Skip to content

Product agent release: NordLayer Browser Extension

The amplitude of online scams is outraging on the internet. Malicious actors always seek original and convincing ways to catch their victims off-guard. LinkedIn creates a perfect environment for social engineering and other types of fraud, and that’s why scams have populated the platform.

Let’s start from the beginning. The LinkedIn platform is incredibly popular, with over 930 million members globally, making its scams an intriguing topic not only from a consumer perspective but from businesses.

Do only small companies or large enterprises fall victim to LinkedIn threats? Does it depend on a country or organization’s maturity? And what are the most common approaches that get employees’ trust?

To answer these questions and dig deeper into the source of businesses-linked LinkedIn scams, NordLayer researched the fraudulent activity tendencies.

LinkedIn scam — is a fraudulent scheme on the LinkedIn platform that aims to trick people into giving money or personal information, often through a fake job or business opportunities, requests for payment, or impersonation.

Click to tweet

These scams usually target individuals. Yet, due to the peculiarity of LinkedIn, they are often connected to organizations the targeted people are employees of. A LinkedIn scam poses personal threats but also puts a company at risk, making it an interesting case from a B2B security point of view.

Research methodology

NordLayer surveyed 500 respondents in Canada, the United Kingdom, and the United States. An external agency conducted the surveys between the 15th–25th of March, 2023.

Respondents (adult population, 18+) of non-governmental organizations were asked what kind of scams they encountered on the LinkedIn social media platform and what aftermath effects it had on their business. Subindustries represented included business management and support services, e-commerce, education, finance and insurance, health care, information and communication, IT, professional and technical services, and consulting.

The survey covered questions about the organization’s cybersecurity maturity level (Beginner, Basic, and Advanced), their cybersecurity solutions, and whether they had an in-house specialist or responsible department.

Companies by size were segmented by:

  • Small companies: 1-10 employees

  • Medium companies: 11-200 employees

  • Large companies: 201+ employees

Typical LinkedIn scams

The professional nature of a LinkedIn platform opens unique opportunities to vary the approach to encounter platform users. With a focus on job and industry topics, LinkedIn is no less than a social networking platform for making connections, communicating, and finding think-alikes.

The primary function of LinkedIn – building a career – introduces one of the most common LinkedIn scams, fake job offers. With 117 job applications submitted per second on the platform, fraudsters have an ideal environment for creating a legitimate-looking job posting to collect personal information or money.

Another popular scam is LinkedIn phishing, where an actor impersonates a well-known company or professional using fake profiles to send unsolicited messages or emails that ask for sensitive information.

Also, receiving an invitation to connect is common on the platform. Fraud actors use this connection culture to start a conversation and share a link with malicious content expecting LinkedIn users will click on it.

The NordLayer research on LinkedIn scams affecting the business sector confirmed the dominating tendencies of fraud types among the respondents, as the leading ones match the general statistics:

It’s safe to assume that most fraud attempts impacting businesses are social engineering based on public or personal information. On the one hand, LinkedIn is an environment where everyone shows their or their organization’s best side.

Yet, politeness, eagerness to sell oneself, and prospect opportunities tend to create an unintentional smoke screen for LinkedIn members leading to the most bizarre scams that might even involve lotteries or romance fraud.

Research findings on LinkedIn scams

Many businesses acknowledge the significance of being present on LinkedIn. 77% of respondents confirmed that their organization has a profile on the platform. Yet, 82% of medium-large companies tend to register more often than 54% of small (up to 10 employees) businesses.

The scams fall under two main categories. One is targeting individuals or pretending to be LinkedIn users. Another one is on a company level — operating under false organization pretext or impersonating an existing company to build more credibility. The research data shows that over one-third of survey respondents were aware of multiple LinkedIn frauds using their organization name. 

Frequency and scope of LinkedIn scams

According to the research, over half of the respondents encountered a scam attempt or fake account on LinkedIn.

Interestingly, the least active scam outreach was noticed in small companies — 52% of respondents confirmed that no one in their organization had such an experience. Fewer organizations with LinkedIn company profiles can explain such deviation from general tendency.

The rest of the respondents (47%) indicated their organization employees are likely to be engaged in a scheme. The trend corresponds with companies with Advanced cybersecurity maturity (46%).

Advanced cyber-maturity and medium-large companies are the first to fall victim to phishing attempts (52%) and fake tech support (45%) scams. It implies that large and mature companies have higher cyber awareness levels and, at the same time, more often outsourced assets like technical help vendors or a vast yet difficult-to-unravel network of colleagues, which brings everyone to an eye of a storm.

It is also worth mentioning that companies of all sizes get a lot of fault-line messages inviting them to connect. The frequency of receiving such requests varies by around 40% of companies.

Offerings to purchase non-existent or fake products or services are more prominent for mid-sized businesses — 34% compared to an average of 26% of such encounters with small and large enterprises. Medium-sized companies also lead fake lotteries (30% compared to 24%) and dating/romance scams (28% compared to 18%).

Target geography of LinkedIn scams

The distribution of research data is almost even among different countries participating in the survey. Attention-grabbing information shows that most active LinkedIn users are in the United States, with 83% of respondents having a profile on a platform (72% in Canada and 76% in the United Kingdom). 

However, the engagement rate of scams is lower in the States than in the other two countries. Only 38% were contacted by a fake LinkedIn profile or attempted to be scammed more than once, compared to 43% in Canada and 44% in the UK.

Looking closer at the tendencies of each surveyed country, the United Kingdom is attacked mainly by fake job offer scams (63%) and fake get-rich-quick offers (43%).

The United States leads in receiving a request to connect with a suspicious link — even 47% of respondents confirmed getting one, and 29% received an invitation to take part in a fake survey.

LinkedIn scams in Canada are focused on offering to buy a non-existing/fake product or service (36%) and getting involved in dating/romance fraud schemes (30%).

Despite the country, results were distributed almost equally for cases of phishing attempts (47%) and fake tech support (38%). It’s also important to note that if one scam is more popular than the other in different countries, it doesn’t mean that companies and their employees are safe from getting attacked or should expect only trending attacks.

The aftermath of LinkedIn scams

The scam attempt effects on organizations vary from harming reputation to imposing physical infrastructure damage. Regardless of the size of the business, they may experience the following:

Small businesses are impacted the most by cyber attacks, compared to larger organizations. They are more likely to experience financial loss (67%), stolen IP, and operation disruption (each 58%). Additionally, half of the organizations surveyed had their reputation damaged. Due to attacks, small businesses lose more employees (42%), while medium and large enterprises lose fewer employees (16% and 22%, respectively).

Medium-sized enterprises have to deal with reputation damage the most (47%), stolen and/or damaged data, and customer contacts (each 43%). Compared to other size businesses, mid-sized organizations are more likely to experience infrastructure damage (25%).

On the other hand, large organizations tend to suffer from reputation damage the most (41%), as well as compromised data and financial loss (each 40%). Additionally, 37% of all organizations deal with business operations disruption. Based on the data from respondents, it’s clear that small businesses are affected the most with LinkedIn scams and large enterprises the least.

How to avoid falling for a LinkedIn scam?

To avoid falling for a LinkedIn scam, it’s important to be cautious and alert. Start with making sure any job posting or business opportunity you’re interested in is legitimate before you apply or accept an offer. You can do it by researching the company or person offering the opportunity and only providing personal or financial information if you are confident they are not fake.

It’s also essential to protect your privacy on LinkedIn by adjusting your account settings to limit who can see your LinkedIn profile and send you messages. Be careful of unsolicited messages or connection requests from people you don’t know, and always watch out for signs that the message may be a scam, such as poor grammar, spelling mistakes, and overly aggressive or pushy language.

Tips for recognizing fake LinkedIn profiles

  1. Check the links present in the profile. Real profiles link to the person’s company website or their professional social media profiles. Be careful of shortened links or links that redirect you to another website, as these may be used to disguise fraudulent websites.

  2. Look for inconsistencies or lack of detail in the profile. A legitimate profile usually has a lot of information about the person’s professional history, education, and skills. Fake profiles typically have very little information or no profile picture.

  3. Investigate the activity of the LinkedIn profile. If the profile has very little activity or engagement with other users, likely it’s one of the fake LinkedIn accounts. Additionally, suppose the allegedly fake profiles send connection requests to many people, particularly those without connection to the profile. In that case, it may be part of phishing attacks.

  4. Be cautious of suspicious or irrelevant job offers, promotions, or messages from the profile. Fake LinkedIn profiles often use these tactics to lure users into scams, identity theft, or other harmful activities.

How to recognize fake LinkedIn profile

What to do if you’ve been scammed on LinkedIn?

If you think you’ve been scammed on LinkedIn, don’t panic. The first thing to do is to report the fraud to LinkedIn or the Internet Crime Complaint Center (IC3). Follow the instructions on LinkedIn’s Help Center page to report the scam. You should also contact your bank or credit card company if you have been charged for a fraudulent transaction.

To avoid getting scammed in the future, consider enabling two-factor authentication for your LinkedIn account, checking your account settings regularly, and changing your login details from time to time to ensure your account is secure.

FAQ

Are you worried about scams on LinkedIn? Sadly, LinkedIn is not completely safe from scams like many other online platforms. However, there are things you can do to spot and report scams to protect yourself and others.

How to report a scam on LinkedIn?

If you come across a scam on LinkedIn, first, you should report it to LinkedIn. Here’s how:

  1. Go to the profile of the person or company involved in the scam

  2. Click the “More” button below their profile picture

  3. Select “Report this profile” or “Report this company”

  4. Follow the prompts to provide details about the scam and submit your report

LinkedIn’s Trust & Safety team will review the submitted report and take appropriate action, including removing the scammer’s account and preventing them from creating another one.

How to identify a scammer on LinkedIn?

Scammers on LinkedIn may use a variety of tactics to trick people into giving them money or personal information. Some common signs of a scammer include:

  • A profile that appears to be fake or incomplete

  • Unsolicited messages offering a job or business opportunity that seems too good to be true

  • Requests for money, personal information, or account credentials

  • Pressure to act quickly or keep the opportunity secret

If you encounter any of these signs, it’s a good idea to investigate further before engaging with the person. You can also report the profile to LinkedIn as described above.

How can I check if a job offer on LinkedIn is legitimate?

Before accepting a job offer on LinkedIn, it’s a good idea to make sure it’s real. Here are some ways to check:

  • Research the company offering the job. Look for their website and social media profiles to learn more about them.

  • Check the job description for any red flags, such as vague or unrealistic requirements.

  • Ask for more information from the person offering the job. Legitimate employers will likely provide more details about the position and the company.

  • Look for reviews or ratings of the company on LinkedIn or other online platforms.

LinkedIn scams are a reality, but knowing how to recognize and report them can protect yourself and others from harm. If you encounter a scam on LinkedIn, report it to LinkedIn’s Trust & Safety team, and remember to be cautious when engaging with people you don’t know online.

How can NordLayer help?

NordLayer remote network access solution, by its design, protects digital company assets and their employees. By deploying functionalities for secure online browsing, organization administrators can bring more peace of mind in limiting company exposure to external threats.

Organizations can enforce ThreatBlock functionality that lowers the chances of employees potentially landing on malicious websites. This NordLayer feature helps reduce the risk of accessing publicly enlisted phishing sites, making it forbidden to access them.

To make security even stronger, the DNS filtering by category feature allows administrators to block access to the social media category and restrict access to certain websites for the whole organization.

If the blocking is exclusively required only for the LinkedIn site, admins can select and customize Deep Packet Inspection (DPI) Lite functionality for the organization’s network security. DPI Lite blocks specific ports and protocols from accessing when connected to a company network.

If you believe securing a team’s online activity is important for protecting your company, reach out to our team to discuss your options for creating a secure way of working in your organization.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

B2B LinkedIn scams: trends & how to prevent them

The NordLayer team is happy to announce the launch of a new and one-of-the-kind NordLayer Browser Extension. A now-available extension introduces another layer to increase and reinforce connection and access security for web-based resources.

The extension, operating within browser limits, is a lightweight option for organizations to substitute the NordLayer desktop solution and maintain the security of virtual private gateways. Moreover, utilizing the extension on top of the NordLayer desktop solution allows connecting two gateways simultaneously.

Feature characteristics: what to expect

  • Simple deployment & configuration via browser

  • Available for Advanced plan with a virtual private gateway.

  • Compatible with Google Chrome, Mozilla Firefox, Microsoft Edge browsers

Problem to solve: Seamlessly elevate the user experience by eliminating operating system compatibility issues with a lightweight solution that doesn’t negatively impact internet speed and performance, whichever – remote or hybrid – working setup there is, also enabling more flexible geo-based capabilities.

How does it work?

Generally, a standard connection to the internet is not encrypted if additional security measures are not enforced. Therefore, the implementation of solutions like NordLayer address such security issue. The established encrypted and secure connection to the company network protects online activities on the device level.

However, in some cases, there’s a need for an alternative solution that can replace a full Cloud VPN solution to secure connections just while browsing. Therefore, browser extensions operate as a midway alternative for non-existent and fully deployed security solutions.

NordLayer Browser Extension enables the remote workforce to have Secure Web Gateway (SWG) capabilities to access protected internet and cloud resources. Deployed on a browser, the add-on can run without or on top of the NordLayer application.

Establishing ThreatBlock, DNS filtering, or Deep Packet Inspection (DPI) features for filtering malicious websites from user-generated internet traffic enables SWG capabilities via the browser extension. This way, it protects the user, company network, and sensitive data from exposure to threats.

What problem does it solve?

The browser add-on fills a security and usability gap for organizations’ daily challenges of various working setups. Issues like latency or solution incompatibility with some operating systems (OS) are now resolved when installing the NordLayer browser add-on.

Configured for a company virtual private gateway, NordLayer Browser Extension allows IT admins to rest assured that malicious online traffic is restricted from entering the company network only on a browser level.

From the user’s perspective, the extension is seamless and intuitive to deploy and use. Being 15 times smaller than the NordLayer application, the extension runs in the background without disrupting business workflow.

Browser Extension objectives include:

  1. Protection of the internet and cloud resources accessible by remote and/or hybrid workforces

  2. Replace the setup of a third-party (proxy) browser extension for the end user with a login of organization-defined single sign-on (SSO) and two-factor authentication (2FA) solutions

  3. Introduce a widely available add-on to increase online security

NordLayer Browser Extension is an SWG proxy for organizations to secure connections to web-level resources without encrypting all desktop network traffic.

Security by design

NordLayer Browser Extension defines a simple, intuitive, and effective security approach developed by NordLayer. The add-on is an alternative solution to enrich existing security features provided by the solution for online activities.

Easy to launch and quick to set up, the browser extension provides instant network security for web-based company resources when accessed via the browser.

The extension is effective as a solution alone — it sorts availability and compatibility issues of various OS. It downgrades the network’s connection traffic load – but not the security – when accessing the company’s virtual private gateways, resolving latency and performance problems for the organization.

Moreover, it is a solid addition to web-level security when combined with DNS filtering and routing traffic via custom DNS and implemented with Deep Packet Inspection (Lite). Altogether, browsing security–related features and the browser agent introduces a layered security grid to the organization’s network security strategy.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Data Protection Laws: Why Should I Comply with Them?

Data Protection Laws: Why Should I Comply with Them?

Much discussed today, data protection laws are regulations developed by governments and have come into force to protect the personal and confidential information of data subjects.

However, many companies have not yet adapted to these laws and may be impacted by millionaire sanctions in case of information leaks.

Do you want to learn more on the subject? Follow our article to the end!

 

By 2023, 75% of the world’s population will be covered by data protection laws, according to Gartner estimates. These laws are intended to define guidelines for the collection, processing, and storage of personal data, preserving the privacy of data subjects.

Currently, 71% of countries already have privacy laws, 80% have laws related to cybercrime, 49% have consumer protection laws, and 81% have electronic transaction laws.

Given this scenario, organizations must comply with the terms established by these laws, avoiding the loss of revenue with millionaire sanctions.

In this article, we show you everything you need to know about data protection laws, which are in place in different countries. Our content explores the following topics:

 

1. Data Protection Laws: What Are They, How Do They Work and How Important Are They?

2. Data Protection Laws by Country

3. GDPR: Important European Data Protection Law

4. LGPD: Brazilian Data Protection Law

5. Main Data Protection Laws

6. Iconic Cases of Data Leaks

7. Basic Practices for Complying with Data Protection Laws

8. About senhasegura

9. How Does senhasegura PAM Enable Compliance with Data Protection Laws?

10. Conclusion

 

Enjoy the read!

 

1. Data Protection Laws: What Are They, How Do They Work and How Important Are They?

Data protection laws regulate personal data protection and privacy policies, directly impacting the way companies handle information relating to their employees, customers, and business partners.

In practice, they are sets of rules applied in the collection, processing, and storage of data used by individuals, companies, and governmental organizations.

It is important to note that countries that want to maintain negotiations between themselves must comply with the laws in force in both nations.

Many countries still do not have strict and well-established laws when it comes to data protection, but some already have them, and that will be the subject of the next topic.

 

2. Data Protection Laws by Country

 

Now you will know the context of data protection laws around the world. Check it out:

 

  • Germany

When it comes to privacy and data protection regulations, Germany is ahead of many countries. Its Federal Data Protection Act (Bundesdatenschutzgesetz ? BDSG) was made official in 2017 to replace the legislation with the same name created in 2001 and complement the GDPR.

Germany’s data protection law addresses the rights and duties of public and private institutions regarding the collection and processing of data. It also presents specific guidelines on how companies should handle their employees’ data.

In practice, this legislation offers guidance on specific topics, such as data processing in the context of employment, the stipulation of a data protection officer, profiling, and credit checks.

Moreover, several German laws set strict privacy standards for certain topics, such as television and telecommunications providers, banks, and energy.

 

  • Argentina

Argentina’s Data Protection Law must be complied with by any person or institution dealing with personal data. In addition, this legislation requires the consent of the user for the collection of information.

Another right provided by Argentine law is that the data subjects can access, correct, delete, and request the deletion of their data whenever deemed necessary.

 

  • Australia

The Australian Privacy Act of 1988 imposes rules aimed at the public and private sectors. Issues such as data subject rights, transparency, and use and disclosure of information stand out among the 13 Australian Privacy Principles addressed in the legislation.

In addition to the law in force throughout the country, Australian states also have their own regulations, aimed at certain segments.

 

  • Brazil

In Brazil, the General Data Protection Law (LGPD) came into force in 2020, but the topic had already been explored before in the Federal Constitution and the Consumer Protection Code.

In addition, in 2014, the Internet Civil Framework was approved, which addresses the rights and duties of network users, such as privacy, freedom of expression, and civil liability.

 

  • Canada

Between provincial and federal laws, Canada has a total of 28 data protection regulations. Its federal law is the Personal Information Protection and Electronic Documents Act (Pipeda), which regulates the collection, processing, and disclosure of personal information.

Pipeda addresses 10 principles to be followed by organizations and has similar and complementary legislation used in Alberta, British Columbia, and Quebec.

 

  • China

Also known as The Standard, the Information Security Technology ? Personal Information Security Specification law is Chinese legislation on data privacy.

It is a set of rules that addresses things such as the rights of the subject, transparency, and consent. This law came to replace several separate regulations on these matters.

 

  • Europe

GDPR is the data protection law in force in Europe, which is based on seven principles for data processing. They are: lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability.

By following these principles, companies can remain compliant with the regulation. Moreover, data controllers also assume responsibility for their processing and must comply with European legislation.

In practice, personal data should be:

  • Processed in a lawful, fair, and transparent manner;
  • Collected for specific, legitimate, and explicit purposes, and processed in a manner compatible with the explanations offered. In the case of further processing for purposes of public interest, they should not be considered incompatible with the initial purposes;
  • Appropriate, relevant, and limited to what is essential for the proposed purposes;
  • Accurate, updated, erased, and rectified immediately after use;
  • The data must allow the identification of its subjects only for the time necessary for their use. However, they can be stored for longer periods if they are processed exclusively for purposes of public interest, scientific research, historical, or statistical purposes related to the implementation of technical measures and organizations required by the GDPR.
  • Its processing must also ensure the security of personal data, which includes protection against unlawful processing, accidental loss, destruction, or damage.

 

  • Colombia

Four laws regulate data privacy in Colombia. They are: Decree 1,377/13, Law 1,581/12, Law 1,273/09, and Law 1,266/08.

The first addresses issues such as consent, personal data processing policies, and international transfers of information.

The other laws address, respectively, how the collection, storage, and processing of data should be performed; cybercrimes and commercial and financial data, among other topics.

 

  • The United States

The United States has several laws governing data privacy, depending on the industry or state. All in all, there are about 20 laws related to a single area, in addition to approximately 100 state laws.

The state of California alone has 25 laws, with the California Consumer Privacy Act (CCPA) being the main one.

Despite these state laws and legislation such as the Privacy Act, the Privacy Protection Act, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Fair Credit Reporting Act, the United States still does not have specific legislation for the protection of its citizens’ data.

 

  • Philippines

The main legislation on the protection of personal information in the Philippines is the Data Privacy Act, drafted in 2012 and implemented in 2016.

According to this regulation, individuals have the right to know which companies access their data, for what purpose, who will have access to the information, and by whom it will be processed.

 

  • France

Like Finland, France has also replaced its old regulations in order to more faithfully contemplate the aspects addressed in the GDPR: its Data Protection Law (Law 78-17) was replaced by the 2nd French Data Protection Act (2016-1321).

Under the new legislation, companies must specify the purposes of data processing and ensure only information essential to those purposes is collected.

 

  • India

Currently, India has several complementary laws on data security, but the Information Technology Act and the list of Information Technology Rules are the most important ones.

In addition, the country published the Digital Personal Data Protection Act in 2019, which is being analyzed by a parliamentary committee.

 

  • Indonesia

Indonesia has a set of data protection rules, which focus on the Electronic Information and Transactions Law, its amendment, and two other regulations.

Soon, its rules should also be gathered around a single piece of legislation, formulated along the lines of GDPR.

 

  • Japan

Data protection in Japan was governed by the Act on the Protection of Personal Information until 2003, however, in 2017, the country adopted the APPI Amendment, which includes aspects such as sharing information with third parties, information held in databases, and leaks.

 

  • Malaysia

In place since 2010, Malaysia’s first data protection legislation is based on seven principles: generality, notification and choice, disclosure, security, retention, data integrity, and access.

According to this regulation, it is necessary to inform the holder in writing of their rights, the purpose of the collection and processing of the data, and who will access them.

 

  • Mexico

In 2010, the Federal Law on Protection of Personal Data Held by Individuals was established in Mexico, which includes data collected and processed by private organizations.

These companies are also governed by the rules of the list of Regulations of the Federal Law on the Protection of Personal Data Held by Individuals, the Privacy Notice Guidelines, and the Self-Regulation Parameters.

Also, Mexico relies on the Federal Institute for Access to Information and Data Protection (IFAI) to manage all these rules.

 

  • New Zealand

In New Zealand, data protection is controlled through the country’s Privacy Act, which has 12 Information Privacy Principles, established in 1993. In addition, the country has regulations directed at certain industries.

What’s more, the Data Privacy Act 2018 should soon be approved, which will replace 1993’s legislation.

 

3. GDPR: Important European Data Protection Law

The General Data Protection Regulation (GDPR) is a set of European rules governing the use of data in electronic environments. It aims to strengthen the concept of digital citizenship and protect users in aspects such as financial services and social media interactions.

In practice, this regulation proposes individuals and legal entities should use personal data responsibly, preserving the privacy of the information holders.

Its mass spread is still recent, so not all countries in Europe have their virtual environment activities in a regulated manner.

In addition, despite being European legislation, the GDPR impacts other countries that perform commercial transactions with European nations and need to comply with its standards.

The General Data Protection Regulation addresses the collection, use, sharing, and security of personal data in the 28 countries that make up the European Union.

Therefore, organizations that do not comply with its rules are subject to fines of up to 20 million Euros or 4% of their turnover. Here are some important GDPR criteria:

 

  • Consent of Data Subjects

Before companies begin collecting personal data, they need to obtain the express consent of the information holders.

However, it is important to keep in mind some data that is not protected by the laws of the United States and not considered personal in Europe must be preserved. This is the case with IP addresses.

 

  • Notification of Data Breaches to Authorities

Another obligation of companies, according to GDPR, is to notify data subjects and authorities within 72 hours if there is a breach that affects the privacy of users.

 

  • Rights of Data Subjects

Under GDPR, data subjects must be guaranteed certain rights related to their personal information. Among them, we can highlight:

  • Be informed about the collection and use of their data;
  • Request a copy of their personal information and receive explanations about the means of collection, what is being collected, and with whom it will be shared;
  • Request rectification of data that may be incomplete or incorrect;
  • Have their personal data deleted within 30 days if they make such a request;
  • Request the restriction of their personal information;
  • Transfer personal data from one electronic system to another securely; and
  • Oppose the way the data is used, (unless the information is in the possession of a legal authority), for purposes of public interest or by a company that needs to process the data in order to offer a service that the data subject has contracted.

 

New Perspectives for the General Data Protection Regulation

The European Union is expected to update its rules on digital services soon through two new laws: the Digital Services Act and the Digital Markets Act.

The purpose of these laws is to keep what is legal online and what is illegal offline, causing websites like Google to quickly remove content deemed illegal or harmful.

The Digital Services Act and the Digital Markets Act will target very large online platforms and search engines with over 45 million monthly users.

In practice, the Digital Services Act deals with any service delivered through the internet, covering hosting services, intermediary services, and online platforms, and obligations vary according to the size of the company.

The Digital Markets Act, in turn, affects large organizations such as Apple and Facebook. Its goal is to level companies by preventing large organizations from imposing unfair conditions on companies and the public.

In the coming years, the Electronic Privacy Regulation will also enter into force, which will establish privacy guidelines for electronic communication services and institutions, which were not governed by previous legislation.

This law should also simplify consent or denial of tracking cookies, allowing users to withdraw their consent at least once a year.

Finally, there is the AI Law, which should be applied to all organizations that use programs based on artificial intelligence. The legislation has already been introduced and is in the process of being revised. It applies to any organization with customers in the European Union, regardless of where it is located.

 

4. LGPD: Brazilian Data Protection Law

The Brazilian Data Protection Law (LGPD) is a Brazilian regulation that aims to preserve the personal and private data of people residing in Brazil. This legislation describes what personal data is, further explaining what type of information deserves more attention.

Also, according to the LGPD, regardless of whether the company is located outside the country, its requirements must be respected.

 

5. US Data Protection Laws

 

CCPA

As we have already mentioned in this article, the United States has a series of data protection laws divided by segments and areas. One of the states where these regulations have solidified is California, which is governed by the California Consumer Privacy Act (CCPA).

This legislation gives consumers more control over the information collected by companies, as well as the right to know how this data is used and shared, and to delete and refuse to sell that information.

Moreover, clauses in contracts that include the waiver of rights guaranteed by the CCPA are unenforceable.

 

NY Shield

New York also has its own data protection law, the NY Shield, in place since 2020. This regulation requires security and accountability from organizations that handle the personal data of residents of the state.

NY Shield emerged through the expansion of other laws that previously existed in New York: the General Business Law and the Warn Act.

 

US Federal Laws

We will now mention some US federal laws, which, although not specific to data protection, have the function of protecting certain types of information in specific circumstances. One of them is the Health Insurance Portability and Accountability Act (HIPAA), which protects user communication with health entities such as hospitals and pharmacies.

The United States also has, as a federal law, the Family Educational Rights and Privacy Act (Ferpa), with the function of detailing who is authorized to request students’ educational records.

The Gramm-Leach-Bliley Act (GLBA) includes banking services and requires financial institutions to explain how they share data and respect the right of customers who do not wish to provide their information.

6. Iconic Cases of Data Leaks

Here are some known cases of data leaks:

 

  • LinkedIn

In 2012, LinkedIn was hacked by malicious actors who exposed the personal information of more than 117 million users. At the time, data such as names, email addresses, and passwords were leaked.

 

  • Evernote

The following year, it was Evernote’s turn to become a target for attackers, who accessed usernames, email addresses, and account passwords on the platform.

 

  • Yahoo

Also in 2013, Yahoo announced it was the target of a data breach that exposed the names, phones, birthdates, and passwords of 3 billion users.

 

  • Adobe

Also in 2013, Adobe customers had their data leaked. It is estimated that 152 million names and passwords were exposed at the time, as well as 2.8 million credit card numbers. However, only 38 million pieces of data have been confirmed.

Adobe was sued by several US states and had to pay a $1 million fine.

 

  • Facebook

In 2014, Cambridge Analytica used personal data from Facebook users to conduct unauthorized behavioral tests that would later be used in the presidential campaign of Donald Trump.

 

  • Uber

More than 57 million users of the Uber app, including 200,000 Brazilians, had their data exposed in a data breach that occurred in 2016, but it was only released the following year.

As a result, the government of California, in the United States, fined the company R$150 million.

 

  • Myspace

The social network MySpace was also targeted by malicious agents in 2013, with 360 million users impacted. However, the information did not become public until three years later, through a notification that users’ personal data had been exposed and could be for sale.

 

  • Twitter

The 330 million people who used Twitter in 2018 had to change their passwords after the social network discovered a vulnerability in its database. A few years earlier, Twitter users’ personal data had already been exposed twice due to security flaws.

 

  • McDonald’s

In 2019, more than 2 million McDonald’s records with the personal information of its employees were leaked. The data included the full name, age, time of experience, position, and salary of the employees.

 

  • Amazon

In 2021, the company was fined by the Luxembourg National Commission for Data Protection for failing to comply with data protection law requirements in its advertising system. The fine resulted in a loss of 746 millions of Euros.

 

7. Basic Practices for Complying with Data Protection Laws

Data protection experts recommend that companies redefine their organizational management, taking into account certain factors.

Among them, we can highlight:

  • The need to have a professional in charge of data security;
  • Execution of a complete audit of the information;
  • Definition of the data lifecycle;
  • Re-elaboration of contracts with suppliers and partners;
  • Review of security policies; and
  • Preparation of privacy impact reports.

For this, one can count on the services of a legal office specialized in data protection laws, in addition to technological solutions that favor digital security.

 

8. About senhasegura

We, from senhasegura, are part of the MT4 Tecnologia group, created in 2001, to promote the cybersecurity of the companies that hire us.

We serve organizations from 54 countries, offering our customers control of insider actions and information in order to prevent threats such as malicious attackers and data leaks.

For us, digital sovereignty is everyone’s right and this goal can only be achieved using applied technology.

Therefore, we follow the lifecycle of privileged access management, before, during, and after access. Our commitments include:

  • To ensure more efficiency and productivity for businesses, as we avoid interruptions due to expiration;
  • To perform automatic audits on the use of privileges;
  • To automatically audit privileged changes to detect abuses;
  • To ensure customer satisfaction;
  • To perform successful deployments;
  • To provide advanced PAM capabilities;
  • To reduce risks;
  • To bring companies into compliance with audit criteria and standards such as PCI DSS, Sarbanes-Oxley, ISO 27001, and HIPAA.

 

9. How Does senhasegura PAM Enable Compliance with Data Protection Laws?

senhasegura PAM is a solution that allows companies to comply with data protection laws through tools that provide security to the digital environment.

It also proposes the implementation of policies, processes, and procedures, in addition to increasing the level of cyber awareness of users.

One of the main capabilities of this feature is the protection of privileged credentials through the Principle of Least Privilege, which guarantees each user only indispensable access to perform their functions.

 

10. Conclusion

In this article, you saw that:

  • Data protection laws affect the way companies handle sensitive information from their customers, employees, and business partners;
  • Many countries do not have well-established laws on the subject yet, but several nations are already concerned about it;
  • We showed data protection laws in force in different countries;
  • We also covered the main data laws today;
  • We presented emblematic cases of data leaks, such as Facebook, Uber, and Twitter;
  • We listed good practices for companies that need to comply with data protection laws;
  • Finally, we presented senhasegura PAM as an effective solution for these organizations to achieve their goal.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

How to Build a Comprehensive Identity Strategy

JumpCloud recently held a webinar to discuss how password management fits within an organization’s Identity and Access Management (IAM) stack. 

Our host, JumpCloudian Allison Casto, was joined by Antoine Jebara, co-founder and GM of MSP Business, and Rob McGrath, product manager, in discussing the relevance of password management and how JumpCloud Password Manager helps organizations build a comprehensive identity strategy. Below is a recap of the key points discussed during the webinar.

Passwords have long been heralded to be on their way out. With several authentication methods now available to organizations, passwords no longer enjoy the center stage of their identity access management strategy.

However, no thanks to a combination of factors, it doesn’t appear that passwords are going away completely, forever — just yet.

So, what’s an organization to do? 

Should they focus solely on their other authentication methods and hope that passwords die a quicker death? Or should they face the inevitable fact that passwords are sticking around a bit longer than we thought and must be effectively managed?

This post discusses why password management is relevant today and how organizations can include it in their access management strategy.

Password Management: Why Bother?

Almost two decades after Bill Gates first predicted the end of passwords, passwords no longer form the core of most organizations’ access management strategy. But here’s why organizations must pay attention to password management:

Ubiquity

Passwords are the most common authentication method, and for good reason. First, they’ve been around for far longer. Second, passwords are a right-out-of-the-box feature in almost all devices. This is more than can be said for other modes of authentication such as biometric recognition or smart cards.

The net effect is, despite organizations’ less reliance on them, passwords are likely to hang on till, at least, other authentication methods become as commonplace.

Weakness

Organizations must have a password management strategy to protect themselves from the vulnerabilities that passwords pose. From phishing to physical theft, and even dumpster diving, passwords pose the most risk of enabling authorized access.

Throw in the rising cost of data breaches — 4.5 million dollars as of 2022 — coupled with the fact that 80% of data breaches are caused by weak or reused passwords, then it’s clear why IT teams cannot afford to be lax in their password security approach.

Single Sign-On (SSO) Challenges

In developing their IAM strategy, many IT teams have had SSO play a significant role in their strategy. SSO enables users to log in once to all the company resources they need to get their work done.

This is mostly done by coupling SSO with push authentication, biometric recognition, and other authentication modes.

Sometimes, however, users will not be able to use SSO to get into some paywalled web-based apps. Or sometimes, they may have to use some shadow IT tools which aren’t part of the company’s infrastructure.

In such instances, password usage creates a gap which password management must bridge, or organizations risk security exposure.

Password Managers + Types

Password managers are software that securely stores and protects users’ login information. Although they typically maintain records of usernames and relevant passwords, they also offer additional storage options. This includes addresses, card details, etc.

There are three major types of password managers:

Offline Password Managers

These password managers store and encrypt passwords locally on a user’s endpoints but don’t sync the password across different devices. Thus, users can only use the password manager on one device outside the box.

Offline password managers are rather unfit for enterprise use cases because they don’t grant admins with centralized visibility and control. What they lack in convenience however, they make up for in security. Offline password managers are not susceptible to network or server attacks since they store and encrypt passwords on the user’s device.

Cloud-Based Password Managers

Cloud-based password managers store passwords in a vault which is itself located on the password manager servers. The passwords are encrypted with a key called the “Master Password.” The user is tasked with creating, remembering, and protecting this master password.

Users access the information in cloud-based password managers using a combination of their email and the master password.

These are more convenient since users can access them on multiple devices. Plus, they give a high level of visibility and control to admins. However, they make a huge trade-off in security as their effectiveness depends on the user’s ability to create and protect a strong master password.

More worryingly, hackers can also breach password manager servers and gain access to users’ passwords.

Hybrid Password Manager

A hybrid password manager, such as JumpCloud Password Manager, works by combining the best traits of the first two types of password manager.

It uses a decentralized storage architecture where passwords are stored locally on the user’s endpoints. Next, it generates a key for encrypting the passwords in a vault.

This vault then syncs across other devices on JumpCloud’s network, thereby making simultaneous login possible.

It also allows users to share passwords with other users in the organization. What’s more? A hybrid password manager facilitates an environment where admins have visibility and control but without being able to see the user’s password unless where it is shared with them.

An inherent advantage of JumpCloud’s password manager is that reliance is not placed on a user’s ability to create and protect a master password. Thus, users can authenticate access to this vault using biometrics, Windows Hello, or other local authentication means.

JumpCloud Password Manager: Fitting Into a Larger Ecosystem

JumpCloud developed its sophisticated password manager in response to growing demand from organizations. The password manager provides a single-point solution for IAM needs, reducing tool sprawl and lowering IT costs.

The password manager integrates with the JumpCloud open directory platform and greatly complements other tools such as multi-factor authentication (MFA), SSO, conditional access, etc.

Besides its benefits as an important part of a larger ecosystem, JumpCloud Password Manager is also a superior option because it eliminates the dilemma of choosing between convenience and security.

The manager increases users’ productivity and generally makes for a better experience. It saves users’ time and effort that would otherwise have been spent writing out passwords of shadow IT resources on Post-it Notes and Google Sheets. It does this by storing and auto-filling passwords across websites, mobile apps, and desktop apps. 

The password manager also enables users or teams to share passwords with other colleagues without compromising security.

JumpCloud Password Manager also provides a seamless experience for admins as it is deployed and managed through one console. Plus, it gives them a high level of visibility and control over user passwords. For example, the password manager gives admins insight into users’ password strength and reuse cases without revealing the passwords themselves.

Leverage JumpCloud’s Password Manager Today

As passwords continue to stick around, IT admins must understand how to fit password managers into their organizations’ IAM strategies.

With JumpCloud’s hybrid password manager being the perfect mix of security, visibility, control, and convenience, password management just became less of a pick-your-poison dilemma.Learn more about JumpCloud’s password manager and watch a demonstration of it in this webinar.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×