The above information should help you manage your company’s data security needs. Again, every business is different, and this means that you might have security particulars not included on this list. For best results, speak to a local security provider to figure out what best suits your business.

5 Good Reasons to Use PDF Format for Public-Facing Documents

PDFs are great tools to use. They work well for legal information, as well as public-facing documents. They are also easy.

However, they do have a couple of downsides that can make them frustrating to use if you don’t know how to work around them.

Keep reading to learn the best way to overcome almost all PDFs limitations, as well as the benefits of using PDFs.

1 Way to Overcome PDF Limitations

There are a couple of problems with PDFs.

  • Editing PDF files usually costs money and needs specialised programs.
  • Sometimes, the text in a PDF acts as an image, making it hard to edit. 

However, they are both solved the same way. All you have to do, to avoid paying large fees and having to buy specialised software, is to change a PDF into a word document, or something similar. If you don’t know how to change a PDF to Word, you don’t have to worry. It is easy.

Simply find a trustworthy website that will convert them for you, upload the document, and convert! Then, you can edit and adjust your PDF easily and for no cost to you. Plus, since Microsoft has PDF tools included in their program, the files are easy to transfer back into a PDF when you are done.

As you can see, there aren’t many downsides to using a PDF. Once you learn how to get around the specialised software, you can use PDFs and edit them at will.

5 Reasons to Use PDFs

There are a lot of benefits to using PDFs. There is a reason that they are used in many settings and situations.

1. PDFs can be transferred from user to user without any formatting changes. 

Sometimes, when you use documents, like Word, or PowerPoint, you may find that on another computer, or when opened with another program, the formatting drastically changes. Fonts will be different and pictures will move, completely ruining your public-facing document. Thankfully, with PDFs, things stay where they should, no matter what.

2. PDFs work on every operating system

No matter what operating system your computer uses (Linux, Apple, Windows), PDFs work the same. This is nice if you are working with multiple people and teams that use different software and operating systems.

Adobe is usually even installed on all computers anymore. This means you don’t even have to worry about

3. It is easy to Compress PDFs

Compressing PDFs is easy and painless, and you don’t even have to go through the process of zipping and unzipping the documents. Compressing documents is useful for not taking up all the space in your computer.

It also helps you to send more documents without having to worry about size limitations.

4. All PDFs are compatible with any update

Another great feature of PDFs is that they are compatible with all updates. Sometimes, with programs like Word, you may find that the document won’t open for you as someone is using an outdated program or is more up-to-date than you.

With PDFs, you don’t have to worry about that. Since they are always compatible, you could have a very old version of Adobe and never have to worry about how the document will be read by others.

5. It is easy to secure PDFs

Securing PDFs is easy. They can be secured with a password. That way, you can transfer sensitive documents via unsecured channels like email or messaging apps without worrying about the information being spread or stolen.

It’s also just as easy to remove the password if you don’t need it anymore.

Data Protection Officer (DPO) in Brazil

Data protection is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, and the legal and political issues surrounding them.

The personal data controller is a person appointed by the company who basically will be responsible for the communication between the latter, the subject of the personal data and the ANPD (National Data Protection Authority), which oversees compliance with Law no. 13.709/2018, the General Law on Personal Data Protection (LGPD).

Article 41 of the LGPD obliges all companies to appoint a personal data controller, also known as a Data Protection Officer (DPO) by European law.

For the time being, there are no exceptions to the rule referred to in the previous paragraph, although the matter is already the subject of public consultation, for the exemption of small data processors, such as micro-enterprises, small businesses, start-ups and non-profit legal entities, natural persons and unincorporated entities. If these small processors do not appoint a controller, an obligation at least to provide a channel for communication with the data subject is also under consideration.

Note that this exemption applies only to the data controller. The LGPD will not cease to apply to small data processors.

The ANPD has not completed this public consultation and therefore its opinion has not yet been released.

What does a DPO do? According to the paragraphs of article 41, the DPO is responsible for: 1) accepting complaints and communications from data subjects, providing explanations and taking appropriate action; 2) receiving communications from the national authority and taking appropriate action; 3) advising the entity’s employees and collaborators on the practices to be followed with regard to the protection of personal data; and 4) performing the other duties determined by the controller or established in supplementary regulations.

Is it possible to outsource the control of personal data in Brazil? The LGPD does not prohibit outsourcing of the data control. Therefore, it is not obligatory that the controller be an employee of the company.

Accordingly, since it is possible to hire an external DPO, the employees can focus on the company’s core business, without being overburdened or even distorting their employment contracts, which could give rise to legal consequences, such as the payment of additional compensation for deviation from their original function or dual activity.

Logically, hiring a DPO, as a regular employee of the company, is justified when the company’s size and volume of data processing is so significant as to warrant this person’s dedication exclusively to this function.

The Brazilian Bar Association, in response to Consultation no. E-5.537/2021, has authorized lawyers to exercise officially the activities of DPO.

Penalties for non-compliance with the LGPD, which includes absence of a controller, have been in force since the beginning of August 2021, including fines of up to R$50 million, in addition to compensation for property, moral, individual or collective damage.

The Stüssi-Neves Advogados team is at your disposal for any additional explanation regarding this matter.

Fernando Seiji Mihara and Maria Lúcia Menezes Gadotti
Associate lawyer and Partner in Labour Law Area – São Paulo
fernando.mihara@stussinevessp.com.br and marialucia.gadotti@stussinevessp.com.br