There’s a lesson in every cyber security story and the recent one about stolen DNA samples is no exception. Gizmodo recently reported about a DNA testing company that settled a lawsuit with Pennsylvania and Ohio for a leak of one of its databases that held millions of records. That’s not the news. What is, is that those in the company apparently had a bout of amnesia about the database in question, which resulted in someone accessing its data that wasn’t supposed to.
The company in question is DNA Diagnostics Center. Its excuse for the breach was that they didn’t know about the stolen data because they didn’t remember they had that data. It was being stored in an old database; out of sight, out of mind. But hackers don’t care if it’s current data or not as long as they can use or sell it.
For those who are in charge of securing the company’s data, this is a lesson to either continue to secure data that is accessible from the internet or remove the systems off of it completely. If the data isn’t needed, which is what this sounds like, just destroy it so it’s not at risk.
Sadly, for those whose DNA samples were accessed, there isn’t a lot one can actively do. But it’s a reminder that some authentication methods can’t be changed, such as biometric indicators and DNA. Though both of those are still more secure than passwords, using them can still be risky.
A couple of examples of how biometrics can be troublesome. First, in 2014, a hacker from the Chaos Computer Club copied a German minister’s fingerprint using images taken at a press conference. He did it just because he wanted to prove it was possible and that biometrics did have limitations when it came to security.
In 2015, hackers stole millions of records from the U.S. Office of Personnel Management (OPM). Do you remember that? The OPM announced that there were two separate, but related data breaches of information it stored. In that case, OPM reported that 21.5 million records including “background investigation records of current, former, and prospective Federal employees and contractors” were accessed. While social security numbers were part of the data set for all 21.5 million records, fingerprints were included in 5.6 million records. So, if you’re part of that group, someone out there has some of your biometrics already.
Though it’s not trivial to copy biometrics, it can be done. After the German minister’s fingerprint was cloned, there were calls to start using biometrics that were alive. This meant using things like gait or vein recognition; in other words, the biometric must be connected to a living body. In fact, those were being used in some limited instances in 2014. Until they are commonplace, however, we will need to be diligent about protecting our identities and using tools such as two-factor authentication (2FA). Fortunately, this is becoming more of the norm, so enable it whenever it’s offered.
As for facial recognition on your computer or mobile device, in iOS, you can secure it even further by ensuring the “Require Attention for Face ID” is enabled under the Accessibility options. You will have to weigh your risk vs. reward on this. Some may want others to be able to access their device should they become incapacitated. But that’s an individual choice.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
