Information Security Tips from Westfield Insurance

Who has access to your data

This article was originally published in the Mar 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

When John retired last month, when Sue left the company, when Sam moved into another department, did their access rights get updated? Or can they still log onto the computer and see your customers' confidential information? Can they log onto one of your partner web sites and prospect against your customers?

Identity and rights management is a complex and serious problem for any company with more than a few employees. Federal and state regulations require that private customer information be protected based on a business need-to-know. Social Security numbers, credit scores and driver license numbers are just a few of the fields that are considered private. If your employees, contractors or support staff have access to files or programs holding that kind of data, I recommend creating a plan to make sure that only the right employees have access.

Here are suggestions to help keep your data safe:

• Keep a current list of users for your systems.
• If you have a user who no longer needs access, you should remove the name from the list of authorized users. According to Secret Service Internet crime statistics, most penetrations of electronic systems are carried out by former insiders whose access was not properly shut down. Make someone responsible for changing access rights whenever an employee's status changes to ensure users do not keep rights they should no longer have.
• Keep an employee access checklist of all carriers' systems, bank systems industry web sites, etc.
• Make sure that they also know of the employee's status change. A sample checklist with some of the most common considerations is available on Agent's Web Passport* and can be used as a template to build or expand your own list.

* Agent's Web Passport is a proprietary web portal for independent agents affiliated with Westfield Insurance. The sample checklist is not currently available through this blog.

Hackers attack computers every 39 seconds

In the time it takes you to read this entry, two hackers will try to get into your computer.

The Hollywood stereotype of a hacker is a technically-savvy individual trying to get into a specific target computer - the spy trying to breach a military computer, the disgruntled employee vandalizing his former employer or the kid cracking a university system for bragging rights. In fact, most hackers today run brute force attacks using simple software-assisted techniques to randomly attack vast numbers of computers.

According to a Maryland Univ study, computers are attacked on average 2,244 times a day. That's an attack every 39 seconds.

Researchers in this study set up weak security on four computers with internet access, then recorded what happened as the individual machines were attacked. The vast majority of attacks came from relatively unsophisticated hackers using “dictionary scripts,” software that runs through lists of common usernames and passwords trying to break into a computer.

The most commonly guessed usernames were root, admin, test, guest, info, adm, mysql, user, administrator and oracle. The most common password-guessing technique was to use variations of the username. About 43 percent of all attempts simply reentered the username. The username followed by 123 was the second most-tried choice. Other common passwords included blank (that is, no password set), 123456, password, passwd, 123, test, asdf, qwerty and variations based on the date (such as January07).

Once hackers gain access to a computer, they set up back doors so they can easily regain access later, turning the target computer into part of their botnet which they will later either use directly or lease to other hackers so they can send out spam, attack yet more computers, run distributed denial of service attacks, etc.

Never use the kinds of usernames and passwords identified in this research. If your computer came with a default administrator or guest account, change the accountname immediately.

Always choose longer, less obvious passwords with combinations of upper and lowercase letters and numbers that are not as obvious to brute-force dictionary attacks. If your system can handle it, whole sentences make very strong passwords that are still easy to remember and to type.

Anti-Virus Software comparisons

Computer viruses have not been in the news much lately but they are still a serious threat to the stability of your computer and the safety of your information. In the past few years, virus writers have become increasingly sophisticated in both their techniques and their goals. Hackers are no longer so interested in viruses that merely commit vandalism (like wiping your hard drive). Today, they craft their viruses to install backdoors, keystroke loggers and other programs that will allow them to either control your computer or steak your information. The viruses themselves are often designed to work around many anti-virus programs. "Polymorphic" viruses will modify their own code in order to avoid detection. Others will quietly disable your anti-virus program so that you won't get the updates you need to clean the virus out. One virus recently discovered will even install its own anti-virus program designed to keep competitor viruses out.

If you don't have a good anti-virus program on your home computer already, pick one and install it immediately. Above all, keep it current and run your scans regularly.

Never disable your anti-virus program.

The Austrian organization, AV-Comparatives, has released their latest study of the relative effectiveness of 12 commercially available anti-virus software programs. Six of the programs earned their highest rating, McAfee and Dr Web earned their lowest rating and Microsoft's new OneCare package failed to qualify for any rating. You can also find a quick-reference table on the Comparatives page of the av-comparatives.org website.

The authors of the study are careful to say that you should consider not only how effective the programs are at finding and stopping viruses but also how easy the programs are to use and to keep current. An anti-virus program that blocks every possible threat but that also blocks your attempts to get work done is not a good choice even though it would score very highly on these tests.

Annual credit report review

This is your annual reminder to request your credit report. Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is eligible for a free copy of his/her credit report every 12 months. Follow the instructions at www.annualcreditreport.com to request your credit report from each of the three major credit reporting agencies.

When reviewing the credit reports, look for:

• adverse actions on your accounts that might indicate that you have been a victim of identity theft
• accounts that have been opened in your name without your knowledge. Even if the identity thief is making the payments regularly, the account could still be in use for illegal activities.

If you find a discrepancy, follow the specific instructions on the website to dispute any incorrect information.

Don’t forget to check the credit reports of your immediate family members, especially minor children and dependent elders. Both of those groups are at elevated risk of identity theft.

Remember that you are also eligible for a report every 12 months from any of the specialty agencies which have information about you.

If you want more frequent feedback on your credit history, consider asking for your free copy from only one of the major credit reporting agencies at a time. Space the requests for the other two agencies out every four months. For example, you could ask for your free copy from Experian in March, your free copy from TransUnion in July and your free copy from Equifax in November. Once you start, you will have to keep the same rotating pattern. Schedule the requests on your calendar.