Information Security Tips from Westfield Insurance

The Overly Eager Bird Catches a Worm

The social network phenomenon has shown many benefits.  These sites, such as facebook (FB), have great potential for people seeking friends to hang out with online.  Businesses too are finding it desirable to create a company presence on FB, myspace, twitter, etc.  Given their explosive growth, however, these sites have also attracted an unsavory element looking to exploit such new fertile ground.

Do you recall, back in the early 2000s, when email phishing was a relatively new phenomenon?  Eventually people became savvy about not following links that arrived in email messages from businesses with which they had no established relationship.  You see, in order to compromise your system, eventually the bad guys have to get you to act on their behalf ... so at some point, they have to present you with some “stuff to click on” ... thereby tricking you into giving your operating system (Windows, MacOS, linux, etc.) the go-ahead to install their evil code.

In a similar vein – have you noticed that when you go to play a game on a social site, say FB, you are presented with a dialog-box saying something like "This application requires access to your FB profile.  Do you wish to grant access?”  This is the FB security layer warning you that this application is trying to access your FB profile.  This is like a stranger asking to look through your wallet and record whatever they feel like while they’re in there browsing.  Alarm bells should be sounding in your head!  Let’s see ... a game that’s all sorts of fun to play and has really nice graphics, and which must have taken some people a lot of time to develop, all apparently, “for free”!  Too good to be true?  Gee whiz -- that's a little like those emails I occasionally get from "banks" promising to consolidate all my debt into a "Zero down, 0% APR loan” ... too good to be true indeed.

So, while most FB applications/games are not bogus fronts for bad guys that want access to your personal information, it is also true that some of those ostensible applications are in fact phony.  So be very careful before deciding to unleash these apps on your private information.

In another example of social networking abuse, there was recently a worm blazing its way through FB accounts called KoobFace ("facebook" spelled sideways, sort of).  KoobFace arrives as a FB message from a FB friend in your FB inbox.  When you open it, you are told to check out a YouTube video.  When you click on the link to the video you are sent to a fake YouTube site.  When you try to start the video playback, you are told that your system is missing an important piece of video playback software called a codec (engineering speak for coder-decoder).  It asks if you want to install the missing codec.

Let’s step back here.  At the request of a site that looks like YouTube, you are about to install and run some piece of software!  Are those internal alarms bells clanging loud and clear yet?  They should be.  The supposed missing codec is really a worm.  If you OK installation -- your system is infected.  The worm begins executing immediately, making a few "adjustments" to your Windows Registry to make sure it gets restarted whenever you reboot.  It then proceeds to wander about in your browser cookie cache finding out which social networking sites you belong to.  For each site, it authenticates and then sends messages, in your name, to all your friends!  Of course, those messages are just more infect-o-grams like the one you fell for.  And so the worm turns...

The lesson here is: think twice before accepting requests to "access" your social networking profile(s) from applications, games and gifts.  Moreover, think three times about saying yes when some web site that you have followed a link to recommends you OK installation of software you supposedly need!  If you believe you really might be running an old version of a plug-in, anti-virus program, etc., you should still always refuse the unsolicited pop-up style request.  Instead, you should explicitly type in the URL for the software maker and check if there you are missing codecs or updates to the software.  If there are updates then update your software and retry playing the video. 

If your software is already up-to-date, or if you get the pop-up again after updating, then assume the pop-up is malicious and just skip playing it!  It cannot be worth the inherent risk.  You might even go the extra step to inform the sender of your suspicions.  For example, in this particular case, the “sender” would be surprised you even got an email from them!  You’ll recall, in our scenario, it was the worm that sent it.  This is often how people find out their system is infected so you are doing them a big service.

To read further, here is a link to a technical explanation of how the koobface worm works.

How to Stay Clear of Census Scams

Every ten years Uncle Sam asks each of us to provide some information through a Census, in an effort to distribute billions of dollars into appropriate infrastructure and services projects each year. It's purpose is important, however it also opens the door to scammers and criminals alike, who can't wait to take advantage of situations like this.

How will you be counted?

A form will be sent to your home via the mail, which will ask 10 questions, and no it isn't available on the Internet for 2010. These questions are aimed at determining the number of residents per home, and a minimally invasive set of information about each resident. You won't be asked to share your social security number at any time. It's very important that you fill out the form and send it back, or a "Census Taker" may visit your home to gather your answers in person.

What should you be aware of?

Legally you must provide the answers to the Census, whether via the form, a Census Taker who visits your home, or both.

Scams which may pose as the 2010 Census are sure to be in abundance. These scams may come across as emails, websites, telephone calls, or even people knocking at your door.

Do we have any tips for protecting your information?

• Online Information

Read through the 2010 Census website, and contact them if you have any questions or concerns.

Remember, the 2010 Census will never ask for your information online, via email or a website.

• The Form

Know how to identify the census form, any request will be clearly marked as coming from the U.S. Census Bureau and as OFFICIAL BUSINESS of the United States.

• Census Taker

A Census taker may visit your home even if you mailed the form back. Your form may have gotten lost or not arrived yet, you still need to provide the Census Taker with the answers shown on the form you received.

Identifying a Census Taker can be confusing, remember they will not ask to enter your home, if they do, be wary.

It's a good idea to ask to see 2 forms of identification, the first will be a badge with the persons name, and the second could be any form of photo identification, like a drivers license, or state id.

If a census taker contacts you via the phone, you still need to provide the information which is on the official form, but it's a good idea to gather the persons name, the office they work from, the date and time they called, and a phone number to reach them back on. Most scammers won't provide you this information.

• The information you share

Remember you only need to provide the answers to the questions which are on the form, you don't need to provide any other information.

Your information security "chain" breaks at its weakest link

I have been reading a lot of articles lately about information being stolen by foreign intelligence agencies, e-mail systems getting hacked into and millions of dollars of intellectual capital lost  Here are some current examples of this happening:

http://www.csmonitor.com/USA/2010/0125/US-oil-industry-hit-by-cyberattacks-Was-China-involved

http://www.msnbc.msn.com/id/34923887/ns/technology_and_science-security/

This led me to think about the activities we should be doing to reduce the risk of things like this from happening to our companies or ourselves.  There are some very simple common sense things that can be done to protect information that you care about.

I have broken this down into three basic steps:

Step 1: Understand what you need to protect

The first (and most important) thing that you need to do is identify what information is critical to your company and what information you legally need to protect.  Really take the time to think about it.  Most state privacy breach laws state that you need to protect peoples names in association with their Social Security Numbers, any account numbers that have a PIN and any credit card numbers.  These are easy ones, but how about your customer contact lists?  new product ideas?  customer order histories?  etc… What information do you really need to ensure that you don’t lose and doesn’t get out of your control?  In addition to data loss, think about data integrity.  When you open a spreadsheet, how confident are you that someone has not accidentally or intentionally changed some numbers?   How important are the decisions you make from your data.  The controls you place around preserving the integrity of data need to match its importance.

Step 2: Inventory where it is stored

The next thing to do is to identify where all of this information is located.  In addition to the primary location, system or application, also identify where copies, backups, extracts and derivatives are stored. You may have great security around your PeopleSoft system, for example, but store all the reports that are generated out of it on a share drive that is readable by everyone.  Ask yourself these questions:

• Are there any reports, spreadsheets or extracts produced by core systems that contain critical information?
• Is the same level of security placed on these reports, spreadsheets or extracts as on the original information itself?
• Where do you store and how do you protect your system backups?
• Could someone gain access to a system backup and restore the information to their computer?
• Can you reduce the number of locations that your critical information or copies of it are stored?
• Are you relying on third parties to protect your information when it is in their systems?  Do they have the appropriate security controls in their environment?

Step 3: Align security controls with business risk

Finally, assess the security controls that you are using to protect your information.  You should align your controls across systems based on the value of the information you are trying to protect.  You must take a holistic view of your data and approach its protection aligned with its risk of loss or corruption wherever it is stored.  Do not haphazardly place security controls on systems just because they have some checkboxes in their setup screens to allow them to do fun things like expire passwords, disable accounts after failed attempts, etc... Don't apply extra security where it is not needed.

Know what information you want to protect and protect all locations that this information is stored consistently.  Your information chain will break at its weakest link.

The bottom line is that if you know exactly what you need to protect, have identified and minimized the locations that this information is stored and are confident that the controls in place to access or modify that information are appropriate, you have significantly reduced the chances that your information will be lost, stolen or altered.

4 steps to protect your data in an online transaction

Hello readers of the Westfield Insurance Information Security Tips blog!  I am new to Westfield, joining the InfoSec team in the capacity of Information Security Architect.  Previously, I was an information security consultant working predominantly in banking and pharmaceuticals.

 

You may be asking, "What is Information Security (IS) Architecture?"  In its broadest sense, architecture in the IT industry involves marrying an enterprise's business objectives to its current and future technology capabilities.  A good architecture does this by leveraging what is already present, or when needed, carefully introducing new types of technology.  When properly architected, the IT environment adapts smoothly to constantly changing business demands.  Information Security Architecture tries to achieve these same outcomes but within the specialized domain of information security.

 

What tips does an architect have regarding day to day information security?  Well, let’s take a security architecture concept and apply it to your situation.  For example, consider the idea of ensuring the confidentiality of sensitive information.  This idea is broadly applicable everyday on the web.  From an architectural perspective it is helpful to think about the two states of confidential information, namely, at rest (e.g., stored in a file) and in transit (e.g., whizzing across the Internet from server to laptop).

 

Take a scenario where you keep your credit card and expiration date in a file on your PC (you can remember your CVV, that three digit code on the back of your credit card, because it's so short).  Doing this makes it so much easier for you go shopping on the web because you can just cut and paste your information quickly, conveniently and without worrying about typing errors, etc.  So you surf to your favorite shopping site, find the widget you want to buy, follow the checkout process, open the credit card file, cut and paste your credit card information, submit it, and in a few days your stuff arrives.

 

Let's talk about your information's confidentiality during the 4 steps in an online transaction:

 

1)   In your computer file: First, if you saved your credit card information on your computer, it is sitting in a file.  Here it definitely should have been encrypted in such a way that only you could decrypt and read it, for example, using a password protected file encryption such as the free GNU Privacy Guard.

2)   On the merchant's order form: Next, you cut and pasted it to the online merchant’s checkout page.  Did you make sure the browser was indicating that the communications were protected by verifying that there were no browser warnings about unrecognized or expired digital certificates?  These certificates are used to help you make sure that you’re really at the web site of the merchant you think you are.  Some browsers use a color coding scheme in the URL field and green is usually the color indicating the site’s authenticity has been successfully verified. 

3)   In transit on the web: When you submit your credit card information, the data will suddenly be in transit across the Internet!  Prior to submitting anything, make sure it is protected in transit by confirming the URL of the page where you entered your personal data begins with the string https://... Instead of the normal http://... .  That extra ‘s’ in https is for security and it means the data stream between your browser and the merchant’s web server is encrypted.

4)   On the site receiving your info: And finally, after you press Submit, if you get any browser warning about information being sent unsecured, your browser is warning you that, although the page you were on was secure, the place you’re submitting the credit card info. to may not be.  When you recieve such warnings while transacting confidential information you should cancel out of the transaction and perform your purchase via a different medium (e.g., over the phone).

 

So, from an InfoSec architecture perspective, assuring that the encryption infrastructure is guarding your information at rest and in transit is all part of your personal information security architecture.

Information Security Concerns in a Pandemic

For a while now, we have been working on the development of a pandemic plan for our company.  Information Technology supports this plan in many ways.  Through the use of technology we can increase the number of employees who can “work at home” and use Virtual Private Networking (VPN) software to remotely connect into our systems to perform their work.  Getting employees out of the office but still having them be productive is a form of “Social Distancing” that can reduce the risk of exposure to disease.

A component of any pandemic plan needs to be communication on what can and can’t be done from an Information Security perspective, even in a pandemic situation.  For example, we only allow company configured machines to connect to our network, even over a VPN connection.  However, not all of our employees have laptops so many, therefore, cannot work at home.   It must be reinforced that information security policy is still policy even in a pandemic, and employees who do not have company laptops must not use email to send documents or data to themselves to work on using their home (or any non-company owned) computer.  This is the same for taking work home on portable USB drives or other media.  Even if you have the best intentions and only want to help your company, you are putting your company at risk of your data being intercepted, copied or lost resulting in a privacy breach.

Why be so paranoid?  Our employees are only trying to be more efficient and effective in a time where 20%-30% of the company might be out sick.  It can't be that bad, right?  Wrong.  A big reason why is “endpoint protection”.  Your company’s endpoints (workstations and laptops) have known, approved and licensed software on them, they have anti-virus software running on them, they are regularly patched for security vulnerabilities and they are free of peer-to-peer sharing software.  Some of your employees' home machines MAY be up to your company’s standards, but what if even one is not?  When your employee is done with their work, are you sure that no backup or temporary files will linger behind?  How many of your employees have children that use the home computer to share music or files?  How about viruses or malware infecting your corporate network once this work is brought back into your production environment?  What if the employee actually loses the USB drive?  Not to mention the risk of a shared or compromised gmail or yahoo mail account.

All of these scenarios can cause data leakage or data loss that can lead to a privacy breach.  According to the most recent Ponemon study that reports on the costs and causes of privacy breaches, “Over 88% of all cases this year involved incidents resulting from negligence.” This leaves only 12% as a result of malicious activity.  This 88% is composed of employees who think that they are doing the right thing, are trying to help and believe that nothing bad can happen.

So, please reinforce to your employees and peers that it is not safe to trust public networks, infrastructure or non-company owned equipment to store or work on company confidential materials.   Even in a pandemic situation were your workforce may be diminished and people are looking for innovative ways to “keep the lights on”, information security policy is still in effect and information security risks, and their consequences, outweigh lost productivity.

An Information Disaster Kit Prepares for the Silence after the Storm

Have you ever wondered what it would feel like to have a hurricane or a tornado fly over you, the loud swirling sounds ripping away?  Then after what feels like hours rather than a few short minutes all is quiet, leaving you wondering what will happen next.  I'd imagine this same feeling hits just about everyone after they realize they have shared personal information with a con artist or scammer.  How many of us are prepared for either of these disasters?

Natural disasters cause significant damage to us financially, emotionally, and physically, however so can Information Disasters like identify theft, or a virus that deletes every photo we've taken in that past 5 years.  Preparation for such a disaster is key to avoiding or recovering from it, but what is the right level of preparation for an Information Disaster?  Most of us could put together either of the kits in a few hours, but many of us don't feel they are necessary or believe it won't happen to them.  I'd encourage you to take a few minutes and put together at least a few items from each of the lists below.

Ready America provides a list for preparing a Disaster Kit, I'll compare this kit to my suggestions for an Information Disaster kit.

Recommended Items to Include in a Basic Emergency Supply Kit:	Recommended Items to Include in a Basic Information Disaster Response Kit:
Water, one gallon of water per person per day for at least three days, for drinking and sanitation	Record everything you do in a journal, this will help you keep track of what you've completed, and provide piece of mind down the road.
Food, at least a three-day supply of non-perishable food	Contact companies you have outstanding balances with, and inform them of the situation, requesting an extension as necessary for your current bill.
Battery-powered or hand crank radio and a NOAA Weather Radio with tone alert and extra batteries for both	Check your credit report and social security information at least weekly.
Flashlight and extra batteries	Check your data backups at least monthly.
First aid kit	Begin backing up your data if you haven't already.  Using an inexpensive USB thumb drive which can be stored in a safe is a quick and easy solution.
Whistle to signal for help	Contact the authorities if you believe a crime has been committed against you.
Dust mask, to help filter contaminated air and plastic sheeting and duct tape to shelter-in-place	Research and prepare a list of trusted companies who specialize in credit monitoring.
Moist towelettes, garbage bags and plastic ties for personal sanitation	Research and prepare a list of trusted companies who specialize in removing mal-ware or viruses from your computer.
Wrench or pliers to turn off utilities	Stop using your computer, or talking to phone scammers until you are sure they are safe to use.
Can opener for food (if kit contains canned food)	An emergency fund of cash to last you at least 1 month, just in case your accounts are frozen.
Local maps	A list of all account numbers including credit cards, banks, and even home utilities.
Cell phone with chargers	A contact list of toll free numbers to contact each of your providers.

Keep this kit somewhere safe and secure, and be ready to lean upon it to help you get through an Information Disaster.

Please share your thoughts on my suggestions above, I'd really be interested in making this list better!

Secure Cell

President Obama is still awaiting the security enhancements to his Blackberry that allows him to securely send/receive email and voice communications.  Officially, the government uses the Sectéra Edge smartphone to securely communicate.  While this should be the standard for ALL paranoid cell phone users; it may be overkill for the average user if the $3000+ price tag isn’t prohibitive.

While the casual cell phone user doesn’t require military grade security, the proliferation of smartphones or feature phones raises the risk of identity theft or social engineering.  Today’s cell phones are no longer restricted to making and receiving calls.  They are a major component of our everyday lives.  They hold our address books, calendars, email, music and much more.  While it is very convenient to hold all of this information in a single place, it poses a risk if they are lost or stolen.

Millions of cell phones are lost or stolen each year.  Think about the important information you store on your phone.  Names and numbers of friends and relatives; passwords; sensitive emails or text messages.  Not only does it expose this information to strangers, it is also very inconvenient for you.  Are you backing up this information?  While not all phones are capable of doing backing-ups or syncing data, the ones that do…should.

Spend a moment to review the information on your phone.  What could a stranger learn about you and your contacts if they had access?  At a minimum, they would be able to harass them.  At worse, they may have access to their physical location.  Is your phone tied to social networking sites such as Facebook or My Space?  How would you feel if a stranger or criminal had access to your friends’ and families’ contact information, pictures, etc.  Personally, it creeps me out to think that someone might browse photos of my wife and daughters.

So what should you do about this?  First, learn to live with a password to access your phone.  It is inconvenient at times to “log-in” to your phone but the level of protection that even a 4 digit password or pin provides is well worth the extra keystrokes.  My phones are set up so that calls can be made and received; however, access to address books and calendars, etc. are password protected.

Does your phone support remote wipe?  Enterprise Blackberries allow system administrators to delete content of lost or stolen cell phones, but what protection do you have if you are an iPhone, Palm or Windows Mobile user?  Utilities like Teallock for Palm allows you to send a “self destruct” text message to your phone wiping all information from the phone and memory cards.

Finally, be aware of where you leave your cell phone.  With cell phone insurance and “new every so many year” plans; people forget the value of the phone and particularly the information it contains.  Would you leave your wallet or purse lying around even if it was not filled with cash?  I often see phones left unattended on desks as I stroll through the hallways in the office.  I’ve seen them left in cars to charge.  I have even seen them dangling from a wall charger, unattended no less, at the airport.  The unfortunate reality is that a lost cell phone is not just a hassle for the owner, like with a wallet or purse, but also for the friends and families of those who are “lucky” enough to be in your contact list!

A lock will only keep honest people honest

When I was younger my parents tried to teach me about locking the car door, and the house, but they never really explained why.  I've learned over the years that locking something only really offers protection from the people who wouldn't steal anyway.

 

What do I mean? 

Simply put... a lock is breakable, if someone sees or suspects something valuable, then given enough time and a will to steal they will break that lock.  This principal applies both to physical items and your information / identity.

 

So how do you protect yourself?

To get started take steps to avoid being a target in the first place, start by protecting yourself with a few common sense practices.  It’s also very important to share these practices with people you know so they don’t accidently make you a target.

 

Here are a few ideas in each category:

Physical Items:

• When coming back to your vehicle, place all packages, laptops, even grocery bags in the trunk.  Don't wait until you've reached your destination, someone might be watching you to see if you move your laptop or new video game system into the trunk once you get there.
• Don't leave cell phones, GPS devices, or even the GPS holder sitting out; place them under your seat, or take them with you, especially if the item (Laptop, Blackberry, Wallet, Purse, etc) contains sensitive information.
• Lock your doors, go ahead and double check... it’s ok.

Information / Identity:

• Shred, Shred, Shred… Simply put; don’t put your personal identity at risk.  Shred any documents with your Name, address, phone number, Social Security, Bank Information, and or Credit Information.
• Be wary of the proverbial “To good to be true”, if it seems too good, you know what “IT IS”.  Don’t click on the email that tries to lure you into helping a foreign official exchange money, or the IRS link that offers you a double refund if you take this survey.

Quick Example:

A family decides to travel to the mall for an all day shopping trip.  They carefully put their GPS under the seat, and make sure the doors are locked.

A thief notices a GPS holder mounted to the front windshield, and quickly breaks their driver side window.  The thief then unlocks the door and ransacks the vehicle finding a GPS unit, a USB memory stick, and several house keys.

The thief then uses their GPS unit and presses the “Home” key to now burglarize their home. 

In short,  if they had taken the extra few seconds to put the GPS holder under the seat, the family wouldn’t have a broken window, lost checkbook, lost GPS, and a burglarized home.

 

In Summary:

A lock is still very important, however if there doesn’t appear to be anything of value to steal you probably won’t end up a target.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

OnGuard Online

As the holidays get closer, many of us will turn to online shopping. Done right, online shopping is about as safe as catalog shopping - and much more convenient. If you don't take basic precautions, though, you could lose your shirt. Take the time to learn about the kinds of scams and cons that are used online.

The Federal Trade Commission hosts a terrific site with lots of content on identifying and deflecting these kinds of scams. If you haven't already been out to visit www.onguardonline.gov, I strongly recommend the site. It has some excellent overview material on security at the personal and small business level. The site also has a set of games covering a variety of topics like spyware, online auctioneering, peer-to-peer, phishing and spam. Test your knowledge of internet security and safe shopping. It's well worth the time to visit the site.

The site's material comes from a number of public and private sources but is all released for public use. If you run your own personal website, you can post their games, videos and handouts to your own site and help spread the word. (Instructions are here.)

Addendum:
This tip has inspired me to create a more permanent set of links to some of the better games and awareness quizzes that I've run across. I'll try to get them posted in a permanent sidebar on the blog but in the meantime, here are a few good links.

• CMU Anti-Phishing Game - Learn to identify fraudulent URLs
• Mission:Laptop Security - Protect your laptop while traveling
• Anti-phishing Father's Day card - Flash video on phishing
• Auction Action - Test your knowledge of online auctioning
• P2P Threeplay! - a quick quiz on file-sharing
• Invest Quest|http://www.onguardonline.gov/games/invest-quest.aspx - a simple quiz but the 'disclaimers' are pretty funny

You just received a Breach Disclosure Letter. Now what?

You just received a breach disclosure letter. Their systems were "compromised". Now what? Do you call the police, close all your bank accounts and change your credit card numbers, file the letter and hope for the best?

The first thing is to take a deep breath. Breach disclosure letters can be intimidating but don't panic. Take the time to figure out what, if anything, you should do. Read the disclosure letter itself very carefully. The disclosure letter should have some details about the breach. It may be enough to show that the breach didn't apply to you. (I got a letter recently about my son's medical information. Based on the dates in the letter, I knew that the breach couldn't have affected him.) If you want more information, look on the internet. Check out the company's website but also look for independent news reports. Be cautious about the blogs and other unverified sources, though. Look specifically to see what information is at risk. Also try to figure out whether the information was stolen or merely lost. If it was stolen, the odds are much higher that the information will be misused.

If you think it was stolen, start watching your accounts carefully, especially if the compromised information included bank or credit card numbers. Check those accounts online daily, looking for unauthorized transactions. If you see something suspicious, call your bank immediately.

If you haven't done so recently, request a copy of your credit report. You should be in the habit of checking it regularly. Be extra vigilant for a cycle or two after receiving a breach disclosure letter. If the thief is going to abuse your account, it will probably only be for a few large transactions sometime within 3-6 months of the theft.

If your Social Security number has been compromised, strongly consider calling the three major credit bureaus to put a fraud alert on your records. When reviewing your credit report, look particularly for new accounts opened in your name. If you feel you’re at a particularly high risk, you can also implement security freeze, though the costs may outweigh the protections for most people.

If the breach disclosure letter says that you are eligible for credit monitoring, think about that. Personally, I don't believe they will do anything for me that I'm not already doing for myself for free since I already monitor my credit report. I don't want to put my personal information in the hands of yet another company just so they can do the same thing. Worse, some of these monitoring services put into the contract that they will automatically renew you (for fee) when the free period runs out. I don't want to have to remember to turn off the monitoring in a year. But if monitoring will help you sleep better at night, consider it.

Finally, if you’re an actual victim of identity theft ( not just credit card fraud), you do want to call the police and file a police report according to Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse. Keep a copy of the police report for your records. You'll need it to prove your innocence as you attempt to clean up your credit reports. Follow the instructions at the credit reporting agency's website to dispute incorrect information.

based in part on a CSO Online column

Reminder: No Tip next week. Have a great Labor Day weekend.

Safe vacationing (encore tip)

It's hard to believe that it's almost Memorial Day and that people will start leaving for summer vacations soon. Please take appropriate precautions both before you leave and while you're on your vacation to reduce your risk of fraud and identity theft.

Before you leave:

1. Clean out your wallet.
   • Use traveler's checks or credit cards for payment. Leave your checkbook at home.
   • Leave your debit card(s) at home. Under federal law, your liability is limited if your credit card is misused. If your debit card is stolen, you could lose all the money in your checking account.
   • Take an ATM card that does not have debit card privileges. Your bank should be able to issue you an "ATM only" card.
   • Never carry your Social Security card in your wallet.
   • Leave any unneeded credit cards and any other unnecessary documents at home.
2. Photocopy your wallet and keep the copy in a safe place. If your wallet is stolen, the copies will tell you who to call to get your cards canceled. Note: If you will be gone for a long time, consider leaving a copy with someone you trust who can help you cancel the cards while you're still on the road.
3. Stop your newspaper delivery and have the Post Office hold your mail (or ask a trusted neighbor to collect them for you). The bills and account statements in your unlocked mailbox are a goldmine for an identity thief. And the packages and newspapers piling up on your front step are a sure sign to a burglar that you are away.

While on your vacation:

• Don't leave your wallet, passport or any identifying documents in your hotel room unattended. Use the hotel safe if it's available.
• Keep your identity document (passport or drivers license) separate from your wallet. Carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.
• Guard your credit card receipts and rental car agreements, especially if they contain your full credit card number or driver's license number.
• Use ATMs at banks or credit unions and which are in well-lit areas.
• If you are taking your laptop with you, be very careful when using it for on-line banking and other password-protected services, especially if you are connecting to a wireless hotspot.
• Be equally cautious of cyber-cafes and other public-access internet facilities. Anyone could have left a keystroke logger on the machine in order to capture your ID and password.

By the way, there will be no InfoSec Tip next week. Have a safe holiday.

Credit freeze - defined

Most states have passed "credit freeze" laws, allowing individual consumers to lock their credit reports and, in theory, reducing their vulnerability to identity theft. While the credit freeze is in place, the credit reporting agency may not give out your credit report unless you explicitly grant permission and confirm your identity using a PIN or password. This makes it harder for the identity thief to open an new account or to get new credit in your name.

Even if your state does not have a credit freeze law, the three major credit reporting agencies now offer freezes voluntarily. To institute a credit freeze, you generally need to send a written request to each of the three major credit reporting agencies. The specific instructions vary from state to state. You can find links to each state's instructions at ConsumersUnion.org. The states allow the credit reporting agency to impose a fee to initiate the freeze (usually $5-10 per credit reporting agency but often free to confirmed victims of identity theft) .

If you do freeze your credit report, you will have to lift the freeze whenever you want credit. Under almost all the state laws, you'll have to pay again each time you want the freeze lifted. This can make opening a new account or even changing your existing service more difficult and expensive. When you apply for the freeze, you will be given the instructions and PIN needed to lift the freeze. In some cases, you'll have to lift the freeze yourself – in others, you might be able to authorize the merchant to do it for you. Either way, it will take some extra time. It will also make you ineligible for "instant credit" unless you lift the freeze before going to the store.

The credit freeze laws have implications for businesses that use credit reports for purposes other than lending (such as evaluating underwriting risk). Unless the state law has explicitly carved out that usage as allowed (and many but not all states did for underwriting), the business should expect extra paperwork and several extra steps in the process to get permission to view the consumer's credit report. The law varies from state to state. Check with your corporate counsel for details.

As a consumer, you should also know that a credit freeze will not necessarily keep you safe from identity theft. While most reputable creditors will check your report before issuing credit, some don't. Identity thieves can still exploit those situations, knowing that you will have to pay the consequences. A credit freeze also will not protect you from exploitation of existing accounts.

If you are at increased risk of identity theft and already have a house, car, phone service and the credit cards you need and you see no near-term need to refinance any of them, a credit freeze might be appropriate for you. If you have few risk factors or will need to legitimately seek credit for yourself soon, a credit freeze could be more trouble than it's worth. Personally, I do not have a credit freeze on my account. I take normal precautions to make my identity hard to steal in the first place (I have a shredder and use it, I don't leave financial documents like credit card bills on the kitchen counter, I don't keep my SSN in my wallet, I use strong passwords, etc) and I check my credit report regularly. To me, the incremental protection of a credit freeze is not now worth the extra hassle and expense.

What to do when you lose your wallet

My brother-in-law had his wallet stolen over the weekend. In the interest of learning from the misfortunes of others, here are some things to think about.

1. Never, never, never carry your Social Security card in your wallet.
2. Photocopy your wallet about once a year. Lay the contents out on a copier (front and back) so you have a record of all the cards and contact numbers.
3. Only carry the cards that you use on a regular basis. Leave the rest in a safe place at home. If you have bills set up to auto-pay by credit card, use a card that you leave home. Otherwise, you'll have to change all those accounts when the card is cancelled.
4. When your wallet is lost or stolen, immediately call the financial institutions and start canceling the cards that were lost.
5. Call the three credit reporting agencies and put a fraud alert on your account. Consider putting a credit freeze on your account. (A fraud alert is free but must be renewed in 90 days. A credit freeze will typically cost $10 and requires extra effort to have lifted when you want to apply for credit legitimately but it provides somewhat better protection.)
6. If you haven't reviewed your credit report lately, do it now. Follow the instructions at annualcreditreport.com.

Police advise men to keep the wallet in their front trouser pocket, not a jacket pocket and definitely not a rear pocket. Police advise women to keep their purse with them and to carry it on their strong-hand side (if you're right-handed, carry it on your right shoulder).

If you're traveling, keep your identity document (passport or drivers license) separate from your wallet. Carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.

Annual credit report review

This Tip was first run in March 2007. This "encore tip" is an annual reminder to check your credit report.

This is your annual reminder to request your credit report. Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is eligible for a free copy of his/her credit report every 12 months. Follow the instructions at www.annualcreditreport.com to request your credit report from each of the three major credit reporting agencies.

When reviewing the credit reports, look for:

• adverse actions on your accounts that might indicate that you have been a victim of identity theft
• accounts that have been opened in your name without your knowledge. Even if the identity thief is making the payments regularly, the account could still be in use for illegal activities.

If you find a discrepancy, follow the specific instructions on the website to dispute any incorrect information.

Don’t forget to check the credit reports of your immediate family members, especially minor children and dependent elders. Both of those groups are at elevated risk of identity theft.

Remember that you are also eligible for a report every 12 months from any of the specialty agencies which have information about you.

If you want more frequent feedback on your credit history, consider asking for your free copy from only one of the major credit reporting agencies at a time. Space the requests for the other two agencies out every four months. For example, you could ask for your free copy from Experian in March, your free copy from TransUnion in July and your free copy from Equifax in November. Once you start, you will have to keep the same rotating pattern. Schedule the requests on your calendar.

Shredding is a Federal requirement

Under Federal Trade Commission regulation, any information about an individual that is derived from a consumer report or is a compilation of such records must be properly destroyed. These days, almost all of customer information has some connection to a consumer report and is covered under this regulation (scroll to pg 32).

The regulation does not actually require shredding but for most of us, that is the only cost-effective way to comply with the regulation's requirements for destruction. Papers in regular trash are exposed to the public and any private information on those papers can be misused by an identity thief. It can cost your customers thousands of dollars to get their identity back and could be considered a violation of federal privacy laws.

I strongly recommend a "shred all paper" policy for your office because there is too much risk that a piece of personal information will be overlooked on the back side of a form or that the page was used for scratch paper while you were on the phone. It's also easier to enforce the policy when you have a simple rule like "No office paper may be thrown away in the regular trash."

Very small offices can get away with a personal shredder. If you've got more than about 10 or 15 people in the office, it's probably more cost-effective to contract with a reputable shredding vendor who will pick up and properly dispose of your paper waste. Most of the shredding vendors will provide locked bins where the paper waste can be stored until pickup. Have enough bins to be convenient for staff.

Cyber-privacy

Online privacy is hard to achieve – and impossible when you don't think about it enough ahead of time. Anyone can see just about anything you ever wrote online. That includes webpages, blogs, discussion forums, social sites and email. Recruiters routinely check these sources before making hiring decisions. They are also increasingly popular with investigators. Anyone wanting to look into your background can find a wealth of information online.

There is little true anonymity on the internet. Some sites use passwords to limit the number of people who can access information but passwords are routinely compromised. Other sites allow you to use a pseudonym rather than edit under your real name. With a little bit of work (sometimes very little work), almost everything you wrote can be traced back to you.

Many believe that the vastness of the internet protects them. With millions of pages created every day, how would a hacker ever find my little blog or my email where I admit to some personal detail? In a paper-world, correlating all those sources was impossible. Now, we have powerful search engines and intelligent programs that can match details across multiple pages. They are incredible research tools and make the internet far more useful to all of us but they also can be used to create astonishingly complete profiles of you and your family.

None of it really goes away, either. Even if you removed the webpage, deleted your MySpace account and purged all your email, cached versions may still exist scattered all over the internet. Think twice about what you write and how you write it. Once you post something, you must forever live with the consequences.

When posting online, always assume that someone who you can't even guess at today will find and use the information. If you want the information to be private or restricted to a small group of people, the internet is probably not the best way to communicate. Remember too that even if you've never published anything online, you probably have a nephew or distant cousin who is working on a family history and including details about your life. Keeping your private details private takes work and vigilance.

Ohio Breach update

If you live in Ohio, by now you've heard about the loss of the computer backup tape. You may even have received a notice from the state that your information was on the lost tape. By some estimates, the information from as many as one in six Ohio taxpayers was on the tape in one form or another.

On 10 June, the tape was stolen from a state employee's car. The employee had the tape off-site as part of their regular backup procedures to ensure that they would be able to restore their computer systems if something happened to their data center. By all accounts, the information was stored on the tape in a proprietary format that would be very difficult for any outsider to read or interpret. If you've received one of these notices, the probability that your information will be misused is extremely low. You are at far greater risk of identity theft from a family member or friend than from an anonymous crime of opportunity.

If you have received such a notice, you do have a few choices. First, verify that the notice is legitimate. The first round of notices went out from the Ohio Department of Taxation. The second round came from the Ohio Department of Administrative Services. There are unconfirmed reports of fake notices but you can confirm the real notice by going to the state's official site at www.ohio.gov/idprotect/. Don't respond to any telephone call or email on this topic. The state is contacting individuals only by mail.

Second, I strongly recommend that you check your credit report regardless of whether you've received a notice or not. You are entitled to a free copy of your credit report every 12 months. Look for accounts that you didn't open. If you find something suspicious, follow the dispute-resolution procedures included with the credit report. Consider checking just one of the three major agencies right now, the next in 4 months and the last in 8 months. That gives pretty good coverage at three times the frequency.

Third, watch your existing accounts carefully. Check for unauthorized charges or withdrawals and watch out for missing monthly statements or bills. Hackers often file a change-of-address to keep you from noticing the abuse. Call your financial institution if you see anything suspicious.

Fourth, think about the identity theft service offered by the state. The state has contracted with Debix to put a fraud alert on your credit report if you sign up with them. You can do the same thing in a few minutes by calling or mailing the fraud department of the credit bureaus. They also offer some other services, but again, nothing that you can't do for yourself (and have probably already done if you've been reading our Tips regularly). Personally, I will not be giving yet another copy of all my personal information to a state-contracted agency when I can do it so easily myself. Note: the fraud alerts expire every three months. Don't forget to renew. And remember that while most creditors will check before opening a new account, they are not required by law to do so. A fraud alert does not replace checking your credit report regularly.

On the other hand, if you don't think that you'll remember to check your credit report regularly, a service like Debix can be useful.

If you received the notice for your company (rather than about your personal information), there is nothing special that you need to do. It is much harder to abuse a corporate tax ID number than it is to abuse a SSN. Your organization's normal fraud-control procedures are probably sufficient to protect the company.

You should also learn from the state's example. Protect your company from a similar breach by reviewing and updating your data backup procedures. Make sure that the off-site backups are kept well protected and are encrypted if at all possible.

ID Theft by a family member

Despite all the media hype about hackers, security breaches and lost laptops, research shows that just over half of all identity theft is committed by someone close to the victim – a family member or close friend. Recent research also indicates that 55% of all identity theft is committed based on paper documents. As a company, we have to be worried about the attacks against our systems. As an individual, the statistics say that you should be more worried about Uncle Joe or Grandma picking up the credit card statement from your kitchen table.

Unfortunately, if you discover family-related identity theft, there are few good solutions. Most of the legal protections that you have as an identity theft victim will require that you file a police report. The police report could lead to prosecution and even jail time for the offending family member. Few families are ready for the emotional difficulties of prosecuting the case.

Occasionally, a lender will let the victim off the hook without a police report if the thief admits to the deed and commits to making payments and has the means to do so, according to Linda Foley of the Identity Theft Resource Center. The family typically needs to hire a lawyer to conduct the necessary negotiations and to draw up the paperwork.

If you live in a "credit freeze" state (OH is not one yet), you can at least stop further abuse of your identity by putting a freeze on your account and on the accounts of the rest of your family. Freezing your account may not require a police report. Check your state laws for more.

Prevent identity theft in the first place by buying a shredder, locking up or filing bills and statements with personal information and checking your credit report regularly. You can request your own credit report online for free every 12 months. Don't forget to check your family members' credit reports at the same time. Children and dependent elders remain high priority targets for identity thieves. (Note: Requests for the credit report of a minor under age 13 must be submitted in writing on this form and with the identifying documents listed here.)

Credit Report reminder: For those of us on the "trimester plan" for reviewing our credit reports, it's time to ask from for your free copy of your credit report from the next agency.

Annual credit report review

This is your annual reminder to request your credit report. Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is eligible for a free copy of his/her credit report every 12 months. Follow the instructions at www.annualcreditreport.com to request your credit report from each of the three major credit reporting agencies.

When reviewing the credit reports, look for:

• adverse actions on your accounts that might indicate that you have been a victim of identity theft
• accounts that have been opened in your name without your knowledge. Even if the identity thief is making the payments regularly, the account could still be in use for illegal activities.

If you find a discrepancy, follow the specific instructions on the website to dispute any incorrect information.

Don’t forget to check the credit reports of your immediate family members, especially minor children and dependent elders. Both of those groups are at elevated risk of identity theft.

Remember that you are also eligible for a report every 12 months from any of the specialty agencies which have information about you.

If you want more frequent feedback on your credit history, consider asking for your free copy from only one of the major credit reporting agencies at a time. Space the requests for the other two agencies out every four months. For example, you could ask for your free copy from Experian in March, your free copy from TransUnion in July and your free copy from Equifax in November. Once you start, you will have to keep the same rotating pattern. Schedule the requests on your calendar.