Information Security Tips from Westfield Insurance

Unsecured Wi-Fi Hotspots

If you are one of the many Americans who use an unsecured Wi-Fi network at home, then this blog is for you.  You know who you are.  At this very moment you are shifting uncomfortably in your seat thinking … how bad is it really?

And for all those readers who are disdainfully thinking that only a three-legged alien from Mars would be crazy enough to use an unsecured Wi-Fi network at home, let me ask you this … how many of us have been enticed to frequent certain establishments because they advertise ‘free Wi-Fi’?  You know how it is. You’ve just dropped your child off at piano lessons, and with 45 minutes to kill you decide to visit your favorite café to curl up with a cup of java and use the ‘free Wi-Fi’ to update your Facebook page.  All the while thinking you're safe as long as you don’t do any online banking on this Wi-Fi network.

Unfortunately, any semblance of "safe surfing" from any type unsecured Wi-Fi network is about to be debunked.  

In a June 22, 2011 article published by SecurityWeek.com, titled “How Logging On From Starbucks Can Compromise Your Corporate Security”, author Ram Mohan describes three methods that hackers use to maliciously gather data from web enabled devices.  While Ram focuses on the potential theft of corporate data, you can easily apply his message to understand all the ways in which your personal data may also be vulnerable to attacks when using an unsecured Wi-Fi network.

Safe Surfing Tips

In response, we’ve provided a few quick "safe surfing" tips:

• First and foremost, whenever possible, use only SECURE Wi-Fi networks.  Always feel free to ask the establishment or hotspot owner if their Wi-Fi network is secure.  If your device shows several Wi-Fi network names, ask the proprietor which one belongs to their establishment.  Never use an unsecured Wi-Fi network when you don’t know who the owner is – this is a very common way for hackers to pick-up victims’ traffic!  
• If your device is configured to auto-connect to Wi-Fi, consider enabling the notification feature in your Wi-Fi network settings.  Once this is done, your device will prompt you prior to connecting to an unsecured/open Wi-Fi hotspot.  This will keep you in control of which of the available networks your device is connecting to.  You may also prohibit your device from automatically connecting to Wi-Fi hotspots.  See your device’s user manual under Wi-Fi settings for instructions.  Many user manuals may be found online.  
• Whenever possible use the secure/encrypted version of whatever site you are surfing.  When you see ‘https’ in the web address, the ‘s’ actually signifies ‘secure’.  For sites where you already have accounts such as Gmail or Facebook, you can find out how to connect to the secure/encrypted version typically by reviewing the website’s privacy or security settings once you are logged in.  These settings are usually found via a link on the front page of the site.  Sometimes you have to poke around a bit.  Not all sites have this option.  Don’t forget to save your new settings!
• Whenever banking, ALWAYS verify that the web address begins with https and make sure your browser does not warn you that there is anything unusual about the certificate in use!  If you see a warning or the login page is not https, call your bank immediately. 
• Always explicitly ‘log out’ or ‘sign out’ from your favorite websites and wait for the page confirming that you are logged out to load.  Simply clicking the “X” to close your Facebook page is not enough especially when using a public system as in a library or Internet café.  (Internet cafés are very popular abroad). 
• Be wary of downloads!  Do not blindly download files or software from the Internet, as they may infect your computer with a variety of malware.  When in doubt, contact the website from which you want to download – and ask whether or not the download is secure. 
• If something seems too good to be true – it probably is.  Be wary of all pop ups; and especially wary of ones that say “you’ve just won a grand prize” or “click here to retrieve your free gift”.  Pop ups, like downloads, can carry malware to your computer!  Make sure your browser has a pop-up blocker – and USE IT! 

What questions do you have about unsecured Wi-Fi networks?  Post your questions in the comments and we'll post an answer!

- Heather Smee

Work Out the Bugs in Your Information Security

A free eBook on Information Security from the Westfield Insurance InfoSec Blog Team

In today’s global economy, the sharing of information has become essential to business transactions. From providing information through online billing, or managing multiple passwords for various platforms and operating systems, the world of business has become more sophisticated than ever before.  

Just in the last decade, organizations have seen a dramatic conversion to digital information storage. Regardless of how your company stores customer or employee information, rules of privacy and security apply. 

With increasing effectiveness, hackers are able to acquire sensitive information from your office, computers, servers, mobile devices and the like. That’s why it’s vital that your business implement basic security measures to help protect sensitive information trusted to your company and its employees. 
Whether it’s the personal information of your employees or sensitive client information, your business needs to proactively take steps to eliminate unnecessary security exposures. 

Introducing the Westfield Insurance eBook: Work Out the Bugs in Your Information Security. 

Why an Information Security eBook? 

In 2004, Westfield Insurance started publishing internal tips and reminders about computer and personal security to help serve as a reminder to employees about company-specific policies, as well as the importance of protecting their personal information. 

After seeing the success of this approach, we expanded the distribution to include our network of independent agents and colleagues. In 2008, we officially launched the InfoSec blog, authored by members of our IT-Risk, Security and Compliance team.

Since that time, the blog has offered our readers tips on how to best protect private information from risks such as password and system hacking, spamming, tailgating and more. 

Download our free eBook

We’d love to hear your feedback. Please comment below! 

Do You Know the Security of Your Smartphone? (Part 3 of 3)

This is the final post in a three-part series on smartphones and information security. The series has covered overall security of the BlackBerry, Apple and Android mobile operating systems.

Continuing from our earlier posts on the advantages and challenges of the Blackberry and Apple iOS, we are concluding with Google’s Android operating system (OS).

Android is a Linux-based open-source platform whose unified progress is sponsored by Google. Android Inc. developed Android OS circa 2004 and was purchased by Google in 2005.  The OS caught on like wild fire and is used by literally dozens of companies who are creating tablets, phones and myriad other form factors around it.  Despite competition from Apple and Blackberry, 2010 was a huge year for Google. With more than 250,000 apps available on the Android Market, the platform saw an 861 percent increase in app sales.

Additionally, customer intelligence firm Market Force Information recently released findings from a survey on smartphones, which indicated Android’s current appeal over its competition. According to a Feb. 22, 2011 Market Force press release, “When asked which smartphone they would purchase, 34% of survey respondents said Android, while only 21% said iPhone, and 12% said Blackberry.”

 

Android OS Security Concepts

A major aspect of the Android security model resdies in the interface of the platform’s OS application layers and is implemented by running each application in its own efficient Dalvik virtual machine.

From the end user's perspective the effect is quite similar to sandboxing in Apple’s iOS.  Each application’s default view of the device is that it has the entire device to itself, i.e., unless it is explicitly permitted to see other apps, its default view is that it is the only application on the device.

How this works is that when a developer is coding and packaging an application, they must declare what device resources, e.g. GPS, Bluetooth, W-Fi, etc. the application needs to use. This is necessary to build the application but that information is then also used when the end-user installs the app!  This user notification takes the form of an install-time dialog that indicates the list of resources needed on the device to run that application.  So, depending on what resources are listed, the user can either accept, or refuse, installation. For example, if you can’t figure out why the first person shooter game “I Spy On U” wants access to the GPS information on the phone, then you could simply terminate the installation. 

 

Android vs iPhone – Swiss Army Knife vs Sabatier Fine Cutlery

The Android environment is much less centrally controlled than Apple’s iOS.  For example, users can skip the Android Market altogether, and download an application directly from a developer’s web site.  Of course, you do so at your own risk.  The developer might have bad intentions or, if the developer’s download server has been compromised, and his downloads tampered with, you may be getting “more than you bargained for”.  Many Android fans suggest that the healthy skepticism that the Android openness encourages is the only sane default attitude and that Apple users dangerously naïve to believe that “because it came from iTunes App Store it must be safe and well-behaved.”

Incidentally to take complete and utter control of your Android device from the carrier you will need to “root” the phone.  “Rooting” is the equivalent of  jailbreaking an Apple iOS device, which, as described in the iOS edition of this blog, pretty much lets the end user do anything the hardware is capable of. 

 

Android Virtual Phones

Improving upon the user and developer experience with Android, virtualization software company VMware has created a new offering that changes the platform interface, called Mobile Virtualization Platform (MVP).

MVP is similar to the Dalvik VMs of Android; however, whereas the virtual machine presented by Dalvik is an idealized JVM-like set of resources, the VMware VM is more like a thin layer of virtualized hardware implemented as a so-called hypervisor.  This allows a carrier or end-user to install multiple virtual phones!  E.g., on a phone model sold by multiple carriers or by one carrier with multiple versions – like an HP phone that runs either WebOS or Win 7 Mobile – if there was a version of the MVP hypervisor for HP mobile phone hardware, one could run both a Win 7 Mobile and a WebOS phone instance on the same hardware at the same time and “flip” between them.  The Win 7 and WebOS phones don’t even “know” the other personality is resident on the same hardware.  This example is hypothetical but intriguing.

These “guest virtual phones”, running atop the MVP hypervisor, look and act like full-fledged phones!  Besides being interesting technology, VMware’s mainstream concept is that a device owner can have one phone with multiple “personalities” – like a work phone and a personal phone but on a single handset.  With this ability, a corporate IT department could manage the “work phone,” while the owner could have complete control over the personal side.  The MVP platform is mature to the point of being released for some of the most popular phone hardware and it only remains for the phone manufacturers and carriers to embrace it.

 

What has your experience been?

Have you experienced any issues with your Android device?  Have you felt the need to “root” the device? If so, what drove you there; curiosity, annoying carrier apps which you couldn’t delete?  How many apps have you installed?  Did you get them straight from the developer’s site or the Android Market?  Have you ever refused application installation because of the resource the app was asking to use?  We’d like you to share your thoughts and questions with us.

Check out the other posts in this series, and stay tuned for more posts on information security with the leading smartphone operating systems:

• BlackBerry
• Apple iOS

----------------------------

John Brady is an Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust.

 

IMAGE SOURCE: http://www.flickr.com/photos/osde-info/4623612094/

 

Do You Know the Security of Your Smartphone? (Part 2 of 3)

This is the second post in a three-part series on smartphones and information security. The series will discuss overall security of the BlackBerry, Apple and Android mobile operating systems.

Continuing from our previous post on the advantages and challenges of the BlackBerry operating system, we now move on to Apple mobile operating system (iPhone, iPad, iPod Touch), known as iOS.

As mentioned previously, the iPhone has been making waves in the industry concerning its recent introduction to the Verizon Wireless network. Regardless of the initial customer turnout for Verizon’s in-store release, the iPhone is still considered one of the most highly respected and coveted smartphones in the market.

 

Exclusivity of the iPhone iOS

The iPhone, iPod Touch and iPad now run iOS 4.2.  Apple has not only changed its major version, but also changed its name — from iPhone OS to iOS — in recognition of the fact that voice phone functions are a shrinking fraction of their mobile devices’ functionality.

So, what's the main differentiator between early smartphones and iPhone?  I believe the essential “newness” was that Apple inserted the iPhone into its maturing iPod/iTunes content ecosystem and added the App Store.  This closed environment gives users a unified device experience within Apple’s “walled garden.”  Apple prides itself on having created a trusted, friendly device that, conveniently for Apple, only downloads music, videos, podcasts and apps from the iTunes App Store.

While most iPhone owners find this state of affairs comforting, some find it frustrating. The ultimate form of challenging the control of Apple and their carrier at the device level is a process known as “jailbreaking”. Jailbreaking removes the controls, limitations and safeguards put in place by Apple, thus enabling the device to access and run applications, extensions and themes available outside of Apple’s App Store.  However, the added freedom comes with a tradeoff because the App Store is part of the Apple “cocoon of security.”  While Apple makes no guarantees (in their end user agreement) that apps will not misbehave, they do take more effort than any other vendors to assure that an application does what it says it does and only that.  They also restrict content they deem explicit.

 

iOS Security Benefits and Weaknesses

In addition to scrutinized applications, Apple’s iOS uses a “sandboxed application” philosophy. A sandbox is a default installation state of no access to OS level objects, such as persistent storage or executable.  The sandboxed app can, of course, access its own data and network resources freely, but can’t reach into the phone’s OS or even “talk to” other applications except in very controlled ways. This makes it harder to write applications that cooperate via drag and drop, etc., but improves security significantly. It makes it harder for applications to spy on and export each other’s data, and more straightforward when uninstalling an application and cleaning up its associated data.  If an employer controls the apps and deletes the CRM app, the CRM’s database of company confidential customer information is deleted with it.

Of course, retaining our healthy skepticism, iOS is just a device operating system and like all large complex software systems is not exempt from bugs and security issues:

• Erik Sherman’s post, “Want to Protect Your Emails? Don’t use these 11 Android and iPhone Email Apps” cites, in particular, issues with Microsoft’s Windows Live Messenger on the iPhone.

• Just this month (Feb. 2011) the Frauenhofer Institute SIT, exploited an iOS stored password/encryption vulnerability. Via the aforementioned jailbreaking process, the SIT research team was able to crack into stored iOS password vault, called the Keychain, in as little as six minutes.  In addition to the hardware encryption key for that device's storage, where application data would be stored, the Keychain contains user account/password pairs for such things as websites, email accounts, wi-fi hotspots, etc.  Optimistically, since Apple controls the ecosystem from the hardware up, they can rework the affected encryption architecture and system libraries to use the hardware in a different way to restore security to the iOS devices out there.  This should be an advantage of a monolithic device provider.

Apple continues to make iOS more enterprise friendly with hooks to email and other corporate services considered critical.  For example, companies can control whether the device locks its screen after an idle  interval and requires a password to get in.  Or, after say, ten failed attempts to get into the device, it wipes itself (data and applications or just the corporate controlled data and applications).  It can now be remotely wiped on demand by a command sent from a company IT security department.

 

What has your experience been?

Do you love the security of Apple’s walled garden or is it driving you nuts?  Are you excited or worried about switching from your current smartphone to an iPhone?  We’d like you to share your thoughts and questions with us.

Check out the first post in this series, and stay tuned for additional posts on information security with the leading smartphone operating systems:

• BlackBerry
• Google Android

----------------------------

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust.

 

Cyber Monday: How to Manage Online Store Passwords

Have you ever been sitting in front of your computer, getting ready to purchase a gift for someone and just as you click on the checkout button you see the dreaded "Create a new account" option staring back at you?  To me this means yet another password and user ID that I'll need to somehow remember but keep secure at the same time.  To make matters worse, I need to figure out some way to allow my wife access to the account as well, without leaving the password lying around for any and all to pick up and use.

My idea:  Create a password list!

Here's my example:

Create a simple word or text document on your computer, choose a name for the document that would normally not be interesting to someone who was searching for a password like, FinalEssayOntheMigrationofBirds.doc or VehicleRepairTips.txt.

Next, fill it in so it looks something like this!

OnlineStore1 User3251 Y78
SuperBank 2729303  8n!
OnlineStore2 HappyMe123 Ii4

Your first row is the purpose or website for the account, if you feel really daring you can even create a link from this name to the website where you use it.  The second row is your user account or ID for that website.  And the last is a set of numbers, letters, or symbols you would either append to the end of your "known" password or place in front of your "known" password.

A "known" password is a simple word that is easy to remember for you and anyone you share the list with, for example November or Snowstorm might be common shared passwords.  You'll never write or type this one anywhere; it should only be known by the people who share it.

For example, let's take the information I entered above, OnlineStore1 User3251 Y78.  If I was going to login to OnlineStore1, and I used the account User3251, my password would be NovemberY78.

Hope this helps keep some passwords secure this shopping season!

Jacob Harris is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

Securing Mobile: When a Phone is as Powerful as a Laptop

There seems to be a disconnect between want and need with respect to smartphones and information protection.  Securing mobile is a “downer” along at least two main axes of mobile phone interaction: convenience and cost.

If your phone is as powerful as your laptop; meaning the operating system, the peripherals and the applications on your phone are as – or are more - sophisticated than those of your laptop then shouldn’t the security measures that protect the contents be similar?  The real question here is, if you’re using your phone to process the same information as your laptop, then we have to ask – how can one justify not securing it to the same degree as your laptop?

My opinion is that the only logical answer is yes.  For an increasing number of functions, phones are replacing laptops.  I believe that there are ways to secure mobile phones to the same standard as laptops while minimizing the inevitable inconveniences and extra cost. The solutions require thoughtful re-evaluation and sensible compromise.  Rather than slapping the old products from the laptop onto the smartphone, we should look at it as a qualitatively different platform. 

Drawbacks to Treating a Smartphone like a “Small Laptop”

Here’s an example of when it may be typical to treat a smartphone as a “small laptop”.

Many companies now use URL filtering perimeter systems, such as WebSense, to prevent employees from accidentally going to infected websites.  When an employee uses their laptop outside the company network, you may tell them they must “VPN into” the network before using the web. (This way, once the VPN tunnel is established, their browsing goes through the URL filter.)

It is possible to treat the smartphone like a laptop in this scenario, because there are VPN clients that work as well as the laptop version.  Employees could be told to “VPN into” the corporate network before web surfing on their smartphone. 

However, there are drawbacks: a) VPN clients take a fair amount of computational horsepower to run, and b) from a network architecture and management standpoint, why tunnel all that traffic from every mobile browser into the corporate core in order to turn around and go back out to the Internet? 

Rather than treating the smartphone like a laptop, the solution may be to change how your URL filter works.  So perhaps, instead of bringing the traffic to the filter, bring the filter to the traffic!  Put the URL filter on the Internet, and everyone’s computer (smartphone or laptop) can get to it from everywhere.  Companies such as WebSense and zScaler advocates and vendors of such solutions.

Speaking of changing the place where the processing happens – how about using another ancient solution?  How about moving where the applications run and so, where the information is processed?  I am speaking here of just using the phone as a window into the corporate computing environment.  This is déjà vu all over again, the fat client/thin client debate of the 1990s – the Unix X Window system and Citrix ICA.  The fact is that this class of “collapsed data center” solution, which once suffered complaints about bandwidth and server capacity issues has become increasingly viable not increasingly outdated.  Since the days of the mainframe terminal sessions, the thin client paradigm was always attractive from cost, administrative and data security perspectives.  Now the protocols for computing in the data center core and transmitting just the display have become more efficient and bandwidth has come down in price. Similarly, multi-core servers with dozens of gigabytes of RAM are the rule not the exception.  This makes it very attractive indeed to just load the thin client app onto the smartphone and have it connect securely to the core to process corporate information which is also on the core.  If the organization wants people to be able to drag and drop files or query results from the core within apps that run on the endpoint – then the endpoint needs heavy securing as described above.  But if the thin client is set up so that information cannot be transferred from the core to the endpoint then one has a lot less to worry about in terms of “information leakage.”  The “drag and drop” tradeoff being that the information the employee wants to transmit to their smartphone is not directly usable by other apps on their smartphone that make them more productive (e.g., transferring an address to the smartphones contact management system or its GPS app).

So where does this leave us?  I think, for now, the choice is between:

a.    Smartphones with powerful processors and awe-inspiring local apps and local corporate data loaded down with classical malware protections like encrypted file systems, anti-virus, URL filtering, anti-spam, personal firewalling (local or in the cloud)

b.    Collapsed data center where the employees log into a virtual desktop running on a big server and all the employee ever has on their smartphone is a thin interface to corporate data on a far-away desktop

The convenience trade-off is clear – I would much prefer to be able to download a spreadsheet to the app on my phone and then hop on a plane and “play with the numbers” versus having to be on the network and constrained by my company's standard spreadsheet program.  

Cost wise, the price of buying and administering standalone smartphones with high performance client software on them is much higher risk and less cost-effective than standing up a big server with desktop OS licenses, a few licenses for each app and issuing a thin client for each employee’s corporate or privately owned smartphone, laptop or desktop.

Is there is a happy medium?  What do you think?

Next time we’ll discuss modifications to these paradigms that may remove some of the downsides to both, namely, data centers in the cloud and always connected mobile  networking.

----------------------------

Some links to others thinking about the same topics:

http://www.isaca.org/About-ISACA/Press-room/News-Releases/2010/Pages/Mobile-Devices-May-Pose-Greatest-Threat-to-Confidential-Information-New-ISACA-White-Paper.aspx

http://isc.sans.edu/diary.html?storyid=9787

----------------------------

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust

More Facebook Privacy Problems?

It seems like Facebook can’t keep itself out of the news when it comes to information security and personal privacy problems.  I just read another article in the wall street journal http://online.wsj.com/article/SB10001424052702304772804575558484075236968.html which talks to some additional misuse of Facebook member’s information.

It seems that a number of companies are anonymously mining members profile information, creating databases and selling profiles for targeted advertising even when users have set their privacy settings to strict.  At least 25 databases and advertising firms may be involved.

Many of the most popular applications are also transferring information about their users to outside companies.  Three of the top ten actually transmit information about their user’s friends as well to companies, according to the article.

Facebook does have a “policy” that application developers must not share personal information with advertising companies but with over a half a million applications, some appear to be breaking that policy.  Facebook claims to have disabled thousands of applications that have violated its policies.

Social networking has become an important piece of many people’s lives.  I actually know people who seem to live on Facebook 24x7.  Please have fun with it but remember that ANY information you put into a third party’s hands, even if they have great intentions and tell you that they will keep it safe, is completely out of your control and will be used by someone to make a profit if they can.

Wow, with an outlook like this, its no wonder why no one wants to be my Facebook friend!

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust.

An Information Security Plan for Agencies

As the message regarding the need and importance of protecting customer information continues to grow by leaps and bounds, so to do the expectations of compliance and enforcement.  This fact is called out in numerous federal and state laws, best practices, and even contractual obligations.

To their credit, this has not gone unnoticed by independent insurance agencies.  I am frequently asked by agents, "How do I go about developing an Information Security Plan to help keep customer information secure and private?"

Thanks to the Agents Council for Technology (ACT), ask and you shall receive.

The Independent Insurance Agents & Brokers of America (IIABA) website reports that ACT has developed and released a free prototype agency information security plan.

According to Jeff Yates, ACT Executive Director, "Recent headlines have underscored the importance of agents having written security plans ... ACT has developed a free prototype security plan to assist agents and brokers in formulating and implementing specific procedures, training and monitoring to protect the security of their operations and the privacy of their client information."

Having reviewed the protoype information security plan, it is a solid first step.  I strongly encourage agents and brokers to take adavantage of this excellent resource.

The ACT Prototype Agency Information Security Plan & Companion Article can be found HERE.

Robert Salandre manages Information Security Policy and Awareness at Westfield Insurance.   Sharing Knowledge. Building Trust.

Sir, May I See Your Drivers License

I was reading some of the ever increasing material relating to identity theft and ran across an article that I wanted to share.  Apparently there has been a sharp increase of fraudulent identification being given to police and state troopers when they are pulling people over in traffic stops and at driver’s license examination stations.

http://www.daytondailynews.com/news/ohio-news/ohio-highway-patrol-id-theft-increase-alarming-858936.html

Imagine getting a speeding ticket in the mail or having your auto insurance go up because someone falsely used your information when they were pulled over or committed a crime.

I wonder if the police will ever consider making drivers licenses into a multi-factor credential similar to how ATM cards work.  With ATM cards, you have to have the card and know a PIN number in order to use it.  That way when you presented your drivers license you would have to tell the policeman something that he could check to ensure that you were really you.  I am sure that this approach could be easily bypassed as well. 

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust

What emergency number do you call, when you've been a victim of identify theft?

Recently we received several phone calls at home, asking for a person who we didn't know.  After several calls I asked them to stop calling and found out, I was talking to a collections agent.  Someone had given out our telephone number as the primary number on their account.  So this led me down the path of checking out our credit reports at annualcreditreport.com, and validating all of our accounts, I got lucky, everything was fine, but it led me to wonder, what would I do if our identity had been stolen?

I then remembered, my insurance policy included identity theft coverage.  This led me to the website, where I came across a very interesting article about protecting my child's identity from thieves.  The article recommended 7 steps to protecting your child's future

1. Don't give out your child's Social Security number online or on the phone unless you already trust the recipient.
2. Never carry your child’s Social Security card or number in a purse or wallet. Leave it at home in a secure place or in a safety deposit box.
3. Teach your child that people asking for personal information such as a SSN and mother’s maiden name could be trying to defraud them.
4. Thieves love recycling cross-shred documents holding personal identifying information.
5. Watch out for warning signs, such as credit cards arriving in the child’s name or calls from creditors regarding current and past-due debts.
6. Check your child’s credit report if you suspect identity theft. For children above the age of 13, go to annualcreditreport.com, the government-mandated source for free credit reports. For children under 13, parents and guardians must request credit reports by mail. (For more information, go to www.annualcreditreport.com.)
7. The absence of an existing credit report usually means that no one is misusing your child’s information, which is good. If one exists, be sure to check for problems.

As I continued reading, I found several additional helpful articles, including tips to reduce the risk of identity theft, and answers to many of my questions.

Jacob Harris is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

The Problem with Honest People

The problem with honest people is that they don’t think too seriously about how the things that they do or information that they share could be misused or be used against them.

It’s not the nature of good people to think like bad people.  I can hear people saying: “No one cares about my information.  I don’t have anything that people would want to steal.  Bad things happen to other people, not me.  I am just one person in a million; there are better targets out there.  etc…”   It’s not until something actually happens to them, or someone that they know, that they realize the truth.

Please! Please! Please! All you honest and good people living in modern world, think a little bit more about it!  What could a malicious person do with your information if they wanted to?  Even the simple messages you post on Facebook or Twitter.  Malicious people do exist.  I see it regularly in my career as an Information Security professional.  Only in hindsight does the light bulb go off for the victim.  Also, the victim might not be the person who’s information is misueed, many times one person’s information is misused to victimize another who trusts them.  Social networking sites are a ripe field for this kind of information to be harvested.

Here are some tips I ran across that talk about basic security precautions on social networking sites.  These are just some common sense things that can help reduce the probability and impact of information misuse: http://www.bankinnovation.net/profiles/blogs/10-ways-to-prevent-social-1

Even if you don’t think that YOUR information will be stolen or misused, don’t give anyone the opportunity to prove you wrong.  Keep being honest but be "Information Misuse" aware!

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust

A Key to Decreasing ID Theft Exposure

No one wants to have their identifying particulars stolen and abused.   To help, there is the security concept of using one secret (a key) to unlock keys to other services.   The concept is simple, here is a real world analogy – in a car dealership, the service area has a bunch of keys to inventory and customer vehicles.  That collection of keys is kept in a locked wall-mounted cabinet.  Upper management are the only people with the keys to the “key locker.”

On your personal computer, there’s another commonly used example, in most browsers you can set your security preferences so that the username and password fields at different web sites are automatically supplied.  They are stored in a browser-managed repository which is the equivalent of the “key locker” described above.  Using this auto-fill feature alone is a net decrease in your security because, once turned on, anyone that can walk up to your computer, start up the browser and instantly be logged into your various web site accounts without having to know any credentials.  But there is simple way to mitigate this risk.  For example, in say FireFox, IE 8 or Opera you can also set a “Master Password” that is used to keep people other than yourself from getting at those passwords.  This master password is the equivalent of the key to the key locker in our physical world example.   This gives you the best of both worlds because now you only have to remember a single password which, in turn, allows you to set the underlying stored passwords to very hard to guess, long, complicated nonsense strings because you are planning to never have to remember/type them!

Another example of this security concept is in the world of payment card (credit, debit, etc.) clearing house services like PayPal, Google Checkout, PaySafeCard.  These are services that you give various credentials to and they provide clearing house service to merchant sites that have signed up to use their services for payments.  Here’s how it works:

First you sign up for the payment service of your choice, let’s say PayPal:

• you create an account at the payment service using a unique string such as your email address
• you fill out the payment service’s profile by providing contact information and credit card, debit card or checking account information
• depending on the service, you may need to verify that a tiny transaction against the card or account in question goes through

That’s it!  Now, you can use any online vendor that supports that payment service (look for, say, the PayPal logo, although it may not be displayed until you go to checkout):

• go to a merchant site such as Walmart and put some stuff in your virtual shopping cart
•   proceed to check out and notice that there is a PayPal option, choose it
• Walmart’s website sends you to PayPal, giving PayPal the bill you need to OK payment of (vendor and dollar amount)
• you confirm your PayPal password and then tell PayPal which of your accounts to debit
• when you hit “confirm payment”, PayPal debits your card/account on behalf of Walmart and then transfers the funds (not the payment information!) from your account to Walmart
• PayPal also sends you email confirmation and tells you what merchant name to expect to see on your credit card statement
• PayPal sends your browser back to the merchant site where your payment is confirmed in the form of a receipt (and usually another email) and information about order shipment

So, behind the scenes, the payment service deposits the payment (minus their transaction fee) into the merchant’s account without ever sharing your payment information with anyone!

Why bother with that?  In the case of Walmart.com, there is probably little reason for concern but in the case of a small company, say Tom’s LiveBait-by-Mail, you might be a bit leery of giving away your credit card information.  Also, if you signed up multiple credit/debit cards and one or more bank accounts then you can choose which to charge the payment against at checkout time.  So, as long as the payment service is super-secure, it’s a net win because the fewer places that get their hands on your card info the better.

Is there a downside to using these services?  Well, I suppose these particular processors are in a position to know a lot about your cross vendor buying habits and history.  Plus, of course, they are an inviting target for hackers because they store so much account information (although they are extremely aware of and well staffed to store and police said information).

So – keep this “key to the keys” idea in mind when you need to minimize complexity and exposure.

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust

Parental Controls Online - 6 Questions to Ask Your Family

8S22SRE498JM

Have you ever noticed how your child's favorite TV shows are directing them to the Internet to watch extra episodes and access special content like games and other shows? My daughter is just now starting to show interest in our family laptop, finding it wherever we might be hiding it. We keep putting off establishing parental controls, but it's only a matter of time before she figures out how to make the laptop work.  As a family we will be nervous with not only the content she will be introduced to, but the wide variety of identity theftand other serious dangers that lurk within. Struggling with allowing her to learn while keeping her safe is a big challenge, one every parent is going to encounter.

This led me on a path of research, searching the web for keywords like "family safe internet software" and "parental controls for the internet."  I saw quite a few sites selling software solutions like NetNanny, BSecure, and free tools like K9webprotection. There were others which carried with them some recommendations like FocusontheFamily and ConsumerSearch, which suggest pre-reviewed products to use.

Looking at all of the options, I can understand how it would be difficult to choose the best product for your family. Here are a few questions to help identify your family’s need for a tool like this:

1) Who in your family needs protecting? Yourself? Children? Adults who are wary of the Internet? Guests?
2) What devices do you need to protect? Smart phones? Laptops/Desktops? Wii?
3) What applications does your family use? Internet browsers? Instant messaging? Social networking sites like Facebook or Myspace?
4) What operating systems and versions do you have? Mac? Windows? Linux?
5) What are you willing to spend to keep your family safe from these dangers?
6) What kind of monitoring do you want to have access to? Web surfing logs? Online game play? Instant messaging usage?

Let me know your thoughts on this topic! Please chime in and let us know what you do to keep your family safe.

Jacob Harris is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

At the Nexus of Social Networking and Business

In a recent blog post I suggested that, while social networking (e.g., facebook, myspace, twitter, orkut, LinkedIn, etc.) is here to stay, one needs to be somewhat circumspect in using them.  I focused mostly on “apps” within these social networking communities.   These apps often want access to your personal information or want you to install or run some program at their behest.

As a follow-up, I’d like to discuss some general ways in which you can improve the likelihood that you will not get your personal or business systems hacked while still being able to enjoy the fruits of these dynamic, fast-growing communities.

• Think before you click on anything asking:

- for access to your personal information (on various sites, they may be called “applications”, games, “e-cards”, “gifts” like a virtual cup-of-coffee, virtual bouquet of flowers, a snowball).  Do you trust the requestor?  Do you even know their privacy policy?

- you to install some “missing piece of software” (e.g., a dll, driver, codec) and perhaps offering to forward you to the site where you  can install it now and then proceed with your original task.  Do you know the software provider?

• Review your privacy settings periodically, there are many recommendations  in this regard in the mainstream media (see table at bottom).

• When the social network provider notifies you that their privacy policy has been changed – READ the new privacy policy!  There have been cases where the provider has retroactively instituted new default access rules rendering previously private parts of user profiles open to the public!

• Don’t lend the use of your computer (laptop, desktop) to anyone that might be reckless with it.  If the borrower surfs to an infected web site and your account on the PC becomes infected then they have unwittingly put your personal information at risk.  To mitigate the danger – always create a separate account for other users (either one account per person for regular users, or) a shared guest account for people that just want to use a browser for short time.  When creating such accounts do be sure they are not endowed with any administrative powers.  Delete all the files they leave behind and perform a virus/spyware scan.  Don’t think of it as being distrustful, think of it as good hygiene.

• Taken to its logical extreme, you might seriously consider having a completely separate system for when you are working on your high privacy stuff (employee personal info., online banking, personal/business financials,  tax returns, medical bills/records, …).   This will almost guarantee that your private information stays that way. **

Although it may sound like I need to lighten up, if you read some of the horror stories about people that have  experienced ID theft, you may decide I am not being adamant enough!  Of course, you have to find a happy medium for your circumstances.  Hopefully, the list above will help you make more informed decisions before you click.

--------------------------

Site Policy	Privacy Recommendation
facebook	High level: NY Times Very detailed: AllFacebook
MySpace	For better privacy control, switch from profile 1.0 to profile 2.0.  MySpace recommendation
LinkedIn	Walk-through: Network World LinkedIn recommendation
twitter	Creating a non-public  twitter account

** If you are computer savvy enough to know about virtual machines (VM) – you can get much of the same degree of isolation using a separateVM, instead of a separate piece of physical hardware.

The Overly Eager Bird Catches a Worm

The social network phenomenon has shown many benefits.  These sites, such as facebook (FB), have great potential for people seeking friends to hang out with online.  Businesses too are finding it desirable to create a company presence on FB, myspace, twitter, etc.  Given their explosive growth, however, these sites have also attracted an unsavory element looking to exploit such new fertile ground.

Do you recall, back in the early 2000s, when email phishing was a relatively new phenomenon?  Eventually people became savvy about not following links that arrived in email messages from businesses with which they had no established relationship.  You see, in order to compromise your system, eventually the bad guys have to get you to act on their behalf ... so at some point, they have to present you with some “stuff to click on” ... thereby tricking you into giving your operating system (Windows, MacOS, linux, etc.) the go-ahead to install their evil code.

In a similar vein – have you noticed that when you go to play a game on a social site, say FB, you are presented with a dialog-box saying something like "This application requires access to your FB profile.  Do you wish to grant access?”  This is the FB security layer warning you that this application is trying to access your FB profile.  This is like a stranger asking to look through your wallet and record whatever they feel like while they’re in there browsing.  Alarm bells should be sounding in your head!  Let’s see ... a game that’s all sorts of fun to play and has really nice graphics, and which must have taken some people a lot of time to develop, all apparently, “for free”!  Too good to be true?  Gee whiz -- that's a little like those emails I occasionally get from "banks" promising to consolidate all my debt into a "Zero down, 0% APR loan” ... too good to be true indeed.

So, while most FB applications/games are not bogus fronts for bad guys that want access to your personal information, it is also true that some of those ostensible applications are in fact phony.  So be very careful before deciding to unleash these apps on your private information.

In another example of social networking abuse, there was recently a worm blazing its way through FB accounts called KoobFace ("facebook" spelled sideways, sort of).  KoobFace arrives as a FB message from a FB friend in your FB inbox.  When you open it, you are told to check out a YouTube video.  When you click on the link to the video you are sent to a fake YouTube site.  When you try to start the video playback, you are told that your system is missing an important piece of video playback software called a codec (engineering speak for coder-decoder).  It asks if you want to install the missing codec.

Let’s step back here.  At the request of a site that looks like YouTube, you are about to install and run some piece of software!  Are those internal alarms bells clanging loud and clear yet?  They should be.  The supposed missing codec is really a worm.  If you OK installation -- your system is infected.  The worm begins executing immediately, making a few "adjustments" to your Windows Registry to make sure it gets restarted whenever you reboot.  It then proceeds to wander about in your browser cookie cache finding out which social networking sites you belong to.  For each site, it authenticates and then sends messages, in your name, to all your friends!  Of course, those messages are just more infect-o-grams like the one you fell for.  And so the worm turns...

The lesson here is: think twice before accepting requests to "access" your social networking profile(s) from applications, games and gifts.  Moreover, think three times about saying yes when some web site that you have followed a link to recommends you OK installation of software you supposedly need!  If you believe you really might be running an old version of a plug-in, anti-virus program, etc., you should still always refuse the unsolicited pop-up style request.  Instead, you should explicitly type in the URL for the software maker and check if there you are missing codecs or updates to the software.  If there are updates then update your software and retry playing the video. 

If your software is already up-to-date, or if you get the pop-up again after updating, then assume the pop-up is malicious and just skip playing it!  It cannot be worth the inherent risk.  You might even go the extra step to inform the sender of your suspicions.  For example, in this particular case, the “sender” would be surprised you even got an email from them!  You’ll recall, in our scenario, it was the worm that sent it.  This is often how people find out their system is infected so you are doing them a big service.

To read further, here is a link to a technical explanation of how the koobface worm works.

How to Stay Clear of Census Scams

Every ten years Uncle Sam asks each of us to provide some information through a Census, in an effort to distribute billions of dollars into appropriate infrastructure and services projects each year. It's purpose is important, however it also opens the door to scammers and criminals alike, who can't wait to take advantage of situations like this.

How will you be counted?

A form will be sent to your home via the mail, which will ask 10 questions, and no it isn't available on the Internet for 2010. These questions are aimed at determining the number of residents per home, and a minimally invasive set of information about each resident. You won't be asked to share your social security number at any time. It's very important that you fill out the form and send it back, or a "Census Taker" may visit your home to gather your answers in person.

What should you be aware of?

Legally you must provide the answers to the Census, whether via the form, a Census Taker who visits your home, or both.

Scams which may pose as the 2010 Census are sure to be in abundance. These scams may come across as emails, websites, telephone calls, or even people knocking at your door.

Do we have any tips for protecting your information?

• Online Information

Read through the 2010 Census website, and contact them if you have any questions or concerns.

Remember, the 2010 Census will never ask for your information online, via email or a website.

• The Form

Know how to identify the census form, any request will be clearly marked as coming from the U.S. Census Bureau and as OFFICIAL BUSINESS of the United States.

• Census Taker

A Census taker may visit your home even if you mailed the form back. Your form may have gotten lost or not arrived yet, you still need to provide the Census Taker with the answers shown on the form you received.

Identifying a Census Taker can be confusing, remember they will not ask to enter your home, if they do, be wary.

It's a good idea to ask to see 2 forms of identification, the first will be a badge with the persons name, and the second could be any form of photo identification, like a drivers license, or state id.

If a census taker contacts you via the phone, you still need to provide the information which is on the official form, but it's a good idea to gather the persons name, the office they work from, the date and time they called, and a phone number to reach them back on. Most scammers won't provide you this information.

• The information you share

Remember you only need to provide the answers to the questions which are on the form, you don't need to provide any other information.

Your information security "chain" breaks at its weakest link

I have been reading a lot of articles lately about information being stolen by foreign intelligence agencies, e-mail systems getting hacked into and millions of dollars of intellectual capital lost  Here are some current examples of this happening:

http://www.csmonitor.com/USA/2010/0125/US-oil-industry-hit-by-cyberattacks-Was-China-involved

http://www.msnbc.msn.com/id/34923887/ns/technology_and_science-security/

This led me to think about the activities we should be doing to reduce the risk of things like this from happening to our companies or ourselves.  There are some very simple common sense things that can be done to protect information that you care about.

I have broken this down into three basic steps:

Step 1: Understand what you need to protect

The first (and most important) thing that you need to do is identify what information is critical to your company and what information you legally need to protect.  Really take the time to think about it.  Most state privacy breach laws state that you need to protect peoples names in association with their Social Security Numbers, any account numbers that have a PIN and any credit card numbers.  These are easy ones, but how about your customer contact lists?  new product ideas?  customer order histories?  etc… What information do you really need to ensure that you don’t lose and doesn’t get out of your control?  In addition to data loss, think about data integrity.  When you open a spreadsheet, how confident are you that someone has not accidentally or intentionally changed some numbers?   How important are the decisions you make from your data.  The controls you place around preserving the integrity of data need to match its importance.

Step 2: Inventory where it is stored

The next thing to do is to identify where all of this information is located.  In addition to the primary location, system or application, also identify where copies, backups, extracts and derivatives are stored. You may have great security around your PeopleSoft system, for example, but store all the reports that are generated out of it on a share drive that is readable by everyone.  Ask yourself these questions:

• Are there any reports, spreadsheets or extracts produced by core systems that contain critical information?
• Is the same level of security placed on these reports, spreadsheets or extracts as on the original information itself?
• Where do you store and how do you protect your system backups?
• Could someone gain access to a system backup and restore the information to their computer?
• Can you reduce the number of locations that your critical information or copies of it are stored?
• Are you relying on third parties to protect your information when it is in their systems?  Do they have the appropriate security controls in their environment?

Step 3: Align security controls with business risk

Finally, assess the security controls that you are using to protect your information.  You should align your controls across systems based on the value of the information you are trying to protect.  You must take a holistic view of your data and approach its protection aligned with its risk of loss or corruption wherever it is stored.  Do not haphazardly place security controls on systems just because they have some checkboxes in their setup screens to allow them to do fun things like expire passwords, disable accounts after failed attempts, etc... Don't apply extra security where it is not needed.

Know what information you want to protect and protect all locations that this information is stored consistently.  Your information chain will break at its weakest link.

The bottom line is that if you know exactly what you need to protect, have identified and minimized the locations that this information is stored and are confident that the controls in place to access or modify that information are appropriate, you have significantly reduced the chances that your information will be lost, stolen or altered.

4 steps to protect your data in an online transaction

Hello readers of the Westfield Insurance Information Security Tips blog!  I am new to Westfield, joining the InfoSec team in the capacity of Information Security Architect.  Previously, I was an information security consultant working predominantly in banking and pharmaceuticals.

 

You may be asking, "What is Information Security (IS) Architecture?"  In its broadest sense, architecture in the IT industry involves marrying an enterprise's business objectives to its current and future technology capabilities.  A good architecture does this by leveraging what is already present, or when needed, carefully introducing new types of technology.  When properly architected, the IT environment adapts smoothly to constantly changing business demands.  Information Security Architecture tries to achieve these same outcomes but within the specialized domain of information security.

 

What tips does an architect have regarding day to day information security?  Well, let’s take a security architecture concept and apply it to your situation.  For example, consider the idea of ensuring the confidentiality of sensitive information.  This idea is broadly applicable everyday on the web.  From an architectural perspective it is helpful to think about the two states of confidential information, namely, at rest (e.g., stored in a file) and in transit (e.g., whizzing across the Internet from server to laptop).

 

Take a scenario where you keep your credit card and expiration date in a file on your PC (you can remember your CVV, that three digit code on the back of your credit card, because it's so short).  Doing this makes it so much easier for you go shopping on the web because you can just cut and paste your information quickly, conveniently and without worrying about typing errors, etc.  So you surf to your favorite shopping site, find the widget you want to buy, follow the checkout process, open the credit card file, cut and paste your credit card information, submit it, and in a few days your stuff arrives.

 

Let's talk about your information's confidentiality during the 4 steps in an online transaction:

 

1)   In your computer file: First, if you saved your credit card information on your computer, it is sitting in a file.  Here it definitely should have been encrypted in such a way that only you could decrypt and read it, for example, using a password protected file encryption such as the free GNU Privacy Guard.

2)   On the merchant's order form: Next, you cut and pasted it to the online merchant’s checkout page.  Did you make sure the browser was indicating that the communications were protected by verifying that there were no browser warnings about unrecognized or expired digital certificates?  These certificates are used to help you make sure that you’re really at the web site of the merchant you think you are.  Some browsers use a color coding scheme in the URL field and green is usually the color indicating the site’s authenticity has been successfully verified. 

3)   In transit on the web: When you submit your credit card information, the data will suddenly be in transit across the Internet!  Prior to submitting anything, make sure it is protected in transit by confirming the URL of the page where you entered your personal data begins with the string https://... Instead of the normal http://... .  That extra ‘s’ in https is for security and it means the data stream between your browser and the merchant’s web server is encrypted.

4)   On the site receiving your info: And finally, after you press Submit, if you get any browser warning about information being sent unsecured, your browser is warning you that, although the page you were on was secure, the place you’re submitting the credit card info. to may not be.  When you recieve such warnings while transacting confidential information you should cancel out of the transaction and perform your purchase via a different medium (e.g., over the phone).

 

So, from an InfoSec architecture perspective, assuring that the encryption infrastructure is guarding your information at rest and in transit is all part of your personal information security architecture.

Information Security Concerns in a Pandemic

For a while now, we have been working on the development of a pandemic plan for our company.  Information Technology supports this plan in many ways.  Through the use of technology we can increase the number of employees who can “work at home” and use Virtual Private Networking (VPN) software to remotely connect into our systems to perform their work.  Getting employees out of the office but still having them be productive is a form of “Social Distancing” that can reduce the risk of exposure to disease.

A component of any pandemic plan needs to be communication on what can and can’t be done from an Information Security perspective, even in a pandemic situation.  For example, we only allow company configured machines to connect to our network, even over a VPN connection.  However, not all of our employees have laptops so many, therefore, cannot work at home.   It must be reinforced that information security policy is still policy even in a pandemic, and employees who do not have company laptops must not use email to send documents or data to themselves to work on using their home (or any non-company owned) computer.  This is the same for taking work home on portable USB drives or other media.  Even if you have the best intentions and only want to help your company, you are putting your company at risk of your data being intercepted, copied or lost resulting in a privacy breach.

Why be so paranoid?  Our employees are only trying to be more efficient and effective in a time where 20%-30% of the company might be out sick.  It can't be that bad, right?  Wrong.  A big reason why is “endpoint protection”.  Your company’s endpoints (workstations and laptops) have known, approved and licensed software on them, they have anti-virus software running on them, they are regularly patched for security vulnerabilities and they are free of peer-to-peer sharing software.  Some of your employees' home machines MAY be up to your company’s standards, but what if even one is not?  When your employee is done with their work, are you sure that no backup or temporary files will linger behind?  How many of your employees have children that use the home computer to share music or files?  How about viruses or malware infecting your corporate network once this work is brought back into your production environment?  What if the employee actually loses the USB drive?  Not to mention the risk of a shared or compromised gmail or yahoo mail account.

All of these scenarios can cause data leakage or data loss that can lead to a privacy breach.  According to the most recent Ponemon study that reports on the costs and causes of privacy breaches, “Over 88% of all cases this year involved incidents resulting from negligence.” This leaves only 12% as a result of malicious activity.  This 88% is composed of employees who think that they are doing the right thing, are trying to help and believe that nothing bad can happen.

So, please reinforce to your employees and peers that it is not safe to trust public networks, infrastructure or non-company owned equipment to store or work on company confidential materials.   Even in a pandemic situation were your workforce may be diminished and people are looking for innovative ways to “keep the lights on”, information security policy is still in effect and information security risks, and their consequences, outweigh lost productivity.

An Information Disaster Kit Prepares for the Silence after the Storm

Have you ever wondered what it would feel like to have a hurricane or a tornado fly over you, the loud swirling sounds ripping away?  Then after what feels like hours rather than a few short minutes all is quiet, leaving you wondering what will happen next.  I'd imagine this same feeling hits just about everyone after they realize they have shared personal information with a con artist or scammer.  How many of us are prepared for either of these disasters?

Natural disasters cause significant damage to us financially, emotionally, and physically, however so can Information Disasters like identify theft, or a virus that deletes every photo we've taken in that past 5 years.  Preparation for such a disaster is key to avoiding or recovering from it, but what is the right level of preparation for an Information Disaster?  Most of us could put together either of the kits in a few hours, but many of us don't feel they are necessary or believe it won't happen to them.  I'd encourage you to take a few minutes and put together at least a few items from each of the lists below.

Ready America provides a list for preparing a Disaster Kit, I'll compare this kit to my suggestions for an Information Disaster kit.

Recommended Items to Include in a Basic Emergency Supply Kit:	Recommended Items to Include in a Basic Information Disaster Response Kit:
Water, one gallon of water per person per day for at least three days, for drinking and sanitation	Record everything you do in a journal, this will help you keep track of what you've completed, and provide piece of mind down the road.
Food, at least a three-day supply of non-perishable food	Contact companies you have outstanding balances with, and inform them of the situation, requesting an extension as necessary for your current bill.
Battery-powered or hand crank radio and a NOAA Weather Radio with tone alert and extra batteries for both	Check your credit report and social security information at least weekly.
Flashlight and extra batteries	Check your data backups at least monthly.
First aid kit	Begin backing up your data if you haven't already.  Using an inexpensive USB thumb drive which can be stored in a safe is a quick and easy solution.
Whistle to signal for help	Contact the authorities if you believe a crime has been committed against you.
Dust mask, to help filter contaminated air and plastic sheeting and duct tape to shelter-in-place	Research and prepare a list of trusted companies who specialize in credit monitoring.
Moist towelettes, garbage bags and plastic ties for personal sanitation	Research and prepare a list of trusted companies who specialize in removing mal-ware or viruses from your computer.
Wrench or pliers to turn off utilities	Stop using your computer, or talking to phone scammers until you are sure they are safe to use.
Can opener for food (if kit contains canned food)	An emergency fund of cash to last you at least 1 month, just in case your accounts are frozen.
Local maps	A list of all account numbers including credit cards, banks, and even home utilities.
Cell phone with chargers	A contact list of toll free numbers to contact each of your providers.

Keep this kit somewhere safe and secure, and be ready to lean upon it to help you get through an Information Disaster.

Please share your thoughts on my suggestions above, I'd really be interested in making this list better!