Information Security Tips from Westfield Insurance

Web certificates - defined

This tip is part of Westfield's occasional series on general security definitions. To look up other topics, follow the Definitions at left.

You just got a popup on your computer that "there is an error with XYZ's certificate" and asking whether you'd like to accept the certificate forever, accept it only for one visit, or choose not to accept it. (See the example below) What exactly is a web site certificate and should you accept it or not?

Certificates are small bits of code used by organizations to show that they are who they say they are online. Certificates are generally purchased from third parties called 'certificate authorities – trusted companies who give the on-line equivalent of a Good Housekeeping seal of approval on the connection. Note: Certificate authorities do not evaluate the company, the website or their products. A certificate does not mean that the site is free of viruses or other malicious content. Certificate authorities merely verify that the web address actually belongs to the organization buying the certificate. When you type a URL or follow a link to a secure web site, your browser will check the certificate to make sure that the web site address matches the address on the certificate and that the certificate is signed by a certificate authority that the browser recognizes as a "trusted" authority.

If the organization wants to set up a secure website (that is, one that uses https instead of just http and has the yellow padlock in the bottom right of the window), they will need a site or host-certificate to set up the encryption. By making sure that the website encrypts your information and has a valid certificate, you can reduce your online risks.

The problem is that almost anyone can create the piece of code that looks like a certificate. Many legitimate companies want to set up secure connections but don't want to pay extra to the certificate authority for verification so they self-generate a certificate. Hackers can generate certificates, too, and use them to more closely mimic the legitimate secure site.

If the certificate is not from a trusted authority that your browser recognizes (there are about 100 trusted authorities loaded into your browser by default) or has some error or inconsistency, you have to decide whether or not to trust the web address and allow the connection.

To verify a certificate, look for the certificate feature in the browser's menus. In Internet Explorer, you can find it under File/Properties when you are on the secured site. When you click on the certificate button, it should show:

• who issued the certificate - Make sure that the issuer is a legitimate, trusted certificate authority.
• who the certificate is issued to – This should match the owner of the web site.
• expiration date - Most certificates are issued for one or two years. Be cautious of certificates that are valid for longer than two years or that have expired.

If you want to see all of the certificates currently on your machine, try Tools/Internet Options/Content and look for the certificate button.

If you have the time and need, you can verify every aspect of the certificate by contacting the company or the certificate authority. For most sites, you don't need to bother. But if it's a connection that you're using for highly confidential information (like your banking website) or if you have a reason to be suspicious of the site (perhaps a phishing site), take the time to verify the certificate. You'll only have to do it once – your computer will remember your decision thereafter.

Based in part on US-CERT Cyber Security Tip ST05-010

Rootkits - defined

Every once in a while, security geeks talk about "rootkits" in tones of fear or loathing. Here's what we're talking about and why we worry about them (and why you should, too).

A rootkit is a particular type of malicious software. It is different from an ordinary virus in that it is specifically designed to seize control of your computer at the highest possible level. (In the old unix terms, this was called 'root' access - the equivalent level of authority in Windows is 'administrator'.) Once the hacker has a rootkit on your computer, he/she has full access to everything on the computer. More than that, the hacker can usurp control of the computer and make it run other malicious programs (perhaps as part of a botnet) or can use it as a jumping-off point to attack other data on your network. The hacker can do anything on the computer that you can do – and many things that most of us can't.

Rootkits are also different in that they generally limit themselves to seizing and holding control of one system - a virus, on the other hand, is will try to spread itself to other computers. Rootkits are also often kits, that is, combinations of multiple malicious programs that work together. Ordinary viruses are usually single programs. That said, an ordinary virus can be sent out to infect your computer and can, as its first act, load a rootkit onto your computer. Using a virus as a component of a rootkit is a fairly common attack now. According to some researchers, as many as one in five PCs are infected with a rootkit.

Rootkits frequently masquerade themselves as other files and/or deliberately hide files from programs that are used by legitimate administrators to hunt for viruses. This makes them particularly difficult to clean out once your computer has become infected.

Not all rootkits are created by hackers. In 2005, Sony BMG included rootkit software on some music CDs in an attempt to prevent music piracy. Unfortunately, the rootkit exposed every one of their customers' computers to exploitation by anyone who knew to look for the backdoor the rootkit created.

To defend against rootkits:

• Practice safe surfing - don't go to virus-infected websites. Music-sharing, video, software, porn, hacker and other 'gray' websites are frequently loaded with virus-infected downloads. While there are some legitimate freeware sites, "there ain't no such thing as a free lunch". If they're not making money through sales or advertising, they're probably getting something else out of the deal – don't let that something be your computer.
• Keep your antivirus program on and up-to-date. But recognize that this is probably incomplete. Rootkits are specifically designed to defeat the major antivirus programs.
• Keep all the applications on your computer fully patched.
• Keep your firewall turned on and locked down as far as you can go. This won't necessarily stop you from picking up that first infection but it might prevent the virus from sending out the command to download the rest of the kit.
• Turn off your computer when you're not using it. First, restarting the computer each day triggers a number of cleanup activities. More importantly, the computer isn't exposed to exploit while it's turned off.
• If you are infected, take your computer to an IT specialist. Rootkits are especially difficult to clean out and will often reinstall themselves if part is missed. The usual practice is to wipe and rebuild the machine – they're that hard to get rid of.

based in part upon content from Wikipedia

Filesharing - defined

All the kids are doing it. And depending on which news reports you read, it's either the inevitable wave of the future or another sign of the collapse of our society - or both. But what is filesharing really?

Filesharing is the term for software designed to make it easier for you to share stuff through your computer with other people. (I use the technical term "stuff" here because you can share literally any electronic file through these tools but the most common shared files are documents, music files and videos – and viruses. More on that in a minute.) The most common form of filesharing is "peer-to-peer" (P2P) sharing, a way to share files directly from your computer to someone else's computer without needing to store it on a server somewhere. If I want to download a file that you've offered up for sharing, I reach through the internet and grab it directly off your computer.

This kind of filesharing requires special software such as Limewire, BitTorrent or Kazaa. These applications create an index of the files that you've offered for sharing and publish the index to the Internet so others can find your files. They also let you access the index and download the files you want. Filesharing is an easy way to publish documents widely and can get you access to all kinds of free content. Music is especially easy to find.

The problem with filesharing is that it exposes you and your computer to all sorts of risks that are not disclosed by the filesharing network or those "friends" who are pressuring your kids.

• When you use P2P, it is essentially impossible to verify that the file is trustworthy. Hackers hide spyware, viruses, worms and trojan horses and other malicious code into the files. When you download the file, you infect your own computer.
• P2P also opens up your computer to outsiders. The applications claim to only expose certain directories but 1) you don't know if the application is locking the folders down properly and 2) it's too easy to misfile a confidential document in a shared folder. Any little mistake opens up your confidential information to the world.
• Most P2P applications require you to open up certain ports on your firewall so it can send or receive the files. Hackers exploit those open ports to attack your computer directly anytime it is connected to the internet.
• And, of course, the big risk that got so much press when Napster was being sued into bankruptcy is the phenomenally high proportion of copyrighted material being illegally offered for "sharing". If you download pirated content, even unknowingly, you could face fines or other legal action. The Recording Industry Association of America (RIAA) is especially aggressive about finding and suing individual users who have illegally copied content on their computers.

If you run a network, either at a business or at home, I strongly recommend that you block filesharing sites. Remember, you go to jail or pay the fine whether they downloaded the illegal software with your knowledge or not. If you have kids, turn on your computer's parental controls and block those sites. Teach your kids to buy their music legitimately.

Based in part on US-CERT Cyber Security Tip ST05-007

Domain registration "alerts"

Westfield has recently started receiving "alerts" about internet domain registrations from a company in Asia. This company claims to have received an application for internet domains that are close to Westfield's main domain, westfieldinsurance.com, but carry different suffixes such as westfieldinsurance.net.cn, westfieldinsurance.hk or westfieldinsurance.asia. The email claims that the company "discovered" that the brand keyword matched our company's name and trademark and asks someone to contact them "before we finish the registration" for the other company.

On the Internet, the domain naming system treats every combination of domains as a unique destination. Owning example.com gives you no special rights to example.org. And while you may be able to make a case for trademark infringement, the domain naming system has a strong bias in favor of "first-come, first-served." If a domain name is important to your brand, you need to act to protect it.

If you're not already monitoring internet domain registrations that are similar to your trademark and business, you really should start. There are several good monitoring services out there, some that will send daily alerts for free. Remember, however, that you can't commandeer every possible variation of your domain – there are just too many possibilities. Get the domains that you think are most important and monitor the rest.

The message from the Asian company, however, is a scam. We have traced two different types of these messages so far. In the first case, it was a straightforward con for a credit card number. In the second case, it was an actual domain registrar using questionable tactics to generate business. In both cases, we investigated the company - a Google search on some keywords from the email will often return examples of others who have run into the same con - and decided not to respond to their phishing attempt.

If someone registers a domain name similar to yours, look at the domain registration. (There are several excellent lookup tools on the web. I tend to use whois.domaintools.com). If the other person registering the domain appears to be a legitimate business that just happens to have a similar name to yours, don't worry too much about it. We regularly bump into the the Westfield Group that owns Westfield Shoppingtown Malls (an Australian firm). We also know about domains registered to a car repair shop on a Westfield Road in Indiana. There's no connection and no evidence of fraud – and they got to the domain first. As long as they keep the domain out of the phishers' hands, I can live with that. I also don't worry too much about the domain resellers who buy the domain name then "park" it with some generic ads. (Here is an example.) As long as there's no evidence of misuse and no obvious confusion with my brand, I'm willing to let most of those sit.

Metadata - defined

Metadata is getting a lot of press lately, especially among companies that are wrestling with the new electronic discovery standards issued by the US Supreme Court. But what is it really?

Technically, metadata is data about other data. If the customer's address is data, the number of entries in your address book is metadata. If the body of a Word document is data, the date you last opened the file is metadata. If the values in an Excel spreadsheet are data, the formulas in each cell are metadata.

From a legal point of view, metadata is everything about the document that's not immediately visible when the document is printed. It includes all the MS Office "properties" like file size, author and character count. It also includes any hidden features such as the old versions that are still buried in the document when you leave the Track Changes option on. It includes formulae in spreadsheets and formatting commands like the print area.

For most normal uses, the metadata about a document is just background. We take it for granted and almost always ignore it. But if your metadata reveals facts that you wanted to keep private, it can be embarrassing and expensive. In one case, a major pharmaceutical company deleted some study data from a report – and got caught when the New England Journal of Medicine looked in the Tracked Changes to show the deleted comments. In another case, a confidential White House policy paper about Iraq was outed when a quick command revealed the report's author. In yet another case, officials covered up classified information with black bars, not realizing that readers could easily uncover the text by copying it from under the black and pasting it elsewhere.

When you get into a legal situation, metadata becomes even more important. Metadata is used to show "who knew it and when they knew it" – to provide the context around the document in question. Metadata can either clear you or convict you. Because of its importance, metadata must be preserved and unaltered when you are collecting documents that will be used in court. This is hard because routine Windows operations will change the metadata just by opening the file. Make sure that you have the tools you need to keep metadata intact before you get into the lawsuit.

And, of course, be very careful before you post a document publicly. Make sure you clean out the metadata that you don't want public.

What your footprints say about you

Most people surf the web and chat online thinking that they are hidden behind the anonymity of the computer screen. Few people realize that they are leaving footprints all over the web anytime they go online. Here are some of the things that are automatically sent to the website's computer whenever you visit the site:

• Your IP address - Every computer on the internet is assigned a specific, unique IP (internet protocol) address. That IP address can't be easily traced to a name directly except by your internet service provider but it can be correlated with your other online activity. So if you disclose your name in a blog or when writing a book review, someone might be able to trace that back and match it to your other internet habits. You can look up your current IP address at showmyip.com.
• Your computer's software load - Many websites want to know what web browser you are using (including which version). Legitimate sites use this information to adjust for differences between the way browsers display the webpage. A page that looks fine on Internet Explorer may not display properly through Mozilla's Firefox so the website developer adds code to tweak the display based on your browser. Unfortunately, the information sent to the website does not end with the browser. They may also be able to read your operating system and other details.
• Your page visit history - The website can often track which pages you visited, how long you stayed on a given page and where you were just before you came to the website. (This is often helpful for companies who want to know if you came to the site from a search engine and if their advertising dollars are being well-spent.)

If a web site uses cookies, they can collect even more information. The information they can collect about your browsing habits is limited only by their own privacy policy.

On the other hand, If the site you're visiting is malicious, all bets are off. Your privacy is completely dependent on the strength of your antivirus/antispyware programs and how up-to-date you keep your patches. Hackers at these sorts of sites can use all sorts of techniques to either steal information or trick you into revealing more than you intended. They will try to steal passwords (knowing that many people reuse the same password and that, by compromising this password, they have a very good guess at your online bank or work password), load viruses and may even attempt to alter the security settings on your computer so that they can access and use your computer for other malicious activity.

You can reduce the amount of information revealed about yourself by only visiting legitimate sites, checking privacy policies and paying careful attention to the personal information you provide. Don't post your address, password, or credit card information unless you trust the site. Look for indications that the site uses SSL to encrypt your information. Limit what cookies you allow and be careful which web sites you visit; if it seems suspicious, leave the site.

And, of course, always keep your antivirus software up-to-date and your computer fully patched.

Based in part on US-CERT Cyber Security Tip ST05-008

Use bcc: for large email distributions

Have you ever replied to an email message only to realize too late that you just sent your reply to the entire department? Or worse, to the entire company? Reply to All should be used only when you are sure that every recipient on the list really wants and needs to read your reply.

Unfortunately, accidentally hitting Reply to All is an easy mistake to make.

If you are the sender of the original message, you can make life easier and safer for your readers if you use the bcc: field instead of the To: field in the email header. Bcc: stands for "blind carbon copy. Every user will receive the message but the recipient will see only his or her own name in the bcc: field. If a user accidentally hits the Reply to All button, the reply message will only be sent to the original sender.

As a matter of ettiquette, you should disclose the distribution list to your readers in the body of the message. This avoids any appearance of attempting to hide the distribution. A common convention is to use small italicized text in the first line with the text "sent bcc: to MidwestDivision".

Scareware - defined

Have you ever seen a "free" offer to scan your computer for security vulnerabilities? The most common one that I get is a pop-up ad that reads "Your computer may be infected with harmful spyware programs. Immediate removal may be required. To scan, click 'Yes' below." It looks like a great idea. You're offering to test my machine for free so I know what, if anything, needs fixing. Doctors, mechanics, even the lawn guy offers that kind of free screening as a legitimate way to build a relationship with new customers.

Unfortunately, most if not all of these computer scanning offers are scams. They are rogue programs that will always report something that needs to be fixed or cleaned whether the flaw is real or not. They are designed to scare you into believing that there is something terribly wrong with your computer that only their software can fix.

Examples that attack Windows computers include SpySheriff, WinFixer, IEDefender and Cleanator. Interestingly, Mac users ran into this problem for the first time in January with a product called MacSweeper. MacSweeper is so "thorough" that it even finds flaws when it's run against a PC – flaws that can only exist on a Mac.

Most of these are simple attempts to con you out of money or credit card numbers. Some are more malicious and will load spyware onto the computer or even disable your existing antivirus programs.

Never run software from unknown sources. If you do suspect that your computer may be vulnerable, use your own anti-virus and anti-spyware software. Don't trust that "free" offer.

Note: The word "scareware" also includes more harmless pranks such as the program that pops up and says "Erase everything on hard drive?" with two buttons labeled "OK" and "OK". (Nothing is actually deleted in this prank.) Just ignore those pranks.

A few more popup examples:

Credit freeze - defined

Most states have passed "credit freeze" laws, allowing individual consumers to lock their credit reports and, in theory, reducing their vulnerability to identity theft. While the credit freeze is in place, the credit reporting agency may not give out your credit report unless you explicitly grant permission and confirm your identity using a PIN or password. This makes it harder for the identity thief to open an new account or to get new credit in your name.

Even if your state does not have a credit freeze law, the three major credit reporting agencies now offer freezes voluntarily. To institute a credit freeze, you generally need to send a written request to each of the three major credit reporting agencies. The specific instructions vary from state to state. You can find links to each state's instructions at ConsumersUnion.org. The states allow the credit reporting agency to impose a fee to initiate the freeze (usually $5-10 per credit reporting agency but often free to confirmed victims of identity theft) .

If you do freeze your credit report, you will have to lift the freeze whenever you want credit. Under almost all the state laws, you'll have to pay again each time you want the freeze lifted. This can make opening a new account or even changing your existing service more difficult and expensive. When you apply for the freeze, you will be given the instructions and PIN needed to lift the freeze. In some cases, you'll have to lift the freeze yourself – in others, you might be able to authorize the merchant to do it for you. Either way, it will take some extra time. It will also make you ineligible for "instant credit" unless you lift the freeze before going to the store.

The credit freeze laws have implications for businesses that use credit reports for purposes other than lending (such as evaluating underwriting risk). Unless the state law has explicitly carved out that usage as allowed (and many but not all states did for underwriting), the business should expect extra paperwork and several extra steps in the process to get permission to view the consumer's credit report. The law varies from state to state. Check with your corporate counsel for details.

As a consumer, you should also know that a credit freeze will not necessarily keep you safe from identity theft. While most reputable creditors will check your report before issuing credit, some don't. Identity thieves can still exploit those situations, knowing that you will have to pay the consequences. A credit freeze also will not protect you from exploitation of existing accounts.

If you are at increased risk of identity theft and already have a house, car, phone service and the credit cards you need and you see no near-term need to refinance any of them, a credit freeze might be appropriate for you. If you have few risk factors or will need to legitimately seek credit for yourself soon, a credit freeze could be more trouble than it's worth. Personally, I do not have a credit freeze on my account. I take normal precautions to make my identity hard to steal in the first place (I have a shredder and use it, I don't leave financial documents like credit card bills on the kitchen counter, I don't keep my SSN in my wallet, I use strong passwords, etc) and I check my credit report regularly. To me, the incremental protection of a credit freeze is not now worth the extra hassle and expense.

Web browser security settings

Your web browser is your primary connection to the Internet, either by reading web pages directly or through applications that use your browser to function. How you set the security makes a great deal of difference for your computer's safety.

Those security settings will also affect the functionality of some web sites. Web page writers try to improve your experience by enabling different features. Sometimes they're nice but they leave your computer more vulnerable to attack. In fact, a common hacker trick is to set up an "innocent" website with attractive content but which will not work correctly unless you reduce your security settings, exposing you to the hacker's malicious content on other links. The safest policy is to disable those optional features until you decide that it's necessary and that the website is trustworthy. (In most cases, you can enable the feature temporarily.)

Note: Your IT department should control the settings for your work computer. Make sure that they have the security controls locked down so users can not accidentally expose their computer to unacceptable risks. If you use Internet Explorer, you can find the security settings by clicking Tools/Internet Options/Security. (Firefox and other browsers generally use similar paths.) If the security is properly locked down, you should be able to see but not change the settings.

Internet Explorer uses the concept of "zones" and lets you set the security level differently depending on where you are browsing. For most of us, the most important zone is "internet". This is the general zone for all public websites and is the default used when the browser doesn't have different instructions. This should be set as high as possible but never below "medium".

The "local intranet" zone is usually used for internal content. Since your own company developed the pages, it's usually safer to use a slightly lower level of security as long as there is a business reason to do so. "Trusted sites" are those that you have decided are well-designed and use good security practices. Our work computers have certain trusted business partners pre-loaded in this zone. I have none in my personal computer at home.

"Restricted sites" are those that you think might not be safe and that deserve the highest level of caution. Frankly, if you're that suspicious, you're probably not surfing there anyway. But it can be helpful to mark those sites because it will provide an extra layer of protection if your computer is calling those domains for "hidden" content like ads and pop-ups.

Your browser also has some security settings related to JavaScript, ActiveX controls and Plug-ins. You should only allow them if you are at a trusted site. See the tip on Active Content for suggestions on those controls.

You should disable cookies except for sites that you trust that require them. Add those manually to the browser's "allowed" list. Definitely block pop-ups but remember that it will break some websites. You can always allow the pop-ups on a case-by-case basis.

In general, always set your security for the highest level possible. Then lower the security only when a page fails to work properly and only as far as you need to or for as long as you need to. Once you've set the controls properly, it's not that much work to maintain. But it is a vital part of the protection of your computer and your confidential information.

Adapted from: US-CERT Cyber Security Tip ST05-001

Protect your computer from Spyware

Spyware is Internet jargon for advertising-supported software. This type of software often automatically installs itself on your computer without your knowledge in order to collect your personal information and provide it to a website or advertiser. Spyware is hidden in the background and keeps track of your web browsing, what information you enter into forms and even the configuration of your hardware and software. The company receiving this information may use it directly or, more likely, will sell this information about you. Based on this information, you may begin to see incessant pop-up ads, giving the false impression that the Web page being viewed is responsible for the constant annoyances.

Spyware usually is usually hidden in or behind an application that you want to use (such as a music player). When you install the software, the spyware application also installs itself.

In addition to the annoyances of increased spam and advertising, the spyware application ties up valuable computing power and can eventually make it run slower. It can create conflicts with other software on your machine causing programs to lock up or causing your machine to crash. It can even be abused by hackers to steal your password or to take control of your computer.

If you load software from the Internet, read the license agreement carefully. Some companies actually disclose that they will install an application on to your computer and may allow you the option to "opt-out". For example, RealJukebox has the ability to track how you used the program including the number of recorded songs on the computer, the format that songs are recorded in, the user's musical preferences, the quality level of the recordings, and the type of portable player connected to the computer.

You can use specialized software to find and disable spyware applications and to protect your computer. Two of the better-known free-ware applications are SpyBot Search and Destroy and Ad-Aware. Whatever anti-spyware solution you pick, be sure to keep it updated and run it regularly.

Be sure to read all "End User License Agreements" very carefully and make sure you understand what is actually going to be installed on your home computer.

Firewalls

A firewall looks for and attempts to stop forbidden communications between two computers. Firewalls work by examining each piece of traffic entering or leaving the network and blocking those which do not meet specified criteria. If the communication is an allowed type (for example, Windows passing your user name and password to the company network during login), the message is allowed through. If the communication is unrecognized (for example, a virus attempting to impersonate Lotus Notes but really sending your password out to a hacker), the traffic can be stopped.

There are two kinds of firewalls: "personal" or software firewalls and "network" or hardware firewalls.

• Software firewalls are relatively easy to install and provide good protection. They filter traffic entering or leaving a single computer. Software firewall programs (such as ZoneAlarm, Norton or Comodo) can be downloaded from the Internet and may be available in a free version for home users. (Note: If your home computer's operating system is Windows XP or Vista, it has a built-in software firewall but Windows has not traditionally performed well in bench comparisons. Most security experts recommend replacing or at least supplementing the Windows firewall.) For more on personal firewalls and how they work, see the first page of this article.
• Hardware firewalls require you to buy and connect a separate piece of equipment, but they provide stronger protection. They plug in between your internet connection (such as the cable-modem or DSL line) and the computer. Hardware firewalls are often built into routers, allowing multiple computers to share a single, protected connection to the internet. Hardware firewalls often also have the ability to perform network address translation (NAT) which hides the specific IP address of your computer and makes it much harder for a hacker to launch an attack against you. Hardware firewalls are available at many electronics retail stores, usually starting at $50-$75.

CERT (the Computer Emergency Readiness Team) strongly recommends the use of hardware firewalls, especially if you have a broadband or "always on" connection. See "Before You Connect a New Computer to the Internet" for more information.

Some firewalls will display a pop-up box asking if you want to allow the message. If you see one of these pop-ups, never allow the traffic unless you are sure that you know exactly what it is doing. Remember, the firewall won't do any good if you give permission for the virus to send out your password.

Patches - defined

Security geeks often talk about keeping your computer "patched". Here's what we mean and why it's so important.

In a perfect world, all the code on your computer would do exactly what it's supposed to do and nothing more. In the real world, new code was added on top of existing code to fix a problem or to add some new feature until, over time, the code became too complicated to test for every possible scenario. Hackers found ways to exploit the holes in the code. By sending just the right command in just the right circumstances, they could make the computer do something it shouldn't – like give the hacker permission to install software and take control of the computer.

When such a vulnerability is discovered, the developers who made the software have to figure out how to plug the hole – how to change the code just enough to stop the hacker without shutting down the new feature they added or interfering with some other application. "Patches" are the bits of code to be added to your computer to fix that hole. (Patches can also be used to add a new feature or fix something else in the program but for now we'll stick to security patches.)

At work, your IT team should be responsible for keeping your core applications up-to-date and fully patched. For your home computer, you should set your computer to automatically update the software whenever new patches are available. That's the safest way to be sure that you have the latest code protecting your computer. While most vulnerabilities are found in the operating system (those core instructions that the computer needs just to turn itself on), more and more vulnerabilities are being found in applications – Word, Adobe, QuickTime, RealPlayer, etc. No modern application is completely safe. In Windows, you can set the updates through the Control Panel. (Look for something like Automatic Updates or Windows Updater.) In other programs such as Quicken, you usually set the updates via Tools/Options or Preferences.

Of course, there's no such thing as a free lunch or perfect software. Sometimes, the patch will fix the program but will also break some function that some other program needed to run. When that happens, you must either decide to wait (and hope that the developers at one of the two companies will send out yet another patch to fix the breakage) or take the risk and reverse out the last patch. Unless the patch broke something that's absolutely mission-critical, you are almost always better off leaving it in place.

Incidentally, Microsoft has been releasing a packet of security updates on the second Tuesday of each month (so-called Patch Tuesday) for several years now. Some hackers are now exploiting that pattern and holding their latest virus until the second Wednesday so they have the most possible time before they are shut down. Even if you stay fully patched, there are no guarantees in life.

Email spoofing

Have you ever received an error message about an email that you didn't send? Or wondered why someone from your own company's email address is sending you ads for Viagra or financial alerts for penny-stocks? Have you gotten a spam message from yourself? If so, you've just seen email spoofing in action.

Anything about an email can be edited or overwritten including the From, Return-Path, and Reply-To fields. Commands inserted into the header of the email can make the message appear to come from anyone, anywhere saying whatever the sender wants it to say. Spammers and other hackers know that their response rate is 10% higher if they can match the recipient's name – they rely on curiosity and trust to trick you into opening a malicious message. The trick is built right into the hacker tools that are used to generate mass-mailingworms and other malware.

If you think you received a spoofed message, simply delete it. Most email programs allow you to block future messages from that address but that approach is no longer effective at actually stopping spam. The problem is that blocking User1@spoofvictim.com still lets junk through from User2@spoofvictim.com, User3, etc. The odds that the spammer will pick the same victim next time are negligible. But if you ever do get a legitimate message from User1, you'll never see it. If there really is enough spam from one location to justify a black-listing, our spam-filter vendor will find it and include it in their master list. That fixes the problem not just for your email but for everyone else at the same time.

Do not send a complaint to the person that you think sent you the spam. If it was a spoof, they can't do anything about it anyway. If it was not a spoof, all you've done is confirm that you're the kind of person who opens spam messages. You'll get more spam, not less. You can, however, forward a copy to spam@uce.com, a department of the Federal Trade Commission which collects and reports on spam trends.

If you think that your address has been spoofed, delete that message too. Some virus writers are deliberately mimicking the email error messages in the hopes that you'll open the attachment "explaining the problem" and infect your computer with their program. If you don't remember sending the message, trust your memory. It's very likely a scam.

Active Content - defined

At some point, you've probably seen an error message pop up that "Active Content on this webpage has been blocked. Click here for options." Microsoft and the other browser makers give us these warning so we can try to make choices about what to trust on the web and what to avoid. Unfortunately, most average computer users don't know what "active content" is or how to decide what to trust. There are no easy answers for deciding who to trust but after reading this overview, you should have a little more idea of the risks you are taking.

Active content today comes in two basic flavors – web scripts like JavaScript or VBScript and programs such as Java or ActiveX. Both use code embedded in the webpage to help the webpage do something extra (like drop-down menus) or formatting of the page look better. While these scripts make the webpage more user-friendly, they can offer a way for hackers to get into your computer.

Web scripts are used on almost every web site now. These scripts let the web designer customize the look and feel of the site and are very easy to use. The script is written into the webpage and is executed by your browser. There are limits to what the script can do, making them mostly safe. Unfortunately, one of the ways they can be exploited is to redirect you from a legitimate web site to a look-alike malicious one that may download viruses or collect personal information.

Java and ActiveX controls are actual programs that are already on your computer or can be automatically downloaded into your browser. ActiveX can do anything on your computer that you can do. That's helpful if the web page is supposed to find and run a program for you but very dangerous if exploited by a hacker. Untrustworthy ActiveX controls can be used to load spyware, collect personal information, connect to other computers or do other damage. (If you're trying to load or update well-known software like Flash Player or Adobe Reader, it's probably okay. On the other hand, if the browser is trying to launch something like WeatherBug or MemoryMeter, SAY NO!) Java applets usually run in a more restricted environment and have less rights on your computer (and therefore can do less damage if exploited), but if that environment isn't secure, malicious Java applets may be used for attack as well.

In general, you should set your Internet Options to block ActiveX. For computers containing highly sensitive information, you should also consider disallowing Java and JavaScript. Only allow the content through if you are sure that you are at a trusted website. Recognize, however, that the added security may cause some features of the website to not function or to function improperly. Once you've verified the security of a site, you can designate it a "Trusted Site" and allow future active content from that site. And always keep your anti-virus, anti-spyware and firewalls running and your software fully patched.

based in part on CERT Cyber Security Tip ST04-012

Cookies - defined

A cookie is a tasty treat.

It's also a small string of text that's used to keep track of your computer when you browse the Internet. An HTTP cookie might track general information about your computer (such as IP address you used to connect or the type of browser you use) or more specific information about your browsing habits (such as the last time you visited a particular web site or your personal preferences for viewing that site).

The bit of text that makes the cookie is sent to your computer by a server when you first visit a website (or sometimes when you sign in to the site). After that, whenever your computer accesses that server, it sends the text string unchanged back to the server. The cookie identifies your computer to the server and lets the server know to send back the content that's relevant to your request and keeps it from mixing up the reply with the next person's request.

Cookies serve several different purposes depending on how long your computer stores them.

• Session cookies store information only as long as you're using the browser. Once you close the browser, it is erased. Session cookies are a way to keep you logged in so you don't have to reinput your password on every page. Session cookies can also hold onto your preferences or keep track of whether you've already visited a particular page. Session cookies are used on many websites to keep track of the contents of your electronic shopping cart.
• Persistent cookies are stored on your computer's hard-drive so that your personal preferences can be retained over time. Persistent cookies are how your computer knows to fill in your username by default when you open your Yahoo! or Hotmail email account or to display your personalized page appears when you visit Amazon.com. Persistent cookies can also be used by advertisers and others to keep track of your browsing patterns. If an attacker gains access to your computer, he/she may be able to gather personal information about you through these files. Persistent cookies may be set to "expire" after a certain period of time (usually a few days or weeks) but can be set to never expire.

Because of the privacy concerns, cookies can be controversial. Many people recommend blocking or limited the use of cookies in your web browser. While this can make sense in many situations, it will cause some sites to stop working. To control cookies, go to the options or preferences section in your web browser. In Internet Explorer, the path is Tools/Internet Options/Privacy. In general, you should set higher restrictions on third-party cookies – those used by advertisers on a site to track your behavior across multiple webpages – than on first-party cookies – those used by the site that you are actually visiting.

If you are using a public computer, you should make sure that cookies are disabled to prevent other people from accessing or using your personal information.

FBI Botnet Investigation

The FBI just announced the largest ever cybercrime investigation to disrupt and dismantle "botnets" and to prosecute some of the ringleaders in these criminal activities. So far, they have identified about 1 million compromised computers across the country. The FBI is working with the CERT Coordination Center at Carnegie Mellon Univ to notify the victim owners of the computers.

So far, the FBI has charged 3 people with cyber crimes as a direct result of this investigation; one hacker in Texas accused of infecting tens of thousands of computers, one hacker in Seattle accused of using botnets to send tens of millions of spam messages and one hacker in Kentucky accused of using botnets to disable other systems.

Note: The FBI will not contact you online and request your personal information. Nor will they offer to clean your computer for you. As word of this investigation gets out, be wary of fraudulent message appearing to come from the FBI or some other agency and offering to "fix" your computer for you. If you receive such a scam, file a complaint online with the Internet Crime Complaint Center or call the nearest FBI office.

A botnet is a network of other people's computers all controlled by a hacker. In a typical botnet setup, the first hacker uses viruses, worms or trojan horses to install malicious software (the bot) on your computer without your knowledge. The hacker builds up the network as large as possible – tens or even hundreds of thousands of compromised computers. He then rents out the right to use his network of hacked computers to the highest bidder. The second hacker sends out the command messages to all the hacked computers telling them to execute their attack. Examples of attacks might be distributed denial of service (flooding the target with so many requests that the real traffic can't get through), publication of phishing emails, click fraud and mass distribution of spam and spyware.

Unfortunately, the hacked computer's user might not even notice that his/her computer is being used by someone else. Look for slow performance, an outbox full of mail you didn't send or messages saying that you've sent spam. Any of these would be reason to investigate your computer carefully.

If you think your computer might be infected, contact your Technical Support immediately.

Take the following steps to protect your computer from being captured in a botnet:

• Pick strong passwords
• Install anti-virus software and keep it up to date.
• Install a firewall and keep it turned on.
• Keep your computer's software fully patched.
• Install and update anti-spyware software.
• Be careful what you download.
• Turn off your computer when you're not using it.

Who has access to your data

This article was originally published in the Mar 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

When John retired last month, when Sue left the company, when Sam moved into another department, did their access rights get updated? Or can they still log onto the computer and see your customers' confidential information? Can they log onto one of your partner web sites and prospect against your customers?

Identity and rights management is a complex and serious problem for any company with more than a few employees. Federal and state regulations require that private customer information be protected based on a business need-to-know. Social Security numbers, credit scores and driver license numbers are just a few of the fields that are considered private. If your employees, contractors or support staff have access to files or programs holding that kind of data, I recommend creating a plan to make sure that only the right employees have access.

Here are suggestions to help keep your data safe:

• Keep a current list of users for your systems.
• If you have a user who no longer needs access, you should remove the name from the list of authorized users. According to Secret Service Internet crime statistics, most penetrations of electronic systems are carried out by former insiders whose access was not properly shut down. Make someone responsible for changing access rights whenever an employee's status changes to ensure users do not keep rights they should no longer have.
• Keep an employee access checklist of all carriers' systems, bank systems industry web sites, etc.
• Make sure that they also know of the employee's status change. A sample checklist with some of the most common considerations is available on Agent's Web Passport* and can be used as a template to build or expand your own list.

* Agent's Web Passport is a proprietary web portal for independent agents affiliated with Westfield Insurance. The sample checklist is not currently available through this blog.

Security Planning

As a general rule of thumb, it costs 40 times as much to fix the security of a project after the fact as it would have cost to build security in at the front of the project.

You should always design your applications and solutions be designed with security in mind. Call the Information Security team in your IT department for help identifying and prioritizing security risks. They should also be able to help you develop the business requirements and technical controls necessary to ensure that your confidential data is properly secured. Contact them as early in the design cycle as possible – preferably during the business case stage of the initiative. They can help make sure that all the hidden costs and implications have been identified.

If you're planning to buy a service from a third party where the vendor or service provider will have access to any company data, especially confidential customer data, or will have access to any system or accounts which could be used to get access to our data, the vendor's security practices should be evaluated against your company's security standards. Many companies use an Application Service Provider (ASP) Questionnaire to evaluate the vendor's security practices. Again, contact your IT department for help with understanding the vendor's practices. Do not assume that their practices live up to your standards without checking on them.

Multi-Factor Authentication - defined

Authentication means knowing who is on the other end of the line. Authentication is essential before you share any non-public information with the other person whether you are sharing it by phone, email, instant messaging or in person. Authentication is based on one of three "factors":

• Something you are – recognizing your face, voice, fingerprint, signature, etc.
• Something you have – a car key, a digital certificate on your computer, an ID card or security token
• Something you know – a password, the last four of your SSN, mother's maiden name, etc.

Multi-Factor Authentication means checking against two or more of those types of authentications. For example, the HELP Desk might check caller ID to see if you are calling from your own phone (something you have) and still ask for your employee ID number (something you know). A debit card is another form of two-factor authentication. You need both the physical card and the four digit PIN to get cash out of the ATM. Authentication methods that use more than one factor are more difficult to compromise than single-factor methods.

In the weaker sense, multi-factor authentication is sometimes interpreted as asking for two things you know – a password and a PIN. This is better protection than just asking for a single password but considerably weaker than proper multi-factor authentication. If a hacker knows enough to compromise your password, they are also likely to be able to compromise your PIN. Still, internet sites which require both a password and PIN have added "friction" to the process. They force the hacker to do more work and make it more likely that the hacker will go somewhere else instead.