Information Security Tips from Westfield Insurance

Do you tweet?

Did you hear of the security issue on Twitter.com?

On Wednesday, a cross-site scripting  exploit was discovered after a recent update of Twitter.com. The vulnerability allowed browser executable code to be injected into posted messages.  The code executed when you moved your mouse over a link.
 
The exploit was used to redirect you to other sites. The vulnerability was certainly exploited by miscreants to deface and infect some Twitter pages but it’s unknown if this flaw was used by criminal hackers who could use the bug to install malicious software on a person's computer to collect personal and financial information.

As social media sites increase in popularity, there will be increasing efforts to uncover flaws to exploit personal information or deliver malicious code.

The security issue was quickly corrected by Twitter.com

Here is Twitter’s explanation:

http://blog.twitter.com/2010/09/all-about-onmouseover-incident.html

Here is Sophos’ Graham Cluley’s blog on the flaw. Note that on the blog you can download a free Sophos virus scan.
http://www.sophos.com/blogs/gc/g/2010/09/21/twitter-onmouseover-security-flaw-widely-exploited/

 

Jeff Gibson is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

Smartphones are great, but are they secure?

Something I've noticed over the past month is the tremendous amount of smartphones in use, whether at the grocery store, or in a local coffee shop.  These devices are really pretty amazing, even playing some of the most high definition games on a simple little phone.  I saw someone swipe their shopping card at the register the other day, I sure could use that.  Up until the most recent series of smartphones, most people didn't really have the ability to store information other than contacts or small pictures on their phones.  But now, the opportunities are endless.  Most have browsing history available, pictures, videos, stored passwords, emails, and the list goes on and on, what's next? credit cards?

So what are people doing to ensure the sensitivity of the information stored on these devices remains sensitive?

The short answer is very little. I haven't come across many smartphones with a password set, and the memory card has only become increasingly easier to get at. Next time you have a few minutes (please not while driving your car), take a look at the security settings available to you.

• Ensure you have a password on the device .
• Review your application settings, do any applications have permissions to send information to the internet about you?
• Check on your internet browser settings, paying special attention to your identity and privacy options.
• Review the media (pictures, videos, text logs) that you keep on the device.
• Check into solutions that will send a remote wipe to your device, in case its lost.
• Know how to contact your provider to report the device lost or stolen as soon as possible.

Share your ideas for keeping smartphones and other mobile devices secure!

Jacob Harris is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

An Information Security Plan for Agencies

As the message regarding the need and importance of protecting customer information continues to grow by leaps and bounds, so to do the expectations of compliance and enforcement.  This fact is called out in numerous federal and state laws, best practices, and even contractual obligations.

To their credit, this has not gone unnoticed by independent insurance agencies.  I am frequently asked by agents, "How do I go about developing an Information Security Plan to help keep customer information secure and private?"

Thanks to the Agents Council for Technology (ACT), ask and you shall receive.

The Independent Insurance Agents & Brokers of America (IIABA) website reports that ACT has developed and released a free prototype agency information security plan.

According to Jeff Yates, ACT Executive Director, "Recent headlines have underscored the importance of agents having written security plans ... ACT has developed a free prototype security plan to assist agents and brokers in formulating and implementing specific procedures, training and monitoring to protect the security of their operations and the privacy of their client information."

Having reviewed the protoype information security plan, it is a solid first step.  I strongly encourage agents and brokers to take adavantage of this excellent resource.

The ACT Prototype Agency Information Security Plan & Companion Article can be found HERE.

Robert Salandre manages Information Security Policy and Awareness at Westfield Insurance.   Sharing Knowledge. Building Trust.