Stop the Cybersecurity Blame Game

In December, genetic testing company 23andMe acknowledged a hack that led to the theft of nearly seven million customers’ data. As the New York Times reported, criminals obtained “ancestry trees, birth years and geographic locations.” This kind of digital theft may have felt personal to many of those impacted.

The other thing that makes the response to this breach surprising was that the genetic testing company appeared in media reports to place much of the blame for the incident on customers. After a class action lawsuit was filed, 23andMe’s attorneys said in a letter to plaintiffs that impacted customers “used the same usernames and passwords used on 23andMe.com as on other websites that had been subject to prior security breaches, and users negligently recycled and failed to update their passwords following these past security incidents.”

Digital intrusions are inevitable, even at companies with the strongest of protections in place. But how a company approaches protections for their customers, and the fallout after an incident, can make the difference between maintaining, building, or losing trust. The right approach is to take full responsibility, and take full ownership of customer security, instead of appearing to play the blame game. Data about consumer preferences makes this point in a powerful way: 94% of consumers Telesign surveyed in 2023 agreed that businesses — not the consumers themselves — bear responsibility for protecting their digital privacy.

Our survey also shows that, paradoxically, respondents admit they don’t always do enough themselves to protect their own data. That can include, as the 23andMe lawyers pointed out, not changing passwords after being alerted they need to do so. However, that does not change the fact that, in order to maintain trust, it is the digital business that needs to own the responsibility to protect digital privacy. Through this lens, it is always a bad idea to even subtly suggest that it is the customer’s job to protect themselves in order to deflect the blame.

Once a customer signs up for your service, it becomes your responsibility to protect the data they share with you from fraudsters. The good news is there are many ways to do that. For example, require multi-factor authentication (MFA). This simply means an extra step, often a one-time-passcode (OTP) sent via text, email, or through many other channels, before a log-in or transaction is approved. And by the way, sending a highly secure OTP via text message costs less than one penny in the United States. When you value a customer relationship, that is a minor but smart investment. There are also other options, such as RCS messages, that are increasingly effective, secure, and cost-effective.

In addition to stronger passwords and MFA, another layer of defense for enterprises is to utilize services that allow them to monitor breached data on the dark web, which helps determine if and when customer data has been compromised. In those instances, additional security steps can be requested to secure both the customer’s account and your digital infrastructure.

Even with all of these resources available to protect customers, we too often see the trend of not taking enough responsibility to protect people on digital platforms. For example, when it comes to MFA, some companies are removing Short Message Service (SMS) verification — or text messages, as they are commonly known —as an option. Alternatively, some companies now charge for the service. Some suggest that SMS verification is inherently less secure — which it can be, in some cases. However, there are solutions that score phone numbers for fraud risk before an SMS message is sent. And others that allow “silent” verification in which a number is tested for fraud risk without the need to send a text message. These innovations can stop many fraudsters in their tracks.

On the other hand, taking ubiquitous tools away from customers that allow them to keep their accounts secure — or making them pay extra for them — sends the wrong message. In the case of SMS verification, companies that do that are essentially saying that they are unwilling to pay a single penny to help a customer verify their identity in order to keep their account safe.

It's also crucial not to blame customers for digital intrusions when they happen. There are many reasons people may not take every necessary step to protect themselves online. To make an analogy, most of us know we should eat right and exercise, but sometimes fall short of that standard. So, assume customers aren’t doing enough to protect their digital identities and step up to help them do it when they are on your platform. That means creating the right amount of friction when they are logging in, or transacting, including putting in place multi-factor authentication. Educate them on why that friction is there: to keep their digital interactions safe. And if things go wrong, take responsibility. Explain the steps you are taking to fix the problem.

Owning that responsibility — never blaming — is one of the secrets to building and maintaining trust. When you make that investment in your customer relationships, anything is possible.

Featured

  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity

Webinars

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3