Information Security Tips from Westfield Insurance

Tailgaters are a danger to everyone

No, I'm not talking about the Browns fans drinking in the parking lot. I'm not even talking about the road-ragers who think that we'll drive differently just because they're close enough to read the fine print on your license plate renewal sticker.

The tailgaters we need to worry about at work are the neatly-dressed people who quietly walk up behind us and expect us to politely hold the door even though they have no right to be in our building. Tailgating is the art of acting like you belong and of using social pressure to convince people to ignore their own rules and policies. Tailgaters practice coming up behind you with just the right balance of professionalism and distractedness so that you believe that they belong. Good tailgaters come prepared with a plausible excuse why you should "be a nice guy" and break the rules – "It's raining ", "My arms are full", "I forgot it in my desk last night", etc. There is no way to identify a scammer just by looking at him or her.

Tailgaters represent a real risk for your organization. Once in the building, they can steal information, compromise systems or worse. If the intruder is a disgruntled claimant, a former employee or a significant other, they could be attempting to get into the building for violent reasons.

Whatever your entry control procedures are, you should have a strict "no tailgating" policy. Do not let staff hold the door for anyone until you are sure that they are authorized to be in the area. If your building uses security badges and someone tries to follow you through a controlled door, demand to see their badge. If they are a visitor, politely escort them to your main entrance and get them properly signed in. (You do have a Visitor's Log, of course. If not, here's a template you can use. Visitor Logs are surprisingly effective at deflecting these criminals to other, easier targets.)

You also need to know what your office's emergency reaction plan is before someone forces their way in. Know who to call and how to report the breach. Don't put yourself in harm's way but do not allow the intruder to wander your halls unchallenged.

Recovering from a virus

Viruses, worms and Trojan horses don't get much attention anymore but they're still out there. Do you know what to do when your computer becomes infected?

• If your anti-virus program is up and running (and there's never any excuse for it not to be), there's a good chance that the anti-virus program will be able to both detect and repair the damage. If you get an alert from your anti-virus program, take it seriously and act on it immediately.
  • Know what your own anti-virus program alerts look like. If you get that obnoxious pop-up when you're browsing the Internet that says "your computer may be infected", ignore that. It's a scam. Clicking the link will install spyware onto your computer.
• If you are at work, call IT immediately. Do not wait. The sooner they can investigate and clean the computer, the less damage there will be to your computer and to the rest of the network. Do not do anything to the computer until IT tells you to. They may need to try to track down the hacker. Anything you do could muddy the chain of evidence.
• If you are on your home computer, disconnect it from the Internet immediately. If you are infected, this will minimize the damage by preventing the hacker from sending any more commands to your computer or to stealing any more information from it.
  • If your anti-virus program detects but can not repair the damage, see if there's an update to the virus definitions file that might fix it.
  • If your anti-virus program still can not remove the infection, you could try manual repairs. There are websites which can walk you through the technical steps of manually cleaning up the dlls, registry settings, etc. You will need to know exactly which virus you have and you need to know exactly what you're doing or you might do even more damage to the computer. If you are uncertain, take your computer to someone who can repair it professionally.
  • In the worst case, you may need to reinstall your operating system. Look for a "system restore disk" that probably came with the computer. Reinstalling the operating system usually erases all of your other programs and data files. If you haven't backed up your files lately, it's incredibly stressful – but better than leaving the hacker in control of your computer.
• Once you've done everything else, it's a good idea to update your anti-virus definitions (again) and run a full scan against your computer. If you haven't checked for software patches and updates lately, you need to do that, too.
• Finally, you should assume that all your passwords were potentially compromised during the infection. This includes passwords for websites that were cached in your browser. Pick strong passwords when you change them.

based in part on CERT Cyber Security Tip ST05-006

Hotel key-cards contain private information – HOAX

Have you received the latest email "alert" about protecting your old hotel key-cards from identity thieves? If so, you're not alone. This urban legend resurfaces fairly regularly. I suspect that this one is popping up again as people begin making their holiday travel plans.

According to this legend, hotel key-cards have all sorts of private information encoded in the magnetic strip on the back of the card. The information allegedly includes your name, home address, hotel room number, check-in and check-out dates, credit card number, expiration date, etc. and claims to be based on an alert from the Pasadena Police Department.

While you certainly could fit all that information on the magnetic strip, no hotel actually does. For one thing, why would they bother? They already have all that data in their database. Why would they pay to put it on the card as well and take up the problem of fixing all the inevitable mistakes when the coding needs to be fixed? The hotel's card only needs a serial number to control your room's door. No personal information is recorded on the card.

These hoax emails end by encouraging you to "cut up the card". Don't waste your time. Leave it for the hotel staff to reuse with a new customer.

For more information, see Snopes.com.

Home Shredders

How secure are you from identity theft? For all that we are (and ought to be) worried about hackers and other threats to our electronic information, researchers estimate that 55% of all cases of identity theft are based on information from paper. Could someone find credit card numbers, bank account numbers or social security numbers in your trash?

Garbage left at curbside is considered to be in the public domain. That means it's not illegal for someone to take items out of your trash. And don't think that someone won't go through it just because it's mixed in with the dirty diapers. In many municipalities, all the waste is opened and manually sorted as part of the area's recycling program. In Medina County, for example, your trash is touched by about 20 people between the time you put it in your trash can and it ends at the bottom of the landfill. Your credit card statement is a great temptation.

Home-quality shredders are available for as low as $40. If you don't yet have a shredder at home, you need one. We all need to be concerned with how much of our information can be accessed from our mail, including our credit card and bank statements, and any other piece of mail that may provide confidential information. Anything that has your name, address, phone number or any kind of account number on it should be shredded before discarding. Credit cards should be destroyed by cutting the card across the number.

There are two basic kinds of shredders: strip-cut and cross-cut. Most of the cheaper shredders are strip-cut. They cut the pages into strips between 1/8 and 1/4 inches wide. Cross-cut shredders (also called "confetti-cut") will chop the strips into smaller pieces, and thus provide much greater protection. The other factors commonly used to compare shredders are durability and capacity (how many pages can it shred at a time without jamming).

Note: Keep the shredder unplugged or locked away when young children are around.