Information Security Tips from Westfield Insurance

Email can come back to haunt you

This Tip was first run in October 2006. This "encore tip" is a reminder to be professional in email.

Halloween is a time for scary stories - tales of vampires and ghouls rising from the dead to terrify innocents - a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is sometimes all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

Americans have a bad habit of treating email very casually – as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the message is private and that recipient will understand the context and correctly interpret our tone.

In fact, email is more like a postcard - anyone can read it while it's in transit and any of the recipients can save it, forward it or post it to the internet. Electronic copies can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. Emails can be subpoenaed and forced into the public record. You have no right of privacy in your email, either sent or received. When you write an email, you must assume that it will be read by an unknown and unforeseen audience.

That unknown audience will assume that you carefully crafted and wordsmithed your message (or, if not, that the hurried email is evidence of the writer's "real state of mind"). They will not believe that you were "just joking" and won't care that you were trying to dash off a quick note. They will interpret the tone according to their own preconceptions.

Always assume that anything you write will come out at the worst possible time and in the worst possible light. Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow's newspaper.

Remember, email can come back to haunt you.

Create a "_readme" for folders

Whether you use shared folders or keep files on your personal drive, eventually others in your organization will need to find some of the files that you've created or saved. Electronic searches help some but it's still important to file your ad-hoc documents carefully if you ever hope to find them again. In order to help the rest of your team members (especially future team members) understand your new filing system, I strongly recommend creating a very small file in each folder describing the:

• purpose of the folder
• owner of the folder
• intended audience and users of the folder – who should and should not have access
• retention period – how long should we generally keep the documents in the folder^†

If you name the file _readme.txt, the underline will cause the file to sort itself to the top of the list where everyone can find it. Here's an example of one I created to describe the folder where I hold my InfoSec Tips drafts. _readme.txt

†

When deciding on the appropriate retention period, refer to your organizational Retention Policy for guidance. And remember that "forever" is technically possible but outrageously expensive for electronic documents. Westfield is 159 years old. If we say that a document should be kept "forever", we are handing our IT department a blank check to spend whatever it takes to make sure that the document will still be here in another 159 years. There aren't very many documents with that kind of business need. Make your best estimate of the realistic business need for the documents in the folder. Also remember that saying you want to keep a document for 12 months does not mean that it will be automatically deleted. You (or someone in your organization) will still have to clean out the folder when the documents are no longer necessary.

A Parent's Guide to Internet Safety

Every parent worries about their children – will they be safe crossing the street, what's happening at school, why aren't they home yet? In the physical world, we do everything we can to find the right balance between caution and over-protectiveness. We put wood chips or other padding under the swing set, we don't take it away. And we stay with our children at the playground until they're old enough to look after themselves.

In the electronic world, we need to find that same balance. The internet is a wonderful opportunity to tap into new sources of knowledge and gain exposure to cultural experiences that we could not even imagine when we were children. Yet those same tools can also expose children to exploitation and harm. And unlike with the swing set, few of us grew up in this environment. We all understand how the swing set works and what could happen if you lose your grip – we're not so sure about the online risks.

The FBI has a Parent's Guide to Internet Safety which focuses on the risk of sexual exploitation and includes some factors to watch for in your child's behavior. You should also be very alert to phishes and other scams designed to steal your child's identity.

Protect your children by:

• Talking with them about the dangers. Explain phishing, spam and other scams. Don't assume that they're too young to understand the difference between good advertising and liars. But do explain it in terms they will understand.
• Teaching them to never share any personal information online even if they think they know who's on the other end of the line. And never, never, never agree to meet someone face-to-face that you met online.
• Keeping the computer in a common room in the house, not in the child's bedroom. Make sure that their time online is supervised.
• Using a parental controls program to reduce the chance that they'll end up somewhere inappropriate and always keeping your computer's anti-virus, anti-spyware, firewall and patches up-to-date and active.
• Checking their credit report regularly.

Shredding is a Federal requirement

Under Federal Trade Commission regulation, any information about an individual that is derived from a consumer report or is a compilation of such records must be properly destroyed. These days, almost all of customer information has some connection to a consumer report and is covered under this regulation (scroll to pg 32).

The regulation does not actually require shredding but for most of us, that is the only cost-effective way to comply with the regulation's requirements for destruction. Papers in regular trash are exposed to the public and any private information on those papers can be misused by an identity thief. It can cost your customers thousands of dollars to get their identity back and could be considered a violation of federal privacy laws.

I strongly recommend a "shred all paper" policy for your office because there is too much risk that a piece of personal information will be overlooked on the back side of a form or that the page was used for scratch paper while you were on the phone. It's also easier to enforce the policy when you have a simple rule like "No office paper may be thrown away in the regular trash."

Very small offices can get away with a personal shredder. If you've got more than about 10 or 15 people in the office, it's probably more cost-effective to contract with a reputable shredding vendor who will pick up and properly dispose of your paper waste. Most of the shredding vendors will provide locked bins where the paper waste can be stored until pickup. Have enough bins to be convenient for staff.