Information Security Tips from Westfield Insurance

Shredded documents can be unshredded

Shredding is the ultimate defense, right? Once it's shredded, it's gone!

No longer. It was always vulnerable if your attacker had the shredded chaff and plenty of free time. Think of the shredded embassy documents from the Iranian Hostage crisis of 1979. Those students reconstructed the pages with nothing more than scotch tape and patience. More recently, methamphetamine users have been hired by identity theft ringleaders to do the same thing.

Bill Wilson of the Big I recently found a number of services which make the "unshredding" problem much more manageable. In the Enron case, the government hired ChurchStreet Technology to scan the chaff, then used computer algorithms to piece the documents together. They claim to take the recovery time from hundreds of hours down to mere minutes. It's expensive but not terribly complicated. And your trash is in the public domain - anyone can take it back out of the dumpster without breaking any laws.

So how do you fully protect your waste paper from those ID thieves with too much time on their hands?

1. If you're still using a strip-cut shredder, get rid of it now. Upgrade to a cross-cut that chops the paper into very small bits of chaff.
2. Feed your pages into the shredder vertically, that is, with the words perpendicular to the shredder blades.
3. Don't have unusual-colored paper. Or if you do, shred enough of it that it can't be easily picked out. The rule in the army used to be no less than 20 sheets of any given paper type in each shred "lot".
4. Stir the chaff before disposal. A careful attacker could exploit the fact that pieces from the same document tend to come out of the shredder close to each other and remain so in the waste bag. A few quick stirs can randomize the chaff and make reconstruction much harder.
5. Send the chaff to a paper recycler. Even the best reconstructors can't bring a page back after it's been turned into new paper pulp. Of course, you have to be sure that your waste isn't intercepted before it hits the recycler but there are several bonded shredding companies that will do that for you.

How much is enough? It depends on who's out to get you. For most home users and small businesses, one and two are probably enough. If you really have something to hide, consider three and four and look into five when your shredding contract comes up for renewal. Find the right balance, remembering that identity theft is real but that most of us are not dealing with DoD nuclear secrets.

---

Bill Wilson publishes a bi-weekly newsletter filled with useful information including a technology column in almost every issue. His target audience is an independent insurance agent but many of his topics are applicable to any small business owner. If you're not subscribed already, I recommend looking them up.

Information Security Concerns in Hotels and Hotspots

More and more of us are using our computers while we are on trips and are making use of the ever increasing number of wireless hotspots that are popping up everywhere.  I wanted to take this post and discuss some risks associated with connectivity in these environments and offer some simple things that you can do to reduce these risks.

• Most hotels and wireless hotspots offer a number of wireless access points to connect to.  Each one will appear separately in your wireless network list.  You should check with the establishment you are at as to which ones are "official" and which ones are not.  Many times scammers set up an access point named something similar to those provided by the establishment.  These rogue access points can be set up to perform a classic "man in the middle" attack known as an "evil twin" to forward all your traffic to a real access point and simply capture everything you are doing online.  Another scam is to offer you access at an additional fee.

• When entering your ID and password in public places, take extra care to watch for people looking over your shoulder. "shoulder surfing" it is sometimes called.  It does happen.

• Wireless connectivity can be implemented securely but if you have a choice between a wireless access point and plugging your laptop into a network jack choose the network jack.

• It is important to have your personal firewall turned on and configured with a restrictive rule set when attached to non-trusted networks.  What I mean by a "restrictive ruleset" is simply configuring your firewall to only allow software you trust to access the Internet, and block all other software and network traffic. Anti-virus software should also be enabled, have real time protections turned on and be configured to download anti-virus signature updates automatically.  These are relatively simple things to do.

• Use your corporate VPN (Virtual Private Network).  If you are doing work for your company and they have VPN capabilities, you may be safer connecting to the Internet this way.  It may sound strange, connecting to the Internet to connect to your company to connect back to the Internet but your company has protections in place to block malicious traffic, attackers and websites.  If you establish an encrypted VPN tunnel to them and surf through their network to the Internet, you are adding a few controls that can protect you.

• Keep your laptop powered off when you leave it in your hotel room.  Lock it in the safe if it will fit.  If you just lock the screen (control alt delete), there are vulnerabilities that could be exploited while you are not there to gain access to your software and information.

• Don't leave your laptop sitting there all alone when you get up and get another coffee or cheeseburger.  It may not be there when you go back to your seat. Same goes for USB drives.  It is pretty easy to swipe them without notice.

• Encrypt your hard drive and USB drives, or at least sensitive data or subdirectories on them.  If the unthinkable happens and your laptop is lost or stolen, let the most significant thing the thief gets be the laptop.  It may sound like a hassle but losing $1000.00 on a laptop is a whole lot better than a case of identity theft for you and any other people regarding whom you have their information stored.  Same goes with information about where you live, your children, relationships you are in, etc… Any of this information could be used against people you care about.

Its not a pretty world out there so the best thing you can do is be prepared.

An Information Disaster Kit Prepares for the Silence after the Storm

Have you ever wondered what it would feel like to have a hurricane or a tornado fly over you, the loud swirling sounds ripping away?  Then after what feels like hours rather than a few short minutes all is quiet, leaving you wondering what will happen next.  I'd imagine this same feeling hits just about everyone after they realize they have shared personal information with a con artist or scammer.  How many of us are prepared for either of these disasters?

Natural disasters cause significant damage to us financially, emotionally, and physically, however so can Information Disasters like identify theft, or a virus that deletes every photo we've taken in that past 5 years.  Preparation for such a disaster is key to avoiding or recovering from it, but what is the right level of preparation for an Information Disaster?  Most of us could put together either of the kits in a few hours, but many of us don't feel they are necessary or believe it won't happen to them.  I'd encourage you to take a few minutes and put together at least a few items from each of the lists below.

Ready America provides a list for preparing a Disaster Kit, I'll compare this kit to my suggestions for an Information Disaster kit.

Recommended Items to Include in a Basic Emergency Supply Kit:	Recommended Items to Include in a Basic Information Disaster Response Kit:
Water, one gallon of water per person per day for at least three days, for drinking and sanitation	Record everything you do in a journal, this will help you keep track of what you've completed, and provide piece of mind down the road.
Food, at least a three-day supply of non-perishable food	Contact companies you have outstanding balances with, and inform them of the situation, requesting an extension as necessary for your current bill.
Battery-powered or hand crank radio and a NOAA Weather Radio with tone alert and extra batteries for both	Check your credit report and social security information at least weekly.
Flashlight and extra batteries	Check your data backups at least monthly.
First aid kit	Begin backing up your data if you haven't already.  Using an inexpensive USB thumb drive which can be stored in a safe is a quick and easy solution.
Whistle to signal for help	Contact the authorities if you believe a crime has been committed against you.
Dust mask, to help filter contaminated air and plastic sheeting and duct tape to shelter-in-place	Research and prepare a list of trusted companies who specialize in credit monitoring.
Moist towelettes, garbage bags and plastic ties for personal sanitation	Research and prepare a list of trusted companies who specialize in removing mal-ware or viruses from your computer.
Wrench or pliers to turn off utilities	Stop using your computer, or talking to phone scammers until you are sure they are safe to use.
Can opener for food (if kit contains canned food)	An emergency fund of cash to last you at least 1 month, just in case your accounts are frozen.
Local maps	A list of all account numbers including credit cards, banks, and even home utilities.
Cell phone with chargers	A contact list of toll free numbers to contact each of your providers.

Keep this kit somewhere safe and secure, and be ready to lean upon it to help you get through an Information Disaster.

Please share your thoughts on my suggestions above, I'd really be interested in making this list better!