banks

5 questions journalists should be asking about the Capital One breach

Countless Capital One customers were left reeling this week upon learning that a huge data breach exposed their private information including credit scores, balances, and social insurance numbers. Just days ago the institution revealed that the personal data for more than 100 million credit applications and cards — including six million from Canada — were laid bare.   

Paige Thompson — who goes by the name “erratic” online — is alleged to have exploited a vulnerability in Capital One’s online credit card application, for apparently no reason other than to show that she could. Based on the evidence presented by the FBI in court documents, Thompson does not appear to be an experienced hacker, and even seemed to want to get caught, leaving her digital footprint and evidence everywhere. 

Reporters have come at this story from many angles, but here are a few questions the media haven’t yet addressed: 

1) How long has this vulnerability existed?

The focus of this breach has been on the hacker herself — who she is and how she operated — but we don’t know how long this security hole was open, and who else may have taken advantage of it, with what malicious intent. If a more sophisticated hacker had wanted to get their mitts on this data, they could easily have done so. Thompson is less the problem, and more a symptom.

2) Why are banks holding onto this decade-old data in the first place?

“Zombie data” — old data that’s considered dead to the company but that still lurks somewhere, waiting to be revived — is dangerous, and the data involved in this hack has been hanging around since possibly about 2005. There’s no good reason for a financial institution to hang onto years-old credit card applications after they’ve been approved or denied. Why was this info even there to be exploited?

3) Who knew what, and when?

The FBI documents say Capital One was notified July 17 of the breach, but the bank claims it only became aware of the breach on July 19. Why the discrepancy? Is it plausible that no one checked their email for a full two days? Beyond that, Capital One didn’t disclose the breach to customers until July 29 — well after their July 18 second-quarter meeting. What happened during that week and a half? Based on the FBI documents, this doesn’t seem like it took terribly long to figure out what went wrong and who did it.

4) What kind of fine are they facing in Canada?

When the notorious Equifax breach came to light, Canada gave them little more than a slap on the wrist, instead of imposing tough penalties that would force other institutions to take notice and action. According to our country’s new Digital Privacy Act, fines for this type of privacy breach can be up to $100,000. We still don’t know whether the fine will be applied or the government will dole out another freebie.

5) Why aren’t banks required to provide better security tools to their customers?

Multi-factor authentication, for example. The government should regulate banks’ safety tools to remove the option of choosing convenience for the customer over security. If every bank has the same privacy measures in place, our national cybersecurity will see real improvements, so why are governments not acting on this? Requiring banks to offer more advanced security — in a similar, standardized way with a defined date — will end the standoff that exists where the banks are too afraid of losing customers to another institution due to the perceived inconvenience of things such as MFA.

While these breaches are scary — and becoming more common all the time — if we push for legal change and aim to protect our personal data, we can stop hackers in their tracks.  

To learn more about protecting your identity at home or at work, contact the Beauceron Security Team @ info@beauceronsecurity.com or 1-877-516-9245. 

Verified.Me app makes proving your identity easy

Last week, banks in Canada announced the launch of Verified.Me, a free app that helps you prove your identity online.   

Because practically every online service requires a different username and password, it can be tough to prove who you are when you’re logging into your various accounts. Not only do you need to remember dozens of these credentials, but you often need to answer security questions, show physical identification — and it’s all getting too complicated.

Security AND speed

The goal of the app is to speed up the process of authentication while maintaining security and privacy. Logging into accounts and juggling passwords and identities is a pain, and people tend to sacrifice security in favour of convenience. Verified.Me aims to provide both. 

sign-in partner.PNG

This kind of service is already used by federal agencies like Canada Revenue Agency where you can log into your personal or business tax account through your bank, also known as a “sign-in partner.”  

How does Verified.Me work?

Think of any online service that requires you to create a username and password; instead, you log into your bank account only, through the Verified.Me app. If the bank deems that particular service to be trustworthy, you can log in automatically.  

You’ve already proven your identity at the bank; it’s the most important — and most tedious — step when opening your account. There are strict regulations in place, you need to show government-issued I.D. and open a real account as the real you. Of all the online entities, banks truly know who you are as a person. 

One identity to rule them all

The idea of a “federated identity” — a way of linking your identity and attributes, stored across multiple identity management systems — is coming up more and more these days, as identity becomes increasingly complex.   

“Single sign-on" (SSO) lets users log in to one service with a single ID and password to gain access to several sites and accounts. SSO is a good idea that has been mismanaged in the past by Google and Facebook and others — companies that have shown they can’t be trusted to manage and secure our digital identities. 

Facebook’s SSO was hacked in 2018, when it was revealed that it had fallen victim to an attack that breached 50 million user accounts. Google’s SSO has issues, too — if someone breaches your Google account, for example, they then have access to your passport information in Expedia, private messages on Tinder, location data on Uber — literally any site or service you access through the Google single sign-on.   

Why trust the banks?

Banks spend more on cybersecurity than any other organization in the country. They’re dealing with huge amounts of money so it makes sense that they have a vested interest in verifying their customers' identity and protecting against fraud.  

Unlike Facebook or Google, their entire business relies on being secure. 

How to get started

Download the Verified.Me app on your phone, open it and choose your bank from the list of options (Scotiabank, RBC, CIBC, TD or Desjardins). You’ll then be redirected to your bank’s app or website, where you can log in using your username or card number and password. Once you’re in, you can add “Connections” to your personal list and use the app to log into all those services.   

You’re in control of how and when your personal information is used, and no personal info is stored in the app — it's a win from all angles!  

To learn more about protecting your identity at home or at work, contact the Beauceron Security Team @ info@beauceronsecurity.com or 1-877-516-9245.