Information Security Tips from Westfield Insurance

Your Records Retention Program

This article was originally published in the May 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

What you need to consider from Information Security

How is your Records Retention program? Do you have one? Are you following it? In December 2006, the U.S. Supreme Court released new rules regarding the finding and turning over of electronic documents in response to a subpoena or other court request. Among other requirements, the new rules make it clear that every company must have a records retention/destruction policy that is strictly followed.

With that in mind, your document retention/destruction policy must find the balance between potential future benefits of a document and potential future costs of holding that document.

Think through the total costs of holding a document.

Documents are accumulating at an incredible rate. Who will wade through the archives to find the relevant document? Who will remove all protected or irrelevant hits from your search, and how much will you have to pay that person? (If it is a lawyer in response to a subpoena request, the answer is "a lot.") Even if you do find the document, will you be able to open it? What operating system did it run on? What hardware did it require? What will you do about the inevitable files that go corrupt? What storage medium will you use? These are just some of the questions you must consider.

Unless you have a carefully architected solution for document storage and categorization, your costs for electronic storage can skyrocket over time. If you have a copy of the document, the court can order you to produce it, forcing you to spend money to convert it into a format that they want and can read. Good companies have been forced to spend several millions of dollars recovering old versions and restoring old systems just to get through the discovery phase of a suit.

Then there are the legal liabilities of holding onto documents longer than is necessary. We all write things occasionally that we regret. Courts have said repeatedly that as long as you still have a copy of that message, it must be turned over. However, if you destroyed it in the normal course of business and in accordance to your own policy, the courts do not normally require you to go to extraordinary measures to undelete and recreate the document.

Remember that you also need the ability to centrally suspend the destruction cycle when you receive (or reasonably believe that you will receive) a court-ordered litigation hold. Courts have been unforgiving to companies that fail to suspend their destruction programs. Have a policy and follow it stictly.

Use low-resolution graphics to control file size

All sorts of problems come with an e-mail box that gets too large. Bloated e-mail boxes are a technological and administrative headache. Self-discipline over the size of files that we store or that we attach to e-mail is part of good discipline and e-mail courtesy.

One technique for controlling the size of files is to use lower-resolution graphics wherever possible. For most uses, the lower resolution version looks the same on the page even though it takes one-tenth or even one-hundredth the space. Your communications team should have low-resolution versions of all your logos and graphics. These should be used for all e-mails and internal documents such as meeting minutes and presentations. Make sure your staff know where to find the approved versions of all your official graphics.

A second technique is to scrupulously avoid attaching unnecessary graphics to your e-mail in the first place. Graphics in your signature block are specifically discouraged. While some people think that they add a "personal" feel to the message, they go out on every e-mail, bloating both your and your readers' e-mail boxes. Furthermore, they often fail to display correctly, especially if the message recipient uses a different e-mail program than you do, and frequently cause the message to get trapped in the recipient's spam or virus filters. Keep graphics to an absolute minimum in e-mail.

Sober worm resurfaces

Symantec, a computer security company, recently announced that they have seen a significant increase in message traffic containing a new variant of the old Sober worm. This email (generally written in either English or German) hides the malicious code in an attachment and uses social engineering in order to con the user into opening it.

The known English versions of the message read either
You notified us that you have forgotten your password. We have changed your password to a random sequence of letters and digits! For more detailed information, see the attached password file.
or
Your eMail has occurred an unknown error on our Server. Please read your mail and check the text. The full email is attached!

More variations of the wording of the scam email are likely to appear over time. The message can seem to come from anybody and could appear to come from a trusted institution like your bank. The attachment could be under several different names but so far have all been .zip files. (.Zip files are sometimes not as well screened by anti-virus programs.)

While this is probably not going to be a particularly dangerous worm, it is a reminder to:

• Never open attachments in unexpected emails
• Always keep your anti-virus software up to date.

The Sober worm was first released back in October 2003. Variants remained in circulation and caused significant damage for several years. The last major variant of this worm was in 2005. The hackers sending out this worm typically set it to take over PCs, send spam, download keyloggers, install rootkits, etc.

Automated ACH scam

A US Airman assigned to a Colorado Support Squadron recently discovered a new scam that exploited a hole in his bank's ACH (automated clearinghouse) process. This is the process by which banks move money around to settle all our checks, credit card and debit card transactions, mortgage payments, etc.

In this scam, the thief randomly generates account numbers and attempts to deposit a single penny into the account using the ACH system. When one of these tiny deposits clears, the scammer knows that he/she has found a live account and immediately processes a withdrawal from the account. According to one bank's representative, this has been a recurring attack. In each case, the scammer makes only a single, fairly small withdrawal from the account - $124.90 in this case. Presumably, that's small enough that it won't overdraw most bank accounts immediately and that it might get overlooked if you don't reconcile your checkbook regularly but it's large enough to make money for a scammer conducting thousands of these attacks.

The scammers particularly like to make their initial transactions at the start of the month, knowing that their scam will likely go undiscovered until the end of the month when the bank statements are sent out. From the available evidence, this attack was automated and is likely to become more common, at least until banks are able to address the lack of real-time validation in the Federal Reserve's ACH system. Read more at Air Force Link.mil.

The only defense against this kind of attack is to watch your bank account carefully. Reconcile your statement monthly and consider checking your account online a couple of times during the month to see if there are any unrecognized transactions. If you find one, contact your bank immediately.

Remember that a Bank error in your favor is only a good thing in Monopoly. Any unknown transaction, positive or negative, should be treated with suspicion.