Information Security Tips from Westfield Insurance

CVS sued over improperly destroyed records

The drugstore chain CVS is being sued by the Texas Attorney General for failure to properly dispose of customer records including credit card and debit card numbers, drivers license numbers and medical prescription forms with name, address, date of birth, issuing physician and the types of medication. According to news reports, the store was being closed when over 1,000 papers with confidential information were found in the dumpster behind the store. (1,000 records would be 2 reams or about 10 pounds of paper and could easily have come from a single office-sized trash can.)

Dumpster-diving for sellable information is an increasingly common problem. Last year, a local Westfield Office Manager drove into his office's parking lot early one morning and surprised a man and a woman fishing papers out of the building's dumpster. Before he could even get parked, they jumped into their pickup truck and sped away. (Because the members of the office follow Westfield's "shred everything" policy, none of our customer information was compromised but we did notify the other tenants of the building.)

Failure to properly destroy confidential information is a violation of the Federal Trade Commission's regulation on disposal. In addition, it is a violation of several Texas laws and carries potential penalties of $50,000 per violation and/or $500 per abandoned record. This one incident could cost CVS's parent company over $500,000 in regulatory fines alone. The company is also reported to be under investigation by the US Office for Civil Rights and the Illinois AG for similar failures in other states.

In addition to the legal penalties, CVS is expected to suffer in the marketplace. According to a recent study by Javelin Strategy & Research, 77% of consumers said that they would stop shopping at stores that suffer data breaches. While it's unclear how many customers will realistically carry through with that threat, independent research estimates that a security breach costs $200-300 per lost record when you include the costs of disclosure, increased call centers costs, lost employee productivity, legal fees and the loss of investor and customer confidence.

While the law requires only that confidential documents be properly destroyed, I strongly recommend a policy that all papers must be shredded when they are no longer needed - that no office paper may go into the regular trash stream. There is too much chance that a social security number or unlisted phone number will be overlooked on the back side of a page.

For offices below about 10 employees, the most cost-effective solution is usually to invest in a good quality cross-cut shredder. For larger offices, consider contracting with a shredding vendor who can provide secure bins where papers can be collected until the vendor's scheduled pick-up. Require that all paper trash be placed in one of these bins.

VIP Cons

Recently, four Westfield folks went into Cleveland together for a Cavalier's game. As they pulled into the arena's parking garage, they noticed that several of the parking spaces had been marked off with traffic cones. One of the parking attendants removed one of the cones and waved them into a very close parking spot on the same level as the pedestrian bridge to the game. They assumed that it was some sort of VIP treatment that came with their tickets. They locked coats and purses in the trunk, then went in to enjoy the game.

Over the next three days, all four reported that their corporate credit cards had been used for fraudulent transactions. Police believe that the car was "marked" by a confederate working as a parking attendant based on the make of their car and their professional appearance. He waved them into the "VIP spot" so his confederate would know which cars to target. The criminals either picked the lock of the car with a slim-jim and popped the trunk from the inside or recorded the electromagnetic code of the trunk's remote so they could open the trunk themselves.

When the four people each checked their wallets, only these corporate credit cards had been stolen. Personal cards, personal checks and cash were untouched. It's human nature to pay more attention to our personal accounts than to a faceless corporation's account. Intelligent criminal exploit that trait and selectively target who and what to steal so they can go undetected as long as possible.

The bank did an excellent job of handling the fraudulent transactions but we all pay when the criminals get away. It is extremely unlikely even with this evidence that criminals will be caught or prosecuted. Sometimes the best we can do is to avoid being targets in the first place.

• If someone's offering you a service that seems too good to be true, it probably is. Be extra cautious (and a little bit suspicious) when someone is giving you unexpected special treatment.
• Keep your valuables with you whenever possible.
• Watch your credit card accounts (personal and corporate) carefully.
• Always lock your vehicle.

Google Desktop is evil

Okay, that's a bit of an overstatement but it is a security professional's nightmare.

Google Desktop is a popular free program that can be downloaded onto a personal computer to allow the indexing and searching of files on your computer. It operates much like the internet-based Google search engine and can find content from a wide variety of file types and formats including emails, instant message logs, web history, MS Office and Adobe documents, videos, music files, images, etc.

Given enough time, Google Desktop will search all drives to which you are connected. This means that if you are connected to your office's systems, the Google Desktop engine will begin indexing all of their files as well – whether or not that was your intent. This information will be exposed to anyone with access to the index. Since web histories are included by default, this frequently has the result of allowing users to bypass usernames and passwords before seeing confidential information and to see information that should have been protected by someone else's password.

Google Desktop allows users to "share across computers". In theory, this increases your ability to find content since you can simultaneously search multiple locations. In practice, this exposes your documents and private information to outsiders. Even if you have the actual documents in protected folders, the index (and all the confidential information which was captured by that index) is available to everyone. The research company Gartner considers this an "unacceptable security risk", an assessment to which even Google agreed. (See here for more.) If you have any private information on your computer or if you are covered by any privacy regulation (and in the insurance industry, we all are), you should never allow the installation of the "share across computers" feature.

Google Desktop also represents yet another piece of software which must be kept fully patched and up to date. Unpatched software creates an avenue which hackers can follow to gain access to your computer. Read this article about a recent vulnerability with this software.

Unless you have a dedicated security expert who can make sure that your configuration is exactly correct, Google Desktop should not be allowed on any corporate computer holding confidential information.

Drive-by router vulnerability

If you have a home network or wireless router, it can add a layer of security to your computer. But if you haven't changed the default password on your home router, that can be worse than doing nothing. Hackers have recently developed some new tricks to automatically attack your computer's router just because you were at an infected site. It might not even be the primary site you were visiting – it could be the site hosting one of the ads on the page.

In this attack, hackers use small bits of code that automatically try to log in to the router using the default password. The default password is the one that came on the router when you got it from the manufacturer. It's usually something like "admin", "password", "1234" or sometimes blank. Default passwords are printed in the user manual (which is also available online). An online search for "default password list" turned up over 60,000 sites sharing this information, most of them hacker sites.

In a variation, some local hackers will try the same default password against your wireless router as they drive through your neighborhood.

Once the bit of code has successfully logged into the router, it opens a port. The hacker will later come back to your computer and attack it through that port. One common attack is to send false directions to the computer so that when you attempt to log in to your bank's website, the compromised router instead sends your request to a fraudulent site designed to look and feel like your bank's website. Read this CSOonline article for more.

If you haven't changed the default password, do it today! Follow the router manufacturer's instructions to change the password. Make sure you pick a strong password when you change it.

How do you get rid of an old computer?

It's time for spring cleaning and you finally want to get rid of that old computer that's been gathering dust for so long. What will you do with the old one? You can't just give it away or sell it. There are thieves who specialize in buying used computers on eBay just to search them for private or financial information before reselling them.

Even if you remembered to delete your files, the data is not really gone yet. (When you delete a file in Windows, all that really happens is that the file information is removed from the computer's "table-of-contents". The data is still on the hard-drive and will stay there until Windows decides that it needs to overwrite that particular space with a new file. That can take months or years.) Even re-formatting the hard-drive does not sufficiently wipe the data. You might hide it from a casual hacker that way but a determined attacker using the latest techniques will be able to reconstruct your hidden information. Read this PC World article for more.

You also can't just put the old hardware out on the curb with the weekly trash. Even if it doesn't get taken from your trash by some passerby, there are hazardous materials within most of the devices that should be properly disposed of. Here are some steps you should take:

1. Make a couple of backup copies of important data and programs by writing the files to CDs.
2. Use one of the free or relatively inexpensive software programs available that will write over the data on the hard drive. This ensures that no one will be able to access your personal information later even if they try to use data-restoration software. Click here for a review of several common programs.
3. If you can, donate or recycle the equipment. Computer manufacturers often have suggestions on their websites (see for example, Dell or HP) and may even offer free pick-up and will work with local agencies in order to donate or recycle the equipment. You can also look for local donation sites at websites such as Earth 911. Finally, many counties offer computer hardware drop-off locations at their hazardous waste collection and recycling sites (e.g., Medina, and Summit counties) .

Note: Several donation programs ask that you not delete the operating system or software from your computer, arguing that schools can't afford to replace the software. This is in general untrue. Most schools, like most corporations, buy "site licenses" and can reinstall the operating system at a fixed, discounted rate. If you do want to donate the software along with the hardware, give them the original installation disks and let them install the software themselves. Always wipe the drive before you donate it.