Information Security Tips from Westfield Insurance

Security Certificate Warnings

Have you ever gone to a secure (https://) web site before and gotten an “invalid certificate”?

 

The purpose for these warnings is to tell you that there is a problem with this Web site's security certificate. which should cause you to stop and take notice. According to a recent Carnegie Melon University study, there’s a good chance you’ll ignore it and click through anyways.

 In a laboratory experiment, researchers found that more than 55% ignored the certificate warning. The experiment started with an online survey of over 400 Web surfers. Then 100 people were brought in and were studied on how they surfed.

 What the experiment uncovered was that people had a mixed-up understanding of the warnings. Many thought these warnings meant they could ignore the messages when going to a site they trusted and should only be concerned when a less-trustworthy site was being visited.

 Often these warnings relate to a technical problem on the web site, but it can also mean that you’re being redirected to a fake Web site. If you were attempting to get to your online banking and received a certificate warning, it could be an attempt to transfer you to a fake site to steal your bank access credentials.

 So what should you do? Well, the best thing to do if you get a certificate warning is to read the message. If the site you’re going to is your online banking or other site that requires credentials, call the company and ask them about the warning. A phone call could save you from a potential mistake.

 The complete article can be read @ http://www.techworld.com/security/news/index.cfm?newsid=119829

Ahoy There Me Hearties!

Several weeks ago, I logged into Twitter (@jodoan1) to learn that The Pirate Bay had been sold to a legal software manufacturing company.  For those unfamiliar with The Pirate Bay; they are a website dedicated to tracking torrents which facilitate the piracy or illegal sharing of software and movies.  Like Kazaa and Napster before them, The Pirate Bay has turned over a new leaf and appears to be going down the road of legal file sharing.

So if they can do it; what is stopping you?  I have admittedly violated an end-user licensing agreement or several in my lifetime.  It started when I made a copy of a friend’s Def Leppard tape which he dubbed from his brother’s friend.  The audio quality was about as good as an MP3 ripped at 10kbps for the younger crowd or a Heathkit AM radio for the more mature.  As a poor college student I may have borrowed a friend’s software installation disk to install on my hand-me-down computer.  Likewise, I have burned a few disks for friends and family.  I am remorseful of my poor judgment in the past and I have made it a point to live a pirate free life moving forward.

Is this blog a step in my twelve-step program to pirate recovery?  No.  Well, maybe.  The thought came to me as I was looking to purchase a photo editing program recently.  The software license cost is $300.  WOW!  What a penny to pay when I can find a license key on the Internet for free or have a family member, who is a teacher, purchase the software at the discounted education price of $99.  But why should I implicate loved ones in a crime?  Would you ask a family member to help you steal from the grocery store?  The problem is people see these crimes differently; when in reality, they are very much the same.  “Borrowing” software that is not properly licensed IS a crime and it costs consumers and manufacturers billions of dollars every year.

Besides the obvious ethical concerns around pirated software, videos, music, etc; there are many information security related risks as well.  Users who download media from peer-to-peer or bit torrent sites are more likely to become infected by viruses or other malicious software.  Additionally, the lack of support may outweigh the initial cost of the software if you incur any downtime.  Like any other crime, there is always the risk of being caught.  Those who are caught may find themselves owing tens if not hundreds of thousands of dollars in fines and penalties.  It makes $300 seem like a real deal to me.

You live your life righteously and have never borrowed or copied software; but that doesn’t necessarily mean you aren’t violating copyright law.  How often do you audit your computer network for installed software?  Just because Joe in accounting purchased Quick Books at Staples doesn’t mean that you are properly licensed to have it installed on YOUR company asset.  Users may be downloading freeware tools and evaluation software on your behalf if you aren’t preventing them from doing so.  Ad-Aware offers a no cost consumer version of its software, but commercial installations must be licensed and paid for.

To end an otherwise lengthy debate on ethics and law; I will recommend a few things to keep yourself out of hot water.

1)      Properly license your and your company’s software if you are in a position to do so

2)      Audit your environment regularly to determine whether unauthorized software has been installed.  If the user has a legitimate reason for installing a particular application, see step 1.

3)      Think about your business or your employer’s business the next time you are tempted to borrow a copy of software or other copyrighted material

Finally, the software industry is evolving.  Competition has driven down the cost of many software applications.  There are many “open source” or free applications that are compatible with their expensive name brand counterparts.  Offerings like Open Office, Picasa and AVG are just a few examples of affordable applications that are available.

The dangers of vacationing via your web browser

Now that mid summer has arrived, most people are looking forward to a vacation.  Of course it's important to let everyone know you will be away from work for a few days, but when is broadcasting your upcoming vacation on Facebook, Myspace or Twitter a danger?

Let's say you plan to travel out of state for the week, and you post to your Facebook profile about it.  It just so happens a thief may be watching by searching public profiles for the word "vacation" or "leaving", and they run across your post.  Now they know when you will be gone, and it's not very hard to lookup your full name and city from your profile.  From there a simple google search provides directions to your home.  Guess what happens next?

What can you do to protect yourself?

Take steps not to post information which could harm you or your property.

Examples: 

• Don't post about vacations, business trips, the big graduation party at the park, or going to the mall until you've come back.
• It's not a good idea to post about your brand new car or HD TV.

Ensure your privacy / security settings are appropriate for your accounts.

Example:

• Set your Facebook "Privacy Settings" so you aren't broadcasting information to everyone in your "Network." Remember, "network" could mean everyone in a specific geographic region for example.  Maybe only your friends, and maybe their friends, should be able to view your profile.

There are multiple options to securing a Facebook profile:

• Secure your basic profile to make sure only people you want to see your information can see your information.
• Secure your search settings to determine who can search for you, and what they can see about you.
• Secure your posts to make sure you aren't sending everything you post to everyone, unless of course you want to.
• Secure any add-ins and remove applications which are no longer being used on your account.

Sure are a lot of options available to secure an account, but it's important to pay attention to each of them. 

I hope this encourages a few people to take another look at their profile settings, and start thinking about what kind of personal information should or shouldn't be posted.

If anyone has any great ideas or recommendations, please drop them off so everyone can benefit.

You don’t need to (and shouldn’t) protect everything the same way

I was recently in a situation where I had to explain why our information security group had made strict requirements for one project team and much lesser requirements for another project team.  Cries of “It's unfair”, “You’re just picking on us” and "You're singling us out" were heard in the isles when the teams read the requirements.

Requirements are simply based on the type of information that is being handled, or as it is known in the security industry, its “Data Classification”.  Here are some examples of possible data classifications that a company may have:

• Some information can be considered “Public”.  For example: the annual statement of a company, directions to their Home Office, advertising, statements on websites and even this Blog post.  This information is targeted at people regardless of the company they work for and can’t really get lost or stolen because you freely give it away.  You really don't really even need to try to protect this information.

• Other information can be considered “Internal Use Only”.  For example, the employee phone number directory and management reporting hierarchy, your vendor list and their contact numbers, specific processes that you use for responding and resolving incidents, etc…  You don’t want this information all over the place because it could weaken internal controls or could be used by a salesperson or competitor for a slight advantage.  If it is lost, it is more of an inconvenience or embarrassment rather than a serious, regulatory or legal issue.  You should place some simple controls around this information.

• Some information is specifically identified in regulations and laws.  This information is called “Customer Privacy Information” or CPI and contains things like SSN, Drivers License Number, Account number and PIN, etc…  This information, if lost or stolen, will result in a company releasing a Privacy Breach notification and executing all the steps required by the State where the customers reside.  This information requires strict protection, monitoring and response.

• Finally, some information can be considered “Confidential”.  This type of information includes things like employee salaries, merger and acquisition plans, company intellectual property, etc…  If this information was lost or stolen, your company would realize a severe impact.  This information also requires strict protections and monitoring.

Just this brief list of four possible data classifications makes it easy to see that if a project is implementing a system that automates the tracking of internal work requests that have a classification of “Internal Use Only”, they will have significantly different requirements than a project has been proposed to expose employee benefits information over the Internet classified as “Customer Privacy Information”.

What controls are appropriate for each data classification?  Who should perform the classification? What is the classification for aggregate information?  These are topics for a future posts.  But remember that you don't need to protect all information the same way.