Information Security Tips from Westfield Insurance

Suing the scareware vendors

According to a Washington Post article, Microsoft and the state of Washington recently filed lawsuits against a number of scareware vendors. They're finally taking on the scammers who are trying to trick us into buying worthless (or worse, malicious) "security" software.

One of the lawsuits specifically charges Texas-based Branch Software with involvement in the "Registry Cleaner XP" scam. A number of other "john doe" lawsuits were filed in an attempt to learn the identities of the individuals responsible for marketing other scareware products such as WinDefender, XPDefender, Antivirus2009 and Scan & Repair Utilities.

Kudos to Microsoft for finally attempting to do something about these scammers. Now if they'd just reset the defaults in their own software so it wasn't so vulnerable in the first place…

Until they do, make sure you keep your computer fully patched, never bypass the firewall and be cautious of any suspicious links or pop-ups – especially ones telling you that your computer needs fixing.

If your office has an IT specialist, make sure he/she is signed up for regular alerts about the latest technical security vulnerabilities. These alerts will help you prioritize which patches need immediate remediation and which can wait while you test them for unintended consequences. Here are a few that I've found to be reasonably thorough:

• US-CERT (US Computer Emergency Readiness Team)
• Internet Storm Center (a service of SANS.org)
• BOL Tech Talk (a service of BankersOnline.com)
• Internet Security Systems' X-Force Threat List (recently purchased by IBM)

If you don't have someone who can watch and evaluate these notifications, you probably need to set your patches to automatically update themselves and hope that the patch doesn't break anything else accidentally.

Email can come back to haunt you (encore tip)

Back by popular demand, this "encore tip" is a reminder to be especially professional in your email communications. Please share this seasonal message with your co-workers. (This Tip was first run in October 2006.)

Halloween is a time for scary stories - tales of vampires and ghouls rising from the dead to terrify innocents - a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is sometimes all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

Americans have a bad habit of treating email very casually – as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the message is private and that recipient will understand the context and correctly interpret our tone.

In fact, email is more like a postcard - anyone can read it while it's in transit^† and any of the recipients can save it, forward it or post it to the internet. Electronic copies can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. Emails can be subpoenaed and forced into the public record. You have no right of privacy in your email, either sent or received. When you write an email, you must assume that it will be read by an unknown and unforeseen audience.

That unknown audience will assume that you carefully crafted and wordsmithed your message (or, if not, that the hurried email is evidence of the writer's "real state of mind"). They will not believe that you were "just joking" and won't care that you were trying to dash off a quick note. They will interpret the tone according to their own preconceptions.

Always assume that anything you write will come out at the worst possible time and in the worst possible light. Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow's newspaper.

Remember, email can come back to haunt you.

^† Footnote: The comment that "anyone can read [your email] while it's in transit" is less true if you have email encryption with your business partners but your words can still be saved, forwarded or otherwise sent outside your control. Please don't assume that email encryption will protect you from sloppy wording.

Microsoft disables old file formats

We talked last week about the problems of holding onto old documents. Microsoft just made the problem even more complicated.

In the Service Pack 3 (SP3) update for Office 2003, Microsoft is blocking a number of older file formats so they can no longer be opened by MS products like Word, Excel or Powerpoint. Microsoft is walking away from it's commitment to backwards-compatibility because many of the older file formats had weaknesses that could be exploited by hackers to insert viruses and other malicious code into your computer. By disabling the older formats, Microsoft reduces the vulnerability of the Office applications to some of those kinds of attacks.

The problem is that if you are keeping old files in their native format as part of your records retention plan, you may no longer be able to open them. (Worse, if you get sued and have to turn over those documents, the courts don't care about format compatibilities. You still have the document – it's your responsibility to make sure that they can be opened and evaluated.)

Microsoft has two workarounds for this problem – neither very good.

The first involves modifying your registry settings so your computer can still open the older formats. That is a high-risk action and I do not recommend it. Not only does it defeat the security advantage of the change, any mistake when editing the registry settings can corrupt your entire computer. Even Microsoft warns against it saying "Serious problems might occur if you modify the registry incorrectly." and "Modify the registry at your own risk."

The second is to convert all your historical documents to the newer format. Microsoft has some automated tools to help but the conversion process is much more labor-intensive and error-prone than I think Microsoft wants to admit. I would seriously question the business case for converting any but your most critical of official records.

There is a third option which I consider far better. Take this opportunity to check those old documents against your retention policy and clean out the ones that you should have gotten rid of long ago. For the few that you must retain, make sure that you are keeping your business records in a stable format. Don't save files in their native MS Word document format - convert them to pdf or even tiff. Those formats are simpler and have far fewer holes that a hacker could exploit. They're also designed to remain readable across many generations of software.

Call your IT team for instructions on how to convert an old file to an updated format.

---

Addendum:
Bill Wilson at IIABA's Virtual University published the tip above in his newsletter and received the following question.
What are the file extensions that Microsoft has abandoned? I think it would be very helpful to know as we would then be able to do searches for those file types stored on our system. Thank you.

As Bill pointed out to the caller, the file extensions alone will not tell you which file formats have been disabled since Microsoft continues to use the same file extensions for the newer versions of it's software. (A Word document carries the .doc extension whether it's Word 1.2, Word 2003 or any version in between.) Microsoft has a little bit more information about the changes here but no new answers.

You can read another article about the problem at wired.com.
Thanks to Bill for finding those extra links.

Being a packrat costs a lot of money

Holding onto old documents is hard and far more expensive than most people realize.

In the paper world, the paper just keeps piling up. The paper must be protected from theft and damage (fire and water) and if it's ever going to be useful again you need some sort of filing and record-keeping system. A proper records retention facility is expensive to run.

With electronic documents and cheap memory, many people started to think that we could now hold onto everything. A two-gigabyte thumbdrive can hold up to the equivalent of 400,000 pages of documents. That's 80 boxes of copy paper. And, being electronic, I can type in a few keywords and let the computer find the document I want. No more filing! Right?

Not by a long shot. Memory may be cheap but usable storage isn't.

Electronic storage costs explode as file formats change over time. For example, a first notice of a claim involving a minor child has to be kept for up to 24 years (the child's age of majority plus four). What word processor were you using 24 years ago? What printer was the program compatible with? What operating system did it run on? What drivers did it need to operate? What hardware did it use? When was the last time you even saw a 5¼" floppy drive, much less an old 8" floppy? How much can you afford to pay IT to keep a working version of every system and application in the company's history?

And that's assuming you can find the file in the first place. We are used to thinking of searching as being as easy as Google. In fact, searching for documents is very hard when documents are scattered across ad-hoc structures like personal hard-drives and departmental folders. Solutions that try to solve the ad-hoc storage (like Google Desktop) create new problems, especially around the security of the index.

Keeping old records also exposes you to legal costs down the road. Under the new electronic discovery rules, a company must search through all its old documents just to see if they hold anything that might possibly be relevant to the lawsuit. One class action lawsuit can run into millions of dollars just in search and review costs - and that's even if you don't find anything. If you do have a relevant document, now you have to convert it, produce it and defend it from anyone who tries to take your words out of context. That's expensive.

• If your Records Retention Policy doesn't explicitly require you to keep the record, don't keep it. Throw it away and then you don't have to worry about storage or formats. The cost of recreating those few useful things that we lose will be far less than the cost of hanging on to all the rest of the trash.
• If you do have to keep a document, think long and hard about what format to save it in. Convert the file to a more stable format such as pdf or even tiff. Those formats are designed to remain readable across many generations of software. Call your IT team for instructions on how to save a file to an alternate format.