Information Security Tips from Westfield Insurance

Email spoofing

Have you ever received an error message about an email that you didn't send? Or wondered why someone from your own company's email address is sending you ads for Viagra or financial alerts for penny-stocks? Have you gotten a spam message from yourself? If so, you've just seen email spoofing in action.

Anything about an email can be edited or overwritten including the From, Return-Path, and Reply-To fields. Commands inserted into the header of the email can make the message appear to come from anyone, anywhere saying whatever the sender wants it to say. Spammers and other hackers know that their response rate is 10% higher if they can match the recipient's name – they rely on curiosity and trust to trick you into opening a malicious message. The trick is built right into the hacker tools that are used to generate mass-mailingworms and other malware.

If you think you received a spoofed message, simply delete it. Most email programs allow you to block future messages from that address but that approach is no longer effective at actually stopping spam. The problem is that blocking User1@spoofvictim.com still lets junk through from User2@spoofvictim.com, User3, etc. The odds that the spammer will pick the same victim next time are negligible. But if you ever do get a legitimate message from User1, you'll never see it. If there really is enough spam from one location to justify a black-listing, our spam-filter vendor will find it and include it in their master list. That fixes the problem not just for your email but for everyone else at the same time.

Do not send a complaint to the person that you think sent you the spam. If it was a spoof, they can't do anything about it anyway. If it was not a spoof, all you've done is confirm that you're the kind of person who opens spam messages. You'll get more spam, not less. You can, however, forward a copy to spam@uce.com, a department of the Federal Trade Commission which collects and reports on spam trends.

If you think that your address has been spoofed, delete that message too. Some virus writers are deliberately mimicking the email error messages in the hopes that you'll open the attachment "explaining the problem" and infect your computer with their program. If you don't remember sending the message, trust your memory. It's very likely a scam.

Active Content - defined

At some point, you've probably seen an error message pop up that "Active Content on this webpage has been blocked. Click here for options." Microsoft and the other browser makers give us these warning so we can try to make choices about what to trust on the web and what to avoid. Unfortunately, most average computer users don't know what "active content" is or how to decide what to trust. There are no easy answers for deciding who to trust but after reading this overview, you should have a little more idea of the risks you are taking.

Active content today comes in two basic flavors – web scripts like JavaScript or VBScript and programs such as Java or ActiveX. Both use code embedded in the webpage to help the webpage do something extra (like drop-down menus) or formatting of the page look better. While these scripts make the webpage more user-friendly, they can offer a way for hackers to get into your computer.

Web scripts are used on almost every web site now. These scripts let the web designer customize the look and feel of the site and are very easy to use. The script is written into the webpage and is executed by your browser. There are limits to what the script can do, making them mostly safe. Unfortunately, one of the ways they can be exploited is to redirect you from a legitimate web site to a look-alike malicious one that may download viruses or collect personal information.

Java and ActiveX controls are actual programs that are already on your computer or can be automatically downloaded into your browser. ActiveX can do anything on your computer that you can do. That's helpful if the web page is supposed to find and run a program for you but very dangerous if exploited by a hacker. Untrustworthy ActiveX controls can be used to load spyware, collect personal information, connect to other computers or do other damage. (If you're trying to load or update well-known software like Flash Player or Adobe Reader, it's probably okay. On the other hand, if the browser is trying to launch something like WeatherBug or MemoryMeter, SAY NO!) Java applets usually run in a more restricted environment and have less rights on your computer (and therefore can do less damage if exploited), but if that environment isn't secure, malicious Java applets may be used for attack as well.

In general, you should set your Internet Options to block ActiveX. For computers containing highly sensitive information, you should also consider disallowing Java and JavaScript. Only allow the content through if you are sure that you are at a trusted website. Recognize, however, that the added security may cause some features of the website to not function or to function improperly. Once you've verified the security of a site, you can designate it a "Trusted Site" and allow future active content from that site. And always keep your anti-virus, anti-spyware and firewalls running and your software fully patched.

based in part on CERT Cyber Security Tip ST04-012

Cookies - defined

A cookie is a tasty treat.

It's also a small string of text that's used to keep track of your computer when you browse the Internet. An HTTP cookie might track general information about your computer (such as IP address you used to connect or the type of browser you use) or more specific information about your browsing habits (such as the last time you visited a particular web site or your personal preferences for viewing that site).

The bit of text that makes the cookie is sent to your computer by a server when you first visit a website (or sometimes when you sign in to the site). After that, whenever your computer accesses that server, it sends the text string unchanged back to the server. The cookie identifies your computer to the server and lets the server know to send back the content that's relevant to your request and keeps it from mixing up the reply with the next person's request.

Cookies serve several different purposes depending on how long your computer stores them.

• Session cookies store information only as long as you're using the browser. Once you close the browser, it is erased. Session cookies are a way to keep you logged in so you don't have to reinput your password on every page. Session cookies can also hold onto your preferences or keep track of whether you've already visited a particular page. Session cookies are used on many websites to keep track of the contents of your electronic shopping cart.
• Persistent cookies are stored on your computer's hard-drive so that your personal preferences can be retained over time. Persistent cookies are how your computer knows to fill in your username by default when you open your Yahoo! or Hotmail email account or to display your personalized page appears when you visit Amazon.com. Persistent cookies can also be used by advertisers and others to keep track of your browsing patterns. If an attacker gains access to your computer, he/she may be able to gather personal information about you through these files. Persistent cookies may be set to "expire" after a certain period of time (usually a few days or weeks) but can be set to never expire.

Because of the privacy concerns, cookies can be controversial. Many people recommend blocking or limited the use of cookies in your web browser. While this can make sense in many situations, it will cause some sites to stop working. To control cookies, go to the options or preferences section in your web browser. In Internet Explorer, the path is Tools/Internet Options/Privacy. In general, you should set higher restrictions on third-party cookies – those used by advertisers on a site to track your behavior across multiple webpages – than on first-party cookies – those used by the site that you are actually visiting.

If you are using a public computer, you should make sure that cookies are disabled to prevent other people from accessing or using your personal information.

FBI Botnet Investigation

The FBI just announced the largest ever cybercrime investigation to disrupt and dismantle "botnets" and to prosecute some of the ringleaders in these criminal activities. So far, they have identified about 1 million compromised computers across the country. The FBI is working with the CERT Coordination Center at Carnegie Mellon Univ to notify the victim owners of the computers.

So far, the FBI has charged 3 people with cyber crimes as a direct result of this investigation; one hacker in Texas accused of infecting tens of thousands of computers, one hacker in Seattle accused of using botnets to send tens of millions of spam messages and one hacker in Kentucky accused of using botnets to disable other systems.

Note: The FBI will not contact you online and request your personal information. Nor will they offer to clean your computer for you. As word of this investigation gets out, be wary of fraudulent message appearing to come from the FBI or some other agency and offering to "fix" your computer for you. If you receive such a scam, file a complaint online with the Internet Crime Complaint Center or call the nearest FBI office.

A botnet is a network of other people's computers all controlled by a hacker. In a typical botnet setup, the first hacker uses viruses, worms or trojan horses to install malicious software (the bot) on your computer without your knowledge. The hacker builds up the network as large as possible – tens or even hundreds of thousands of compromised computers. He then rents out the right to use his network of hacked computers to the highest bidder. The second hacker sends out the command messages to all the hacked computers telling them to execute their attack. Examples of attacks might be distributed denial of service (flooding the target with so many requests that the real traffic can't get through), publication of phishing emails, click fraud and mass distribution of spam and spyware.

Unfortunately, the hacked computer's user might not even notice that his/her computer is being used by someone else. Look for slow performance, an outbox full of mail you didn't send or messages saying that you've sent spam. Any of these would be reason to investigate your computer carefully.

If you think your computer might be infected, contact your Technical Support immediately.

Take the following steps to protect your computer from being captured in a botnet:

• Pick strong passwords
• Install anti-virus software and keep it up to date.
• Install a firewall and keep it turned on.
• Keep your computer's software fully patched.
• Install and update anti-spyware software.
• Be careful what you download.
• Turn off your computer when you're not using it.

Who has access to your data

This article was originally published in the Mar 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

When John retired last month, when Sue left the company, when Sam moved into another department, did their access rights get updated? Or can they still log onto the computer and see your customers' confidential information? Can they log onto one of your partner web sites and prospect against your customers?

Identity and rights management is a complex and serious problem for any company with more than a few employees. Federal and state regulations require that private customer information be protected based on a business need-to-know. Social Security numbers, credit scores and driver license numbers are just a few of the fields that are considered private. If your employees, contractors or support staff have access to files or programs holding that kind of data, I recommend creating a plan to make sure that only the right employees have access.

Here are suggestions to help keep your data safe:

• Keep a current list of users for your systems.
• If you have a user who no longer needs access, you should remove the name from the list of authorized users. According to Secret Service Internet crime statistics, most penetrations of electronic systems are carried out by former insiders whose access was not properly shut down. Make someone responsible for changing access rights whenever an employee's status changes to ensure users do not keep rights they should no longer have.
• Keep an employee access checklist of all carriers' systems, bank systems industry web sites, etc.
• Make sure that they also know of the employee's status change. A sample checklist with some of the most common considerations is available on Agent's Web Passport* and can be used as a template to build or expand your own list.

* Agent's Web Passport is a proprietary web portal for independent agents affiliated with Westfield Insurance. The sample checklist is not currently available through this blog.

Security Planning

As a general rule of thumb, it costs 40 times as much to fix the security of a project after the fact as it would have cost to build security in at the front of the project.

You should always design your applications and solutions be designed with security in mind. Call the Information Security team in your IT department for help identifying and prioritizing security risks. They should also be able to help you develop the business requirements and technical controls necessary to ensure that your confidential data is properly secured. Contact them as early in the design cycle as possible – preferably during the business case stage of the initiative. They can help make sure that all the hidden costs and implications have been identified.

If you're planning to buy a service from a third party where the vendor or service provider will have access to any company data, especially confidential customer data, or will have access to any system or accounts which could be used to get access to our data, the vendor's security practices should be evaluated against your company's security standards. Many companies use an Application Service Provider (ASP) Questionnaire to evaluate the vendor's security practices. Again, contact your IT department for help with understanding the vendor's practices. Do not assume that their practices live up to your standards without checking on them.

Multi-Factor Authentication - defined

Authentication means knowing who is on the other end of the line. Authentication is essential before you share any non-public information with the other person whether you are sharing it by phone, email, instant messaging or in person. Authentication is based on one of three "factors":

• Something you are – recognizing your face, voice, fingerprint, signature, etc.
• Something you have – a car key, a digital certificate on your computer, an ID card or security token
• Something you know – a password, the last four of your SSN, mother's maiden name, etc.

Multi-Factor Authentication means checking against two or more of those types of authentications. For example, the HELP Desk might check caller ID to see if you are calling from your own phone (something you have) and still ask for your employee ID number (something you know). A debit card is another form of two-factor authentication. You need both the physical card and the four digit PIN to get cash out of the ATM. Authentication methods that use more than one factor are more difficult to compromise than single-factor methods.

In the weaker sense, multi-factor authentication is sometimes interpreted as asking for two things you know – a password and a PIN. This is better protection than just asking for a single password but considerably weaker than proper multi-factor authentication. If a hacker knows enough to compromise your password, they are also likely to be able to compromise your PIN. Still, internet sites which require both a password and PIN have added "friction" to the process. They force the hacker to do more work and make it more likely that the hacker will go somewhere else instead.

Keystroke Logger - defined

Keystroke loggers are small tools which covertly capture the user's keystrokes on his/her computer. They record every click the user makes including typos, backspacing and retyping. Some loggers will also capture the user's mouse movements and clicks and may even take snapshots of the contents of the user's computer screen.

Keystroke loggers were first developed by researchers to see how users interact with new software and to identify sources of error. More commonly, keystroke loggers are used by hackers as a means to obtain passwords or encryption keys and to bypass the user's security. Because the keystroke logger captures the information at the point of keyboard clicking, it can capture information which would normally be hidden from display.

Keystroke loggers are widely available on the internet.

Hardware keyloggers come in two types – visible (a device that attaches to the keyboard cable) and invisible (installed by opening up the keyboard case and soldering the logger into the circuits). A hardware logger will store the information until the person who installed it comes back to collect and download the data.

A software logger can be installed on your machine by a virus, worm or trojan horse. Software loggers will typically attempt to send the data back to the hacker through the internet. Because they are so easy to spread to a victim's computer, software loggers are now more common.

• Always keep your antivirus program and firewall turned on and up-to-date. Run anti-spyware software regularly.
• When using public computers (such as the library or a cyber-café), avoid visiting sites that require you to enter login details.
• Use common sense.

Adapted from: wikipedia.org

Notification - Security Breach

This article was originally published in the Jul/Aug 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

State Laws Require Notification of Security Breach

States are aggressively requiring companies to tell consumers if there is a security breach affecting the consumers' personal information. As of May 8, 2006, 28 states have enacted laws and another 17 have legislation pending. There are also several competing federal bills that require breach disclosure. You need to know how to keep your agency compliant with these new laws.

The Security Breach laws require notification anytime there is reasonable belief that a person's private information is at risk of identity theft or fraud. Most of these laws are very similar to each other, though there are some state-to-state differences. Contact your local legal counsel for specifics.

What is a "security breach?"
The laws generally define a "security breach" as the unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information. In most states, laws do not apply to employees or agents using personal information in good faith for a business purpose, as long as the information is not later used for an unlawful purpose or subject to unauthorized disclosure.

What is included in personal information?
Personal information includes an individual's name (first name or initial plus last name) in combination with at least one of the following:

• Social security number
• Driver's license number or state identification number
• Account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account
  Note: In general, if the data elements are encrypted, or otherwise made unreadable, that would not constitute a breach.

What to do if your agency has a breach
Notify the people who may be affected as soon as possible. Some states, such as Ohio, require notification no later than 45 days after you discover or find out about the breach. Some specific exceptions to the 45 day requirement apply, such as a request by law enforcement.

You can provide notification in writing or by other means as specifically allowed in the law. The notification must include a description of the information which was potentially compromised and an explanation of the consumer's rights. Most states also require you to provide a toll-free contact number for consumers to call for more details.

Working with Westfield

When you own and process all customer information yourself, this law is fairly straightforward. If you share information with a business partner or vendor, the responsibilities are more complicated. This has led to some misunderstandings. At least one news bulletin claimed that agents have no obligations under this law if the information systems of an insurance carrier are breached. In fact, the law requires that the company processing the data notify the company which "owns or licenses" the consumer information and that the "owning" company must notify the consumer. According to the Westfield Agency Agreement, the Independent Agency owns the relationship with the consumer and the consumer's information.

This approach to notification is a result of lessons learned in the CardSystems breach. (CardSystems was a credit card processor for MasterCard, Visa, etc.) When CardSystems attempted to notify consumers, many threw the notice away unopened because they did not recognize the company and assumed it to be junk mail. Many legislators concluded that the notice must come from the company with which the consumer has the relationship in order to be effective.

If your agency has a breach, Westfield will work with you to determine who should notify the customer - the company or your agency. Often, it may make more sense for Westfield to notify the customer, and we will work with your agency to find the solution that is in the best interests of the customer if this situation arises. Westfield stands ready to assist in the notification to any Westfield consumers in the event of a breach either to Westfield's systems or to your agency's systems.

Westfield has also taken aggressive steps to safeguard all customer data. These days, an ounce of prevention is worth far more than a pound of cure.

Viruses, Worms & Trojan Horses - defined

A virus is a piece of software code that, like a biological virus, makes copies of itself and spreads by attaching itself to a host, often damaging the host in the process. The host is your computer’s operating system. The virus then infects files that are transferred to other computers. Viruses use the host's resources (memory and hard disk space) and are sometimes deliberately destructive (erasing files or formatting hard disks). Many of the more sophisticated viruses do minimal direct harm but are designed specifically to allow others to access your machine without authorization.

While viruses are often malicious, some are fairly benign or merely annoying (for example, playing a message on a specific holiday or day of the month. Their uncontrolled self-reproduction wastes or overwhelms computer resources. "Good" viruses sometimes appear that are intended to spread improvements or to delete other viruses. Unfortunately, "good" viruses are quite rare, still consume system resources and may accidentally damage the systems they infect.

"Virus" is often used to describe all kinds of malware (malicious software), including those that are more properly classified as worms or trojans. Most popular anti-viral software packages defend against all of these types of attack.

• A virus must attach itself to another program to function.
• A worm is a self-contained program.
• A trojan is also a self-contained program, but unlike a worm which can send itself to other computers, a trojan must be loaded by an unsuspecting victim - usually by masquerading as an innocent download file or email attachment with a name like README.txt.exe.

Westfield Group protects our office computers by installing current anti-virus software on all computers, establishing firewalls at the computer access points and filtering all e-mails for malicious content. To help protect your system from viruses, worms and trojans:

• Never load a disk or file to your computer unless you know and trust the source.
• Never disable the anti-virus software even temporarily.
• Do not post your company e-mail address on a website or chat board. (Hackers frequently troll through those sites looking for target accounts.)
• Install anti-virus and firewall software on your computer and keep it current.

Identity Theft

Identity theft is the deliberate assumption of another person's identity, usually to gain access to their credit. Identity theft is the fastest-growing crime in North America and is estimated at over $5 billion per year in the US alone. To protect yourself from identity theft:

• Limit your credit card use. Keep your account information in a safe place that lets you immediately cancel all your credit cards if your wallet is lost or stolen.
• Check your accounts each week online. You can catch unusual activity more quickly than if you wait for monthly statements.
• Shred credit-card receipts, pre-screened credit-card offers and other such documents because they contain private information.
• Mail letters from the post office. Install a lock on your home mailbox.
• Don't order checks preprinted with your driver's license or SSN number. If you can keep your address off the checks, do so.
• Don't carry your social security card. Don't give out the number unless it is absolutely necessary or legally required (employers, landlords etc.). If you have your SSN on your drivers license, be equally careful about who sees your license.
• Don't give out personal information to telemarketers who initiated the call to you. Get a phone number to call marketers back if it is an offer you'd like to pursue. Get a company name and web URL and check them out with the Better Business Bureau.
• Never speak to anyone claiming to be from a collection agency about anything regarding a third party - and make clear to others that you expect the same protection.
• When shopping online, make sure the company is reputable and displays an approved security symbol. Also, make sure you log out of the site when finished.
• Request your own credit report each year and check the reports for inaccuracies. If you've been the target of identity fraud, check the data every six months.
• If you believe that you have been a victim of identity fraud, keep copies of police reports and records of who you talked to and when, so that you can back up the claim of fraud with skeptical lenders.

adapted from www.wikipedia.org/Identity_theft