A gift horse ...

While commercial and paid-for software used to be the rule, today you can find more and more free offers. However, there is no such thing as "free" or "gratis" in the free economy.

In English, there is also an apt description for this: "TANSTAAFL - there ain't no such thing as a free lunch".

There may be no payment, but you still have to pay with something of value. In most cases today, users simply pay for free internet offers or apps with their data.

A user becomes a "profile" - and the more you enrich it with data, the better you can tailor advertising to that user. This "business model" is omnipresent today, even with some security products.

However, with this model, the data usually remains in the relationship between provider and customer. This is something that the customer can normally still penetrate. However, it becomes critical when (even anonymized) profiles are sold on to third parties.

This "Holy Grail" for advertisers makes it possible to create even better and more transparent profiles by cross-correlating a wide variety of data sources.

And this is all the more true if it is possible to "de-anonymize" data that is actually anonymous in this way.

This is all the more tragic because both theoretical and practical experiments clearly show that de-anonymization is basically a purely statistical problem that depends solely on the available data sources and quantities.

Galloped

Unfortunately, even providers of security solutions are now using this opportunity to earn extra money. This is all the more tragic as a certain level of sensitivity is expected when handling personal data, especially in the security sector.

Although legally perfectly legal, the question of ethics must also be allowed here. Of course, the resale of data is a lucrative additional business for the provider. However, customers can no longer penetrate this "three-or-more" relationship.

The simple question "Who has my data?" is almost impossible to answer.

Until now, the only option was to stubbornly work through the provider's terms and conditions. The fact that these are usually written in the finest legal English did not exactly make the task any easier ...

Backing the right horse

This is where the so-called "minimum standard" of the European Expert Group for IT Security (EICAR) comes into play. It is probably known to many as an independent European research organization in the antivirus sector, but has long been concerned with IT security as a whole.

The most recent project is the "minimum standard", which forces certified providers to maintain data hygiene. This means that security products may only collect and transfer data to the manufacturer that is absolutely necessary to fulfill the security functions.

The collection and transfer of personal data clearly violates this requirement. As CTO of Trend Micro, it is also a personal concern of mine to say that we were the first manufacturer to certify solutions according to the EICAR minimum standard.

Trend Micro's business model is to sell our customers the best possible protection against the dangers of the IT world. The collection and secondary use of customer data and its resale are definitely not part of this.

Ultimately, you have to ask yourself which horse you want to back, what price you are prepared to pay for a service or solution.

On the one hand, there is the commercial option with a clearly defined monetary price and corresponding performance. On the other hand, you pay with your data ...