Information Security Tips from Westfield Insurance

How safe are your systems? How do you know?

This article was originally published in the first quarter, 2008 edition of The Agent Newsline, a publication of Westfield Insurance.

Despite the Hollywood stereotypes, most hackers are not technical geniuses using complicated and personalized attacks on your systems. Hackers use openly-available toolkits to look for and exploit known holes in the most common computer systems. They look for unpatched operating systems and old versions of software that are vulnerable to specific viruses and other malicious code. They don’t really know how the virus works but they know enough to send it toward your computer.

Of course, some hackers don’t use software at all. They use well-known tactics to try to con your staff into revealing confidential information or into giving them access that they can later abuse.

If you have some fairly simple defenses in place, the vast majority of hackers will go looking for easier prey. The challenge is finding (and fixing) these common holes. Few of us can do our day jobs and also keep up with the constantly-changing list of vulnerabilities, rapidly changing software versions or evolving tactics of the hackers.

In addition, more and more regulators (and customers) are expecting us to have our security periodically tested by someone from outside our own organization. Luckily, there is an entire "vulnerability testing"industry with experts who do stay current on all these issues and who can provide an independent assessment of your systems' strengths and weaknesses.

Every company should have an independent assessment of their systems conducted at least annually and preferably more often. It validates that your normal IT operations are running properly, finds and closes the door on the more obscure vulnerabilities that you didn’t know about and, perhaps most importantly, shows that you have been doing everything reasonable to protect the confidential information entrusted to you. If you have independent audits of your security and act on the findings, you will be in a far better position to defend your company if the unthinkable happens.

There are many vulnerability or "penetration" testers out there, offering a wide range of services. Pick a vendor that decides what to test based on your specific risks and circumstances. Ask for samples of their final reports and make sure that they can communicate their recommendations clearly. The most thorough test in the world is worthless if the findings are buried under incomprehensible jargon. The best test for you is the one that you will use to improve your company's security.

Never share your password

As a user, you should never share your password with anyone. It is used to track who had access and made changes to specific information. You are responsible for everything done on the system using your ID and password.

As a manager, you must set up the processes and procedures so that your staff and customers do not need to share their passwords. They need a simple rule that anyone asking for their password is running a con.

• The user's co-workers should never have access to each others' passwords. If work needs to be shared, use shared folders or other collaboration tools that maintain tracabilty in the logs about who did what. If a co-worker needs temporary access to the user's files (for example, if covering for someone on vacation or emergency medical leave), have IT use their administrative tools to grant the access rights under their own ID, not by compromising the ID of the person who is out of the office.
• Not even your own IT staff should ask for a user's password. If IT needs the password to complete a repair, the IT person should insist that the user type in the password.
• You don't need their password either. If you need to access their files, you should have IT set up your rights so that you can monitor their work under your own ID and password. No one ever wants to be in the middle of an investigation but, if you are, you really don't want to have counter-accusations that the chain of evidence was compromised.

Too many people are running phishing and other cons that try to trick people into sharing their passwords. Make it possible to say with confidence that no one at your organization will ever ask you for your password.

Patches - defined

Security geeks often talk about keeping your computer "patched". Here's what we mean and why it's so important.

In a perfect world, all the code on your computer would do exactly what it's supposed to do and nothing more. In the real world, new code was added on top of existing code to fix a problem or to add some new feature until, over time, the code became too complicated to test for every possible scenario. Hackers found ways to exploit the holes in the code. By sending just the right command in just the right circumstances, they could make the computer do something it shouldn't – like give the hacker permission to install software and take control of the computer.

When such a vulnerability is discovered, the developers who made the software have to figure out how to plug the hole – how to change the code just enough to stop the hacker without shutting down the new feature they added or interfering with some other application. "Patches" are the bits of code to be added to your computer to fix that hole. (Patches can also be used to add a new feature or fix something else in the program but for now we'll stick to security patches.)

At work, your IT team should be responsible for keeping your core applications up-to-date and fully patched. For your home computer, you should set your computer to automatically update the software whenever new patches are available. That's the safest way to be sure that you have the latest code protecting your computer. While most vulnerabilities are found in the operating system (those core instructions that the computer needs just to turn itself on), more and more vulnerabilities are being found in applications – Word, Adobe, QuickTime, RealPlayer, etc. No modern application is completely safe. In Windows, you can set the updates through the Control Panel. (Look for something like Automatic Updates or Windows Updater.) In other programs such as Quicken, you usually set the updates via Tools/Options or Preferences.

Of course, there's no such thing as a free lunch or perfect software. Sometimes, the patch will fix the program but will also break some function that some other program needed to run. When that happens, you must either decide to wait (and hope that the developers at one of the two companies will send out yet another patch to fix the breakage) or take the risk and reverse out the last patch. Unless the patch broke something that's absolutely mission-critical, you are almost always better off leaving it in place.

Incidentally, Microsoft has been releasing a packet of security updates on the second Tuesday of each month (so-called Patch Tuesday) for several years now. Some hackers are now exploiting that pattern and holding their latest virus until the second Wednesday so they have the most possible time before they are shut down. Even if you stay fully patched, there are no guarantees in life.

Most Americans overestimate their cyberprotection

Most people think that they're protecting their computers but few are as safe as they think they are. According to a poll conducted by the National Cyber Security Alliance (NCSA) and the anti-virus company McAfee, 87 percent of Americans say they have anti-virus software. When their computers were scanned (with their permission), 94% actually had anti-virus software but only 52% had updated it in the last month. New viruses are released daily. An out-of-date anti-virus package does you almost no good at all. Most anti-virus packages have an option to update themselves automatically. For almost all of us, that's the right choice.

73% of those surveyed said they had a firewall. 81% had a firewall but only 64% had it activated. That's like saying your money is protected by the steel door of the bank vault but leaving the door hanging open. Never disable your firewall.

70%t said they had anti-spyware software but only 55% actually have it.

The poll also reported that 61% believe they have anti-spam software installed but only 21% do. (In this case, the poll question may have been worded poorly. If your spam filtering is done by your ISP or your webmail provider, you may be protected from spam even though the anti-spam software is not on your specific machine.) Regardless of how you run it, the important point is to have an anti-spam solution.

Oddly, the study found that computers of older Americans tend to be more secure than those of the allegedly-more tech-savvy younger Americans.

To be properly protected, you need current anti-virus, an active firewall, up-to-date patches for your operating system and applications and at least one anti-spyware program running. If you don't, you are taking unnecessary risks with your personal information.

Click here to read the full study results.

Resolve to make stronger passwords in 2008

According to a non-scientific survey I just conducted, the most common question this time of year is "How were your holidays?" The second most common question is "Have you broken your New Year's resolutions yet?"

Here's a trick to help keep at least a few of those resolutions by choosing stronger passwords. As we've talked about before, passwords are fairly easy to break because most of us pick an English word, capitalize the first character and add a number at the end. That's a statistically common trend among English-speakers. It meets the minimum complexity rules but will fail to a password cracking tool in 30 seconds or less.

If your New Year's resolution is your passphrase, you'll get a strong password that is hard for an outsider to break. (Microsoft's password rules allow up to 127 characters and permit any character on the keyboard, including the spacebar. You can pick a whole sentence including spaces and punctuation for your password.) And by typing it several times a day, well, maybe repetition will help me actually live up to the resolution. For example, I need to eat less and exercise more. If my password for the month is "Take the Stairs.", I'm reminding myself several times a day that I shouldn't be lazy – that those extra steps are good for me.

A couple of thoughts, though. First, don't make your password obvious to others. If your password is "Spend more time with your Kids!", don't make a poster with the same phrase and hang it in your office. Second, add unusual capitalization or swap a letter for a number in the middle of the phrase. For example, "Give more time 2 Charity." Even if someone does guess your resolution, they won't know what little change you've made to the way you type it. Put together, you'll have a strong password that's easy to remember and might actually help you keep that resolution a little longer.