Information Security Tips from Westfield Insurance

Ask before responding to Phone Surveys

Imagine that you received the following voicemail:

My name is Lillian and I am calling from ABC Company on the morning of Tuesday, February 26. We are conducting a paid study about the types of software used in the Insurance industry. We're offering $200 in compensation for your time, so if you are interested in participating, you can reach us at 1-800-555-2672, that was 1-800-555-2672. When you call you can ask for reference code p as in pork 8515, that was p as in pork 8515 and this is for a paid survey that pays $200 to answer questions about software. Thank you very much and hope to hear from you soon.

Sounds like a great deal, right? $200 for just answering a few questions. You won't be buying anything so it's not like it's a kickback, is it? And you would never answer any questions about confidential data. Why not call them back?

Although there are some legitimate marketing research firms, this caller was not one of them. These scams can take one of two forms. Most likely, they are vendors trying to get an unethical edge over their competition or an unfair advantage in their negotiations with your company. Sometimes, they are social engineering cons - the caller is trying to pull information out of you in order to sound more like an insider when he/she makes the final scam call against one of your co-workers. Sometimes these scammers claim to be from a vendor, other times they claim to be conducting "research" for a university, etc.

Either way, these callers are trying to con you out of information that they don't think they could legitimately get. If it was a legitimate business request, they wouldn't be so eager to bribe you for your participation. When someone emphasizes the money as much as this caller did, something's not right. You should participate in surveys because it's in your company's best interests, not because one person in the company was bribed.

Do your staff know how to respond to survey requests like these? Do you have a policy that requires them to check with your Legal Department or some other group who can validate the request and make sure that all the required non-disclosures are met? Does your policy allow the response to phone surveys or do you require that all surveys be submitted (and replied to) in writing? If compensation or a gift is offered, who does the employee report it to? Is it personal compensation or remitted to the company? Do your staff know how to tell the legitimate from the questionable requests?

Real researchers follow a code of ethics about their surveys. They will give you more upfront information before inviting you to participate in the study and will provide the credentials necessary to prove their identity. They may offer to compensate you for your time but will do so in ethically appropriate ways. They understand your concerns about proprietary information and will work with you to make sure that your information is properly protected. They will provide their Privacy Policy on request and can show you that they live up to it.

Westfield occasionally conducts surveys either directly or through a third party. Our surveys will always be announced as "on behalf of Westfield Marketing Research". Our surveys should never come as a surprise to an Agency. If you receive a survey request claiming to be from Westfield and you are at all suspicious, call us at 1-800-243-2562 or check on Agents Web Passport to confirm the survey.

Using "Temporary" shared drives

Many companies have a shared drive set aside for "temporary" use. When used properly, this can be an efficient way to share short-term documents across the organization and to minimize email bloat. Users post their document to this shared folder and provide a link to the document rather than sending dozens of copies of attachments around and bogging down your email system. When the short-term need is complete, users are supposed to go back to the shared folder and delete the documents they posted.

Too often, documents posted to these "temporary" folders are hardly temporary. And, while shared, they are rarely shared properly. Users post documents and forget to delete them or fail to consider that others (who may not have a need-to-know the contents) will be able to see the documents. IT departments know that these folders have to be extremely flexible in order to work well. They rarely implement access controls or other restrictions on the use of the folder. Doing so would defeat much of the purpose of the shared folder.

• If you have a shared "temporary" folder on your network, you need to know about it. Don't let these documents fly under the radar screen.
• Consider implementing controls on the folder. Controls can include:
  • Limit access to employees only. Lock out contractors, vendors and others who don't need to see the contents of the folder.
  • Set up the folder to automatically purge all contents older than some set (and short) period. A week or two is all that you can reasonably call "temporary".
  • Never allow the posting of unprotected confidential information to a shared folder.
• Many electronic content management systems (ECM) can make the need for these temp folders obsolete. If you haven't already invested in an ECM system, ask your technology team to look into it. If you have an ECM application, make sure that your staff are taking full advantage of it and not still using the old, uncontrolled shared folders.

No Tailgating

My mother taught me to be polite and always hold the door for strangers. Those early lessons are hard to ignore, especially when the weather is bad. It is very hard to tell a coworker "no" and force them to walk around to the main entrance of the building in the rain or snow. Unfortunately, in today's world of identity theft, litigation and physical violence, those polite habits are increasingly a threat to the safety and security of our coworkers and customers. Imagine the risks if you let someone in who does not belong here. With unescorted access to our building, an intruder could pick up enough information to commit identity theft against our customers on a massive scale. Or worse, the intruder could be coming in with malicious intent toward a fellow employee.

Every company needs have a policy about visitors and needs to enforce a strict "no tailgating" policy. Visitors should always be signed in and out of your facility and should always be escorted while in any non-public part of your facility. If a customer or other important visitor comes to the wrong door, politely greet them and then tactfully escort them to the correct entrance so they can be signed in.

Employees and contractors should be required to show their authentication every time they enter the building. Do not hold the door for anyone and please do not expect someone to hold the door for you. This is an essential part of security discipline.

If someone does follow you into a non-public part of your building and/or refuses to show their ID badge, immediately go to the nearest phone and call your local Security contact. Give them your name, location and a description of the intruder. The borders between information security and physical security are increasingly blurry. These days, security is everyone's job.

Security Planning

As a general rule of thumb, it costs 40 times as much to fix the security of a project after the fact as it would have cost to build security in at the front of the project.

You should always design your applications and solutions be designed with security in mind. Call the Information Security team in your IT department for help identifying and prioritizing security risks. They should also be able to help you develop the business requirements and technical controls necessary to ensure that your confidential data is properly secured. Contact them as early in the design cycle as possible – preferably during the business case stage of the initiative. They can help make sure that all the hidden costs and implications have been identified.

If you're planning to buy a service from a third party where the vendor or service provider will have access to any company data, especially confidential customer data, or will have access to any system or accounts which could be used to get access to our data, the vendor's security practices should be evaluated against your company's security standards. Many companies use an Application Service Provider (ASP) Questionnaire to evaluate the vendor's security practices. Again, contact your IT department for help with understanding the vendor's practices. Do not assume that their practices live up to your standards without checking on them.