Information Security Tips from Westfield Insurance

Google Desktop is evil - updated

Google continues to roll out new applications to make sharing information easier. Kudos to them for some really creative programming. From a security point of view, though, you have to wonder what they are thinking.

Their Google Apps Team Edition allows employees to sign up for the Google Applications without any assistance or oversight from IT. Team Edition contains the core applications and collaboration services like the word processor, spreadsheet, Start page, Talk instant messaging and calendar, but does not include Gmail.

In any regulated or litigious industry, this is a recipe for disaster. You might save a few bucks on word processing and spreadsheet software but you're going to pay far more the first time you have to comply with an electronic discovery request or get into a dispute based on the Terms & Conditions of the application. No only are you putting your confidential data in someone else's hands and trusting to the security of their data center with little or no evidence of their worthiness of that trust, you're also still exposing all your data to the Google search indexing algorithms. (For more, see the Tip from April 2007.)

Luckily, you can block the worst aspects of the application/data sharing without having to block off all of the google.com domain. If your internet filter has a category for filesharing or for "Network Storage and Backup", make sure that category is blocked. You should also strongly consider blocking any category about "Web chat" so you don't have to worry about electronic discovery requests for instant messages that you didn't properly control. Read more about Google Apps latest attempt to bypass the business at ComputerWorld.com.

---

Update to Suing the scareware vendors (27 Oct 2008) The Federal Trade Commission has gotten a restraining order against two companies who were marketing scareware software. It's very good to see law enforcement successfully prosecuting these scammers. Remember, however, that there are lots more out there. Always be suspicious of pop-up 'alerts' and ads warning you about "illegal porn content" or "compromised software" on your computer. Read more at the FTC's consumer alert page.

Get ready for a Storm of holiday-related scams

For the past year or so, we've seen a significant uptick in attempted scams and frauds around every holiday. Many of them trace back to the Storm Warn gang, a crime ring based out of Germany that sells hacker software. Their last big attack was at the Fourth of July and tricked many thousands of users into downloading the 'storm-bot' trojan by offering a fake video clip of "the largest fireworks" celebration in the nation. Victims found their computer hijacked as part of a bot-net or had keystroke loggers and other malicious software loaded onto their computer.

If past patterns hold true, we can expect to see a dramatic rise in the volume of spam and phishing attempts during this holiday season. Some of their cons last holiday season included dedicated sites like the Merrychristmasdude.com website (a site offering suggestive holiday-themed photos along with a very malicious download) and spam emails such as the Happy New Year phishes. This group develops very sophisticated software with hundreds of variants that attempt to evade and outrun standard anti-virus software.

To combat these scams, first be suspicious. Never open unexpected messages or attachments.

Second, keep your anti-virus up to date at all times. Set your anti-virus to automatically update itself as often as the software allows. And if you're particularly suspicious about an email or website, force a manual update before clicking the link. Remember that if your kids have a computer at home that runs under parental controls, their computer may not be able to complete the update under the restricted ID. Their computer may be at risk until you log on under your parental ID so the updates can take hold.

Finally, keep your firewall turned on and be very suspicious of any 'free' video or other offer sent through the internet. In particular, be cautious about electronic greeting cards. While some are legit, many are frauds. See this tip for some thoughts on how to sort out e-card invitations.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

Security hype

Bill Brenner of CSO Online ran a column recently about fear and hype by the security vendors, especially around the need to "immediately patch the latest critical vulnerability" in a piece of software.

Patches fix holes in the vendor's software and keep hackers from being able to walk through the back door of your system. Applying patches is important. Security vendors want you to apply the patch immediately in case the hackers are pounding on your door right now. Every minute you wait is a minute of exposure.

But most of us don't apply the patches immediately. It takes your IT shop a few days of testing to make sure the patch won't break something else and to tweak the network so everything runs properly again. With so many companies ignoring the vendors, why haven't we had a catastrophic zero-day attack yet?

The truth is that most responsible IT departments use a layered approach to security. They have tools and policies that will generally keep out the malicious software for long enough for IT to complete the tests and apply the patches in an orderly fashion.

So who does get hacked? According to a recent Verizon report, nine out of ten data breaches could have been prevented if the company had taken reasonable security measures, most often applying patches that had been available for years. As Brenner points out, why should a hacker bother to write a complicated new virus to exploit the latest hole when you can still make money walking through holes that should have been patched four years ago?

If you have a solid approach to computer security, you can take the time to test the latest patches properly. On the other hand, if you don't have a dedicated IT team, you probably also don't have the staff to conduct the testing so you should set the patches to automatically update themselves.

Of course, if you're not guarding your infrastructure with the basics (strong passwords, current anti-virus and anti-spyware, firewalls, up-to-date on patches even if not up-to-the-minute, etc.), you need to start now.