As Data Privacy Day approached, we saw a fantastic opportunity to create a meaningful blog post while highlighting one of our annual sponsors and cherished partners: AE Business Solutions. I immediately reached out to Paula Lukach, a dedicated member of the i.c.stars Development Committee, and a passionate advocate for our organization.
Paula’s commitment to i.c.stars is as remarkable as her dedication to IT and data. Instead of delegating the project to her marketing team, we saw an opportunity and worked collaboratively to incorporate our new interns in a learning exercise.
Our Cycle 17 interns, just two weeks into their journey at i.c.stars, became the perfect research assistants for this editorial piece. These interns come from diverse backgrounds—some with prior IT knowledge, others with minimal exposure, but all eager to learn. Providing them with hands-on experience in researching and understanding data privacy aligned perfectly with our mission to nurture talent and foster learning every day.
To kick things off, I discussed the idea with the program manager, Mimi Perez, and she was “All In, loving the idea to engage the interns.” Together, we visited the studio on Tuesday afternoon to gauge the cohort’s existing knowledge of data privacy. As anticipated, their responses varied, ranging from “not much” to “keeping my personal data locked down.” This conversation laid the foundation for an engaging research project: we tasked the interns with investigating data privacy and crafting two questions they would ask an expert if given 20 minutes.
What followed was truly inspiring. Despite being only seven days into the program, the interns approached the assignment with enthusiasm and diligence. They delved into the nuances of data privacy versus data security and submitted thoughtful, well-researched questions. Choosing just a handful to present during our session with John Urbanek was no easy task.
Although we couldn’t represent all 22 interns in this piece, their contributions were outstanding. Rest assured, there will be many more opportunities to showcase the brilliance within this cohort. Their energy and curiosity are a testament to the transformative potential of this program. We extend our deepest gratitude to AE Business Solutions for your continued support and collaboration. Your partnership empowers us to create impactful learning experiences and inspire the next generation of IT leaders.
What you read in the following are the questions written by the i.c.stars Milwaukee Cycle 17 interns during week 2 of their journey, and the responses from John Urbanek, Senior Director of Solution Architecture & Engineering at AE Business Solutions.
Tammie Brings: Welcome, John. We are so grateful, and the cohort is extremely excited for the two of you taking time from your day to join us and share your expertise with us. AE Business Solutions is an Annual Sponsor and trusted partner of i.c.stars Milwaukee and are looked at in the tech ecosystem as experts in Data, Cybersecurity, and Cloud. They provide an amazing partnership with us as well as thought leadership to many, and that is why when I learned that Data Privacy Day was coming, you were our natural selection to partner with. Can we start with you introducing yourself?
John Urbanek: Hello i.c.stars Milwaukee. AE Business Solutions is composed of several centers of technical excellence, our Coe’s – cybersecurity, infrastructure, networking, cloud & DevOps, and data science. I’ve been both an engineer and an architect, hands-on keyboard, roll up the sleeves type in cybersecurity and network domains with some cloud for close to 20 years. I’ve had the opportunity to present at i.c.stars events before and am happy to be here.
Carl Lewis: Q: How can we use data to make things more personalized while still keeping people’s information safe?
Hi, John. Nice to meet you. I joined i.c.stars to deepen my knowledge in AI development and business strategy. Formerly, I was a startup founder and a huge tech enthusiast. My goal is to create AI-driven solutions that empower organizations to transform their work workflows during this digital transformation we’re in. How can we use data to make things more personalized while keeping people’s information safe?
Urbanek A: That’s an interesting question. In the cybersecurity space there’s this seesaw concept of increasing security and usability goes down or decreasing security and usability goes up.
Similarly, with respect to people’s information we want to have more personalized experiences because of that data but how do we do it safely? Understanding the Data Security Life Cycle is important. The Data Security Lifecycle begins with Discovery, Classification, and Governance.
Discovery is one of the most important parts. Many organizations don’t know what data they have. Various business units may collect data as part of their day-to-day without realizing the data may be private, sensitive, or covered by a regulation. This data could be in a cloud service, a database, an application, a storage system or a traditional file system somewhere.
Once it’s been Discovered, we must Classify it. These are three common big buckets, Personal Information, Financial Data, and Intellectual Property or IP.
The secret sauce of an organization could be in engineering diagrams, chemical formulas, or software – as Intellectual Property. We want to classify the things that we’ve discovered so we know what and where they are.
The end of the beginning of the Data Security Lifecycle is Governance. Building out the process for how that data should be handled and accessed. What are the retention schedules? Is there a regulatory mandate around how long it must be? How can we share it? Can it even be shared?
There’s tooling available that greatly aids in Discovery and Classification. Governance requires broader organizational buy-in and people power.
When we get past those early, but critical elements of the Data Security Life Cycle, then we move into Protecting the data. Is it encrypted at rest, in transit? Who’s accessing it? At the end of the cycle is destruction or getting rid of the data, if required.
That was quite a tangent on Data Life Cycle but we are likely going to come back to it throughout our interview.
Now to your question Carl, how can we use data to make things more personalized while keeping the data secure? By eating our data security vegetables, of course. They’re good for us, but don’t always taste good.
We have to Discover, we have to Classify. We have to have Governance. We have to appoint the right people to do it. We have to spend the money and do the work to do those early things. Once in place and rowing in the same direction, the Protection and down the line Destruction becomes a lot easier.
Q: Bernard Gales: What information should be protected?
Good afternoon, John. My name is Bernard.
I joined i.c.stars to enhance my networking skills and to further my education in the tech field. My question for you today in regard to data privacy, which I’m pretty sure you might already cover, what info should be protected?
A: Urbanek:
From a regulatory standpoint that’s determined by vertical. For example, in the education world there’s FERPA. In healthcare, HIPAA. Government subcontractors have CMMC. There are plenty more.
Data is still usually one of: Personal Information, Financial Information, and Intellectual Property.
Q: Ja’Mire Carpton: How would you approach securing sensitive data in real-time communication systems, such as video conferencing platforms, to prevent unauthorized access, eavesdropping, and metadata leaks?
Hey,. How would you approach securing sensitive data in real-time communication systems such as video conferences and prevent unauthorized access, eavesdropping, or leaks?
A: Urbanek: That’s a great question. Real-time communication systems, like this Teams call that is being recorded, require strong security measures.
One of the most critical aspects is preventing unauthorized people from gaining access. You can limit unauthorized users by requiring authentication so that you must be logged in with a valid Zoom account or Teams account. There are policy checks that you can have at an organizational level inside those platforms that serve to limit unauthorized users from joining.
Another one that’s been done is forcing people to turn their cameras on at the beginning of a call. Establish protocols especially when you know that you’re going to be discussing sensitive information mandating cameras must be on for all parties. I personally have given interviews to people in the past where the person that showed up to a round two interview was not the same person that we interviewed in round one. Cameras on for all interviews after that.
Q: Leosha Stones: What’s the best way to protect sensitive data, like customer/business information, from being hacked or accessed without permission?
Hi there, John. Thanks for being here with us. I’m Leosha. I’m a business owner and I joined i.c.stars to strengthen my business and leadership skills and try to segue more into tech. But my question is, what’s the best way to protect sensitive data like customer and business information from being hacked or accessed without permission? So, you kind of answered that, but if you have more to add to it, I’d be grateful for that.
A: Urbanek
We’ve chatted about some of that today with the Data Security Life Cycle – discovery, classification and governance which then flows into protecting, monitoring, and destroying. It’s a lot to consider.
One of Gartner’s newer Magic Quadrants is in the Data Security Posture Management or DSPM space. It provides a short-list of the top vendors who provide technology and tooling in this space including the likes of Varonis, Cyera, and others. Technology is one part of the holy triad of People, Process, and Technology – we can’t forget about the People and Process – which play most heavily in the Governance part of the life cycle.
Q: David Hernandez: How do we protect our data privacy when we travel globally?
My name is David. I joined i.c.stars for many reasons, but my main goal is to become a software developer at some point in my career. But my question for you is concise: how do we protect our data privacy when we travel globally?
A: Urbanek:
Personally, when traveling globally I tend to focus on physical security and physical privacy which in some ways can represent data privacy. My security-related habits center around the ability to continue operating in the event of an emergency.
I keep a photo of my passport in my phone and depending on where I am going may have a physically printed copy as well. I have an iPhone with iCloud and iCloud Advanced Data Protection enabled which provides end-to-end encryption so Apple can’t even see my photos and other data in iCloud. End-to-end encryption (E2EE) is unique to Apple iCloud with Advanced Data Protection. Microsoft OneDrive and Google Drive do not support true E2EE at this time.
The physical passport that I have is kept in a safe in the room and not on me so it cannot be confiscated. If there is no safe, I hide it or tape to the underside of furniture.
If I sign up for services when remote at a hotel or restaurant, I use a throw-away email address.
Q: Carlos Vazquez. Often when downloading an app we are asked to give certain permissions for free use. We know those companies sell data to others. How do we leverage the price of our information?
Hi, John. My name is Carlos. I have a background in sales. I’d like to learn more about software development and data privacy. My question is, often when downloading an app we are asked to give certain permissions for free use, and we know those companies sell data to others. How do we leverage the price of our personal information?
A: Urbanek:
Yeah, that’s a cool question.
Carlos Vazquez
Right. How do I get in on what’s being sold?
John Urbanek
Well, the short answer is that it’s hard. Period.
Are you familiar with the Brave browser? It’s a chromium-derived browser that rewards you Bitcoin for letting Brave serve you up specific ads and track certain things. You are not going to become a millionaire, but your question was how can you get in on the action? The Brave browser. There’s other stuff out there that’ll pay you for watching videos and responding to surveys and other stuff like Kash kick.
Most apps and services don’t have these kinds of models. You use them for free. You probably heard this before, but you are the product.
I pay close attention to the location data requirements for every app afforded the privilege of living on my phone. If it requires access to location data all the time, I delete it and don’t use it. Only allow apps to track location when using the app itself and then close the app when done with it.
Your location data is more valuable than you know. Even if you don’t have apps that are currently tracking your location, your carrier is tracking you. All major carriers track location data and they’re selling it without your knowledge. No app integration required, they do it using tower trilateration and sell that data. Authorities generally don’t bother with warrants for this data anymore – it’s for sale and easier to obtain. Good question though.
Q; Soraya Sanchez: Where does privacy fall through the cracks most in corporate America? Examples are DNA data centers and medical info.
Hello, John. Nice to have you here today. I’m Soraya Sanchez. I joined i.c.stars to obtain networking skills and to immerse myself in the ever-changing tech community. Formerly, I worked at Software One as an admin assistant, my focal point right now is cloud security. My question for you would be where does privacy fall through the crack most in corporate America? Examples are DNA centers and medical information.
A: Urbanek:
Strong data security and privacy costs money. It’s not overwhelming, it’s not impossible, but it’s costly to get the right people in place to build out the right governance, risk, and compliance policies. On top of that shell out for the tooling and technology needed to implement and then people to manage the technology.
There’s no “data privacy” award, there’s no “cybersecurity award” for best in class. The financial incentive for a strong cybersecurity posture or a data privacy-like practice is down the road.
On the positive side, some of you have probably heard of GDPR, the General Data Protection Regulation; California has its own CCPA, the California Consumer Privacy Act. They’ve moved the needle. The regulatory bodies exists. There are increasingly stiffer penalties for failures. That’s a step in the right direction.
The SEC, the Securities & Exchange Commission holds authority over publicly traded companies. In 2024 they started making quite a few examples out of individuals at these companies. There’s this concept of individual accountability. Normally when an organization is in the news for a breach of protected data, the SEC fines the organization a few million dollars and the company pays it. Well, who at the company was responsible for the decisions that led to the breach? They’re getting away. Or maybe they get fired? Then they go get a job at another company, making similar terrible decisions. There’s no individual accountability.
In 2024 and continuing in 2025 the SEC is focused on individual accountability. Prosecuting individual officers within the organization. Blocking their ability to work in the financial sector, or from being an officer in a future publicly traded company, frequently fining them individually. This idea of individual accountability is another step in the right direction.
Back to the first part of your question – it’s frequently money-related. Delayed incentive is a big crack that has a lot of things falling into it. People and organizations have a problem with delayed incentives.
Q: YuXeng Lo: What do you see as the biggest challenge in data privacy over the next five years?
So again, thank you for taking the time to join us today. I joined i.c.stars to develop my professional skills, and networking skills and just to learn more about programming and coding. My question to you is what do you see as the biggest challenges in data privacy, within the next five years?
A: Urbanek
Five years from now. You know what hasn’t been said yet – AI.
The biggest challenge in data privacy over the next five years is removing the “do no evil” or “Halo Handcuffs” that are on many of the publicly accessible LLMs and AI models.
If you ask them to do nefarious things, they often won’t do it. If you were to ask “how do I get through airport security with an explosive that can cause rapid decompression in an aircraft?” Guardrails are in place to prevent that AI from helping you with evil deeds. As models become more readily available and cost effective, more nefarious-GPT’s will rise.
Short history lesson. Bitcoin was released in 2009 and hit its first wave of popularity in 2013. Exchanges popped up. Most of the transactions were either techies mining on GPU’s or Silk Road-type payments for things not legal. Cybercriminals eventually figured out it was a way to get paid with less tracks. Being good at cybercrime was one thing, getting rich off it was hard. Like anything you catch criminals by following the money. If you look at the cybercrime numbers starting in about 2013, particularly with ransomware – it goes off the charts. They finally had a way to reliably get paid without getting caught – or get paid in a decentralized currency while living in a country where the government doesn’t care about your acts of cybercrime.
Back to biggest risks, 5 years, data privacy. Imagine a great way to get paid in mostly anonymous decentralized cryptocurrency combined with strong prompt-engineer-cybercriminals using AI after its shackles have been removed. I think it’s a recipe for a lot of danger in the coming five years, and we’re starting to see it already.
If you’ve heard of these things called bad GPTs. It is a name for rogue AI assistants. Imagine targeting a million people at a time, each individual slightly customized. Maybe the Bitcoin ransom is only $100 which most people would pay to get their photos back. Say a million people are targeted and 1,000 of them are successful. It’s a pretty low success rate. 1,000 times 100 bucks is a hundred grand in gains for a single campaign that ran for the price of a fast casual lunch. Five years from now, ha. At the current rate of iteration that might be here in a year. I think it’s scary.
Q: Terrance Richardson: What are some key signs we should look for to ensure our information is effectively secure?
Hey, John. I’m Terrance, a little bit about me. I joined i.c.stars because I wanted to do something different and challenge myself. I have a background in security and I wanted to get into the cybersecurity field. Just try and use my mental strengths, more than my physical strength, I’m getting a little bit older, so I have to, you know, switch it up a little bit. But my question for you guys is what are some key signs we should look for to ensure our information is effectively secure?
A: Urbanek
I’ll start with the business side. As a part of your agreements and contracts you sign with other businesses, include cybersecurity addendums that require attestation of certain business practices. You may not be able to go in and look at all the practices and data inside a business partner, but you can require they attest to their cybersecurity around e-mail security, endpoint security, logging. Do they have MFA enabled? Do they have a MDR with 24-hour monitoring? Do they get a penetration test? Once per year? Ongoing?
Business partners fill out your addendum and questionnaire and if I don’t like the answers, don’t do business or negotiate a better rate. Many of these addendums include the ability to have an independent third-party audit against the things attested. These addendums are very common as part of contract negotiation and gives an organization a window into what their partners are doing.
On the consumer side – simply put, we take risks every day using services on our phone or other devices to make our lives easier or entertainment. My cynic take is to assume most of the information I provide is going to be breached at some point. But it changes my focus on limiting what information is shared and taking steps to limit the blast radius when that data is breached.
We talked about security vegetables earlier.
Use unique passwords in every single account, don’t reuse passwords, use a password manager. I like BitWarden and Keeper. BitWarden has a free tier, and both run on all your devices and have true end-to-end encryption. Some people don’t understand why. Why do I need to use a password manager? If you use one email address and password combination for 10 services, and one of those 10 gets breached, now those breachers can log into the other nine because you use the same password. They will try to login across the most common public services that are out there with that credential, and they just might get in.
Enable Multi-Factor Authentication (MFA) on any service it is available. I like Authy as a general-purpose One-Time Password (OTP) app that can replace ten others.
Review, tune, and configure all those privacy and data collection settings on your phone. Pay special attention to location access. When you sign up for web services online that don’t have an app, tune the privacy settings and turn all data collection stuff off so you’re not sharing additional information or telemetry that would be shared during a breach. Do these things right away when signing up for services. Waiting ten minutes for your appointment? Instead of doom-scrolling, delete an app and tune some privacy settings.
Freezing your credit is a big one. You can freeze your credit for free with all three of the reporting bureaus – Equifax, Experian, and TransUnion. It takes about 45 minutes to do in total. If some of your information does get out there, personally identifiable stuff enough to create a new credit account, at least you won’t have to worry about someone three states away going on a spending spree on fresh plastic. Now if you need to go get a mortgage a car loan, you have to “thaw” it temporarily – it takes just a minute.
Use transaction notifications on your credit and debit cards. Prefer credit cards if possible.
Again, this is about containing and minimizing the blast radius, so identity monitoring services like LifeLock or Arora are helpful. Consider scrubbing your digital footprint with services like Incogni or DeleteMe which are reputable services used to force legitimate business and data brokers to expunge personal data using data protection laws and legal means.
And not to start a holy war, but it usually does. If you need a smart phone and want strong privacy capabilities, use an iPhone. The operating system was not developed by an advertising company. iOS and Apple has a strong consumer privacy record in the industry. You still have to practice safe smart-phoning, but in my opinion the best privacy controls and capabilities are there to be tuned.
If you want an alternative to iOS and Android, but don’t want to go back to 1999, I really like what Light Phone has been doing. Strongly considering picking one up to play with it.