I see the future. I see it so clear to see one message you will receive a few years from now.
The BlahBlah monitoring system has noticed suspicious attempts to log in to multiple users’ accounts (an AI brute-force technique). Your account has been recognized with potentially weak security settings.
Therefore, to prevent unauthorized access, your account password has been regenerated automatically.
To restore access and ensure the security of your account, please complete the following step:
Reset a new strong password(At least 58 characters, including at least 3 uppercase, 7 lowercase letters, 9 numbers, and at least 7 special characters, e.g., ! @ # ? ])…”
The future BlahBlah security team
I like this feature. Why? People are lazy, and we tend to learn less and less and watch TV every day instead of reading books, solving math problems, thinking about space, dreaming big.
Imagine how your brain will work if you need to remember your new 58 characters password for your fresh 58 new services you will subscribe to deliver food to your home.
The future is bright! Embrace it. Please change your password to 58 characters now, and don’t write them down. Train your brain!
I am so happy that Citrix allowed me to release under Creative Commons license the threat modeling framework I developed in the last four months.
What was the challenge?
Doing threat modeling is one of the main requirements for almost any Agile organization. Most of the teams are doing it wrong, and as an award, they receive a false sense of security, which leads to products and services that attacker personas can easily exploit.
What’s the solution?
I created an agile visual threat modeling framework (code name: Protecto)
How many times you received a food delivery and you see on the tax receipt written your name, address, and phone number?
How many packages did you get from a courier with the same data written with giant letters?
Data that could identify you is private, and we must protect it. At the same time, your delivery partner needs those details so they can fulfill your order. Are we in a Cacth 22 type of situation here? Not at all!
Let’s see the flow of data in this complicated situation:
You order food via your favorite app, and you give your name, address, and phone to them.
They are just an aggregator, so they forward your details to the actual place to prepare the food.
The restaurant uses a courier company (or a shared delivery engine) to deliver the order to you, and of course, they will share your details with them.
You can see your data flowing from system to system without your control or awareness. If you put it on top of that, they print out the tax receipt and hand it over to a 3rd party without your consent, and you could imagine all possible threats.
You don’t have the visibility of who is doing what with your protected personal data. Any party of this chain believes that they need your details stored and printed out to “help you” get your food or item. And you even pay them to abuse you. Too harsh? Nope.
What is the solution, then?
Let me get this right. We all need service like that – where you can order stuff and get it at home. The goal here is – can we get a service that 1) believes your data is precious and it will use it only when needed; 2) with your permission, and 3) without storing it?
Imagine a situation like that..
The courier needs to deliver you some food. Before she is leaving the station, she would need to know where to go. Remember – they don’t have your data. Then she opens up an application and initiates a request to you to share the details.
Then while sitting on the couch, receive an alert for the request.
The courier is requesting the first name and the last name. You think they don’t need them for your food delivery. They could need your address and maybe your phone. So you select what you want to share and send it to them by selecting data from your data wallet, where you keep your details secured and encrypted.
Then the courier receives that, and the data will be available only until they deliver the food to you and then will expire and not be visible or stored anywhere.
Here, the concept is that you, as a human you own your data. You keep them safe with you as you have your physical wallet. When someone needs a bit of information, you decide what to send and how long they can have it.
* In the text “Data Wallet” is a concept, not a name of an already existing product.
As I said before in this tiny article – the data we share with random parties must be protected. The best way to do that is to have the control at your disposal and not count on 3rd parties to do that for you. Most vendors are using the data you shared with them for the means you never agreed to. So why don’t we take the control back if the technology supports that?
Food for thought
If you recycle, how many times did you make your data unreadable before throwing the envelope in the bin?
If you look at the paper recycling bin that sits in front of your building, how many names, phones, and addresses you think you will find?