Data Privacy and Cloud Security - Study Notes

Cookies, Tracking, and Privacy Settings

• Location in device: Settings → Privacy and Security
• Options available:
  • Delete cookies, history, browsing data
  • Manage third-party cookies
• Third-party cookies:
  • By default, often allowed
  • Change this manually to block third-party cookies
• Do-not-track request:
  • Can be sent but often has limited effect on websites
• Implications of tracking:
  • If data leaks or is accessed by bad actors, it can enable impersonation of the user
  • Block or limit third-party cookies to reduce exposure; avoid accepting all cookies automatically
• Privacy-conscious practices:
  • Use Incognito/Private mode when you don’t want tracking
  • Clear cookies regularly
  • Prefer HTTPS websites for secure transmission

Cloud Computing: Definition, Architecture, and Real-World Use

• What is the cloud?
  • A term for servers located in data centers that are accessed over the Internet
  • Data centers are large facilities housing many computers for storage and processing
• Common cloud services (examples):
  • iCloud, Google Drive, OneDrive, Dropbox
• Data in transit and at rest (conceptual):
  • When uploading, files are encrypted during transmission
  • Encryption is performed using a key
• Who holds the keys?
  • In many cases, cloud providers have the keys and can decrypt data
  • This means providers can access the content unless additional protections are used
• Data center proximity and availability:
  • If a chosen data center is unavailable (e.g., California server down), the system may serve data from another center (e.g., Canada) that is geographically closer to maintain access
  • Cloud providers replicate and back up data across multiple centers to prevent data loss and improve availability
• Practical implication:
  • When you upload data to the cloud, the provider technically has access to read the content unless end-to-end encryption is used
• Real-world examples of cloud services:
  • iCloud, Google Drive, OneDrive, Dropbox

Encryption, Keys, and Data Security

• What is encryption?
  • A process that converts readable data into an unreadable format using a key
  • Example described: a file with contents "hello" is transformed during upload
• Decryption requires the key
• In typical cloud contexts:
  • The cloud provider performs encryption during upload and holds the key, enabling decryption
  • This means others can potentially access the plaintext if they obtain the key or data
• Data center behavior example:
  • If you request information from a cloud service, the server may deliver data from the nearest or available data center (e.g., California vs. Canada)
• Data replication and backups:
  • Services copy your data to multiple locations for redundancy and availability
• Encryption best practices discussed:
  • Encrypt sensitive files before uploading to cloud services
  • Tools mentioned for local encryption before storage or transfer: $ext{7-Zip}, ext{VeraCrypt}$
  • Use password protection with strong, unique passwords
  • Password managers can help store and generate strong passwords
• End-to-end encryption (EE) concept mentioned:
  • In EE, the service provider does not hold the decryption keys; only the user has them
  • Examples of EE-enabled services include ProtonMail and some configurations of encrypted cloud services
• Important security caveat:
  • If you upload unencrypted sensitive information (e.g., SSN, health data) to a provider that holds the keys, the provider or lawful requests could expose data
• Data security guidance for encrypted storage:
  • If encrypting files locally, store the encrypted archive with a strong password
  • Back up encrypted files to external storage as an extra safeguard
• Quick recap on encryption concepts:
  • In-transit encryption protects data while being transmitted
  • At-rest encryption protects data on storage media
  • End-to-end encryption protects data so the provider cannot read it

Data Availability: Data Centers, Replication, and Backups

• Cloud data centers host vast networks of servers that store and process data
• Replication strategy:
  • Providers copy data across multiple data centers to ensure availability even if one center fails
• Backup practices:
  • Regular backups help prevent data loss and support recovery
• Practical takeaway:
  • Sensible data handling includes using services with robust replication and backup strategies, plus encryption controls to protect data

Password Hygiene and Authentication

• Password best practices:
  • Use strong passwords; make them long and complex
  • Do not reuse the same password across multiple sites
  • Change passwords regularly
• Two-factor authentication (2FA):
  • Adds a second factor (e.g., a code sent to your phone) for access
  • When accessing cloud services, you may be prompted for a code from your device
• Additional security tips:
  • Avoid using public Wi-Fi for sensitive access
  • Use a trusted device and secure network
• Context from the class activity:
  • In the discussed game, students were reminded to strengthen passwords and use 2FA

Handling of Sensitive Personal Data

• Examples of sensitive personal data (SPD):
  • Social Security Number (SSN), passport numbers, banking details (bank account numbers, routing numbers, credit/debit card numbers)
  • Health data (medical history, treatment records, vaccination records), genetic information, biometric identifiers
• Why SPD is sensitive:
  • Higher risk if exposed; could lead to identity theft or harm
• Digital storage safeguards for SPD:
  • Encrypt files/folders before saving to disk or cloud
  • Use tools like $ext{7-Zip}, ext{VeraCrypt}$ for encryption
  • Use strong, unique passwords for encrypted archives
  • Consider password managers to store complex credentials securely
• Cloud with encryption considerations:
  • Prefer cloud services that offer end-to-end encryption or at least do not retain decryption keys (e.g., ProtonMail, certain encrypted cloud configurations)
  • If a provider holds the key, they can access your data; legal/government access is possible via requests
• Privacy policy awareness:
  • Read privacy policies of services like Facebook, Instagram, Google to understand data sharing practices
• Practical guidance for SPD on cloud:
  • Encrypt SPD locally before uploading
  • Use services that provide end-to-end encryption or zero-knowledge architecture
  • If possible, avoid storing essential SPD in plain form on consumer cloud services
• Physical storage for SPD:
  • Store in a locked safe or cabinet
  • Shred or destroy old documents instead of discarding them

Physical and Digital Data Handling Best Practices

• Physical handling:
  • Do not leave sensitive documents unattended
  • Shred expired or unnecessary documents before disposal
• Digital sharing and access controls:
  • Share passwords only via separate, secure channels
  • Use password managers or service-provided proxy/authorized access mechanisms when sharing access with family or caregivers
  • Limit access to sensitive accounts to only those who truly need it
• Access control hygiene:
  • Be cautious with access permissions; revoke access when no longer needed
  • Avoid storing passwords in plain text or insecure notes

Phishing, Ransomware, and Incident Response

• Phishing overview:
  • Phishing emails attempt to trick users into revealing credentials or clicking malicious links
  • They may appear legitimate (e.g., asking to change a password)
• Ransomware overview:
  • Malware that encrypts data and demands payment for release
  • Ransomware is typically money-motivated
• Example discussed:
  • A phishing email pretending to be a Canvas password-change notice; such emails can look legitimate but may be invalid or suspicious
• Defensive practices:
  • Verify requests via official channels; do not click unexpected links
  • Maintain up-to-date security software and system updates
  • Regular backups to recover from ransomware incidents
  • Use two-factor authentication to reduce risk of credential compromise

In-Class Activity and Administrative Notes (Data Sharing Practice Survey)

• In-class activity: Data sharing practice survey on Canvas
• Details:
  • Graded survey; anonymous responses allowed
  • Worth $10$ points
  • If not visible, refresh the page
• Administrative help:
  • If access issues occur, contact an adviser or visit the campus branch office

Summary of Key Ethical, Philosophical, and Practical Implications

• Ethical considerations:
  • Balancing convenience of cloud services with the right to privacy and data control
  • The responsibility of service providers to protect user data and the limits of user trust
• Practical implications:
  • Active management of cookies and trackers reduces exposure
  • Strong authentication and encryption are essential for protecting SPD
  • Regular training and awareness reduce susceptibility to phishing and ransomware
• Philosophical takeaway:
  • Data ownership and the degree of control individuals have over data stored on third-party services
  • The trade-off between accessibility and security in a connected digital world

Quick Reference: Key Do/Don'ts

• Do:
  • Block third-party cookies when possible
  • Use Incognito/Private mode for non-tracking sessions
  • Clear cookies regularly
  • Use HTTPS everywhere
  • Use long, unique passwords and rotate them
  • Enable 2FA
  • Encrypt SPD before uploading to cloud
  • Use password managers
  • Shred physical sensitive documents
  • Be cautious with phishing attempts and verify requests
• Don't:
  • Share passwords via insecure channels
  • Reuse passwords across sites
  • Rely solely on cloud provider encryption without local protection for SPD
  • Ignore privacy policies and data-sharing terms of services
  • Access sensitive accounts on public Wi-Fi without protections