Information Security Tips from Westfield Insurance

Disaster Recovery 101

Information Security is the practice of protecting information from unauthorized access, use/misuse, and disruption.  Industry insiders refer to this as the "CIA" triad.  In layman's terms, that is Confidentiality, Integrity and Availability.  This post addresses the often overlooked practice of availability.

Until 9/11/2001; an insurance policy was the only thing companies and individuals thought of when it came to disaster recovery planning.  Insurance continues to be the disaster recovery plan for many individuals today.  In the event of a disaster; material items could be easily repaired or replaced.  But as more and more information becomes electronic; is an insurance policy enough to recover from a disaster?

Since 9/11, many companies have implemented Business Continuity and Disaster Recovery programs.  These programs involve a department or departments of people whose sole responsibility is to analyze the business processes and document manual workarounds, as well as, manage information technology (IT) systems and/or contracts to mitigate the risk of data center loss or outages.  Companies like Sungard and IBM have practices around data center recovery which are affordable only to large corporations.  But what can small to mid size companies do to protect themselves from a major outage?  Surprisingly, the answer is relatively simple and can and should also be practiced in our personal lives.

Back it up!  Remember when you made copies of all your important documents and kept those at home while keeping the originals in a safety deposit box?  All of those important documents (and many more) would probably fit on a memory stick the size of your pinky finger.  The King James Bible is approximately 15MB in size.  With USB flash drives available in storage capacities of up to 64GB, you literally could fit 66,000+ Bibles in your pocket!  External hard drives are available with capacities well over 1 terabyte (1000GB) are available if you have lots of information to back up.  Your insurance policy will help you replace that laptop, desktop or server in the event of a loss; however, you won’t be able to recover the data that is invaluable to your business. 

There are numerous back-up strategies depending on whether your focus is on speed, completeness or long/short-term storage requirements.  They can be very specific to your business process so I can’t make any recommendations.  If your company does not have a backup solution, I do recommend that you begin researching one immediately.  Fortunately, there is a lot of information available to you on the Internet.  There are many companies willing to sell you a solution.  I also recommend you reach out to local organizations such as Contingency Planners of OHIO (CPO), Association of Contingency Planners (ACP) and Business Emergency Planners Association (BEPA) which meet regularly to discuss and share ideas around Disaster Recovery and Business Continuity planning.

In conclusion, there are many things that go into a successful Business Continuity and Disaster Recovery program.  Understanding your company’s Recovery Time Objective (RTO), Recovery Point Objective (RPO) and risk tolerance will help you in right-sizing an appropriate strategy and solution.  However, if you do nothing else but back-up files and applications that are most important to your business and store them in a place that they can be recovered, you may very well save your business from the unthinkable.

Anti-Virus Software?

    Just the other day, I ran into another person who told me they don't run anti-virus software on their home computer. I looked at them in disbelief and asked why they would expose their computer/personal information to the potential danger? The response I got was, "I've never had a virus on my computer before". As I explained to this person that they have every right to not run anti-virus software, I cautioned them and asked that they looked at the risks they were taking.

     I started to ask what things were on the computer such as financial information, etc. Next, I asked if they used their machine for online banking. I started to see a look of concern on their face. I stated that getting a virus is as easy as clicking on a link in your web browser. I said I would hate to see a virus drop a keystroke logger on their computer and get their online banking credentials. Some legitimate sites could have been hacked and not know it yet.

     I know because it has happened to me. I was surfing on my children's computer and clicked on a link. Immediately, a second browser opened and my anti-virus software popped up an alert. Fortunately, I was running AV software that contained it and their computer had zero information on it. I got to spend my Sunday afternoon rebuilding their computer.

     Symantec states that “10-15 new viruses are discovered every day.” A Network World article written in May 2008 says “The total number of viruses will reach 1 million by year-end, according to security experts.” With this information alone, it makes a great argument to make sure to run anti-virus software. Anyway, a lot of Internet Service Provider’s (ISP) are giving it away for free because they don't want the potential problems inside their own networks. I guess the way I look at it is, I would rather spend a little time and maybe some money to reduce my risks of identity/financial theft than spend potentially thousands to straighten out my credit.

Good luck in whatever you choose to do.

Jeff Gibson

Vulnerability Management, Compliance & Forensics Analyst

Westfield Group

Experiences of a carpenter

Hi everyone, I'm Jake Harris one of the new team members who will be carrying on Westfield Insurance's Information Security Blog.  I thought I'd take a second and share with you a recent issue which I've seen quite often.

I recently had the chance to work on a friend’s computer. (Actually it was a fair trade; I'll fix your computer if you can watch my daughter for a few extra minutes)  The first thing I noticed was a little black box connected directly to their computer.  I asked "Don't you have a router?”  The response was "sure do, it's down in the garage with the other wood working tools".  I laughed as I've heard that one more than once in my travels.  But from a more serious point of view a router is a very handy piece of technology, not to mention component of securing a home network.

I'll take a few moments to explain (no not in great detail, unless you ask me for them) what a router is, why it really makes sense to get one, and how simple they really are to use.

What is a "Router"?

Well a router is a rather complex device if you start talking about all the cool things they could do in a corporate network, rather from a home network point of view a router is a device which acts as a protective gate between your home network and your internet connection. 

Think of it like this if:

·         A computer with a password is a locked building

·         Antivirus software on a computer is a security guard patrolling that building

·         Your home network is like a parking lot connecting all of the buildings

Then a router would be a protective fence surrounding your parking lot with a gated entrance.  The gated entrance is only going to let something in if it is welcome or allowed to come in.

The technology used to make this happen is called NAT (Network Address Translation), basically what that means is the router is the actual computer that gets a "public" address or “dirty” address, and then the router provides each home computer a "private" address.  The router is usually very secure from an internet point of view, so you don’t have to worry about it getting damaged.

Why should I get a router?  I don't have a parking lot, or security guards?

No, most people probably don't have parking lots or security guards, and I wonder to myself why, well point blank they can't afford it.  But a router is cheap, usually less than $50, and if you can afford that type of security for your home network maybe you should get it, not to mention you can connect multiple computers at one time to the internet and use wireless.

You just said they are complex, are you sure they are simple?

In short companies which make home routers have done a great job of making them simple to install in a home network.  In many cases all you have to do is:

·         Open the package

·         Plug power into the router

·         Plug your internet connection into the Internet port on your router

·         Plug your computers into the private ports on your router

·         Reboot your internet connection device (simply remove the power, wait 5 seconds, and plug it in)

And you’re ready to surf once again.

A few thoughts on keeping your router safe:

·         Change the administrator password

·         Update the firmware every few months or as available

·         Backup your router’s configuration

All of these tasks should be documented on a CD or paper that comes with your router.

Will a router fix all your worries, well a short answer is no.  Anti-virus, Anti-spyware, updating your software (patching) and safe web surfing practices are just as important, however a router is still an important component of keeping your home computer secure.

Well I hope my thoughts reached someone out there and made them a little more secure.  Looking forward to hearing about other’s thoughts and experiences, even if you want to tell me about that great new router you just bought or a vote for a next topic.

Thanks for reading,

Jake

Information Technology Risk, Security & Compliance

As Mike noted in last week’s post, his new responsibilities will be taking priority over publishing the weekly Information Security blog.  Mike is a key member of Westfield’s legal team and his information security experience will undoubtedly be of great benefit in his new role and will be sadly missed in Westfield’s Information Security blog.

Blogging responsibilities have been transitioned to Westfield’s Information Technology Risk Security and Compliance team (ITRSC).  The team is comprised of Information Technology and Information Security professionals with over 60 years combined experience.  The ITRSC team has experience in the areas of computer networking, network security design (firewalls, intrusion prevention/detection systems), information security policy, data forensics and penetration testing to name a few.

Over the next several weeks the team will be introducing themselves and blogging about their areas of expertise.  We would also like to reach out to the readers to solicit ideas or topics that you would like to see discussed.  We will continue to publish the Information Security blog posts on every Monday as Mike has done previously.

To submit your questions or topic ideas, please direct mail to infosec@westfieldgrp.com.

The ITRSC Team

Bill Murray

Jeff Gibson

John Doan

Jake Harris