Cyber Security Unit - 5
Cyber Security Unit - 5
Privacy Issues:
“No one shall be subjected to arbitrary interference with his privacy, family,
home or correspondence, nor to attacks upon his honor and reputation.
Everyone has the right to the protection of the law against such interference or
attacks. - Universal Declaration of Human Rights
“Everyone has the right to respect for his private and family life, his home and
his correspondence. -European Convention for the Protection of Human Rights
and Fundamental freedoms
Data profiling is the process of examining the data available from an existing
information source (e.g. a database or a file) and collecting statistics or informative
summaries about that data. ... Assess the risk involved in integrating data in new
applications, including the challenges of joins.
Introduction:
Today is world of heterogeneity.
Enterprises.
Problems
Duplicated , inconsistent
, ambiguous, incomplete.
Data Profiling:
Context:
In process of data warehouse design, many database professionals face
situations like:
1. Several data inconsistencies in source, like missing records or NULL values.
2. Or, column they chose to be the primary key column is
not unique throughout the table.
3. Or, schema design is not coherent to the end user
requirement.
4. Or, any other concern with the data, that must have been
fixed right at the beginning.
Solution:
Instead of a solution to the problem, it would be
better to catch it right at the start before it
becomes a problem.
After all “PREVENTION IS BETTER THAN
CURE”.
Hence data profiling software came to the
rescue.
Personal information can be anything that can be used to identify an individual, not limited to the
person's name, address, date of birth, marital status, contact information, ID issue, and expiry
date, financial records, credit information, medical history, where one travels, and intentions to
acquire goods and services.[2] In the case of a business, it is often a statement that declares a
party's policy on how it collects, stores, and releases personal information it collects. It informs
the client what specific information is collected, and whether it is kept confidential, shared with
partners, or sold to other firms or enterprises.[3] Privacy policies typically represent a broader,
more generalized treatment, as opposed to data use statements, which tend to be more detailed
and specific.
The exact contents of a certain privacy policy will depend upon the applicable law and may need
to address requirements across geographical boundaries and legal jurisdictions. Most countries
have their own legislation and guidelines of who is covered, what information can be collected,
and what it can be used for. In general, data protection laws in Europe cover the private sector,
as well as the public sector. Their privacy laws apply not only to government operations but also
to private enterprises and commercial transactions.
This Privacy Policy applies only to data collected through the Site and not any other data
collection or processing including, without limitation, data we may collect offline or data
collection practices of other web pages to which we link, or though websites, products or
services that do not display a direct link to this Privacy Policy.
Data you submit. When you request information, subscribe to or order a product
or service, register as a user, respond to an online survey or otherwise actively
send us data, we usually collect data such as your name, email address, mailing
address, telephone number, and certain information related to your the business
you represent. In connection with chargeable services,
we will also collect payment information (e.g., credit card number and related
verification information), phone number, and billing and shipping addresses.
We some time partner with other organizations. When we do, we may present
you with the option to share your email and personal information with the
partner organization and to opt-in to their program. In each such instance, you
will know what data we collect through the site, because you actively submit it.
We may also allow third parties such as web analytics partners, advertisers, data
processors, marketers, shippers, product logisticians, customer service
personnel, advocacy and outreach personnel, or ad networks to set or access
their cookies or web beacons (also referred to as 1x1 pixel.gifs or action tags)
on the site. For example, we may use third party advertising companies to serve
ads on our behalf across the Internet or to display ads for other companies on
our site.
This information may include: date/time of banner ad shown, their cookie, and
the first three octets of the IP address. This anonymous information can also be
used for online preference marketing purposes. These third parties may use
information about your visits to this and other websites in order to provide ads
about goods and services of interest to you. If you would like more information
about this practice and to know your choices about not having this information
used, click here.
You are free to decline cookies, but by doing so, you may not be able to use
certain features on the site or take full advantage of all of our offerings. Check
the “Help” menu of your browser to learn how to change your cookie
preferences.
Parallel does not sell or otherwise disclose your personal information outside of our
organization without your explicit permission. However, if you become a registered Site user,
some information on our membership lists, such as your name and mailing address, may be
exchanged with other organizations. Members may opt-out of such membership list
exchanges by following the opt-out procedures described below.
Opting-Out
If you no longer wish to receive communications from Parallel, you may email us at
[email protected] or click on the “unsubscribe” link at the bottom of any email sent
to you by Parallel. You should know that opting-out or unsubscribing from our site does not
delete your personal information from our system, which may exist in backup or disaster-
recovery files.
Even if you opt-out, we may continue to contact you via email for administrative or
informational purposes, including follow-up messages regarding the administration of your
account, renewal of your membership, contests you have entered or other transactions you
have undertaken.
Security
Parallel uses industry accepted data collection and encryption methodologies in an attempt to
ensure the secure collection and transmission of sensitive user information. While we try our
best to safeguard your personal information once we receive it, no transmission of data over
the Internet or any other public network can be guaranteed to be 100% secure.
IP Addresses
An Internet Protocol (IP) address is a number that is automatically assigned to your computer
by your Internet service provider whenever you access the Internet. This number may be the
same each time you access the Internet, or it may change. Like other Internet sites, Parallel
uses IP addresses to collect aggregate information about numbers of visitors and Site usage.
The address is logged on our server when your computer requests information from Parallel.
You IP address is not linked to your personal information so you can access our site
anonymously. Parallel reserves the right, in rare instances, to use IP addresses to identify
individuals who threaten our site, service, or users.
Parallel qualifies for this alternative option. It has a comprehensive privacy policy and
provides you with details on how you may either opt-out or opt-in to the use of your personal
information by third parties for direct marketing purposes. We are not required, therefore, to
maintain or disclose a list of the third parties that received your personal information for
marketing purposes during the preceding year.
Children’s Privacy
The Site is intended for adults. We do not intentionally or knowingly collect personally
identifiable information from children under the age of 13. We request that children under
the age of 13 not submit any information on the Site.
Other Websites
This Privacy Policy applies only as long as you remain on the Site. Once you leave the Site,
we have no control over your privacy or security issues even if you reached the other site by
clicking on a link within the Site.
Contacting Us
If you suspect that we have handled your personal information in a manner that doesn't
comply with the Privacy Policy, please contact us by e-mailing [email protected].
Amendments
We reserve the right to change this Privacy Policy from time to time and in our sole
discretion. We reserve the right to change, modify, add or remove portions of this Privacy
Policy at any time, but will alert you that changes have been made by indicating on the
Privacy Policy the date it was last updated. When you visit the Site, you are accepting the
current version of this Privacy Policy as posted on the Site at that time. We recommend that
users revisit this Privacy Policy on occasion to learn of any changes.
Privacy policy languages were designed to express the privacy controls that both
organizations and users want to express. Most of the privacy policy languages were
designed for specific purposes with specific features and characteristics.
privacy in
PRIVACY IN DIFFERENT DOMAINS- MEDICAL, FINANCIAL:
Privacy is the fair and authorized processing and access of personal information. ...
Information Security is that the use of logical, technical, administrative, physical safeguards
to ensure the confidentiality, integrity, and availability of the data is maintained.
Cybercrime: Examples and Mini-Cases
Joint Commissioner of Police (Crime) Rakesh Maria said that access to the
website, www.maharashtra.gov.in , had been blocked for a while. "It had some Arabic
content posted on it by the hacker. The IT department has lodged an FIR with the police and
we will try and trace the culprit," said Maria. It is suspected that the same group of
international hackers was behind all the four attacks.
The site was hacked into late on Monday night by a person or a group calling itself
"coolhacker" who had left an imprint of a hand on the website. The state’s information and
technology department came to know of the hacking Tuesday morning and immediately
blocked all access to the website.
State officials maintained that no data had been lost and no serious damage had been
inflicted on the website, which is updated daily with information on various government
regulations and decisions, and supports links to all government departments. The hacker
could only manage to damage the homepage. However, restoration work is in progress.
The state government website is hosted on a VSNL server. In the month of August, 345
Indian websites — ending with .in, .co.in and edu.in — were defaced by hackers. Nearly
2,700 Indian websites have been hacked since January.
Indian banks reported a total loss of about Rs 70,000 crore due to frauds
during the last three fiscals up to March 2018, the Rajya Sabha was
informed today.
The extent of loss in fraud cases reported by scheduled commercial banks
(SCBs) for 2015-16, 2016-17 and 2017-18 was Rs 16,409 crore, Rs 16,652
crore and Rs 36,694 crore, respectively, Minister of State for Finance Shiv
Pratap Shukla said in a written reply quoting RBI data.
The minister said that data of frauds is as per the year of reporting and not
the year of occurrence of fraud or sanction of loan, letter of undertaking,
which may might be of an earlier period.
The minister also informed the House that gross advances by SCBs
increased from Rs 25.03 lakh crore as on March 31, 2008, to Rs 68.75 lakh
crore on March 31, 2014.
As regards the stressed assets in the banking system, Shukla said the
spurt was due to aggressive lending practices, wilful default, loan frauds,
corruption in some cases and economic slowdown.
Replying to another question, he said as per RBI data, there were 139
borrowers with aggregate gross NPAs of more than Rs 1,000 crore.
Parliament Attack
The gang was also wanted by the police in Delhi, Mumbai, Tamil Nadu
and Gujarat, Hyderabad Police Commissioner Anurag Sharma told media
persons here on Friday.
The gang members would later apply for a trade licence from the Labour
Department. After getting the trade licence, they would open current
accounts. With the help of their associates in India, the gang would send
emails containing fake bank pages to lakhs of people. “Many fell into the
trap and sent their online banking details,” Mr. Sharma said.
The gang then used to accesses the bank details of customers. The
Nigerians would target accounts having huge cash and pass on the details
to their accomplices in India who would transfer the funds using fake ID to
the accounts created earlier fraudulently.
After deducting their commission, the accomplices here would transfer the
remaining amount to the Nigerian nationals who would buy clothes and
return to their country by ship. “Connivance of a few officials coupled
with superficial checking by bank officials, labour department and service
providers is leading to this problem,” the Commissioner said.
The accused, Prabhu Jayadeep Patvari, managed to secure 154 SIM cards
in three months and the gang was also able to open 38 accounts
fraudulently in the city.
The police also managed to stop money transfer of Rs.61 lakh by alerting a
nationalised bank but the gang managed to withdraw Rs.5 lakh using a
cheque.
The fraud came to light when branch manager of Sanghvi Corporation,
Kailash Nath Seth, complained to the police that Rs.5 lakh was
fraudulently transferred to a Kanpur PNB account. He gave two phone
numbers from which an unidentified person claiming to be a bank
employee took a password from him. With this information, the police first
caught Patvari and later the five others.
Waking up to the threat of email spoofing after six companies fell prey to
scamsters in the span of a week, the cyber police station at Bandra-Kurla
Complex has issued an advisory to top executives of corporate companies to
be careful when they receive mails requesting funds.
In email spoofing, scamsters create mail ids similar to their target company’s
domain name, and send a mail, generally to the CFO, in the name of one of its
top executives seeking money urgently. If the company’s domain name is
rampaints.com, they might register a domain name rampa1nts.com, says
advocate and cyber expert Prashant Mali.
About 50% of these six companies have lost lakhs of rupees, if not crores. “In
a majority of the cases, the CFOs were targeted. The mails were sent in the
name of MDs or CEOs asking for immediate fund transfer through RTGS
or NEFT to their personal account (by giving the scamster’s account number),”
a cyber police officer said.
In almost all cases, the CFOs did not verify the mail. “The sender’s mail id
looked similar to the company’s domain, so they thought it was a mail from
their top executives,” said the officer.
Investigators said the mails were sent the same day that the domains were
created so that the scamsters earned fast buck before the domain was
suspended.
There are also other costs. As counterfeit goods are produced without regard to EU
health and safety standards, they may be dangerous for consumers.
Government revenue is also affected by counterfeiting and piracy, which can stifle
investment and innovation, hinder economic growth and reduce the creation of
wealth.
In addition, the criminal groups involved in intellectual property crime often use the
profits to finance other illegal activities.
Financial Frauds in Cyber Domain.
Globally it is been observed the more and more cyber crimes are being committed
for financial motives rather than for revenge or fun. ... Financial Frauds include
Credit card frauds, Debit card frauds, Internet banking frauds, Mobile
banking frauds, Insurance frauds, Computer manipulation, Accounting scams etc