Information Security Tips from Westfield Insurance

Cookies - defined

A cookie is a tasty treat.

It's also a small string of text that's used to keep track of your computer when you browse the Internet. An HTTP cookie might track general information about your computer (such as IP address you used to connect or the type of browser you use) or more specific information about your browsing habits (such as the last time you visited a particular web site or your personal preferences for viewing that site).

The bit of text that makes the cookie is sent to your computer by a server when you first visit a website (or sometimes when you sign in to the site). After that, whenever your computer accesses that server, it sends the text string unchanged back to the server. The cookie identifies your computer to the server and lets the server know to send back the content that's relevant to your request and keeps it from mixing up the reply with the next person's request.

Cookies serve several different purposes depending on how long your computer stores them.

• Session cookies store information only as long as you're using the browser. Once you close the browser, it is erased. Session cookies are a way to keep you logged in so you don't have to reinput your password on every page. Session cookies can also hold onto your preferences or keep track of whether you've already visited a particular page. Session cookies are used on many websites to keep track of the contents of your electronic shopping cart.
• Persistent cookies are stored on your computer's hard-drive so that your personal preferences can be retained over time. Persistent cookies are how your computer knows to fill in your username by default when you open your Yahoo! or Hotmail email account or to display your personalized page appears when you visit Amazon.com. Persistent cookies can also be used by advertisers and others to keep track of your browsing patterns. If an attacker gains access to your computer, he/she may be able to gather personal information about you through these files. Persistent cookies may be set to "expire" after a certain period of time (usually a few days or weeks) but can be set to never expire.

Because of the privacy concerns, cookies can be controversial. Many people recommend blocking or limited the use of cookies in your web browser. While this can make sense in many situations, it will cause some sites to stop working. To control cookies, go to the options or preferences section in your web browser. In Internet Explorer, the path is Tools/Internet Options/Privacy. In general, you should set higher restrictions on third-party cookies – those used by advertisers on a site to track your behavior across multiple webpages – than on first-party cookies – those used by the site that you are actually visiting.

If you are using a public computer, you should make sure that cookies are disabled to prevent other people from accessing or using your personal information.

FBI Botnet Investigation

The FBI just announced the largest ever cybercrime investigation to disrupt and dismantle "botnets" and to prosecute some of the ringleaders in these criminal activities. So far, they have identified about 1 million compromised computers across the country. The FBI is working with the CERT Coordination Center at Carnegie Mellon Univ to notify the victim owners of the computers.

So far, the FBI has charged 3 people with cyber crimes as a direct result of this investigation; one hacker in Texas accused of infecting tens of thousands of computers, one hacker in Seattle accused of using botnets to send tens of millions of spam messages and one hacker in Kentucky accused of using botnets to disable other systems.

Note: The FBI will not contact you online and request your personal information. Nor will they offer to clean your computer for you. As word of this investigation gets out, be wary of fraudulent message appearing to come from the FBI or some other agency and offering to "fix" your computer for you. If you receive such a scam, file a complaint online with the Internet Crime Complaint Center or call the nearest FBI office.

A botnet is a network of other people's computers all controlled by a hacker. In a typical botnet setup, the first hacker uses viruses, worms or trojan horses to install malicious software (the bot) on your computer without your knowledge. The hacker builds up the network as large as possible – tens or even hundreds of thousands of compromised computers. He then rents out the right to use his network of hacked computers to the highest bidder. The second hacker sends out the command messages to all the hacked computers telling them to execute their attack. Examples of attacks might be distributed denial of service (flooding the target with so many requests that the real traffic can't get through), publication of phishing emails, click fraud and mass distribution of spam and spyware.

Unfortunately, the hacked computer's user might not even notice that his/her computer is being used by someone else. Look for slow performance, an outbox full of mail you didn't send or messages saying that you've sent spam. Any of these would be reason to investigate your computer carefully.

If you think your computer might be infected, contact your Technical Support immediately.

Take the following steps to protect your computer from being captured in a botnet:

• Pick strong passwords
• Install anti-virus software and keep it up to date.
• Install a firewall and keep it turned on.
• Keep your computer's software fully patched.
• Install and update anti-spyware software.
• Be careful what you download.
• Turn off your computer when you're not using it.

Have an information-safe vacation

Before you leave for vacation, take these steps to reduce your risk of fraud and identity theft.

1. Clean out your wallet.
   • Plan to use traveler's checks or credit cards for payment. Leave your checkbook at home.
   • Leave your debit card(s) at home. Under federal law, your liability is limited if your credit card is misused. If your debit card is stolen, you could lose all the money in your checking account.
   • Take an ATM card that does not have debit card privileges. Your bank should be able to issue you an "ATM only" card.
   • Never carry your Social Security card in your wallet.
   • Leave any unneeded credit cards and any other unnecessary documents at home.
2. Photocopy your wallet and keep the copy in a safe place. If your wallet is stolen, the copies will tell you who to call to get your cards canceled. Note: If you will be gone for a long time, consider leaving a copy with someone you trust who can help you cancel the cards while you're still on the road.
3. Stop your newspaper delivery and have the Post Office hold your mail (or ask a trusted neighbor to collect them for you). The bills and account statements in your unlocked mailbox are a goldmine for an ID thief. And the packages and newspapers piling up on your front step are a sure sign to a burglar that you are away.

While on your vacation:

• Don't leave your wallet, passport or any identifying documents in your hotel room unattended. Use the hotel safe if it's available.
• Guard your credit card receipts and rental car agreements, especially if they contain your full credit card number or driver's license number.
• Use ATMs at banks or credit unions and which are in well-lit areas.
• If you are taking your laptop with you, be very careful when using it for on-line banking and other password-protected services, especially if you are connecting to a wireless hotspot.
• Be equally cautious of cyber-cafes and other public-access internet facilities. Anyone could have left a keystroke logger on the machine in order to capture your ID and password.
  based in part on suggestions from the Privacy Rights Clearinghouse