Today is Data Privacy Day. A day dedicated to awareness of how data, often very personal data, needs to be managed and protected. Just about every company you interact with on a daily basis has collected, uses and is responsible for being a good steward of that data.

But we can’t expect those companies, your bank, your doctor’s office, your insurance company, your favorite social media experience and any of the myriad of applications you might have on your smart phone to be the only responsible stewards of our data.

We are also responsible.

Take a moment to take stock of your various identities. We all wear different hats in real life – parent, volunteer, employee, pet owner, what have you. Some cross over to others, some do not. We have equivalents online and a collection of companies are vying to be the holder of the “primary” identity you use online. We are constantly offered the chance to log in or “connect” using Facebook, or Google, or Microsoft, creating additional interconnection between the fabric of websites and mobile apps in our ecosystem.

Today, I challenge you to inventory your online identities and make improvements where necessary. Break out a piece of paper and pen:

1. List out all your email addresses. Which ones are used for access to which websites? When you create an account on your bank’s website or a shopping website or anywhere, that service has created an identity for you. While it’s true that your bank’s computers don’t connect with the servers that run Netflix, if you are using the same email and password in both places, you have increased your risk in the event that a password breach at one service could allow someone to access your information from the other service.
2. Document all the popular services you use that all provide the option to use that identity to connect to other sites – the situations where you connect to services or other websites using the credentials from another. In this case, those services may not bother to maintain their own database access credentials, instead relying on the services of another. This “single sign on” feature is great – event potentially more secure than having a less robust system maintain a list of email address and password combinations – but make sure you are combining those services in a way that makes sense for you. I would never sign onto my banking websites “using Facebook” for example, even if it was available. Using my Twitter credentials to connect to a news website, would be a more reasonable use.
3. Review the list so far and make changes as necessary. Update passwords, change email addresses and consider the “single sign on” options that make sense for how your organize your life. If you’ve used your work email (which is an identity you don’t fully control) as the primary email for a personal service, make sure to adjust that appropriately. You never know when you might lose access to that email service, making it difficult to recovery a lost password or receive notifications.
4. Turn on multi-factor authentication where available. Those services ensure that additional information is needed to grant access to the service with a phone call, text message or email to an alternative account. Make sure that your contact information is up to date with alternative phone numbers and current email addresses that you can access.
5. Some services provide printable one-time use access codes that you can store offline. Google and Microsoft are two companies that do this. I print these and store them in a secure location at home, as a backup to all the other multi-factor security options.
6. Review the recovery related FAQs for all the major services you use. In the past, some have required you to know rather specific information related to your account, like creation date, etc. If necessary, gather that information and store it securely offline as well.
7. Finally, review the security and privacy settings on the sites where you purposely post personal information, like Facebook and LinkedIn. Make sure you have them set so what you have publicly visible is what you intended.

I know that’s big list.  Make it Data Privacy “Week” if you have to. Your future self will thank you.

Learn more about privacy settings for:

• Microsoft
• Google
• Facebook
• Amazon AWS
• Amazon.com
• Twitter

As a system admin, I like to think that I’m pretty savvy when it comes to online security.  However, it never hurts to look at some current recommendations as a refresher and maybe pass on a link or two to family and friends regarding ways to prevent fraud, theft and other online ills.

Visit the STOP. THINK. CONNECT. campaign or Microsoft’s Cyber Security web page for tips on staying aware and secure online.

Check out my previous security posts for some of my thoughts on cyber security. What are your recommendations for friends and family when they ask you about online security? 

I know that airport security is probably pushing it when it comes to technology topics, but one can’t help but miss all the recent hoopla regarding airline travel lately.

I travelled to the east coast over the holidays (after the Christmas day incident) and had mixed feelings about the fact that security screenings were no better, nor no worse than they had been the past year. My husband got the extra “pat down” during our return trip, but stated that he’d been physically screened more significantly when going to a music concert. Overall, I find the current system to be more “security theater” than not. I’m sure that the current procedures do discourage some more casual attempts to cause harm, but when someone is determined its possible to circumvent the system.

While it’s important to look for metal items that could be used as weapons, TSA still can not consistently detect explosives on passengers or in carry-on luggage. Personally, I would be willing to bring less into the cabin of the plane and tolerate having it more closely screened, if it meant that I would have unlimited access to those items for the duration of the flight and would not have my movements unnecessarily restricted.

Granted this would mean making improvements in the baggage handling systems and require airlines to charge less for checked baggage in order to restore confidence in handing one’s bag over to an agent. However less carry-on luggage would allow for faster passenger screening – either by hand, machine or trained dog.

On Sunday, EWR was partly shut down due to someone entering through an exit into a secure area. I am surprised this doesn’t happen more often. Airports are busy often confusing places, filled with distracted people who want to be someplace else. What concerns me is that they never found the guy. Clearly airports need to take a sheet from the casino playbook when it comes to installing video surveillance systems. Hundreds of travelers could have avoided being rescreened and flights could have operated as usual if TSA could have simply tracked down the errant man.

Security works best when it’s unobtrusive and consistently applied. While random screening procedures do have their place, it’s not practical to make traveling more frustrating for the majority of the population by adding to the confusion with knee-jerk restrictions that don’t address the obvious issues. If nothing else, TSA does lend itself to some great tweets. Check out this travel blog post that calls out seven of them.