Information Security Tips from Westfield Insurance

Personal e-mail accounts and the impact on your agency

This article was originally published in the Jul/Aug 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

Are personal e-mail accounts acceptable for work? What are the advantages and disadvantages to your agency? The lines between personal and professional life often become increasingly blurring. One of the advantages of allowing personal use can be that a few minutes to check e-mail during a lunch break can help staff feel connected and productive for the rest of the day.

Keeping personal e-mail accounts separate from work e-mail accounts can have some real advantages for your agency.

• First, it helps to keep business and personal issues separate. Work is completed on the employee's official e-mail account, and they can talk to family and do their Internet shopping via the personal account.
• Second, it keeps a lot of the spam messages out of your agency e-mail box. Spammers can find you in lots of different ways but some of the most common involve scanning internet chats and shopping sites for e-mail addresses. If you use a work e-mail address and the spammers find you, they can rapidly invest the account - and you can't easily change it because that's were customers expect to find you. In addition, if you use one of the free web-based services like Hotmail or Yahoo and the spam gets too bad, you can always abandon the account and open a new account.
• Third, if set up correctly, it's portable. When you're no longer an active employee, you will lose the companyprovided e-mail address. A personal address provides continuity during your transition. If you use one of the web-based services, you're not even dependent on your personal Internet service provider.

Here are a few things to keep in mind.

• A good rule of thumb to follow is to not allow use of a personal e-mail account for work-related communication. Customers and coworkers expect us to communicate through a consistent channel. In these days of spam and e-mail spoofing, messages from any address other than your regular domain will be met with justifiable suspicion.
• Make sure that you tell employees that you retain the right to monitor personal e-mail if they check it on a work computer. Employees have no right to an expectation of privacy in anything they do on a work computer or system.
• Remind them that if they're on your work computer, all the normal rules about professionalism and appropriate use still apply, even though it's their "personal" account.

Ohio Breach update

If you live in Ohio, by now you've heard about the loss of the computer backup tape. You may even have received a notice from the state that your information was on the lost tape. By some estimates, the information from as many as one in six Ohio taxpayers was on the tape in one form or another.

On 10 June, the tape was stolen from a state employee's car. The employee had the tape off-site as part of their regular backup procedures to ensure that they would be able to restore their computer systems if something happened to their data center. By all accounts, the information was stored on the tape in a proprietary format that would be very difficult for any outsider to read or interpret. If you've received one of these notices, the probability that your information will be misused is extremely low. You are at far greater risk of identity theft from a family member or friend than from an anonymous crime of opportunity.

If you have received such a notice, you do have a few choices. First, verify that the notice is legitimate. The first round of notices went out from the Ohio Department of Taxation. The second round came from the Ohio Department of Administrative Services. There are unconfirmed reports of fake notices but you can confirm the real notice by going to the state's official site at www.ohio.gov/idprotect/. Don't respond to any telephone call or email on this topic. The state is contacting individuals only by mail.

Second, I strongly recommend that you check your credit report regardless of whether you've received a notice or not. You are entitled to a free copy of your credit report every 12 months. Look for accounts that you didn't open. If you find something suspicious, follow the dispute-resolution procedures included with the credit report. Consider checking just one of the three major agencies right now, the next in 4 months and the last in 8 months. That gives pretty good coverage at three times the frequency.

Third, watch your existing accounts carefully. Check for unauthorized charges or withdrawals and watch out for missing monthly statements or bills. Hackers often file a change-of-address to keep you from noticing the abuse. Call your financial institution if you see anything suspicious.

Fourth, think about the identity theft service offered by the state. The state has contracted with Debix to put a fraud alert on your credit report if you sign up with them. You can do the same thing in a few minutes by calling or mailing the fraud department of the credit bureaus. They also offer some other services, but again, nothing that you can't do for yourself (and have probably already done if you've been reading our Tips regularly). Personally, I will not be giving yet another copy of all my personal information to a state-contracted agency when I can do it so easily myself. Note: the fraud alerts expire every three months. Don't forget to renew. And remember that while most creditors will check before opening a new account, they are not required by law to do so. A fraud alert does not replace checking your credit report regularly.

On the other hand, if you don't think that you'll remember to check your credit report regularly, a service like Debix can be useful.

If you received the notice for your company (rather than about your personal information), there is nothing special that you need to do. It is much harder to abuse a corporate tax ID number than it is to abuse a SSN. Your organization's normal fraud-control procedures are probably sufficient to protect the company.

You should also learn from the state's example. Protect your company from a similar breach by reviewing and updating your data backup procedures. Make sure that the off-site backups are kept well protected and are encrypted if at all possible.

New Scams - continued

Last week, we highlighted two of the recent explosion of new scams and frauds. Here are two more examples. Always be alert for suspicious messages and never give out confidential information unless you are absolutely sure who's on the other end of the line.

Dept of Justice spams
The US Department of Justice announced a number of fraudulent emails claiming to be from the DOJ and alleging that the recipients (or their businesses) have been the subject of complaints filed with the DOJ and/or the IRS. The message often contains a "copy of the complaint" as an attachment and offers contact information to resolve the issue. Do not open the attachment. It's a trojan horse and will load malicious software onto your computer. Don't call the contact information either. You'll just open yourself up to a social-engineering scam as the person attempts to scare you into revealing confidential information. The DOJ does not send out email notices for these issues. Read more here.

MySpace worm
Many thousands of MySpace.com websites were successfully attacked by a new and particularly complex computer worm. In this attack, MySpace visitors who are browsing an infected page are redirected to a fake login page that attempts to steal the visitor's username and password. According to one researcher, about one in four falls for the scam. The hacker then changes the code on their MySpace page to trap even more visitors. The redirect works against some recent vulnerabilities in MS Windows and Internet Explorer. The same attack will also install software onto your computer, turning it into a part of a hostile botnet and possibly exposing all the personal information on your computer to the hacker.

Protect yourself by keeping your computer fully patched. By the way, the same research showed that many people choose weak passwords on MySpace, thinking that there's nothing to protect. Remember that hackers use this as an avenue into your personal information. Pick strong passwords even for websites like MySpace. Read more here.

Next week, we'll have an update on the State of Ohio's recent security breach and the relative merits of their "identity theft protection service".

New Scams

In the past few days, there have been a surprising number of new electronic scams discovered or announced. These kinds of attacks seem to come in waves but right now it seems like we're facing a tsunami. Here are just a few examples of recent scams. Be on the alert for messages that seem fishy and never give out confidential or personal information unless you are absolutely sure who you are talking to.

Fake "Red Cross" calls targeting military spouses
In this scam, a caller with a young-sounding, American accent phones a military spouse and identifies herself as a representative from the Red Cross. She says that the spouse's husband was hurt while on duty in Iraq and was medevaked to a hospital in Germany. She says that they can't start treatment until some paperwork is finished and they need the spouse to verify her husband's SSN and date of birth.

This is an out-and-out scam. The military does not need any additional information before they can begin treatment. They already know the member's SSN, date of birth, medical history, etc. The American Red Cross also won't initiate this kind of call. Notices of injuries, etc. come through official channels – usually the commander or first sergeant. Read more at redcross.org.

Fake Microsoft patch email
In this scam, users receive an official-looking email claiming that you have received a notice about a new Microsoft patch because you're signed up to an official Update mailing list. The email includes your name and sometimes your company in the body of the email. After scaring you about the dangers of this new vulnerability, it provides a link to microsoft.com and instructions on how to download the patch. The link instead redirects you to a fake site and downloads malicious software onto the affected computer.

This particular scam seems to have been targeted at users with high-level IT accounts, perhaps in an attempt to trick them into loading this new "security patch" onto all the computers in their network. Whether you're an IT administrator or not, always be suspicious of unsolicited emails and never follow a "helpful" link in an email. Read more here.

Next week, we'll highlight two more of these recent examples.

"You've received a greeting ecard" trojan horse

I still remember the first time someone sent me an electronic greeting card. It was kind of hokey but it really brightened up my day. Sending one back was convenient, fun and best of all, free. Unfortunately, someone has recently launched an aggressive campaign that combines the worst aspects of spam and malicious software and is exploiting the popularity of e-cards. The hacker is using pre-packaged software to spam millions of messages across the internet that read with some variation of "You have received an ecard from" a school mate, a colleague or a family member.

If you open the message, you'll see a standard text-only message describing the e-card and offering you a link to a website where you can download your e-card. The messages claim to be from any of several legitimate ecard websites but in the versions that I've seen, the link is a raw IP address (such as http://12.345.67.89), not a domain name (www.example.com). Other versions may get more sophisticated and cover the IP address with a fraudulent domain. The IP addresses trace back to hundreds of different owners. My suspicion is that these are individual machines which have been hijacked as part of someone's botnet.

Opening the email won't do anything immediately bad to your computer (other than waste your time) but following one of the links is another story. Do not under any circumstances follow these links. Merely opening the page will trigger the download of a particularly nasty computer trojan horse which will then attempt to download even more malicious software onto your machine.

If your anti-virus program is up-to-date and running, it should catch and stop this trojan. However, if you get any kind of alert or think that you might have triggered one of these downloaders, you should run a full virus scan on your system. Call your IT department for instructions. Never open a message from an unrecognized sender and never open an attachment or follow a link in a message that you were not expecting.

Note: If you think the email card might be legitimate, you can check by opening a browser and typing the address of the greeting card company (for example, www.hallmark.com or www.bluemountain.com) and follow the instructions on the site to 'pick up an e-card'. This will usually involve entering the email address of the sender and a confirmation number from the email. If the message was legit, it will show up on the website. As long as you type in the address yourself (rather than following a possibly faked link) and you're going to a major company that you trust, it should be safe to check.

ID Theft by a family member

Despite all the media hype about hackers, security breaches and lost laptops, research shows that just over half of all identity theft is committed by someone close to the victim – a family member or close friend. Recent research also indicates that 55% of all identity theft is committed based on paper documents. As a company, we have to be worried about the attacks against our systems. As an individual, the statistics say that you should be more worried about Uncle Joe or Grandma picking up the credit card statement from your kitchen table.

Unfortunately, if you discover family-related identity theft, there are few good solutions. Most of the legal protections that you have as an identity theft victim will require that you file a police report. The police report could lead to prosecution and even jail time for the offending family member. Few families are ready for the emotional difficulties of prosecuting the case.

Occasionally, a lender will let the victim off the hook without a police report if the thief admits to the deed and commits to making payments and has the means to do so, according to Linda Foley of the Identity Theft Resource Center. The family typically needs to hire a lawyer to conduct the necessary negotiations and to draw up the paperwork.

If you live in a "credit freeze" state (OH is not one yet), you can at least stop further abuse of your identity by putting a freeze on your account and on the accounts of the rest of your family. Freezing your account may not require a police report. Check your state laws for more.

Prevent identity theft in the first place by buying a shredder, locking up or filing bills and statements with personal information and checking your credit report regularly. You can request your own credit report online for free every 12 months. Don't forget to check your family members' credit reports at the same time. Children and dependent elders remain high priority targets for identity thieves. (Note: Requests for the credit report of a minor under age 13 must be submitted in writing on this form and with the identifying documents listed here.)

Credit Report reminder: For those of us on the "trimester plan" for reviewing our credit reports, it's time to ask from for your free copy of your credit report from the next agency.