Online Buyers Beware
Internet users in the United States are dangerously ignorant about the types of data that website owners collect from them and how that data is used, making them vulnerable to fraud, overcharging and misuse of their personal information
August 01, 2005 — CSO — Fraud Internet users in the United States are dangerously ignorant about the types of data that website owners collect from them and how that data is used, making them vulnerable to fraud, overcharging and misuse of their personal information, a new study finds.
For the study, titled "Open to Exploitation: American Shoppers Online and Offline," 1,500 adult U.S. Internet users were asked true-or-false questions about topics such as website privacy policies and retailers' pricing schemes. The survey was conducted by the University of Pennsylvania's Annenberg Public Policy Center and released in June.
Respondents generally failed the test, answering correctly an average of only seven of the 17 questions. The study's interviews, conducted between early February and mid-March, yielded alarming findings:
75% of respondents wrongly believe that if a website has a privacy policy, it will not share their information with third parties.
49% can't identify phishing e-mail (messages that information thieves have dressed up to look like e-mails from legitimate companies in order to lure users to disclose sensitive information such as their Social Security numbers).
66% can't name one of the three national credit reporting agencies (Equifax, Experian, TransUnion).
To address the problems identified in the study, the authors propose increased consumer education as well as new regulations requiring retailers to disclose what data they have collected about customers and when and how they will use it. In addition, the authors suggest replacing the term "Privacy Policy," which most websites use, with the label "Using Your Information," in order to combat users' misconception that these documents are pledges not to share customer information.
Read more about data protection in CSOonline's Data Protection section.
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- The CISO's Survival Guide to Securing Data
- Data Privacy and Protection in Production Environments: New Research from Ponemon Institute
- FireEye Advanced Threat Protection KnowledgeVault
- Five Tips to Consider in a Data Security Strategy for Smartphones and Tablets
- Moving Your Email to the Trusted Cloud
- Comprehensive Server Protection
- Teenage hackers could be our last, best hope
I got an email yesterday asking if teenage hacking is on the rise. At first I balked. Teenage hackers have always been in abundance, so the question seemed stupid to me. Then I remembered something about teens that the SANS Institute's Alan Paller mentioned at a conference last week. Let's start with that press release, which framed the scenario this way: - Busted: When security tools fail
- Hey Linux, Mac and Windows users: It's ALL vulnerable
More Salted Hash with Bill Brenner
