Information Security Tips from Westfield Insurance

All I really need to know about cybersecurity I learned in Kindergarten

If it sounds too good to be true, it is.
Regardless of what the email claims, there are no wealthy strangers desperate to send you money. Beware of grand promises - they are spam, hoaxes or phishing schemes. Remember that anyone can publish information online so before accepting a statement as fact, verify that the source is reliable. It is also easy for attackers to "spoof" email addresses, so verify that an email is legitimate before opening an unexpected email attachment or responding to a request for personal information.

Don't take candy from strangers.
Finding something on the internet does not mean that it is true or safe. Be wary of advertisements for free software downloads - they may be disguising spyware. Check out the reputation of the provider and of the website hosting the download before you act.

Close the door behind you.
Your personal information is only private if you work to keep it so. Lock your computer (using Ctrl-Alt-Del) when you step away. Pick strong passwords and keep them safe. Put a firewall, anti-virus and anti-spyware programs on your computer and keep them all current. Be smart when browsing or using email.

Don't tell everyone when you'll be away from home.
The email "Out of Office" function lets you create an "away" message that is automatically sent to anyone who emails you while the autoresponder is enabled. This is helpful especially in business because it lets people know that you will not be able to respond right away. Be careful how you phrase your message. You do not want to let potential attackers know that you are not home, or, worse, give specific details about your location and itinerary. (Also, if your away message replies to spam, it confirms that your email account is active and will increase the volume of spam you receive.) If possible, restrict the recipients of the message to people within your organization or in your address book.

Always tell the truth.
What you write in email, you may have to live with it forever. Be honest, be trustworthy, be tactful and think twice about what you wrote before you hit send. Never write anything that you'd be embarrassed to see on the front page of tomorrow's newspaper.

Hold hands when crossing the street.
We're all in this together. What affects you affects me, too. If you see something suspicious or if a caller strikes you as a bit fishy, ask a co-worker or supervisor for help. Help each other be safe.

based in part on CERT Cyber Security Tip ST05-014

Hackers go commercial

For only $700, you too can become a hacker. New hacker tools are as easy to use and as well supported as any commercial software package. The Mpack toolkit is a particularly easy-to-use hacker kit being sold on Russian e-crime forums. It is "guaranteed to bypass all anti-virus programs at the time of purchase". Like many commercial software packages, it includes a year's worth of free updates and support for the hacker in the price. Mpack is also disturbingly common. It has been discovered embedded in more than 10,000 web sites so far.

Between the increased availability of these tools and the sheer number of vulnerabilities that they are programmed to automatically exploit, it is vital that you keep your computer's operating system and applications up-to-date and fully patched.

Regularly check for updates and immediately load them. Consider setting them to automatically update. And remember that you have to check for updates for every program you have on the computer, not just the Microsoft updates.

Shut down your computer every night. This limits your vulnerability to automated attacks against your computer. Depending on how your network is set up, it may also trigger your update process, making sure that the latest patches are loaded to your computer when you log on in the morning.

Mpack targets security holes in many common software programs including QuickTime media player, plug-ins for the Firefox web browser and Microsoft Windows. According to researchers at one anti-virus company, this toolkit uses simple yet very sophisticated web-based interfaces and allows the hacker to take control of the victimized computer to either steal information, install keyloggers or use your computer as a "zombie" to attack someone else. You can read this technical report for more about Mpack.

Password security

Passwords are only useful if they are kept secret. That sounds obvious but we are still finding users who tape their passwords to the computer or "hide" them in an unlocked desk drawer.

Laptop and desktop computers represent the single greatest risk to the computer systems and customer private information of most organizations. A stolen or lost laptop is a gold mine for an identity thief. Laptops and desktops hold all kinds of private information (often including the access rights and certificates necessary for a hack to get onto the rest of the network).

In order to mitigate the risk, many organizations have encrypted their computers – scrambled the content so that, in theory, if a computer is stolen, the thief gets away with a $2000 doorstop. Unfortunately, that encryption is often completely dependent on the password. If the thief also gets away with the password, they have access to everything and all the organization's defenses are for naught.

Make it very clear to your staff that leaving a password unprotected is a very serious violation of your security policies. If they see an unsecured password, have them report it immediately to their manager or supervisor.

Email alerts about cell phones are a hoax

Ignore any email warning you receive that your cell phone number is about to be released to telemarketers unless you sign up for the Do Not Call Registry. These "warnings" are a hoax. Please DO NOT "help others by passing this on to all your friends." Your friends will not thank you for perpetuating the hoax.

Under existing federal law, telemarketers who use auto-dialers (in other words, almost all telemarketers) are prohibited from calling cell phones. There is no legislation pending to change that law.

These hoax warnings have been around for years. They tend to resurface every time the cell phone companies talk about creating a cell phone directory. Adding your number to the Do Not Call Registry will not keep your number out of the directory nor will it prevent anyone who gets your number from calling you.

If you want to sign up for the DNC Registry anyway, call 1-888-382-1222 from the phone that you want excluded or go to www.donotcall.gov. Despite the panicked tones of these hoax emails, there is no deadline for doing so.