Information Security Tips from Westfield Insurance

Information Security Concerns in a Pandemic

For a while now, we have been working on the development of a pandemic plan for our company.  Information Technology supports this plan in many ways.  Through the use of technology we can increase the number of employees who can “work at home” and use Virtual Private Networking (VPN) software to remotely connect into our systems to perform their work.  Getting employees out of the office but still having them be productive is a form of “Social Distancing” that can reduce the risk of exposure to disease.

A component of any pandemic plan needs to be communication on what can and can’t be done from an Information Security perspective, even in a pandemic situation.  For example, we only allow company configured machines to connect to our network, even over a VPN connection.  However, not all of our employees have laptops so many, therefore, cannot work at home.   It must be reinforced that information security policy is still policy even in a pandemic, and employees who do not have company laptops must not use email to send documents or data to themselves to work on using their home (or any non-company owned) computer.  This is the same for taking work home on portable USB drives or other media.  Even if you have the best intentions and only want to help your company, you are putting your company at risk of your data being intercepted, copied or lost resulting in a privacy breach.

Why be so paranoid?  Our employees are only trying to be more efficient and effective in a time where 20%-30% of the company might be out sick.  It can't be that bad, right?  Wrong.  A big reason why is “endpoint protection”.  Your company’s endpoints (workstations and laptops) have known, approved and licensed software on them, they have anti-virus software running on them, they are regularly patched for security vulnerabilities and they are free of peer-to-peer sharing software.  Some of your employees' home machines MAY be up to your company’s standards, but what if even one is not?  When your employee is done with their work, are you sure that no backup or temporary files will linger behind?  How many of your employees have children that use the home computer to share music or files?  How about viruses or malware infecting your corporate network once this work is brought back into your production environment?  What if the employee actually loses the USB drive?  Not to mention the risk of a shared or compromised gmail or yahoo mail account.

All of these scenarios can cause data leakage or data loss that can lead to a privacy breach.  According to the most recent Ponemon study that reports on the costs and causes of privacy breaches, “Over 88% of all cases this year involved incidents resulting from negligence.” This leaves only 12% as a result of malicious activity.  This 88% is composed of employees who think that they are doing the right thing, are trying to help and believe that nothing bad can happen.

So, please reinforce to your employees and peers that it is not safe to trust public networks, infrastructure or non-company owned equipment to store or work on company confidential materials.   Even in a pandemic situation were your workforce may be diminished and people are looking for innovative ways to “keep the lights on”, information security policy is still in effect and information security risks, and their consequences, outweigh lost productivity.

An Information Disaster Kit Prepares for the Silence after the Storm

Have you ever wondered what it would feel like to have a hurricane or a tornado fly over you, the loud swirling sounds ripping away?  Then after what feels like hours rather than a few short minutes all is quiet, leaving you wondering what will happen next.  I'd imagine this same feeling hits just about everyone after they realize they have shared personal information with a con artist or scammer.  How many of us are prepared for either of these disasters?

Natural disasters cause significant damage to us financially, emotionally, and physically, however so can Information Disasters like identify theft, or a virus that deletes every photo we've taken in that past 5 years.  Preparation for such a disaster is key to avoiding or recovering from it, but what is the right level of preparation for an Information Disaster?  Most of us could put together either of the kits in a few hours, but many of us don't feel they are necessary or believe it won't happen to them.  I'd encourage you to take a few minutes and put together at least a few items from each of the lists below.

Ready America provides a list for preparing a Disaster Kit, I'll compare this kit to my suggestions for an Information Disaster kit.

Recommended Items to Include in a Basic Emergency Supply Kit:	Recommended Items to Include in a Basic Information Disaster Response Kit:
Water, one gallon of water per person per day for at least three days, for drinking and sanitation	Record everything you do in a journal, this will help you keep track of what you've completed, and provide piece of mind down the road.
Food, at least a three-day supply of non-perishable food	Contact companies you have outstanding balances with, and inform them of the situation, requesting an extension as necessary for your current bill.
Battery-powered or hand crank radio and a NOAA Weather Radio with tone alert and extra batteries for both	Check your credit report and social security information at least weekly.
Flashlight and extra batteries	Check your data backups at least monthly.
First aid kit	Begin backing up your data if you haven't already.  Using an inexpensive USB thumb drive which can be stored in a safe is a quick and easy solution.
Whistle to signal for help	Contact the authorities if you believe a crime has been committed against you.
Dust mask, to help filter contaminated air and plastic sheeting and duct tape to shelter-in-place	Research and prepare a list of trusted companies who specialize in credit monitoring.
Moist towelettes, garbage bags and plastic ties for personal sanitation	Research and prepare a list of trusted companies who specialize in removing mal-ware or viruses from your computer.
Wrench or pliers to turn off utilities	Stop using your computer, or talking to phone scammers until you are sure they are safe to use.
Can opener for food (if kit contains canned food)	An emergency fund of cash to last you at least 1 month, just in case your accounts are frozen.
Local maps	A list of all account numbers including credit cards, banks, and even home utilities.
Cell phone with chargers	A contact list of toll free numbers to contact each of your providers.

Keep this kit somewhere safe and secure, and be ready to lean upon it to help you get through an Information Disaster.

Please share your thoughts on my suggestions above, I'd really be interested in making this list better!

Secure Cell

President Obama is still awaiting the security enhancements to his Blackberry that allows him to securely send/receive email and voice communications.  Officially, the government uses the Sectéra Edge smartphone to securely communicate.  While this should be the standard for ALL paranoid cell phone users; it may be overkill for the average user if the $3000+ price tag isn’t prohibitive.

While the casual cell phone user doesn’t require military grade security, the proliferation of smartphones or feature phones raises the risk of identity theft or social engineering.  Today’s cell phones are no longer restricted to making and receiving calls.  They are a major component of our everyday lives.  They hold our address books, calendars, email, music and much more.  While it is very convenient to hold all of this information in a single place, it poses a risk if they are lost or stolen.

Millions of cell phones are lost or stolen each year.  Think about the important information you store on your phone.  Names and numbers of friends and relatives; passwords; sensitive emails or text messages.  Not only does it expose this information to strangers, it is also very inconvenient for you.  Are you backing up this information?  While not all phones are capable of doing backing-ups or syncing data, the ones that do…should.

Spend a moment to review the information on your phone.  What could a stranger learn about you and your contacts if they had access?  At a minimum, they would be able to harass them.  At worse, they may have access to their physical location.  Is your phone tied to social networking sites such as Facebook or My Space?  How would you feel if a stranger or criminal had access to your friends’ and families’ contact information, pictures, etc.  Personally, it creeps me out to think that someone might browse photos of my wife and daughters.

So what should you do about this?  First, learn to live with a password to access your phone.  It is inconvenient at times to “log-in” to your phone but the level of protection that even a 4 digit password or pin provides is well worth the extra keystrokes.  My phones are set up so that calls can be made and received; however, access to address books and calendars, etc. are password protected.

Does your phone support remote wipe?  Enterprise Blackberries allow system administrators to delete content of lost or stolen cell phones, but what protection do you have if you are an iPhone, Palm or Windows Mobile user?  Utilities like Teallock for Palm allows you to send a “self destruct” text message to your phone wiping all information from the phone and memory cards.

Finally, be aware of where you leave your cell phone.  With cell phone insurance and “new every so many year” plans; people forget the value of the phone and particularly the information it contains.  Would you leave your wallet or purse lying around even if it was not filled with cash?  I often see phones left unattended on desks as I stroll through the hallways in the office.  I’ve seen them left in cars to charge.  I have even seen them dangling from a wall charger, unattended no less, at the airport.  The unfortunate reality is that a lost cell phone is not just a hassle for the owner, like with a wallet or purse, but also for the friends and families of those who are “lucky” enough to be in your contact list!

A lock will only keep honest people honest

When I was younger my parents tried to teach me about locking the car door, and the house, but they never really explained why.  I've learned over the years that locking something only really offers protection from the people who wouldn't steal anyway.

 

What do I mean? 

Simply put... a lock is breakable, if someone sees or suspects something valuable, then given enough time and a will to steal they will break that lock.  This principal applies both to physical items and your information / identity.

 

So how do you protect yourself?

To get started take steps to avoid being a target in the first place, start by protecting yourself with a few common sense practices.  It’s also very important to share these practices with people you know so they don’t accidently make you a target.

 

Here are a few ideas in each category:

Physical Items:

• When coming back to your vehicle, place all packages, laptops, even grocery bags in the trunk.  Don't wait until you've reached your destination, someone might be watching you to see if you move your laptop or new video game system into the trunk once you get there.
• Don't leave cell phones, GPS devices, or even the GPS holder sitting out; place them under your seat, or take them with you, especially if the item (Laptop, Blackberry, Wallet, Purse, etc) contains sensitive information.
• Lock your doors, go ahead and double check... it’s ok.

Information / Identity:

• Shred, Shred, Shred… Simply put; don’t put your personal identity at risk.  Shred any documents with your Name, address, phone number, Social Security, Bank Information, and or Credit Information.
• Be wary of the proverbial “To good to be true”, if it seems too good, you know what “IT IS”.  Don’t click on the email that tries to lure you into helping a foreign official exchange money, or the IRS link that offers you a double refund if you take this survey.

Quick Example:

A family decides to travel to the mall for an all day shopping trip.  They carefully put their GPS under the seat, and make sure the doors are locked.

A thief notices a GPS holder mounted to the front windshield, and quickly breaks their driver side window.  The thief then unlocks the door and ransacks the vehicle finding a GPS unit, a USB memory stick, and several house keys.

The thief then uses their GPS unit and presses the “Home” key to now burglarize their home. 

In short,  if they had taken the extra few seconds to put the GPS holder under the seat, the family wouldn’t have a broken window, lost checkbook, lost GPS, and a burglarized home.

 

In Summary:

A lock is still very important, however if there doesn’t appear to be anything of value to steal you probably won’t end up a target.

Phone scam targets insurance policyholders

The Ohio Department of Insurance has confirmed an on-going scam targeting insurance policyholders. According to the ODI, the scam is currently targeted primarily at auto policies. In this scam, the caller alleges that "there was a problem with your insurance payment" and asks for confidential information such as bank account numbers, birthdates, SSNs, etc. The call often includes a threat that "your coverage will lapse" if the customer does not comply.

You can read the full ODI press release at ohioinsurance.gov.

Insurance companies (like Westfield) do sometimes ask for confidential information such as SSNs and birthdates in the normal course of business. However, it would be highly unusual for the insurance carrier to contact the customer directly or to do so other than in writing. If you receive a call that strikes you as suspicious, hang up and call the number printed on your last policy statement. If the call was legitimate, the customer service representative will be able to look up your account and confirm it.

Be very cautious about handing out your personal information to anyone you do not know well. Ohio customers who have already received one of these fraudulent calls, are asked to report it to the ODI at 1-800-686-1527.

Lastly, if you believe that you may have given up your confidential information to a fraudulent caller, you should check your credit report and consider putting a fraud alert on your account. For more on how to check your credit report, you can follow this link to our archive of tips on this topic.

OnGuard Online

As the holidays get closer, many of us will turn to online shopping. Done right, online shopping is about as safe as catalog shopping - and much more convenient. If you don't take basic precautions, though, you could lose your shirt. Take the time to learn about the kinds of scams and cons that are used online.

The Federal Trade Commission hosts a terrific site with lots of content on identifying and deflecting these kinds of scams. If you haven't already been out to visit www.onguardonline.gov, I strongly recommend the site. It has some excellent overview material on security at the personal and small business level. The site also has a set of games covering a variety of topics like spyware, online auctioneering, peer-to-peer, phishing and spam. Test your knowledge of internet security and safe shopping. It's well worth the time to visit the site.

The site's material comes from a number of public and private sources but is all released for public use. If you run your own personal website, you can post their games, videos and handouts to your own site and help spread the word. (Instructions are here.)

Addendum:
This tip has inspired me to create a more permanent set of links to some of the better games and awareness quizzes that I've run across. I'll try to get them posted in a permanent sidebar on the blog but in the meantime, here are a few good links.

• CMU Anti-Phishing Game - Learn to identify fraudulent URLs
• Mission:Laptop Security - Protect your laptop while traveling
• Anti-phishing Father's Day card - Flash video on phishing
• Auction Action - Test your knowledge of online auctioning
• P2P Threeplay! - a quick quiz on file-sharing
• Invest Quest|http://www.onguardonline.gov/games/invest-quest.aspx - a simple quiz but the 'disclaimers' are pretty funny

You just received a Breach Disclosure Letter. Now what?

You just received a breach disclosure letter. Their systems were "compromised". Now what? Do you call the police, close all your bank accounts and change your credit card numbers, file the letter and hope for the best?

The first thing is to take a deep breath. Breach disclosure letters can be intimidating but don't panic. Take the time to figure out what, if anything, you should do. Read the disclosure letter itself very carefully. The disclosure letter should have some details about the breach. It may be enough to show that the breach didn't apply to you. (I got a letter recently about my son's medical information. Based on the dates in the letter, I knew that the breach couldn't have affected him.) If you want more information, look on the internet. Check out the company's website but also look for independent news reports. Be cautious about the blogs and other unverified sources, though. Look specifically to see what information is at risk. Also try to figure out whether the information was stolen or merely lost. If it was stolen, the odds are much higher that the information will be misused.

If you think it was stolen, start watching your accounts carefully, especially if the compromised information included bank or credit card numbers. Check those accounts online daily, looking for unauthorized transactions. If you see something suspicious, call your bank immediately.

If you haven't done so recently, request a copy of your credit report. You should be in the habit of checking it regularly. Be extra vigilant for a cycle or two after receiving a breach disclosure letter. If the thief is going to abuse your account, it will probably only be for a few large transactions sometime within 3-6 months of the theft.

If your Social Security number has been compromised, strongly consider calling the three major credit bureaus to put a fraud alert on your records. When reviewing your credit report, look particularly for new accounts opened in your name. If you feel you’re at a particularly high risk, you can also implement security freeze, though the costs may outweigh the protections for most people.

If the breach disclosure letter says that you are eligible for credit monitoring, think about that. Personally, I don't believe they will do anything for me that I'm not already doing for myself for free since I already monitor my credit report. I don't want to put my personal information in the hands of yet another company just so they can do the same thing. Worse, some of these monitoring services put into the contract that they will automatically renew you (for fee) when the free period runs out. I don't want to have to remember to turn off the monitoring in a year. But if monitoring will help you sleep better at night, consider it.

Finally, if you’re an actual victim of identity theft ( not just credit card fraud), you do want to call the police and file a police report according to Paul Stephens, director of policy and advocacy for the Privacy Rights Clearinghouse. Keep a copy of the police report for your records. You'll need it to prove your innocence as you attempt to clean up your credit reports. Follow the instructions at the credit reporting agency's website to dispute incorrect information.

based in part on a CSO Online column

Reminder: No Tip next week. Have a great Labor Day weekend.

Safe vacationing (encore tip)

It's hard to believe that it's almost Memorial Day and that people will start leaving for summer vacations soon. Please take appropriate precautions both before you leave and while you're on your vacation to reduce your risk of fraud and identity theft.

Before you leave:

1. Clean out your wallet.
   • Use traveler's checks or credit cards for payment. Leave your checkbook at home.
   • Leave your debit card(s) at home. Under federal law, your liability is limited if your credit card is misused. If your debit card is stolen, you could lose all the money in your checking account.
   • Take an ATM card that does not have debit card privileges. Your bank should be able to issue you an "ATM only" card.
   • Never carry your Social Security card in your wallet.
   • Leave any unneeded credit cards and any other unnecessary documents at home.
2. Photocopy your wallet and keep the copy in a safe place. If your wallet is stolen, the copies will tell you who to call to get your cards canceled. Note: If you will be gone for a long time, consider leaving a copy with someone you trust who can help you cancel the cards while you're still on the road.
3. Stop your newspaper delivery and have the Post Office hold your mail (or ask a trusted neighbor to collect them for you). The bills and account statements in your unlocked mailbox are a goldmine for an identity thief. And the packages and newspapers piling up on your front step are a sure sign to a burglar that you are away.

While on your vacation:

• Don't leave your wallet, passport or any identifying documents in your hotel room unattended. Use the hotel safe if it's available.
• Keep your identity document (passport or drivers license) separate from your wallet. Carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.
• Guard your credit card receipts and rental car agreements, especially if they contain your full credit card number or driver's license number.
• Use ATMs at banks or credit unions and which are in well-lit areas.
• If you are taking your laptop with you, be very careful when using it for on-line banking and other password-protected services, especially if you are connecting to a wireless hotspot.
• Be equally cautious of cyber-cafes and other public-access internet facilities. Anyone could have left a keystroke logger on the machine in order to capture your ID and password.

By the way, there will be no InfoSec Tip next week. Have a safe holiday.

Credit freeze - defined

Most states have passed "credit freeze" laws, allowing individual consumers to lock their credit reports and, in theory, reducing their vulnerability to identity theft. While the credit freeze is in place, the credit reporting agency may not give out your credit report unless you explicitly grant permission and confirm your identity using a PIN or password. This makes it harder for the identity thief to open an new account or to get new credit in your name.

Even if your state does not have a credit freeze law, the three major credit reporting agencies now offer freezes voluntarily. To institute a credit freeze, you generally need to send a written request to each of the three major credit reporting agencies. The specific instructions vary from state to state. You can find links to each state's instructions at ConsumersUnion.org. The states allow the credit reporting agency to impose a fee to initiate the freeze (usually $5-10 per credit reporting agency but often free to confirmed victims of identity theft) .

If you do freeze your credit report, you will have to lift the freeze whenever you want credit. Under almost all the state laws, you'll have to pay again each time you want the freeze lifted. This can make opening a new account or even changing your existing service more difficult and expensive. When you apply for the freeze, you will be given the instructions and PIN needed to lift the freeze. In some cases, you'll have to lift the freeze yourself – in others, you might be able to authorize the merchant to do it for you. Either way, it will take some extra time. It will also make you ineligible for "instant credit" unless you lift the freeze before going to the store.

The credit freeze laws have implications for businesses that use credit reports for purposes other than lending (such as evaluating underwriting risk). Unless the state law has explicitly carved out that usage as allowed (and many but not all states did for underwriting), the business should expect extra paperwork and several extra steps in the process to get permission to view the consumer's credit report. The law varies from state to state. Check with your corporate counsel for details.

As a consumer, you should also know that a credit freeze will not necessarily keep you safe from identity theft. While most reputable creditors will check your report before issuing credit, some don't. Identity thieves can still exploit those situations, knowing that you will have to pay the consequences. A credit freeze also will not protect you from exploitation of existing accounts.

If you are at increased risk of identity theft and already have a house, car, phone service and the credit cards you need and you see no near-term need to refinance any of them, a credit freeze might be appropriate for you. If you have few risk factors or will need to legitimately seek credit for yourself soon, a credit freeze could be more trouble than it's worth. Personally, I do not have a credit freeze on my account. I take normal precautions to make my identity hard to steal in the first place (I have a shredder and use it, I don't leave financial documents like credit card bills on the kitchen counter, I don't keep my SSN in my wallet, I use strong passwords, etc) and I check my credit report regularly. To me, the incremental protection of a credit freeze is not now worth the extra hassle and expense.

What to do when you lose your wallet

My brother-in-law had his wallet stolen over the weekend. In the interest of learning from the misfortunes of others, here are some things to think about.

1. Never, never, never carry your Social Security card in your wallet.
2. Photocopy your wallet about once a year. Lay the contents out on a copier (front and back) so you have a record of all the cards and contact numbers.
3. Only carry the cards that you use on a regular basis. Leave the rest in a safe place at home. If you have bills set up to auto-pay by credit card, use a card that you leave home. Otherwise, you'll have to change all those accounts when the card is cancelled.
4. When your wallet is lost or stolen, immediately call the financial institutions and start canceling the cards that were lost.
5. Call the three credit reporting agencies and put a fraud alert on your account. Consider putting a credit freeze on your account. (A fraud alert is free but must be renewed in 90 days. A credit freeze will typically cost $10 and requires extra effort to have lifted when you want to apply for credit legitimately but it provides somewhat better protection.)
6. If you haven't reviewed your credit report lately, do it now. Follow the instructions at annualcreditreport.com.

Police advise men to keep the wallet in their front trouser pocket, not a jacket pocket and definitely not a rear pocket. Police advise women to keep their purse with them and to carry it on their strong-hand side (if you're right-handed, carry it on your right shoulder).

If you're traveling, keep your identity document (passport or drivers license) separate from your wallet. Carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.

Annual credit report review

This Tip was first run in March 2007. This "encore tip" is an annual reminder to check your credit report.

This is your annual reminder to request your credit report. Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is eligible for a free copy of his/her credit report every 12 months. Follow the instructions at www.annualcreditreport.com to request your credit report from each of the three major credit reporting agencies.

When reviewing the credit reports, look for:

• adverse actions on your accounts that might indicate that you have been a victim of identity theft
• accounts that have been opened in your name without your knowledge. Even if the identity thief is making the payments regularly, the account could still be in use for illegal activities.

If you find a discrepancy, follow the specific instructions on the website to dispute any incorrect information.

Don’t forget to check the credit reports of your immediate family members, especially minor children and dependent elders. Both of those groups are at elevated risk of identity theft.

Remember that you are also eligible for a report every 12 months from any of the specialty agencies which have information about you.

If you want more frequent feedback on your credit history, consider asking for your free copy from only one of the major credit reporting agencies at a time. Space the requests for the other two agencies out every four months. For example, you could ask for your free copy from Experian in March, your free copy from TransUnion in July and your free copy from Equifax in November. Once you start, you will have to keep the same rotating pattern. Schedule the requests on your calendar.

Shredding is a Federal requirement

Under Federal Trade Commission regulation, any information about an individual that is derived from a consumer report or is a compilation of such records must be properly destroyed. These days, almost all of customer information has some connection to a consumer report and is covered under this regulation (scroll to pg 32).

The regulation does not actually require shredding but for most of us, that is the only cost-effective way to comply with the regulation's requirements for destruction. Papers in regular trash are exposed to the public and any private information on those papers can be misused by an identity thief. It can cost your customers thousands of dollars to get their identity back and could be considered a violation of federal privacy laws.

I strongly recommend a "shred all paper" policy for your office because there is too much risk that a piece of personal information will be overlooked on the back side of a form or that the page was used for scratch paper while you were on the phone. It's also easier to enforce the policy when you have a simple rule like "No office paper may be thrown away in the regular trash."

Very small offices can get away with a personal shredder. If you've got more than about 10 or 15 people in the office, it's probably more cost-effective to contract with a reputable shredding vendor who will pick up and properly dispose of your paper waste. Most of the shredding vendors will provide locked bins where the paper waste can be stored until pickup. Have enough bins to be convenient for staff.

Cyber-privacy

Online privacy is hard to achieve – and impossible when you don't think about it enough ahead of time. Anyone can see just about anything you ever wrote online. That includes webpages, blogs, discussion forums, social sites and email. Recruiters routinely check these sources before making hiring decisions. They are also increasingly popular with investigators. Anyone wanting to look into your background can find a wealth of information online.

There is little true anonymity on the internet. Some sites use passwords to limit the number of people who can access information but passwords are routinely compromised. Other sites allow you to use a pseudonym rather than edit under your real name. With a little bit of work (sometimes very little work), almost everything you wrote can be traced back to you.

Many believe that the vastness of the internet protects them. With millions of pages created every day, how would a hacker ever find my little blog or my email where I admit to some personal detail? In a paper-world, correlating all those sources was impossible. Now, we have powerful search engines and intelligent programs that can match details across multiple pages. They are incredible research tools and make the internet far more useful to all of us but they also can be used to create astonishingly complete profiles of you and your family.

None of it really goes away, either. Even if you removed the webpage, deleted your MySpace account and purged all your email, cached versions may still exist scattered all over the internet. Think twice about what you write and how you write it. Once you post something, you must forever live with the consequences.

When posting online, always assume that someone who you can't even guess at today will find and use the information. If you want the information to be private or restricted to a small group of people, the internet is probably not the best way to communicate. Remember too that even if you've never published anything online, you probably have a nephew or distant cousin who is working on a family history and including details about your life. Keeping your private details private takes work and vigilance.

Ohio Breach update

If you live in Ohio, by now you've heard about the loss of the computer backup tape. You may even have received a notice from the state that your information was on the lost tape. By some estimates, the information from as many as one in six Ohio taxpayers was on the tape in one form or another.

On 10 June, the tape was stolen from a state employee's car. The employee had the tape off-site as part of their regular backup procedures to ensure that they would be able to restore their computer systems if something happened to their data center. By all accounts, the information was stored on the tape in a proprietary format that would be very difficult for any outsider to read or interpret. If you've received one of these notices, the probability that your information will be misused is extremely low. You are at far greater risk of identity theft from a family member or friend than from an anonymous crime of opportunity.

If you have received such a notice, you do have a few choices. First, verify that the notice is legitimate. The first round of notices went out from the Ohio Department of Taxation. The second round came from the Ohio Department of Administrative Services. There are unconfirmed reports of fake notices but you can confirm the real notice by going to the state's official site at www.ohio.gov/idprotect/. Don't respond to any telephone call or email on this topic. The state is contacting individuals only by mail.

Second, I strongly recommend that you check your credit report regardless of whether you've received a notice or not. You are entitled to a free copy of your credit report every 12 months. Look for accounts that you didn't open. If you find something suspicious, follow the dispute-resolution procedures included with the credit report. Consider checking just one of the three major agencies right now, the next in 4 months and the last in 8 months. That gives pretty good coverage at three times the frequency.

Third, watch your existing accounts carefully. Check for unauthorized charges or withdrawals and watch out for missing monthly statements or bills. Hackers often file a change-of-address to keep you from noticing the abuse. Call your financial institution if you see anything suspicious.

Fourth, think about the identity theft service offered by the state. The state has contracted with Debix to put a fraud alert on your credit report if you sign up with them. You can do the same thing in a few minutes by calling or mailing the fraud department of the credit bureaus. They also offer some other services, but again, nothing that you can't do for yourself (and have probably already done if you've been reading our Tips regularly). Personally, I will not be giving yet another copy of all my personal information to a state-contracted agency when I can do it so easily myself. Note: the fraud alerts expire every three months. Don't forget to renew. And remember that while most creditors will check before opening a new account, they are not required by law to do so. A fraud alert does not replace checking your credit report regularly.

On the other hand, if you don't think that you'll remember to check your credit report regularly, a service like Debix can be useful.

If you received the notice for your company (rather than about your personal information), there is nothing special that you need to do. It is much harder to abuse a corporate tax ID number than it is to abuse a SSN. Your organization's normal fraud-control procedures are probably sufficient to protect the company.

You should also learn from the state's example. Protect your company from a similar breach by reviewing and updating your data backup procedures. Make sure that the off-site backups are kept well protected and are encrypted if at all possible.

ID Theft by a family member

Despite all the media hype about hackers, security breaches and lost laptops, research shows that just over half of all identity theft is committed by someone close to the victim – a family member or close friend. Recent research also indicates that 55% of all identity theft is committed based on paper documents. As a company, we have to be worried about the attacks against our systems. As an individual, the statistics say that you should be more worried about Uncle Joe or Grandma picking up the credit card statement from your kitchen table.

Unfortunately, if you discover family-related identity theft, there are few good solutions. Most of the legal protections that you have as an identity theft victim will require that you file a police report. The police report could lead to prosecution and even jail time for the offending family member. Few families are ready for the emotional difficulties of prosecuting the case.

Occasionally, a lender will let the victim off the hook without a police report if the thief admits to the deed and commits to making payments and has the means to do so, according to Linda Foley of the Identity Theft Resource Center. The family typically needs to hire a lawyer to conduct the necessary negotiations and to draw up the paperwork.

If you live in a "credit freeze" state (OH is not one yet), you can at least stop further abuse of your identity by putting a freeze on your account and on the accounts of the rest of your family. Freezing your account may not require a police report. Check your state laws for more.

Prevent identity theft in the first place by buying a shredder, locking up or filing bills and statements with personal information and checking your credit report regularly. You can request your own credit report online for free every 12 months. Don't forget to check your family members' credit reports at the same time. Children and dependent elders remain high priority targets for identity thieves. (Note: Requests for the credit report of a minor under age 13 must be submitted in writing on this form and with the identifying documents listed here.)

Credit Report reminder: For those of us on the "trimester plan" for reviewing our credit reports, it's time to ask from for your free copy of your credit report from the next agency.

Annual credit report review

This is your annual reminder to request your credit report. Under the Fair and Accurate Credit Transactions Act (FACTA), every consumer is eligible for a free copy of his/her credit report every 12 months. Follow the instructions at www.annualcreditreport.com to request your credit report from each of the three major credit reporting agencies.

When reviewing the credit reports, look for:

• adverse actions on your accounts that might indicate that you have been a victim of identity theft
• accounts that have been opened in your name without your knowledge. Even if the identity thief is making the payments regularly, the account could still be in use for illegal activities.

If you find a discrepancy, follow the specific instructions on the website to dispute any incorrect information.

Don’t forget to check the credit reports of your immediate family members, especially minor children and dependent elders. Both of those groups are at elevated risk of identity theft.

Remember that you are also eligible for a report every 12 months from any of the specialty agencies which have information about you.

If you want more frequent feedback on your credit history, consider asking for your free copy from only one of the major credit reporting agencies at a time. Space the requests for the other two agencies out every four months. For example, you could ask for your free copy from Experian in March, your free copy from TransUnion in July and your free copy from Equifax in November. Once you start, you will have to keep the same rotating pattern. Schedule the requests on your calendar.

Photocopy your wallet

If your wallet is ever lost or stolen, you need to immediately contact the issuers of all the credit cards and identity documents and begin the process of getting new cards.

About once a year, lay out the contents of your wallet on a photocopier. Copy both the front and back so you have a record of all the card numbers and phone numbers.

Be sure to keep the copy in a very safe place. When you make a new sheet, be sure to shred the old one so it can not be misused.

File a police report immediately in the jurisdiction where your credit cards or wallet were stolen. Do not wait until you return home. Promptly calling the police shows to the credit providers that you were diligent and will be the first step toward their investigation.

Consider calling the three national credit-reporting agencies to place a fraud alert on your name and social security number. That will make it a bit harder for the thief to open new accounts in your name.

If you are traveling, keep your identity document (passport or drivers license) separate from your wallet. You should also carry a photocopy of the first two pages of your passport in a third pocket whenever traveling abroad.

Protect Your Customers' Social Security Numbers

This article was originally published in the Oct/Nov 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

We all know about the rising threat of identity theft, and hear how it can affect a person's life. Along with businesses, legislatures around the country are also under a lot of pressure to do something about identity theft. Here are some tips to help you keep your customers' Social Security Numbers (SSNs) and your agency safe. It's not just a good practice - in almost all states, it's the law.

• If you don't absolutely need the SSN, don't ask for it. Take the field off forms unless it is absolutely necessary.
• If you only need the SSN once, use and destroy. Don't record a copy or make a note "just in case." If you must ask for the SSN, protect it carefully:
  • Watch records that get posted on a web site. Be cautious of spreadsheets with SSNs, which can get found via a search engine. Keep documents with SSNs in secured folders.
  • For log-ons to web sites, don't use the SSN unless the web site also requires a password or PIN for access.
  • Several states explicitly ban the selling, renting, trading, etc. of any list containing the consumer's SSN, so don't give out a consumer's SSN to anyone.
  • Only print or show the last four characters from the SSN.
  • SSNs may not be printed on any ID card required for the individual to receive products or services. That means that SSNs generally may not be printed on the proof-of-insurance card. This includes embedding the SSN using a barcode, smart chip or magnetic strip.
  • Unless the message is encrypted, don't request or send SSNs via e-mail.
• When sending mail, do not print the SSN on anything mailed to the individual unless required by law. The news tends to highlight the technology-based hacks and compromises but research continues to show that most identity theft is committed based on paper records and the largest single source of stolen SSNs is still physical mail theft. (The second source is trash.)
  • If you do send a document with a SSN in the mail, be sure the SSN is not visible through the envelope. Also watch postcards, top-sealed mailers with open sides or envelope window openings.
  • The "required by law" exception applies primarily to certain HR records like your W-2. There may be a few state laws requiring us to send SSNs by mail either to a state agency or to the individual but as a general rule, avoid putting any document with the consumer's SSN in the mail unless it is strictly required.
• Destroy everything when it is no longer necessary. As soon as that retention period runs out and the record is no longer necessary, make sure that it is properly destroyed.
  • Paper documents should generally be destroyed by shredding. While the FACTA Disposal regulation allows other means of destroying paper documents, shredding is almost always the most reliable and cost-effective way.
  • Make sure that all electronic media (hard-drives, floppy-disks, thumb-drives, CD-ROMs) get sent back to your IT department for wipe. Make sure that the data has been irrecoverably destroyed first before donating or throwing away.

Private information on cell phones

The average cell phone has a life expectancy of 18 months. What happens to all your personal information when you upgrade your phone? In too many cases, that personal information gets passed along to the next user.

Personal information can include:

stored phone numbers and addresses	usually not much of a worry
records of calls made or received	not a problem unless you've been talking to someone that you wouldn't want your spouse or employer to know about
pictures	again, may not be a problem depending on what kind of pictures you took
copies of text messages sent and received	often a serious privacy issue
the speed-dial setting for your voicemail with both the access number and password	potentially very serious

This is not an all-inclusive list. Modern phones also include calendars, memo pads, to do lists and other applications, all of which you might have used and which might have personal or business information that should be kept private.

Most phones include a delete function but independent reviews of those delete functions show them to be mostly pretty poor. Good hackers can undelete the information on most common cell phones with only a little specialized equipment and knowledge. To protect your privacy:

• Treat a phone's text message service with the same caution that you use for unsecured email. Be especially professional in your use of text messaging.
• Make sure that your old information is really gone before giving the phone to a friend, family member, charity or try to sell it online. (If all else fails, a 2½ lb sledge hammer does a very reliable job of making the data unreadable – but it won't be worth much when you're done.)

For additional information and a real-life scenario, read this recent story from CNN.com.

Notification - Security Breach

This article was originally published in the Jul/Aug 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

State Laws Require Notification of Security Breach

States are aggressively requiring companies to tell consumers if there is a security breach affecting the consumers' personal information. As of May 8, 2006, 28 states have enacted laws and another 17 have legislation pending. There are also several competing federal bills that require breach disclosure. You need to know how to keep your agency compliant with these new laws.

The Security Breach laws require notification anytime there is reasonable belief that a person's private information is at risk of identity theft or fraud. Most of these laws are very similar to each other, though there are some state-to-state differences. Contact your local legal counsel for specifics.

What is a "security breach?"
The laws generally define a "security breach" as the unauthorized acquisition of computerized data that compromises the security or confidentiality of personal information. In most states, laws do not apply to employees or agents using personal information in good faith for a business purpose, as long as the information is not later used for an unlawful purpose or subject to unauthorized disclosure.

What is included in personal information?
Personal information includes an individual's name (first name or initial plus last name) in combination with at least one of the following:

• Social security number
• Driver's license number or state identification number
• Account number, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual's financial account
  Note: In general, if the data elements are encrypted, or otherwise made unreadable, that would not constitute a breach.

What to do if your agency has a breach
Notify the people who may be affected as soon as possible. Some states, such as Ohio, require notification no later than 45 days after you discover or find out about the breach. Some specific exceptions to the 45 day requirement apply, such as a request by law enforcement.

You can provide notification in writing or by other means as specifically allowed in the law. The notification must include a description of the information which was potentially compromised and an explanation of the consumer's rights. Most states also require you to provide a toll-free contact number for consumers to call for more details.

Working with Westfield

When you own and process all customer information yourself, this law is fairly straightforward. If you share information with a business partner or vendor, the responsibilities are more complicated. This has led to some misunderstandings. At least one news bulletin claimed that agents have no obligations under this law if the information systems of an insurance carrier are breached. In fact, the law requires that the company processing the data notify the company which "owns or licenses" the consumer information and that the "owning" company must notify the consumer. According to the Westfield Agency Agreement, the Independent Agency owns the relationship with the consumer and the consumer's information.

This approach to notification is a result of lessons learned in the CardSystems breach. (CardSystems was a credit card processor for MasterCard, Visa, etc.) When CardSystems attempted to notify consumers, many threw the notice away unopened because they did not recognize the company and assumed it to be junk mail. Many legislators concluded that the notice must come from the company with which the consumer has the relationship in order to be effective.

If your agency has a breach, Westfield will work with you to determine who should notify the customer - the company or your agency. Often, it may make more sense for Westfield to notify the customer, and we will work with your agency to find the solution that is in the best interests of the customer if this situation arises. Westfield stands ready to assist in the notification to any Westfield consumers in the event of a breach either to Westfield's systems or to your agency's systems.

Westfield has also taken aggressive steps to safeguard all customer data. These days, an ounce of prevention is worth far more than a pound of cure.