Information Security Tips from Westfield Insurance

Security mistakes you can fix cheap

Budgets are tight everywhere this year. It's tempting to put off investing in security because "we just can't afford it now." That's a risky strategy at any time but worse, it's largely an unnecessary attitude. There are many things you can do to improve your security posture that don't cost cash. They do cost your time and attention, though. Make fixing these common mistakes a priority.

• Walk around your office some night and see how many people keep their passwords on sticky notes right on the computer monitor. Keeping track of passwords is hard. But writing them down and leaving them out for every casual visitor or after-hours maintenance person to see is inexcusable.
• While you're walking around, see how many people left sensitive documents on their desks. Make sure that sensitive documents, especially including anything with an SSN or Drivers License Number on it, is put away at night. If you absolutely can't implement a clean desk policy in your office, at least flip over the top page in the stack to reduce the temptation to snoop.
  If you allow the use of thumbdrives in your environment, make sure you watch for them, too. Thumbdrives are high risk devices - very easy to steal.
• Make sure people keep their access cards with them at all times. Access cards are your credentials. If they fall into the wrong hands, the bad guy effectively is you. He/she can do anything you can do and you will get the blame. Access cards should be protected as carefully as the data they protect. (And, by the way, neither under your keyboard or in the top right drawer of your desk is a safe place to keep them. Thieves know to look there.)
• Prevent tailgating and make sure your visitors are escorted. Challenge unknown people - politely but directly. Don't assume that just because a person is in your area that they have a right to be there.
• Remember the fax and the printer. Countless sensitive documents get overlooked and often forgotten or lost when we send them to the printer. Make sure you have internal control and that documents get picked up immediately.

based in part on a CSO Online article

Blog changes

In other news, this will be my last tip for a while. Westfield has asked me to take on some new responsibilities within our Legal department so some of the other members of the Information Security team will be stepping up to the publication of these tips. Writing the tips has been a lot of fun. I hope they have been helpful to you. Stay safe.

Web certificates - defined

This tip is part of Westfield's occasional series on general security definitions. To look up other topics, follow the Definitions at left.

You just got a popup on your computer that "there is an error with XYZ's certificate" and asking whether you'd like to accept the certificate forever, accept it only for one visit, or choose not to accept it. (See the example below) What exactly is a web site certificate and should you accept it or not?

Certificates are small bits of code used by organizations to show that they are who they say they are online. Certificates are generally purchased from third parties called 'certificate authorities – trusted companies who give the on-line equivalent of a Good Housekeeping seal of approval on the connection. Note: Certificate authorities do not evaluate the company, the website or their products. A certificate does not mean that the site is free of viruses or other malicious content. Certificate authorities merely verify that the web address actually belongs to the organization buying the certificate. When you type a URL or follow a link to a secure web site, your browser will check the certificate to make sure that the web site address matches the address on the certificate and that the certificate is signed by a certificate authority that the browser recognizes as a "trusted" authority.

If the organization wants to set up a secure website (that is, one that uses https instead of just http and has the yellow padlock in the bottom right of the window), they will need a site or host-certificate to set up the encryption. By making sure that the website encrypts your information and has a valid certificate, you can reduce your online risks.

The problem is that almost anyone can create the piece of code that looks like a certificate. Many legitimate companies want to set up secure connections but don't want to pay extra to the certificate authority for verification so they self-generate a certificate. Hackers can generate certificates, too, and use them to more closely mimic the legitimate secure site.

If the certificate is not from a trusted authority that your browser recognizes (there are about 100 trusted authorities loaded into your browser by default) or has some error or inconsistency, you have to decide whether or not to trust the web address and allow the connection.

To verify a certificate, look for the certificate feature in the browser's menus. In Internet Explorer, you can find it under File/Properties when you are on the secured site. When you click on the certificate button, it should show:

• who issued the certificate - Make sure that the issuer is a legitimate, trusted certificate authority.
• who the certificate is issued to – This should match the owner of the web site.
• expiration date - Most certificates are issued for one or two years. Be cautious of certificates that are valid for longer than two years or that have expired.

If you want to see all of the certificates currently on your machine, try Tools/Internet Options/Content and look for the certificate button.

If you have the time and need, you can verify every aspect of the certificate by contacting the company or the certificate authority. For most sites, you don't need to bother. But if it's a connection that you're using for highly confidential information (like your banking website) or if you have a reason to be suspicious of the site (perhaps a phishing site), take the time to verify the certificate. You'll only have to do it once – your computer will remember your decision thereafter.

Based in part on US-CERT Cyber Security Tip ST05-010

Post-holiday phishes

I trust everyone had a good holiday break and hope you have a good new year. With the way 2008 ended, many people are making plans for the future. Unfortunately, some of those planners include phishers and social engineers. And as I'm sure you've seen, they are getting more and more creative and professional in their scams. The days when you could delete a message just because it was poorly written are long gone. Today's scams are targeted, well-written and spell-checked.

In particular, we are already an increase in phishing messages that reference the recipient's holiday credit care spending pattern. The messages will claim to be requests for confirmation, reports of transactions and even a few of the traditional "your account has been frozen" scams. During the holiday season, many people have more transactions and shop with more different merchants; the scammers are attempting to exploit any confusion over those transactions in order to trick you into disclosing your account information, passwords, etc. If last year is any indication, expect that phishing campaign to accelerate during this week and last until the middle of next month or so.

We are also seeing a number of scams related to the economy. The number of work-at-home scam messages is up dramatically. As you may remember from prior tips, these scams promise easy money either for helping transfer funds or to conduct "quality control checks" on merchandise. In the first case, you become part of a money laundering operation, in the second, a fence. Either way, you're like to get a visit from some federal law enforcement agency. If it were that easy to make money, they wouldn't need to be sending out random emails about it.

Interestingly, the old "Nigerian fraud" is back in large numbers. These are fairly transparent messages alleging that someone needs your help to get money out of a foreign country (usually in Sub-Saharan Africa) and offering you a percentage if you will allow the person to transfer the money through your bank account. Foreign lottery scams are also back in significant numbers. I believe that by now most people know that these messages are scams but in times of financial difficulty, sometimes hope trumps common sense.

If an email asks for your personal information or if it contains an offer that looks too good to be true, trust your intuition and delete the message. To learn more about how to identify common scams, check out some of the links in our archived Tips on phishing. Have a safe New Year.