What can be done to limit corporate Identity theft?

Question

Modern fraudsters commit identity theft by impersonation in social media, since a lot of personal information such as our names, location, contact info and other personal details are available for skilled fraudsters to commit identity theft. What can be done at a corporate level to limit corporate identity theft?

Answer 1

This is a vary difficult problem from the corporate perspective. I'm assuming from your question, you are more interested in what the business can do rather than on what the individual can do.

I think there are two main areas that business should focus on in order to reduce the risk of their data being compromised and used for identity theft

1. Staff awareness and education
2. Increasing corporate capability maturity

The majority of data breaches are initiated through social engineering attacks against staff. These often take the form of email phishing and spear phishing attacks against staff. Increasing staff awareness of these types of social engineering attacks is a good way to reduce the risks. This is why many large organisations now actually conduct phishing campaigns against their staff as a training process. For exmaple, Twitter does this as part of the new staff induction. There are a number of companies, such as Phish5, which provide this sort of service to corporations.

The other thing which business should do is have clear policy and procedures regarding data collection, storage and destruction, policy and procedures relating to data governance, classification and custodianship which makes it clear who is responsible for ensuring all data meets corporate policy and procedures.

However, having these policies and procedures is not sufficient. The corporation also needs to have procedures in place to ensure these policies and procedures are being followed and that they are reviewed on a regular basis. This is essentially the capability maturity model (CMM). In this model, a corporation maturity is measured according to where they sit with respect to documentation of policy and procedures and level of adherence. The levels, from lowest to highest tend to be along the lines of

1. Policies and procedures are ad hoc and not documented
2. Policies and procedures are documented, but may not be adhered to
3. Policies and procedures are documented and adhered to, but adherence is
   not verified
4. Documented policies and procedures are adhered to and adherence is
   verified (logged, audited, etc)
5. Documented policies and procedures are adhered to, verified and reviewed
   on a regular basis. 

Generally, staff will attempt to do the right thing. However, the right thing is not always obvious. Having clear policies and procedures will help with this by providing staff with the necessary information to ensure awareness of the issues and requirements. This leads to more mature business processes which are less likely to have inconsistency or rely on assumptions which may not be valid. It also helps ensure the right culture within the organisation.

Critical to achieving a data aware and mature corporate culture is leadership and governance. There has to be a determined effort by the executives of the organisation to establish a culture where client data is valued and protected and managed in a consistent and safe manner. For larger organisations, this is a complex and challenging goal and can take considerable effort to achieve.

There is also a need for consumers to become more demanding. Often, corporations will only improve when it becomes obvious that not doing so will affect the bottom line. As consumers, we really should look at things like the service providers privacy policy and be willing to not use the service if that policy doesn't provide sufficient protection. We should all adopt a proactive position and refuse to use a service if that service is not willing to demonstrate they will take sufficient action to ensure our personal data is sufficient protected. We should demand to know how they will use our data, when they will destroy our data, what protections they have in place for our data and that they will inform us of any incident which may have compromised either the confidentiality or integrity of our data. Unfortunately, too many of us are willing to give up our personal data too easily.

Answer 2

Like you said:

since a lot of personal information such as our names, location, contact info and other personal details are available for skilled fraudsters to commit identity theft.

This is a problem that is hard to avoid which is why the following steps can you help you try and stay safe from fraud:

• Limit what people can see about you on your various online profiles
• Limit the amount of places you sign up to with your main information (If this is a random newsletter, do you really need it?)
• Stay aware of anything strange going on with your social profiles.
• Preform a search of yourself online and try to minimize the information you are providing.

Note: Self awareness is the key to protecting yourself from fraud. If at any given time you see any suspicious activity regarding your identity, investigate and proceed with required actions.

Answer 3

I will answer from my job experience as an IT auditor. Identity theft more often occurs from social engineering that take advantage of human psychology rather than through technological means. Attack vectors can include among others:

1. Phishing
2. Spear phishing - target subgroup of employees
3. Whaling - targets senior management and executives

These type of attacks are hard to avoid through technological means, and countermeasures must rely on employee education. Users can be taught simple steps such as the below:

• Be wary of emails sent from the company domain seeking personal information
• Be wary of requests for information coming from an trusted, authoritative source such as C-level executive
• Hover over a link to see source destination, rather than clicking

Corporate identity theft not only occurs through social media but through other means such as dumpster diving, impersonation, and / or shoulder surfing (watching a person from behind). Countermeasures can include:

1. Ensure all employees follow proper steps to dispose sensitive information such as through shredding rather than simply discarding in the trash.

2. Use two factor authentication to authenticate the person claiming a particular identity.(Know , Have , or Is)

3. Mask all passwords displayed on computer screen

Ultimately, how successful a strategy to defend against corporate identity theft rests with educated and informed employees, and the incentives that company management provides for employees to become this way.