Paul Ducklin is one of the world’s leading security experts. He joined Sophos (a leading IT security vendor) in 1995 and has held numerous senior technical roles there in the years since. He is also a regular contributor to Sophos’s award-winning Naked Security blog. Currently based in Australia, Paul won the inaugural AusCERT Director’s Award for Individual Excellence in Information Security in 2009. Despite a very busy schedule, Paul has been kind enough to answer a few questions for The Security Advocate:

What do you think is the most commonly overlooked security or privacy issue?

I’m tempted to put on my best Franklin Delano Roosevelt accent here, and say something like, “The thing most overlooked in security is security itself.”

But since I need to zoom in on one issue, I’ll say, “Geolocation.”

Ever since modern mobile phones burst onto the scene in the 1980s, we’ve known that someone – the cellular network operator, at least – knows roughly where we are whenever our devices are turned on. That’s the *quid pro quo* for having a phone in your pocket that can accept incoming calls.

These days, however, we’re sharing our location much more widely, and often much more precisely.

Modern “always-on” phones and tablets can pinpoint your position through a mixture of cell tower data, GPS and nearby Wi-Fi networks.

Operating systems like iOS and Android unashamedly urge you to share this information with Apple or Google, and with app-makers, and more, in return for “improving” your online experience with information relevant to your location.

It works, of course: you don’t want to know where to eat out in Sydney while you’re on a business trip to San Franscisco.

So, perhaps sharing your location data, at an intimate level of detail, with any and all of application developers, mobile phone companies, device makers and operating system vendors is worth it.

Aye, there’s the rub: *IS* it worth it?

To answer that question, of course, you have to recognise the downsides, weigh them up, and carry out what amounts to a personal risk assessment.

And that’s something I suspect that many of us have overlooked.

[Some relevant articles on Naked Security:]
Michael Dell’s daughter all at sea on social networks – how do your kids measure up?
Twitter + location = WeKnowYourHouse
‘Girls Around Me’ stalking app developer and Foursquare negotiate API access

Read more ›