How to handle SSN request?

I've got a background investigation coming up, and I've been asked to provide my social security number. The intended method of delivery is print the form, fill it out, scan it, and email email it back. I'm not about to send my SSN over email. I've let my point of contact at this organization know I won't be doing that - I've offered to leave it blank and provide it to her over the phone, or utilize any other option they have available; sending an encrypted zip/pdf, and giving them the password out of band, sftp, etc.. She said she'd check with her superior and get back to me.

Long story short, I need to get this stuff in by midnight tonight, and I'm trying to figure out what I'll do if I haven't gotten an answer by COB today. What would you do? This IS a large, reputable tech company that I trust, I just think this is a case of non-technical HR people not really considering the security implications. TBH, I'm surprised this is the first time this has come up.

Anyway, big news coming later this week...

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

redz

Of course not. It's a pain.
Edit: I phrased that weird. I meant, I don't want me anywhere near sensitive data.

cyberguypr

Data has whatever value the owner assigns to it. I assign a very low value to my social. By emailing it I am understanding the risk and more important, I am accepting it. Nothing wrong with this. I have no extreme and urgent need to protect it.

Decisions I make with my personal data have nothing to do with a similar decision I may need to make for my employer. In a business environment I don't own any data, I'm a mere data custodian. Everything is seen through a different prism, where my employer's policies, standards, and procedures trump any personal opinions I may have.

jmritenour

You do realize that in order to open a fraudulent line of credit in your name, all someone needs is your name, address & SSN? Not that that's ever happened to me, but I have a friend who's trying to recover from identity theft from his SSN being exposed. No, I can't control what another party does with it once they get their hands on it, but I can at least try to make sure I give it to them in a secured manner.

Codyy

I don't even think about it anymore since joining the military, I've seen my social everywhere. I've actually seen it on a paper next to my name, along with probably 100+ others, posted on a bulletin board in a hallway right next to an entrance.

apr911

jmritenour wrote: »

You do realize that in order to open a fraudulent line of credit in your name, all someone needs is your name, address & SSN? Not that that's ever happened to me, but I have a friend who's trying to recover from identity theft from his SSN being exposed. No, I can't control what another party does with it once they get their hands on it, but I can at least try to make sure I give it to them in a secured manner.

Sure but then that still goes back to there are easier ways to get the information required than to snoop your internet traffic. The idea of a social security number being a "secure" method of identifying someone is a bit of a joke. Until 2011, the first 5 digits of the social security were determined by the region to which the card was mailed to and a number that increments in a predictable pattern. The only truly unique part of your SSN is the last 4 digits which still isnt that hard to crack, if you know where and when someone was born.

Especially since the last 4 digits are used so regularly to verify accounts and what not. Not to mention a lot of people use them as PINs for ATMs, etc. There was even an algorithm determined a few year back that could guess your social secuirty number:
New algorithm guesses SSNs using date and place of birth | Ars Technica

Ultimately, it goes back to my original statement/comment "Yes you can exercise due diligence and not post it publicly but there are so many ways and places it can become compromised that you should be monitoring for identity theft as a matter of course not just when you suspect something."

SSNs are a rough subject because people put a lot more stock in the security of them than they probably should so let looks at a few other pieces of information that you might freely disclose without a 2nd thought and some innocuous questions on how I might get that info:

Date of birth. What's your birthday? How old are you? ... Now do the math, bam, DOB compromised
Address. Where do you live? What part of town?... Even mentioning a city and general region is often enough to find your street address
Full name. What's your name? Is that short for anything? Do you have a middle name?
Address at birth. Where did you grow up?

Most people would disclose this information without a second thought. Maybe not if the questions were asked in rapid succession but lets say a telemarketer survey called. They offer you $50 for 15 minutes of your time just to answer a few questions; I think most of us would be skeptical but a lot of people out there wouldn't be. Then through the course of conversation they ask you questions like:

"To verify you're eligible, can you verify your current address (or city)" - Address
"Also, for demographics, I need to know how old you are." - Year of birth
"How many people live in your home?" - Additional targets.
See where this is going?

Throw in some questions about some product or other to mask the fact you have just asked for practically every personally identifiable piece of information that person possesses and you got everything you need to take over that persons identity with a 15 minute phone call and you probably have enough to reverse engineer the persons SSN with a reasonable degree of accuracy, as long as they werent re-issued a number.

Much better than sniffing email traffic for hours and hours and hours and recompiling every shred of data in hopes of finding that needle in the haystack.

On those who encrypt every email? Well more power to you but I know for me, 99% of the email I send is non-sensitive inane chatter and if someone really wants to read my conversations that badly, well its not like Im discussing state secrets. For the 1 or 2 emails I send a week that do contain sensitive information? Well I guess you got me there, if you want to take the time to find it, I wish you luck but you'd probably be better served with 15 minutes and a phone call.

Moral of the story? Every piece of information you posses could be considered sensitive in nature but good luck surviving in today's world without disclosing any of it. If the beef is not over the disclosure but the insecure transport/transfer of the information... Again, good luck functioning in today's world only disclosing information in a "secure" manner, you'd have to scrub the knowledge from everyone who might repeat the information (even your name) and refrain from having conversations with people in public and so much more...

Any one piece of information, even your SSN, by itself is not going to do anyone much good but throw a few additional pieces in there and suddenly you have everything you need to fill in the blanks through inference.