Have You Noticed the PII Leakage?

There are different means by which information can be collected today to identify a particular individual. People are continually registering for various programs and applications. For this, we are providing a lot of private data that can easily be used by other subjects for multiple purposes.

Such sensitive information can also be categorized as personally identifiable information or PII. This information may include the real name, alias, account name, actual address, IP address, email address, social security number, passport, driver’s license number, and some other data.

Each of these data being part of an aggregate can contribute to the identification of a particular individual. The attacker may be able to distinguish the person and perhaps trace it back to committing some fraud, such as identity theft. Many of us innocently believe that what we enter into a specific software is known only to us and no one else.

The attackers are always going to be lurking, even when we think we’re safe. The applications that we believe are the most secure, because of their popularity, also come to mean high risks for the privacy of our information. Cervantes and Khare told us, concerning data breaches and data sharing, and from one of their recent company reports:

If we are creators of mobile apps, we must look for the best ways to deal with the possible risk of data breaches, always trying to guarantee the privacy of our users and keep their data safe. One of the biggest risks comes from the simple fact of collecting too much information from the users of our applications. From there, the risk increases because of the ways of sharing, and in itself the traffic that this information has.

It is then indicated as recommended for risk reduction with user data and to prevent mobile app security intrusions, the following:

With the transit and hosting of information through the networks, appropriate validation and certification processes must be ensured. Also, the background of the third-party providers on how they handle the data collected must be known.

It remains ideal that the data is stored in a secure system. Here we rely heavily on the developers and their knowledge of secure coding practices. These practices should be in place prior to the design and development of software. The central idea is to make the code little or not vulnerable at all. However, always bearing in mind that everything generated can be hacked. Hence the need to maintain a constant evaluation of the system, even in the middle of development.

We come back to something that is continuously repeated in the area of cybersecurity. In essence, sometimes the developers don't know, or sometimes they don't pay attention to it and the subsequent risks, and they are not building secure code when creating software. Sometimes they don’t even know how or don't have the tools to address a vulnerability before it becomes a problem. Besides, enterprise managers may request application development for quick commitment to their customers without fully considering the value of cybersecurity assessment and implementation.

It would indeed be prudent to stop collecting so much information to reduce the risks. How willing would application developers be to do this? Leaving that extraordinary possibility aside, we recommend keeping as a priority the proper securing of other people’s information on any kind of system.