Fear, Uncertainty, and Doubt

shutterstock_574193302

Recently there has been much in the press about Congress “taking away” the Internet privacy of United States citizens. Internet Service Providers can now intercept and sell usage data. There is quite an uproar, and a push for the “necessity” of using Virtual Private Network (VPN) services to keep privacy intact.

Much of this has elements of perhaps not “fake” news but certainly overblown sensationalism. This is a prime example of what we refer to in the infosec industry as spreading FUD – Fear, Uncertainty, and Doubt.

Read closely, friends – nothing has changed. There was a law passed to enable restrictions that would have gone into effect late this year; that will not happen now. Your privacy online is the same today as it was yesterday.

I, like many writers, enjoy writing when the mood hits. That may mean taking out a notebook on a bus or bringing a laptop to a coffeehouse or bar for a drink and a session of keyboard-pounding. I use a cloud service so that my content is synchronized across devices automatically. Use of the public WiFi comes in quite handy.

“But I thought using public WiFi is insecure, and to never do so?”

Well, yes and no.

I do use a VPN service on all my devices, not because I am afraid the government is spying on me or that my ISP is selling my web surfing habits on the open market (I buy aluminum foil to protect against those threats). No, I primarily use my VPN to mitigate risks of Man in the Middle attacks at public WiFi spots.

My fundamental philosophy about information security is it is risk management. Perpetuating FUD does little to help the problem. Do people not drive at all because of the risk of getting into an accident? Of course not, they mitigate that by ensuring brakes are inspected and operating effectively, driving at a safe speed commensurate with conditions and skill, stay focused (no texting and driving, applying makeup, binge watching, and so on), and choosing routes wisely. Does this mean they will never have an accident? No. But they have reduced the chances substantially.

The same applies to cyber. Understand the risks, then mitigate to a level acceptable to your risk tolerance. Yes a VPN service will help protect your privacy if an ISP opts to sell traffic information, but navigate through the FUD and make your decision a risk-informed one. And stock up on aluminum foil.

(Image shutterstock #574193302)