Information Security Tips from Westfield Insurance

Lock your doors, here comes the Conficker worm!

You can hardly look at any news source anymore without being bombarded by articles about security incidents, privacy breaches, worms, viruses, zombies, botnet's or a host of other Information Security related headlines.  The media really eats this Information Security stuff up.

This week’s news continues this trend.

Get ready for the “Conficker.c” worm that has already infected 5 to 10 million computers worldwide and is waiting for April 1, 2009 to awaken.  The experts predict that the payload, which is what the worm will do when it is activated, will somehow involve people being separated from their money.  This assumption is based on the knowledge that many of this worms predecessors have been targeted at convincing their helpless victims to purchase what they think is "anti-virus software" to protect their computers from the very worm that they are already infected with.

It really is all about money these days. Microsoft has even jumped in and offered a $250k reward for information leading to the capture and arrest of the worm writer.

Over the last few months the news has been filled with companies getting "hacked" and loosing their customer privacy related information (SSN & Account numbers, etc...). There have also been several companies that have just simply lost information through carelessness and bad security practices.

And over the next few months I am sure that we will continue to hear about more about companies losing information, more virus and worm scares that threaten society and more about victims who have lost money due to identity theft, phishing attacks or more worms.

I have been in the Information Security profession for a long time and while Information Security threats are ever changing, fast paced and have grown to ever increasing scales, there are some simple and basic things that companies and people can do to significantly reduce their exposure to these threats. 

Not surprisingly, they are really just common sense, don't change much over time and you already know how to do them.

• Patch your systems and do it all the time. The Conficker.c worm exploits a vulnerability that a patch was released to mitigate in October 2008.  New patches are being released all the time.  I guarantee viruses and worms will be written to exploit them.

• Have basic protections in place like a personal firewall that blocks nonstandard traffic and antivirus software that is regularly updated and is configured to regularly scan your computer.  We hear this all the time.  Are you doing it?

• Don't download and run pirated software or software that does illegal things.  This includes peer-to-peer file sharing as well as pirated versions of your favorite tax software.

• Be suspicious of everything.  And even more so if someone or something is trying to help you or give you something for free.  Nothing is free.  Come on, you know that don’t you?

 The bottom line is simple. Protect the information on your computer the same as you would protect your physical property.  Lock your doors and windows.  Don't let strangers in your house even when one comes to the door and wants to give you $100 dollars.  Change your locks if you think that someone has been inside your house.  Don't accept (or seek out) stolen property.  If you receive a recall notice for your car because of failing brakes, make a point to get them fixed as soon as possible. 

Security is security. Use the same logic with computers and information that you use to determine what you should and should not do with your valued physical possessions.  Applying this logic will avoid the majority of the Information Security problems that you hear about in the news.

What do you do with that old computer?

The other night I received a call from a friend. He told me that he had bought a new computer and asked what he should do with his old one. Some of his ideas were to donate it to charity, sell it on eBay, or throw it in the garbage. 

As an Information Security person, I told him these were all good ideas but told him to think about his data. Primarily, did he want the new owner or recipient of the computer to have all his information from the hard drive? As soon as I mentioned that, I could hear the “oops” through the phone.

I began to tell him about a friend of mine who worked with the local news to show what could happen if you didn’t get rid of your data before you gave/sold your computer. I went on to tell him that they had my friend purchase two hard drives from eBay. They then had him look at the drives and tell him what he found. It turns out that he was able to find some financial information from one and the other had photos of the last owner’s child.

My friend then asked me, what’s the best way to make sure the data is destroyed? I told him there were a couple of choices. One would be to use a product called BCWipe. This product performs the Department of Defense standard for thoroughly erasing the disk. The other would be to take the drive out of the computer and repeatedly hit it with a sledge hammer until it was beaten beyond use.

Anyways, be careful of your information when getting rid of old computers.

 

Jeff Gibson

Vulnerability Management, Compliance & Forensics Analyst

Westfield Group

Welcome to Spamalot

Tired of paying full price for ink and toner?  Click here to save 85%.  Are you ready to make $6000 a month working part time from home?  How about consolidating your debt?  With all the layoffs, it’s hard to believe that Michael Vincent has personally found millions of people a new job.

Feel like you’ve seen or heard some of these things before?  You’re not alone.  While computing and the Internet has improved countless things about our lives; it certainly has complicated others.  While spam is primarily an annoyance, there are also risks and vulnerabilities associated with them as well.

Traditionally spam is thought as an email problem.  However, with the proliferation of instant messaging, text messaging and social networks spam can be used to broadly define unsolicited bulk messages.

How did they find me?

Despite what your co-workers may have teased about, receiving spam does not mean that you frequent adult sites or spend too much time on the Internet.  For many, it is simply the misfortune of having a common name.  Since spammers typically use hijacked email accounts, they aren’t too picky about dropping a couple of million name combinations in the “to” field and hitting send.  Often times, these emails are programmed in a way to use the recipient’s name as the sender’s address making it look as though you sent the email to yourself.  Once a valid email is identified, the spammer may spoof that address to make the email appear as though it came from one of your co-workers.

Some of the other common ways that spammers receive your email information is through legitimate purchases from online, as well as, brick and mortar stores. You most likely signed up for direct marketing while signing up for online services such as fantasy sports or weather feeds.  Your email was probably “scraped” if you belong to professional organizations where email is posted on the organization’s contact webpage or if your email is listed on your company’s webpage.

What can I do about it?

For personal email; if you already own an anti-virus product such as McAfee or Symantec, there is most likely a complimentary anti-spam product that is available as an upgrade.  While these programs are usually effective, they are not always very intuitive and make reading and composing email a lot more complex than if you just went through and deleted all of the spam.  There are also many open source solutions available through SourceForge such as SpamBayes.

Depending on your email provider, you may notice that mail you received has already been tagged as spam.  Using an Outlook rule, I have all mail that is marked as spam by my internet service provider moved to a folder that I created called “Spam.”  Periodically, I review the emails in that folder and delete them in bulk.  On any given day, that reduces the number of spam in my inbox by 100-200!

For business email; you have several options depending on whether you use a hosted email solution of if you have your own email server.  In the first scenario, you should start by contacting your email host provider to determine what anti-spam solutions they offer.  If your company manages its own email systems, you have options to redirect your incoming mail directly to solutions such as Postini or an in-house anti-spam solution such as Proofpoint.  In the first scenario, all of your incoming email is redirected to a third-party and scanned for spam/viruses before being forwarded to your company email.  This solution is ideal for companies that do not have full time IT staff.  In the second scenario, your incoming email is first scanned by a product or appliance before being sent to your email server.  This solution is ideal for companies which receive a lot of legitimate emails that may be construed as spam.  For example, a medical or insurance company that receives email related to “personal injury” or common prescription drugs.

Staying ahead of the curve

Anti-spam is a journey and not a destination.  As quickly as companies implement rules to block one spam message, another type appears.  On the surface, it would appear as though your anti-spam just quit working.  In reality, the spammers have found another way to fool the anti-spam products into thinking it is legitimate email.  The solution you choose should be continually updated in order to effectively identify spam.  For more information on how you can become an anti-spam storm trooper visit the Coalition Against Unsolicited Commercial Email.

A lock will only keep honest people honest

When I was younger my parents tried to teach me about locking the car door, and the house, but they never really explained why.  I've learned over the years that locking something only really offers protection from the people who wouldn't steal anyway.

 

What do I mean? 

Simply put... a lock is breakable, if someone sees or suspects something valuable, then given enough time and a will to steal they will break that lock.  This principal applies both to physical items and your information / identity.

 

So how do you protect yourself?

To get started take steps to avoid being a target in the first place, start by protecting yourself with a few common sense practices.  It’s also very important to share these practices with people you know so they don’t accidently make you a target.

 

Here are a few ideas in each category:

Physical Items:

• When coming back to your vehicle, place all packages, laptops, even grocery bags in the trunk.  Don't wait until you've reached your destination, someone might be watching you to see if you move your laptop or new video game system into the trunk once you get there.
• Don't leave cell phones, GPS devices, or even the GPS holder sitting out; place them under your seat, or take them with you, especially if the item (Laptop, Blackberry, Wallet, Purse, etc) contains sensitive information.
• Lock your doors, go ahead and double check... it’s ok.

Information / Identity:

• Shred, Shred, Shred… Simply put; don’t put your personal identity at risk.  Shred any documents with your Name, address, phone number, Social Security, Bank Information, and or Credit Information.
• Be wary of the proverbial “To good to be true”, if it seems too good, you know what “IT IS”.  Don’t click on the email that tries to lure you into helping a foreign official exchange money, or the IRS link that offers you a double refund if you take this survey.

Quick Example:

A family decides to travel to the mall for an all day shopping trip.  They carefully put their GPS under the seat, and make sure the doors are locked.

A thief notices a GPS holder mounted to the front windshield, and quickly breaks their driver side window.  The thief then unlocks the door and ransacks the vehicle finding a GPS unit, a USB memory stick, and several house keys.

The thief then uses their GPS unit and presses the “Home” key to now burglarize their home. 

In short,  if they had taken the extra few seconds to put the GPS holder under the seat, the family wouldn’t have a broken window, lost checkbook, lost GPS, and a burglarized home.

 

In Summary:

A lock is still very important, however if there doesn’t appear to be anything of value to steal you probably won’t end up a target.

Information Security and the Economy?

When the economy started its downturn, I began thinking about how the economic situation might affect Information Security and if companies would be exposed to any different or additional risk.

 

My thoughts initially focused externally, particularly on people with computer skills who were out of work, had a lot more time on their hands and who could potentially use their knowledge and skills to write more viruses and malware.  I also thought that there might be an increase in social engineering attacks.  Social engineering attacks are usually conducted over the telephone to gain information about a company in order to perform some sort of scam or simply to gather information to build a more targeted resume.  Specific knowledge of the systems and software that a company uses can be a differentiator in an interview.

 

But after reading several recently published articles on data theft, it appears that there are also some significant internal risks for companies to keep in mind as well.  A web based survey was conducted by the Ponemon Institute who interviewed nearly 1000 people that had left their jobs in the past year, found that "59 percent of ex-employees admit to stealing confidential company information, such as customer contact lists. The results also show that if respondents' companies had implemented better data loss prevention policies and technologies, many of those instances of data theft could have been prevented."

 

Most of this information loss was in the form of employees forwarding e-mails to their personal e-mail accounts or by copying files to DVD’s and USB drives without their employer’s permission.

 

Does your company have policies or employment agreements in place that address the inappropriate copying of sensitive information?

 

Would your company even know if an employee copied sensitive information before they resigned or were laid off?

 

State privacy breach laws clearly specify the criteria and penalties for data breaches.  We all know that the direct and indirect financial impact of a breach can be devastating to a company.  These facts combined with the forecast of continued economic problems highlight that it is critical for all companies to increase their focus on data loss monitoring and prevention.  With increased layoffs, staff turnover and unemployment numbers growing at the same rate as USB storage capacity, this risk is not one to be ignored.