Information Security Tips from Westfield Insurance

Personal Email Accounts

Many people keep a personal email account separate from their work email address. I recommend this practice for several reasons.

First, it helps to keep business and personal issues separate.

Second, it keeps a lot of the spam messages out of your work email box. If you use one of the free web-based services like Hotmail or Yahoo, you can abandon the account and open a new account when the spam gets too bad. If the spammers infest your work account, you're stuck.

Third, if you set it up right, it's portable. Few people are lucky enough to work at one company for their entire career and all of us hope to retire someday. When you're no longer an active employee, you lose the company-provided email address. A personal address provides continuity during your transition. If you use one of the free web-based services, you're not even dependent on your personal Internet Service Provider. You can switch from AOL to RoadRunner and back without ever making your family and friends change their address books.

There are a few things you should remember about your personal email account, though.

• Never use your personal email account for work. Customers and coworkers expect us to communicate through a consistent channel. In these days of spam and email spoofing, messages from any address other than your official work address will be met with justifiable suspicion.
• In almost all situations, your company does have the right to monitor your personal email if you check it on a work computer (and in some situations, is obligated to do so). If you're on your work computer, all the normal rules about professionalism and appropriate use still apply.

Photocopy your wallet

If your wallet is ever lost or stolen, you need to immediately contact the issuers of all the credit cards and identity documents and begin the process of getting new cards.

About once a year, lay out the contents of your wallet on a photocopier. Copy both the front and back so you have a record of all the card numbers and phone numbers.

Be sure to keep the copy in a very safe place. When you make a new sheet, be sure to shred the old one so it can not be misused.

File a police report immediately in the jurisdiction where your credit cards or wallet were stolen. Do not wait until you return home. Promptly calling the police shows to the credit providers that you were diligent and will be the first step toward their investigation.

Consider calling the three national credit-reporting agencies to place a fraud alert on your name and social security number. That will make it a bit harder for the thief to open new accounts in your name.

If you are traveling, keep your identity document (passport or drivers license) separate from your wallet. You should also carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.

"Storm Warning" email worm

Hackers are trying to exploit the storms which have been hitting Europe. F-Secure, a Finnish data security firm, announced the identification of the "Storm" email worm in emails with the subject line "230 dead as storm batters Europe." The file attached to the message contains a virus that creates a backdoor into the computer. This allows the hacker to later either steal data or to use the victim's computer to post spam messages to other victims.

This is part of the growing evidence that hackers are conducting real-time attacks, trying to take advantage of our curiosity and compassion during breaking new stories. Security experts estimate that thousands of computers have already been affected, mostly personal computers. Most corporate systems (including Westfield's) have already been configured to block this virus but the hackers know that many personal users are not as diligent at keeping their anti-virus software up-to-date.

• Do not open unsolicited emails.
• Keep your anti-virus software up-to-date and run it regularly.

Read this Reuters article for more.

Anti-Phishing Toolbar Review

Phishing is a continuing and serious problem for all of us. In the past few months, a number of companies have come out with anti-phishing toolbars – applications that you add to your internet browser and/or email program to help identify and block phishing websites and other web-based scams. Several of these tools are available for free.

Despite all the marketing hype, a recent independent study of these tools found them to be of only limited use. This study, conducted by four researchers at Carnegie Mellon University, found that even the best of the available anti-phishing toolbars only identified about 85% of fraudulent websites in their test. Worse, the toolbar created a false sense of security among users. Users tended to assume that the toolbar was working and that the website was safe even when it was not.

The anti-phishing toolbars also had problems with false-positives – good websites which were incorrectly identified by the tool as a probable phishing site. While 85% is a good start and shows that a technology solution might be someday possible, it is not yet safe to rely on these toolbars to identify phishing websites. Remain cautious whenever visiting a website that asks for any personal information.

For more, here are links to the full study (including descriptions of each of the tested toolbars) and a ComputerWorld article about the study.

Phishing IQ Test

When was the last time you got an urgent email warning you that your account was about to be disabled unless you reregistered the account? Did you fall for it? How good are you at sorting out the phishing emails from the legitimate requests?

With the huge increase in spam recently, it's a guarantee that you either have received or soon will receive a phishing email – and you probably have received several in the past week alone. Take this test to see how good you are at sorting the good from the bad.

Note: According to the makers of this test,
       19% of phishing emails are incorrectly identified as legitimate by the test takers
       48% of good messages are incorrectly identified as phishing.

Remember, never follow the "convenient" link in an unsolicited or unverified email. If you think it might be a legitimate message, contact the sender directly.

Resolve to pick stronger passwords in 2007

Resolve to pick stronger passwords for the New Year.

A surprising number of people still think that January07 is a good password. Admittedly, it does pass the Microsoft password-complexity rules. It has an upper-case letter, several lower-case letters and two numbers. The problem is that it's an English word with the capital letter at the front and the numbers at the end. English-speakers have a natural tendency to follow this pattern. We know it – and the hackers know it too. That password can be cracked in under 30 seconds.

Pick whole sentences for your password. A whole sentence (including spaces and punctuation) makes a very strong password that is easy to remember and to type. Windows accepts any key on the keyboard in your password (and some that aren't on your keyboard) and allows it to be up to 127 characters long. You only need a 4 or 5 word sentence to make a very strong passphrase. I particularly like sentences from children's counting books.

For systems with limits on password length or allowable characters (like mainframe accounts), you can keep your passwords in synch by using rules to transform your sentence into a shorter code. For example, you could start with the number of words in the sentence, then take the second and last letters of each word in the sentence, capitalizing each third letter. As long as you follow the same rules each time, you can consistently convert your easy-to-remember passphrase into a strong random-looking password.

Remember – your password is the key to all of your electronic defenses. Keep it safe, never share it and pick them strong enough that they can not be easily cracked.