Information Security Tips from Westfield Insurance

Secure shopping reminders for Cyber-Monday

It's Cyber-Monday, the biggest on-line shopping day of the year, and that means it's time for Cyber-Monday scams. And there are a lot of them this year. Online shopping can be safe but you have to be careful where and how you shop. It's not really that much different from safe shopping at a physical store or over the phone. Be suspicious.

• When shopping online, type the merchant's URL in by hand instead of following any "convenient" link in an email or instant message. Those links can be spoofed in a phishing attack which looks like legitimate advertising.
• Look for the prefix https in the address line. This indicates that you are on an encrypted connection to the merchant's website. You can also look for the little yellow padlock icon in the bottom right of the browser. Be careful, however. Sophisticated hackers can spoof these signs
• Read the site's privacy policy carefully and use common sense about the offer. If it sounds too good to be true, it probably is. If you don't trust the company to protect your personal information, shop somewhere else.
• Make sure your own protections (anti-virus, firewall, patches) are up-to-date and running.
• Use a credit card, not a debit card. If your credit card is stolen or the number misused, federal law limits your liability to $50 (as long as you comply with the notification requirements). If a debit card number is compromised, you could lose the entire amount in the account to which the debit card is linked.
• Check your statement carefully for charges you don't recognize. Report any anomalies to your bank and report a lost or stolen card immediately.
• Consider keeping a separate credit card with a low credit limit just for internet purchases.

And in the theme of Cyber-Monday scams, here's one that isn't.

There are allegations online that a Facebook-based promotion being run by the Australian mall company which shares our name is a scam. They are letting Australian customers sign up for a lottery for a $10,000 gift card in exchange for all kinds of semi-confidential information (basically the same information you'd give up for a discount card, though) and the inclusion of a Facebook app to your account. Many people have accused the Facebook app of being virus-infected and/or the sign-up of being a phish. It actually checks out, though. Despite the skepticism (which I consider entirely appropriate and healthy in our current online environment), the mall's promotion has been confirmed. Hoax-slayer.com has a good writeup describing their confirmation of the promotion.

Whether you shop with the Westfield mall is up to you. Take a few minutes to research any such offer and company before you sign up, though. Being suspicious of an offer that seems too good to be true is an excellent habit to build.

3 Ways to Help Avoid Unauthorized Software

Last week at work, I received an e-mail letting me know of a "lost and found" item that I needed to claim.  So I stopped down at the security office thinking, “Hmm ... did I lose something with my name on it? Did someone see me drop my umbrella or something else I wouldn't have missed yet?”

 

Long story short; I had turned in 2 dollar bills found on the ground back in April, and since nobody had claimed it, I was now the owner.  As Earl would say, “Karma did that.”  But this made me think about all of the things people do to cut corners, or take advantage of someone else’s misfortune.  I'm by no means a knight in shining armor, but I try to be as honest as I can. 

 

I thought about this more as I read an article about a virus infecting the iPhone.  The virus only affected the phones which had been "hacked" or modified to run unauthorized software knowingly by the owner.  Many of us have called, e-mailed or asked the big software companies like Microsoft and Apple to protect us from security vulnerabilities, and they've tried, but often people install unapproved software which removes any chance they had at protecting their own information.  The software industry often calls this "Piracy", but in reality it's also hurting the people taking advantage of it in the long run.  Sure you can get access to all the cool new features of a "hacked" iPhone, xbox or any number of other devices, but in the end is it worth losing any or all information on your device, or even voiding your warranty?

 

Sometimes people don’t realize that they are running unauthorized software on their iPhone or other device.  Here are 3 ways to help determine if software is unauthorized:

 

1. Avoid installing packages with the words "Hacked" or "Free", unless they are approved by the company who sells the device.  All too often people create applications without considering the security ramifications. Despite their best intentions, they may be opening you up to some big vulnerability.

 

2. Avoid those e-mails which offer you a link to the latest software download or add-on for your device.  Remember if you didn't request the e-mail, it's probably a scam.

 

3. When in doubt, ask questions and search for answers. Vendors have customer support for a reason; they are often the best resources for those hard-to-find answers.

 

How are you keeping your information safe this holiday season?

Information Security Concerns in a Pandemic

For a while now, we have been working on the development of a pandemic plan for our company.  Information Technology supports this plan in many ways.  Through the use of technology we can increase the number of employees who can “work at home” and use Virtual Private Networking (VPN) software to remotely connect into our systems to perform their work.  Getting employees out of the office but still having them be productive is a form of “Social Distancing” that can reduce the risk of exposure to disease.

A component of any pandemic plan needs to be communication on what can and can’t be done from an Information Security perspective, even in a pandemic situation.  For example, we only allow company configured machines to connect to our network, even over a VPN connection.  However, not all of our employees have laptops so many, therefore, cannot work at home.   It must be reinforced that information security policy is still policy even in a pandemic, and employees who do not have company laptops must not use email to send documents or data to themselves to work on using their home (or any non-company owned) computer.  This is the same for taking work home on portable USB drives or other media.  Even if you have the best intentions and only want to help your company, you are putting your company at risk of your data being intercepted, copied or lost resulting in a privacy breach.

Why be so paranoid?  Our employees are only trying to be more efficient and effective in a time where 20%-30% of the company might be out sick.  It can't be that bad, right?  Wrong.  A big reason why is “endpoint protection”.  Your company’s endpoints (workstations and laptops) have known, approved and licensed software on them, they have anti-virus software running on them, they are regularly patched for security vulnerabilities and they are free of peer-to-peer sharing software.  Some of your employees' home machines MAY be up to your company’s standards, but what if even one is not?  When your employee is done with their work, are you sure that no backup or temporary files will linger behind?  How many of your employees have children that use the home computer to share music or files?  How about viruses or malware infecting your corporate network once this work is brought back into your production environment?  What if the employee actually loses the USB drive?  Not to mention the risk of a shared or compromised gmail or yahoo mail account.

All of these scenarios can cause data leakage or data loss that can lead to a privacy breach.  According to the most recent Ponemon study that reports on the costs and causes of privacy breaches, “Over 88% of all cases this year involved incidents resulting from negligence.” This leaves only 12% as a result of malicious activity.  This 88% is composed of employees who think that they are doing the right thing, are trying to help and believe that nothing bad can happen.

So, please reinforce to your employees and peers that it is not safe to trust public networks, infrastructure or non-company owned equipment to store or work on company confidential materials.   Even in a pandemic situation were your workforce may be diminished and people are looking for innovative ways to “keep the lights on”, information security policy is still in effect and information security risks, and their consequences, outweigh lost productivity.