The short version: Convenient scanner apps often send your photo to a third-party server to do the conversion — and that middle step is an easy way for sensitive documents to be stolen. Think about what you actually scan.
Convenience comes at a price, or at least it can. We live in a world where nearly everything we need is in our hand, but those fast, convenient solutions can come with a hefty price.
Let’s take scanner apps for example. These apps are a super convenient way to scan and upload documents when you’re not near a scanner, just snap a photo and seconds later you have uploadable and sometimes even editable document. It’s pretty much magic, but there’s a catch…
You install the scanner app and take a photo of whatever you need scanned. Since not all phones are powerful enough to convert the scan (and it’s a very technical process) the app sends the photo to a third party service to perform the scanning, OCR (optical character recognition), automatic document recognition, straightening the image, etc. Then the third party sends the converted image back to the app, and you have your completed scan.
While there are plenty of totally legitimate scanner apps out there, this is a very easy way to steal your data, and it has everything to do with that middle step with the third party. Google and Apple vet every app in the app store, and they do what they can to verify legitimacy. They make sure the app has the proper permissions, it’s doing what it’s claiming to do, it’s not overreaching etc., but they do not verify third-party affiliations because that is pretty much impossible. It’s the perfect loophole for someone wanting to steal data. The app passes the approval process to be added to the app store, so it looks completely legitimate, but that third-party middle step goes completely unchecked, and you have no idea where your information is going or that it’s at risk at all.
Tax documents, photo ID, customer contracts — the exact things you never want in the wrong hands.
Now, think about the kinds of things you’re scanning with this app. Tax documents, photo Id, customer contracts… It’s almost certainly something of a sensitive nature, the kind of thing you do not want falling into the wrong hands. Now, consider how many of your employees are scanning documents. Do you have any idea how they’re doing this? Are you certain that they’re ALWAYS using the company scanner or are certain that the app they’re using is safe? Think about all the data that could be unintentionally leaked.
This is why Eric’s always saying that either everything is protected, or nothing is protected. You wouldn’t leave one door of your house unlocked and feel secure because you locked all the others. A vulnerability, no matter how small it may seem, can lead to catastrophic results. This “Man in the Middle” style of attack is something we talk about at length in our cybersecurity training we offer our customers. It’s not all that technical, not like a hacker actively trying to break into your organization, it’s someone who made a fast and dirty app for little to no investment waiting patiently for someone to accidentally give up data. There are ways to protect yourself and your organization from things like this, but awareness is a huge component of this and that’s one of the reasons we’re so big on training your whole staff in person.
Sidebar, this is offered completely free to our customers, and for a small investment to non-customers, but the information is invaluable and will save you much more than you’ll ever invest.
First, you need to have a usage policy in place for these sorts of things. This could be as simple as making sure employees only scan documents on the company scanner, or they only use approved, secure apps. Creating usage policies to keep you protected is something we’re glad to do for our customers. Having these policies in place mean that proper steps are laid out for your employees as to how things are to be done, so they don’t need to make a judgment call. They keep you and your organization’s data safer, and give employees proper guidelines.
Second, keeping you and your staff continually educated and up to date with current risks is key. The majority of security breaches happen because somebody unintentionally clicked the wrong thing. It’s usually nothing malicious or purposely negligent, just a mistake that could have been avoided with proper awareness. These security updates we send are on way that we aim to help keep you educated and informed. Regular cybersecurity training with your staff is also key, so that security is always top of mind.
If you’re feeling overwhelmed, we’re here to help! We create custom, affordable cybersecurity solutions for each of our customers to keep them protected and operational. Eric is happy to hop on a call to answer any of your questions, no obligation at all. Click the link below to book.