Access denied!?
Let’s see...is it my favorite team?
No.
My favorite food?
Cupcakes-4-life.
No.
Celebrity crush?
[*sigh*]
Ah!
I’ve got it: 1234.
We’re in.
Taking precautions — like having strong passwords — helps keep our data secure and out of
the hands of anyone nefarious.
Though 1234 is really a terrible password.
So is “password,” actually.
Other security tools like two-factor-authentication can help us do our part to protect data.
But we also need to know how data can be lost, like through hacking attacks and phishing,
so we can be on the lookout for any weak points.
Although we usually want to tell stories with our data, some stories we want to keep private.
Other data stories we want to be reliable, and that means making sure the underlying
data isn’t tampered with.
Data that’s been manipulated for personal gain, or isn’t there because it’s been
stolen, can’t tell a true story.
I’m Jessica Pucci and welcome to Study Hall Data Literacy presented by Arizona State University
and Crash Course.
Data security keeps data protected from people or organizations who want to use our information
against us.
We’re talking like locks and keys, but usually virtual.
Maybe we have a vague intuition that bad things can happen if our data gets into the wrong
hands, but it’s less clear who is out to get our data,
and what can go wrong if our data isn’t secure.
Lots of us trust companies, researchers, and medical facilities to keep the data they collect
from their customers safe.
So these organizations with lots of data have to be extra careful to protect against data
breaches, or revealing private data either accidentally
or as part of an intentional attack by someone wanting to steal or manipulate data for money,
pride, or revenge.
Data breaches are sometimes called “hacks.”
Actually, a hacker is just anyone with computer skills.
Hackers for good really exist, and “hack-a-thons” often bring together techy people to try to
use their powers to solve big problems.
But nefarious hackers use their powers for evil.
A nefarious hacker may target a hospital’s private health records or a retailer’s customer
payment information.
When hackers access personal information, customers are put at risk of consequences
like identity theft,
which is when someone else uses your personal information to access credit, file taxes,
or get medical attention.
These breaches do happen, even for places with lots of resources.
In 2017 a group of National Health Service hospitals in the UK were locked out of their
patients’ information unless they paid a ransom.
Hackers requested between $300 and $600 per computer, and they infiltrated hundreds of
thousands of computers.
That adds up quick, even if many were instructed not to give in to the demand.
Also in 2017, the US credit reporting agency Equifax was hacked, and credit card numbers
were part of the stolen data.
It definitely opened the door for lots of unauthorized purchases, but identity information
like this is valuable in and of itself.
There are even some bragging rights involved in criminal hacking circles for cracking notable
and well-protected targets.
Like in the summer of 2020 when a 17 year old was charged with hacking into prominent
Twitter accounts.
Data breaches like these cause tremendous headaches for the people whose data have been
compromised, but they also look bad for the company and erode customers’ trust.
It’s enough to make lots of companies want to keep data breaches secret.
But...that can be illegal depending on where you are.
In the US, each state has laws that require customers or users to be notified if data
that personally identifies them is revealed.
Some countries, like those in the EU, the Philippines, and Qatar, have similar laws.
Online look-up tools can also help you check if you’ve been affected by particular breaches.
Yet we still have to be on guard.
Others will try to trick us into divulging important information or sending money.
Phishing — with a “ph” — is a tactic to try to get us to reveal our personal information
by impersonating a real organization or person we might trust.
And phishers have both multiplied and gotten more sophisticated;
it’s no longer just the obvious “transfer me money and I’ll send you back double”
ploy hitting our inboxes every once in a while.
Now people regularly pose as potential customers or service providers — or even our close
friends and family.
Let’s see a phisher at work in the Data Point.
Say an email pops up in your inbox with an all caps subject line:
URGENT: PLEASE HELP!!!
Hmmm, it looks like it’s from your professor.
They need access to your cloud storage account so that they can grade your latest assignment.
Well that’s weird.
They’ve never asked for that information before (or used so many exclamation points).
That’s the first red flag.
But it is your professor asking, so maybe just go with it?
Let’s pause and think this through.
The world’s never ended because of a grading emergency.
A good first move is to check with other people.
So you send a quick text to your friend in the class to see if they got the same email.
Turns out, they have.
And they point out that the email address the message was sent from is actually missing
a letter of your professor’s last name.
Red flag number two!
Just to be sure, you give the email one more careful read.
The account the message asks about is actually the cloud storage company you use for your
personal files, not the one your school uses.
There’s no way your professor knows about it.
Another red flag!
Ultimately, you conclude this can’t really be your professor.
So you ignore the message and don’t open it, click on any links within it, or reply
to it.
At this point you could send a message to your professor using their actual e-mail address
to let them know something is a-foot.
You can also report the message to your school’s tech support staff to help warn other students
who may have been targeted too.
Share the data literacy wealth!
Phishers try to reel us in by taking advantage of how quickly we react to people we trust
without stopping to really think.
But the most important thing we can do is not jump to conclusions and be on the lookout
for odd misspellings,
slightly off email addresses, or messages that just don’t sound like who supposedly
sent them.
Like if your professor is usually pretty formal in their e-mails,
but then all of a sudden starts using smiley faces and jokey language.
Something doesn’t add up!
If a phisher does win and gets us to send them money, reveal personal or password information,
or even releases a virus onto our computer, hope isn’t necessarily lost.
Like if our Paypal password is compromised on one account, we can at least minimize the
fall out by making sure that other connected accounts,
like our bank or credit card, don’t use the same password.
This prevents a domino-effect where one breach leads to more breaches because we have so
many interconnected links.
It might seem convenient at the time to link a bunch of social media and game app accounts
all through Facebook (with one login to rule them all]),
but if that one account is compromised, there go the rest.
Keeping accounts independent is one of the best ways we can combat phishers and help
prevent data breaches in general.
Even if it does mean keeping track of even more passwords.
Thankfully, that’s what password managers are for.
And no, I don’t mean that slip of paper hidden in a desk drawer or wallet.
Password managers store our variety of passwords and other sensitive information for us — all
we have to do is remember one key password.
It depends on the platform, but password managers either store the data locally on our personal
devices or use encryption to turn the data into a code.
Encryption is used when you swipe a credit card or send data over cell-phone and Wi-Fi
networks.
If it’s our personal WiFi network, we can make it even more secure by setting or changing
the default network password.
It also helps to keep the software up-to-date on the internet router that allows us to connect
with other networks and puts up a firewall to keep unauthorized users out.
Part of software updates, like on our phones, computers, and browsers, often includes security
fixes for holes in older versions.
So in general, keeping software up-to-date is a good tactic for keeping your data secure.
Even with all those precautions and trying to stay on our guard, data breaches still
happen and nefarious hackers and phishers are getting trickier.
So we can make it harder by increasing the amount of information they need to access
our important accounts and enable two-factor authentication.
It’s no longer enough to just have the password, now someone accessing our account has to provide
another proof of identity.
Like a one-time code sent to our phone or email that hypothetically only we have access to.
In theory, two-factor authentication is very secure since hackers aren’t usually the
type to come physically steal your phone.
But phones and e-mails aren’t completely invulnerable.
Any device or account that’s involved in two-factor authentication should have the
strongest passwords since they’re connected to so many other accounts.
Any time you’ve shopped online, you’ve actually used two-factor authentication.
If you pay with a credit or debit card, the card verification value, or CVV number on
the back of a card, makes sure you’re physically holding the card,
not just a leaked credit card number.
Now, since so much of our data security relies on passwords it’s important to recognize
not all passwords are created equal.
“Abc123,” “password,” and simple keyboard walks like “qwerty” are notoriously easy
to guess.
Passwords that can be guessed from basic personal information, like pet names or favorite colors,
are also not hard for the dedicated hacker.
Just think how many preferences and favorites we inadvertently share on social media.
The best strategy is to move beyond a password to a passphrase or sentence and change them frequently.
Phrases and sentences are easy to remember and tend to be longer or use special characters,
which makes them harder to crack.
But the best move we can make is to take data privacy seriously and keep personal information,
well, personal.
Be careful what you share with companies.
Or even separate yourself a bit more, like by using an email address just for receipts
and mailing lists or signing up for virtual credit cards.
If you can, only give access to personal information to people we trust and who truly need access.
Protecting our data starts with taking some simple precautions, but these same tactics
apply to large scale data security at companies too.
We have a lot of personal data to keep track of, and companies that we entrust that information
with have even more to protect.
We’re all tasked with being aware of and careful with where our data is going.
Today we learned about data breaches, hackers, and phishers and what harm they can cause,
like identity theft and financial woes.
But we also amassed a set of tips and tools for keeping our data secure against these bad actors.
Passwords are at the heart of data security, and encryption and two-factor authentication
are tools that we can use to add extra layers of protection.
This time we worried about data getting in the wrong people’s hands.
Next time we’ll see what it means to do good data work and publish it out in the world.
Thanks for watching Study Hall: Data Literacy, which is produced by Arizona State University
and the Crash Course team at Complexly.
If you liked this video and want to keep learning with us here in Study Hall, be sure to subscribe.
You can learn more about ASU and the videos produced by Crash Course in the links in the description.
See you next time!