Information Security Tips from Westfield Insurance

Information Security Concerns in Hotels and Hotspots

More and more of us are using our computers while we are on trips and are making use of the ever increasing number of wireless hotspots that are popping up everywhere.  I wanted to take this post and discuss some risks associated with connectivity in these environments and offer some simple things that you can do to reduce these risks.

• Most hotels and wireless hotspots offer a number of wireless access points to connect to.  Each one will appear separately in your wireless network list.  You should check with the establishment you are at as to which ones are "official" and which ones are not.  Many times scammers set up an access point named something similar to those provided by the establishment.  These rogue access points can be set up to perform a classic "man in the middle" attack known as an "evil twin" to forward all your traffic to a real access point and simply capture everything you are doing online.  Another scam is to offer you access at an additional fee.

• When entering your ID and password in public places, take extra care to watch for people looking over your shoulder. "shoulder surfing" it is sometimes called.  It does happen.

• Wireless connectivity can be implemented securely but if you have a choice between a wireless access point and plugging your laptop into a network jack choose the network jack.

• It is important to have your personal firewall turned on and configured with a restrictive rule set when attached to non-trusted networks.  What I mean by a "restrictive ruleset" is simply configuring your firewall to only allow software you trust to access the Internet, and block all other software and network traffic. Anti-virus software should also be enabled, have real time protections turned on and be configured to download anti-virus signature updates automatically.  These are relatively simple things to do.

• Use your corporate VPN (Virtual Private Network).  If you are doing work for your company and they have VPN capabilities, you may be safer connecting to the Internet this way.  It may sound strange, connecting to the Internet to connect to your company to connect back to the Internet but your company has protections in place to block malicious traffic, attackers and websites.  If you establish an encrypted VPN tunnel to them and surf through their network to the Internet, you are adding a few controls that can protect you.

• Keep your laptop powered off when you leave it in your hotel room.  Lock it in the safe if it will fit.  If you just lock the screen (control alt delete), there are vulnerabilities that could be exploited while you are not there to gain access to your software and information.

• Don't leave your laptop sitting there all alone when you get up and get another coffee or cheeseburger.  It may not be there when you go back to your seat. Same goes for USB drives.  It is pretty easy to swipe them without notice.

• Encrypt your hard drive and USB drives, or at least sensitive data or subdirectories on them.  If the unthinkable happens and your laptop is lost or stolen, let the most significant thing the thief gets be the laptop.  It may sound like a hassle but losing $1000.00 on a laptop is a whole lot better than a case of identity theft for you and any other people regarding whom you have their information stored.  Same goes with information about where you live, your children, relationships you are in, etc… Any of this information could be used against people you care about.

Its not a pretty world out there so the best thing you can do is be prepared.

An Information Disaster Kit Prepares for the Silence after the Storm

Have you ever wondered what it would feel like to have a hurricane or a tornado fly over you, the loud swirling sounds ripping away?  Then after what feels like hours rather than a few short minutes all is quiet, leaving you wondering what will happen next.  I'd imagine this same feeling hits just about everyone after they realize they have shared personal information with a con artist or scammer.  How many of us are prepared for either of these disasters?

Natural disasters cause significant damage to us financially, emotionally, and physically, however so can Information Disasters like identify theft, or a virus that deletes every photo we've taken in that past 5 years.  Preparation for such a disaster is key to avoiding or recovering from it, but what is the right level of preparation for an Information Disaster?  Most of us could put together either of the kits in a few hours, but many of us don't feel they are necessary or believe it won't happen to them.  I'd encourage you to take a few minutes and put together at least a few items from each of the lists below.

Ready America provides a list for preparing a Disaster Kit, I'll compare this kit to my suggestions for an Information Disaster kit.

Recommended Items to Include in a Basic Emergency Supply Kit:	Recommended Items to Include in a Basic Information Disaster Response Kit:
Water, one gallon of water per person per day for at least three days, for drinking and sanitation	Record everything you do in a journal, this will help you keep track of what you've completed, and provide piece of mind down the road.
Food, at least a three-day supply of non-perishable food	Contact companies you have outstanding balances with, and inform them of the situation, requesting an extension as necessary for your current bill.
Battery-powered or hand crank radio and a NOAA Weather Radio with tone alert and extra batteries for both	Check your credit report and social security information at least weekly.
Flashlight and extra batteries	Check your data backups at least monthly.
First aid kit	Begin backing up your data if you haven't already.  Using an inexpensive USB thumb drive which can be stored in a safe is a quick and easy solution.
Whistle to signal for help	Contact the authorities if you believe a crime has been committed against you.
Dust mask, to help filter contaminated air and plastic sheeting and duct tape to shelter-in-place	Research and prepare a list of trusted companies who specialize in credit monitoring.
Moist towelettes, garbage bags and plastic ties for personal sanitation	Research and prepare a list of trusted companies who specialize in removing mal-ware or viruses from your computer.
Wrench or pliers to turn off utilities	Stop using your computer, or talking to phone scammers until you are sure they are safe to use.
Can opener for food (if kit contains canned food)	An emergency fund of cash to last you at least 1 month, just in case your accounts are frozen.
Local maps	A list of all account numbers including credit cards, banks, and even home utilities.
Cell phone with chargers	A contact list of toll free numbers to contact each of your providers.

Keep this kit somewhere safe and secure, and be ready to lean upon it to help you get through an Information Disaster.

Please share your thoughts on my suggestions above, I'd really be interested in making this list better!

Real-Time Trojan

In a recent NY Times article, some of the elite hackers are taking advantage of the real-time Web. These hackers have released the next generation of Trojans which uses a Twitter-like stream to channel information back to the hacker in real-time.

The ability to report back in real-time allows hackers to get around roadblocks such as RSA’s SecureIDs, temporary one time passwords. By sending this temporary password back to the hacker immediately, it allows them to sign onto your account.

Joe Stewart, the director of malware research for SecureWorks, recently decoded a particularly nasty Trojan that uses a real-time technique called Clampi, which is used to attack people who have access to corporate bank accounts with large balances.

This Trojan is being unknowingly downloaded through people going to hacked websites that download the code onto your machine. Clampi can take advantage of a vulnerability in Windows and spread itself to all of the computers on a corporate network. Mr Stewart found that all the infected machines were coded to notice when the user visits any of 4,600 Web pages, including banks and brokerage sites.

Clampi then transmits a real-time stream of user actions using instant messaging-like software. Hackers would log into the bank account and initiate wire transfers, funneling them through accomplices or fake employees.

What can you do to limit your chances of getting one of these Trojans? One way to keep your computer clean of malware by avoiding suspicious e-mail attachments and Internet downloads. Also, keep your antivirus definition up to date. When a new piece of malware is discovered, AV companies add it to their list of checks.

Cash for Crooks Buying Your Clunker

Many Americans are trading in their gas guzzlers for a fresh start as part of the government’s “Cash for Clunkers” initiative.  Your rush to trade-in your vehicle for $3500-$4500 may not be worth it if you don’t spend an extra moment to give your car a thorough once-over before leaving the dealership.

As a long-time buyer of “previously enjoyed” vehicles, I am amazed by what I have found left behind by the previous owner.  Besides the typical French fries, coins and Skittles hidden under the seats; I have found plenty of personal information.  Information that you probably don’t want the new owner to have in their possession.

Glove box – Your dealership was nice enough to put all of your loan origination paperwork, licensing & title information in the leatherette binder which holds the owner’s manual you never read; before you trade your car in, make sure you remove all of that paperwork.  It includes your name, address, social security number and income information.

Center console – I’ve found ATM receipts, credit cards and a checkbook.  Did I mention that I had the previous owner’s signature on file (see glove box)?  Most new cars have a removable tray to trick thieves into believing that nothing lies beneath the center console.  It’s also the perfect place for owners to place things only to forget them there forever.

Seat pockets – The backs of the driver’s and passenger’s seats have soft pockets that are sized perfectly for medical billing information.  My wife usually places our children’s immunization records and school information here as she straps the children into their car seats.

Trunk – You never used the spare tire but somehow that tire well was able to collect things anyway.  Aside from the $10 in loose change, there’s a good chance that missing (intentionally placed) house key is there for the new owner’s taking.  Don’t forget they have your address!

In conclusion, it’s a great time to take advantage of a government subsidized new car purchase.  Just make sure you spend an extra 15-30 minutes going over all of the nooks and crannies of your vehicle to make sure you aren’t handing over your life’s story to an identity thief.  And if you are wondering where the other sock went, you might start here too!

Four Steps to Avoid Scams: A Courage-Building Cheat Sheet

New scams are created every day which target each and every one of us.  The AMS Users group identified a prime example recently that targets independent insurance agents. This new scheme attempts to steal an agent's credit card information posing as a representative of the department of insurance.

 

Our blog posts have identified several of the scams in the past such as toner scams, and the Michael Jackson spam emails recently spread across the web.

 

Most people find it difficult to challenge these scammers, but a great courage builder is to make a simple cheat sheet and post it near your phone. Here is an example that hopefully will save you quite a bit of grief and money in the future:

 

Step 1: If it sounds too good to be true...it most likely is.

 

Don’t be afraid to ask hard questions after all they wouldn’t be calling you if they didn’t want to.

 

Step 2:    Ask for a reference for validation or a call back number.

 

A scammer probably won’t have a reference available and surely won’t want to give you a number to contact them back. If they aren’t reputable enough to have a reference, use caution.

 

Step 3:    Ask for the request or offer in writing.

 

Any offer can be provided in writing, and it provides you an easy out if someone is attempting to pose as an official or service provider.  Most companies have policies which state they must send you a notice in writing if requested.

 

Step 4:     If and when they hang up on you, take it as a compliment.

 

You most likely just avoided a scam.  Feel good about yourself, and share your experience with others.  One of the best ways to protect yourself and others is to share positive experiences.

 

Feel free to share your cheat sheets as well!

 

Security Certificate Warnings

Have you ever gone to a secure (https://) web site before and gotten an “invalid certificate”?

 

The purpose for these warnings is to tell you that there is a problem with this Web site's security certificate. which should cause you to stop and take notice. According to a recent Carnegie Melon University study, there’s a good chance you’ll ignore it and click through anyways.

 In a laboratory experiment, researchers found that more than 55% ignored the certificate warning. The experiment started with an online survey of over 400 Web surfers. Then 100 people were brought in and were studied on how they surfed.

 What the experiment uncovered was that people had a mixed-up understanding of the warnings. Many thought these warnings meant they could ignore the messages when going to a site they trusted and should only be concerned when a less-trustworthy site was being visited.

 Often these warnings relate to a technical problem on the web site, but it can also mean that you’re being redirected to a fake Web site. If you were attempting to get to your online banking and received a certificate warning, it could be an attempt to transfer you to a fake site to steal your bank access credentials.

 So what should you do? Well, the best thing to do if you get a certificate warning is to read the message. If the site you’re going to is your online banking or other site that requires credentials, call the company and ask them about the warning. A phone call could save you from a potential mistake.

 The complete article can be read @ http://www.techworld.com/security/news/index.cfm?newsid=119829

Ahoy There Me Hearties!

Several weeks ago, I logged into Twitter (@jodoan1) to learn that The Pirate Bay had been sold to a legal software manufacturing company.  For those unfamiliar with The Pirate Bay; they are a website dedicated to tracking torrents which facilitate the piracy or illegal sharing of software and movies.  Like Kazaa and Napster before them, The Pirate Bay has turned over a new leaf and appears to be going down the road of legal file sharing.

So if they can do it; what is stopping you?  I have admittedly violated an end-user licensing agreement or several in my lifetime.  It started when I made a copy of a friend’s Def Leppard tape which he dubbed from his brother’s friend.  The audio quality was about as good as an MP3 ripped at 10kbps for the younger crowd or a Heathkit AM radio for the more mature.  As a poor college student I may have borrowed a friend’s software installation disk to install on my hand-me-down computer.  Likewise, I have burned a few disks for friends and family.  I am remorseful of my poor judgment in the past and I have made it a point to live a pirate free life moving forward.

Is this blog a step in my twelve-step program to pirate recovery?  No.  Well, maybe.  The thought came to me as I was looking to purchase a photo editing program recently.  The software license cost is $300.  WOW!  What a penny to pay when I can find a license key on the Internet for free or have a family member, who is a teacher, purchase the software at the discounted education price of $99.  But why should I implicate loved ones in a crime?  Would you ask a family member to help you steal from the grocery store?  The problem is people see these crimes differently; when in reality, they are very much the same.  “Borrowing” software that is not properly licensed IS a crime and it costs consumers and manufacturers billions of dollars every year.

Besides the obvious ethical concerns around pirated software, videos, music, etc; there are many information security related risks as well.  Users who download media from peer-to-peer or bit torrent sites are more likely to become infected by viruses or other malicious software.  Additionally, the lack of support may outweigh the initial cost of the software if you incur any downtime.  Like any other crime, there is always the risk of being caught.  Those who are caught may find themselves owing tens if not hundreds of thousands of dollars in fines and penalties.  It makes $300 seem like a real deal to me.

You live your life righteously and have never borrowed or copied software; but that doesn’t necessarily mean you aren’t violating copyright law.  How often do you audit your computer network for installed software?  Just because Joe in accounting purchased Quick Books at Staples doesn’t mean that you are properly licensed to have it installed on YOUR company asset.  Users may be downloading freeware tools and evaluation software on your behalf if you aren’t preventing them from doing so.  Ad-Aware offers a no cost consumer version of its software, but commercial installations must be licensed and paid for.

To end an otherwise lengthy debate on ethics and law; I will recommend a few things to keep yourself out of hot water.

1)      Properly license your and your company’s software if you are in a position to do so

2)      Audit your environment regularly to determine whether unauthorized software has been installed.  If the user has a legitimate reason for installing a particular application, see step 1.

3)      Think about your business or your employer’s business the next time you are tempted to borrow a copy of software or other copyrighted material

Finally, the software industry is evolving.  Competition has driven down the cost of many software applications.  There are many “open source” or free applications that are compatible with their expensive name brand counterparts.  Offerings like Open Office, Picasa and AVG are just a few examples of affordable applications that are available.

The dangers of vacationing via your web browser

Now that mid summer has arrived, most people are looking forward to a vacation.  Of course it's important to let everyone know you will be away from work for a few days, but when is broadcasting your upcoming vacation on Facebook, Myspace or Twitter a danger?

Let's say you plan to travel out of state for the week, and you post to your Facebook profile about it.  It just so happens a thief may be watching by searching public profiles for the word "vacation" or "leaving", and they run across your post.  Now they know when you will be gone, and it's not very hard to lookup your full name and city from your profile.  From there a simple google search provides directions to your home.  Guess what happens next?

What can you do to protect yourself?

Take steps not to post information which could harm you or your property.

Examples: 

• Don't post about vacations, business trips, the big graduation party at the park, or going to the mall until you've come back.
• It's not a good idea to post about your brand new car or HD TV.

Ensure your privacy / security settings are appropriate for your accounts.

Example:

• Set your Facebook "Privacy Settings" so you aren't broadcasting information to everyone in your "Network." Remember, "network" could mean everyone in a specific geographic region for example.  Maybe only your friends, and maybe their friends, should be able to view your profile.

There are multiple options to securing a Facebook profile:

• Secure your basic profile to make sure only people you want to see your information can see your information.
• Secure your search settings to determine who can search for you, and what they can see about you.
• Secure your posts to make sure you aren't sending everything you post to everyone, unless of course you want to.
• Secure any add-ins and remove applications which are no longer being used on your account.

Sure are a lot of options available to secure an account, but it's important to pay attention to each of them. 

I hope this encourages a few people to take another look at their profile settings, and start thinking about what kind of personal information should or shouldn't be posted.

If anyone has any great ideas or recommendations, please drop them off so everyone can benefit.

You don’t need to (and shouldn’t) protect everything the same way

I was recently in a situation where I had to explain why our information security group had made strict requirements for one project team and much lesser requirements for another project team.  Cries of “It's unfair”, “You’re just picking on us” and "You're singling us out" were heard in the isles when the teams read the requirements.

Requirements are simply based on the type of information that is being handled, or as it is known in the security industry, its “Data Classification”.  Here are some examples of possible data classifications that a company may have:

• Some information can be considered “Public”.  For example: the annual statement of a company, directions to their Home Office, advertising, statements on websites and even this Blog post.  This information is targeted at people regardless of the company they work for and can’t really get lost or stolen because you freely give it away.  You really don't really even need to try to protect this information.

• Other information can be considered “Internal Use Only”.  For example, the employee phone number directory and management reporting hierarchy, your vendor list and their contact numbers, specific processes that you use for responding and resolving incidents, etc…  You don’t want this information all over the place because it could weaken internal controls or could be used by a salesperson or competitor for a slight advantage.  If it is lost, it is more of an inconvenience or embarrassment rather than a serious, regulatory or legal issue.  You should place some simple controls around this information.

• Some information is specifically identified in regulations and laws.  This information is called “Customer Privacy Information” or CPI and contains things like SSN, Drivers License Number, Account number and PIN, etc…  This information, if lost or stolen, will result in a company releasing a Privacy Breach notification and executing all the steps required by the State where the customers reside.  This information requires strict protection, monitoring and response.

• Finally, some information can be considered “Confidential”.  This type of information includes things like employee salaries, merger and acquisition plans, company intellectual property, etc…  If this information was lost or stolen, your company would realize a severe impact.  This information also requires strict protections and monitoring.

Just this brief list of four possible data classifications makes it easy to see that if a project is implementing a system that automates the tracking of internal work requests that have a classification of “Internal Use Only”, they will have significantly different requirements than a project has been proposed to expose employee benefits information over the Internet classified as “Customer Privacy Information”.

What controls are appropriate for each data classification?  Who should perform the classification? What is the classification for aggregate information?  These are topics for a future posts.  But remember that you don't need to protect all information the same way.

Not a “Thriller”

Hours after the death of Michael Jackson, the first wave of spam began hitting in-boxes. Currently the email, with a subject line “Confidential – Michael Jackson”, is not pitching a product or directing you to a malicious website but it is trying to get people to reply to capture email addresses.

Graham Cluley, a Sophos senior technology consultant, said “Undoubtedly we'll see more with Jackson. Actually, spammers and hackers have done Jackson before. Several years ago they pitched a breaking news story, claiming that he had attempted suicide."

Right now, there are only guesses as to what hackers may do to use the pop singer’s death as a means to deploy bots. One thought was top-secret hospital footage to get you to download software to view it.

You should also use caution with results from searches run with the singer’s name. There has already been search engine manipulation relating to Farah Fawcett who also just recently passed. Criminals will create web pages with keywords and news stories in order to get them to the top of search lists. If you go to one of the sites, they drop malware on your box.

The best thing that you can do is be cautious, update your virus definitions and OS patches. Don’t just install any software. 

You can read the full article @ http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=security&articleId=9134895&taxonomyId=17&intsrc=kc_top

Social Networks: The Good, The Bad and The Ugly

Where were you on June 9, 2009 at 10:22am?  At that moment in history, the 1,000,000^th word was adopted into the English language.  What was that word?  Web 2.0.  Now you are probably asking yourself, I’ve heard of Web 2.0 well before June…why are we only adopting it now?  Well, the Global Language Monitor has certain criteria by which they judge; but that is well beyond the scope of our discussion here.

So what is Web 2.0?  It has nothing to do with the technology or domain naming.  Mostly it is about the dynamic content and the way users interact with the Internet.  Remember how your parents read the newspaper every evening or watched a newscast on television?  The information flow was one way.  Web 2.0 is about sharing information, opinions and experiences.  You live with Web 2.0 everyday and you probably don’t even know it.  Have you read a review on Amazon?  Have you commented on a news article?  Those are just a couple examples of user provided content.  Websites such as Facebook, Twitter and MySpace, YouTube and other social networks are the big names in social networks or Web 2.0 but there are countless others.  You may think that because you don’t have a Facebook account or don’t visit social networking sites that you, your family or business are immune from anything harmful; you better think again.

The Good

Rather than jump right into the bad or ugly, let’s first discuss how social networks can be good.  Social networking or social media IS the future of communication.  Rather than wait for the newspaper to be delivered, you get news as it happens by the people who are experiencing or involved in the situation.  Remember the US Airway’s flight that landed in the Hudson River?  Well before the media had a chance to deploy reporters to the scene, passengers on the flight were posting pictures and updates through their Twitter account.  Companies are using social networks as a tool to market their brand.  Have you heard of Blendtec?  How about “Will it Blend?”  Blendtec CEO, Tom Dickson, became an instant celebrity when he began posting videos of his blender destroying things like iPhones, Guitar Hero guitars, etc on YouTube.  It also helped them sell a lot of blenders.  Even Westfield Insurance uses LinkedIn and Facebook to find talent, as well as, communicate promotions and events.  Blogs such as this one and the Westfield Loss Control Blog are another way that companies can reach out to current and potential customers.  Internally, employees can network between departments giving them a feeling of being more than just another “employee.”

The Bad

Those were just a few examples of how social networks can be beneficial to a company. What are some of the drawbacks?  First, it is difficult to balance a work culture that embraces social networking while ensuring that it does not impact productivity.  It is increasingly more difficult to monitor or limit these activities as social networks extend beyond the desktop and onto cell phones.  Additionally, companies may have a difficult time restricting or limiting the content that employees post.  A disgruntled employee may post negative information about their employer for all to see.  Companies may have human resource policies when it comes to employees posting information about their employer; but how does a company draw a hard line in the sand between moral, religious and political biases and freedom of speech?  Social networks are making it difficult for companies to separate an employee’s business relationship and their personal lives.  On the other hand, employees are learning that inappropriate use of social networking may allow a company to terminate their employment.

The Ugly

So your company is on the cutting edge of technology and you have an HR policy that addresses social networks; is that enough?  Not quite.  Aside from the fact viruses, Trojans and other malware have found a new distribution vector; there are many other security concerns.  Data Loss Prevention is among the top as employees may maliciously or accidentally distribute sensitive company information.  Depending on the leaked information, your company may be faced with regulatory fines and requirements such as privacy breach.  Even if the information isn’t overtly sensitive, information may trickle that may give a hacker or your competitors an inside advantage.  Take for example your network administrator who blogs and/or posts questions about Cisco routers and firewalls.  A hacker may use that inside knowledge to target the vulnerabilities specific to Cisco products.  I am sure there are additional threats that remain to be discovered.

Conclusion

Whether your company has adopted or is blocking social networks; it is probably time for a revisit.  While the inherent risks and productivity impact of social sites such as Twitter, Facebook, etc. are good reason to not allow them in the work environment; you may find that people are spending more time on their cell phones texting or other social activities.  It is difficult to balance a no tolerance policy for social sites while allowing shopping or other entertainment sites while on company time.  Blocking all non-work essential sites has proven time and time again to reduce employee morale; which in turn has greater impact in reducing productivity.  If you feel your company is behind in addressing this issue, don’t feel alone.  Many companies are working struggling to weigh the risk versus the reward.  We would love to hear how your company handles social networks. Please make a comment or contact us at infosec@westfieldgrp.com.

Securing the future

Today was a day for milestones... I've reached 10 years with Westfield and my 8 month old starting saying da da. 

10 years ago information security meant keeping up with anti-virus, and making sure you sent your e-mail to the right person.  People were concerned about locking their doors, and making sure their checkbooks were still in their possession.  Schemes weren’t as complex as they are today.

 

Today information security is almost as complex as the brain teasers you can pick up at the local toy store.  You still need to keep your doors locked, but now you need to make sure you clean the circle the GPS device leaves on your windshield so your car doesn't get broken into.  You also need to shred every document which could remotely leak your identity.  If that's not enough, you need to keep your computer as secure as Fort Knox, with anti-virus software, personal firewalls, anti-spyware, anti-spam, and quite a few more anti-products that are widely available.  If people are willing to dig through trash cans, and spend countless numbers of hours creating viruses what could tomorrow hold in store?

What is information security going to be like in 10 years?  Will your home computer be joined by many other devices requiring all of the anti products above?  Will your car need them, so a hacker doesn't program it to follow their car back to a chop shop?  Will you have to use your fingerprint to access any computer information, including your email?  Will your cell phone be capable of communicating with a maintenance robot doing your laundry, as it senses an intruder breaking into your home? 

 

The message here is that we don’t know what is coming next, but it doesn’t mean that we can let our guard down.  The best we can do is to educate ourselves and others to help protect the future and prepare for the unexpected.

 

I'm interested in hearing others thoughts on this topic?  Please drop a comment, and help us keep the future secure.

Don't Toss that Paper !

In today's post, I want to remind everyone that the proper protection and disposal of printed information is equally important as the protections we place on information stored on electronic media. 

In the past, business was conducted primarily with paper acting as the primary mechanism for information storage and processing.  Businesses had "clean desk" policies and their file cabinets were locked up at night when they were not in use.  Only the appropriate people had the file cabinet keys.  Files and documents were taken and shredded when they were no longer needed.

As we all know too well, technology has forever changed the way businesses work, introducing automation, database processing, the Internet and all the benefits that go with these advancements.  Protective controls have also evolved along with technology such as; system passwords, Role Based Access Control, file encryption, etc... 

There has been a tremendous focus on the protective controls for electronic information but we have to remember that paper has not been completely replaced yet (if it ever will be).  All the rules that made sense in the past still make sense today, but in some cases we have stopped practicing them.  Agreed, it is much more damaging to a company to have a million pieces of information  from a database be sent to a hackers website, however, you may be in a privacy breach situation if someone steals a folder of printed customer information containing SSN's, credit card numbers or account numbers.  Even a report of employees and their personal information, that is lost or improperly disposed of, might also place you in a breach situation.  The new laws are tough and they do not care if information was lost on a disk drive, backup tape or paper report.  One thousand records lost on an unencrypted USB drive is just as bad as one thousand records lost through someone "Dumpster Diving" and finding last months discarded report.

Please remember to physically protect all reports, printed e-mails. photocopies of receipts and other paper materials.  Lock them up and only access them when needed.  Shred everything before throwing them away -or- place all paper into specially designated paper disposal bins (if your company has them - we do at Westfield).  Many companies have worked out recycling arrangements so you can safely dispose of your paper and help the environment at the same time!

Protect information on paper as you protect information on electronic mediums. Don't think that it isn't important because it is on paper.

Internet Domain Names

    Internet domain names such as www.westfieldinsurance.com are managed by the Internet Assigned Numbers Authority (IANA) on behalf of the U.S. Commerce Department. The US government therefore has the ultimate authority to review or revoke any decision as it pertains to domain names.

    This authority has European allies and Third World countries placing pressure on the current administration to surrender this control as the central manager of key aspects of the Internet. Other countries are pushing for more control. It would be a mistake to change America’s role of managing the Internet.

    There are persistent proposals to break IANA and the U.S.government in favor of an international body like the United Nations or International Telecommunication Union to direct IANA. There have been no serious complaints about American administration of the Internet. If this role was relinquished this could present difficulties.

    One serious difficulty in relinquishing control of Internet domain names could be the ability to restrict content on the Internet. Many governments already attempt to control speech on the Internet. If control is given to an international organization, we can expect attempts of censorship of Internet content.

    Most countries lack our First Amendment right, and if we wish to protect free speech, we should not let Internet domain names be subjected to foreign standards. Many other countries already have government-imposed restrictions on Internet speech.

    American supervision of Internet naming is no accident. Much of the world’s telecommunications infrastructure was developed by national post offices. Our development of private infrastructure, including railroad and telephone networks, made America fertile ground for Internet development. The extent to which the Internet is de-centralized and self-governing is because Americans expect society to work that way.

    It is only natural for other countries to resent the United States for controlling Internet administration of domain names and demand more control themselves. But if we believe in freedom of speech, we need to keep control of the Internet away from foreign countries that do not value it as we do.

Secure Cell

President Obama is still awaiting the security enhancements to his Blackberry that allows him to securely send/receive email and voice communications.  Officially, the government uses the Sectéra Edge smartphone to securely communicate.  While this should be the standard for ALL paranoid cell phone users; it may be overkill for the average user if the $3000+ price tag isn’t prohibitive.

While the casual cell phone user doesn’t require military grade security, the proliferation of smartphones or feature phones raises the risk of identity theft or social engineering.  Today’s cell phones are no longer restricted to making and receiving calls.  They are a major component of our everyday lives.  They hold our address books, calendars, email, music and much more.  While it is very convenient to hold all of this information in a single place, it poses a risk if they are lost or stolen.

Millions of cell phones are lost or stolen each year.  Think about the important information you store on your phone.  Names and numbers of friends and relatives; passwords; sensitive emails or text messages.  Not only does it expose this information to strangers, it is also very inconvenient for you.  Are you backing up this information?  While not all phones are capable of doing backing-ups or syncing data, the ones that do…should.

Spend a moment to review the information on your phone.  What could a stranger learn about you and your contacts if they had access?  At a minimum, they would be able to harass them.  At worse, they may have access to their physical location.  Is your phone tied to social networking sites such as Facebook or My Space?  How would you feel if a stranger or criminal had access to your friends’ and families’ contact information, pictures, etc.  Personally, it creeps me out to think that someone might browse photos of my wife and daughters.

So what should you do about this?  First, learn to live with a password to access your phone.  It is inconvenient at times to “log-in” to your phone but the level of protection that even a 4 digit password or pin provides is well worth the extra keystrokes.  My phones are set up so that calls can be made and received; however, access to address books and calendars, etc. are password protected.

Does your phone support remote wipe?  Enterprise Blackberries allow system administrators to delete content of lost or stolen cell phones, but what protection do you have if you are an iPhone, Palm or Windows Mobile user?  Utilities like Teallock for Palm allows you to send a “self destruct” text message to your phone wiping all information from the phone and memory cards.

Finally, be aware of where you leave your cell phone.  With cell phone insurance and “new every so many year” plans; people forget the value of the phone and particularly the information it contains.  Would you leave your wallet or purse lying around even if it was not filled with cash?  I often see phones left unattended on desks as I stroll through the hallways in the office.  I’ve seen them left in cars to charge.  I have even seen them dangling from a wall charger, unattended no less, at the airport.  The unfortunate reality is that a lost cell phone is not just a hassle for the owner, like with a wallet or purse, but also for the friends and families of those who are “lucky” enough to be in your contact list!

The scam that keeps on giving

Recently I like many others have received a painful slurry of telephone calls, postcards, and Spam email asking me if I would like to renew my auto warranty. The pain solicitors tend to offer is usually bearable, however this specific solicitation is beginning to feel more and more like a scam attempt to harvest my personal information. This all started several months back, at first only a single postcard, which I discarded without a second thought. Now I am receiving multiple calls and postcards per week, which to me really points out a problem. This company or group of individuals is very persistent, even to the point of switching their call back phone numbers faster than you can call them back to complain.

How does it apply to information security?

Scams like this can waste your time, put your information at risk, and challenge your patience not to mention your pocket book. If not handled appropriately these scams can really become a headache to get out of. The best way to avoid being a victim is to avoid jumping into anything, always remember if it's to good too be true, it probably is.

Why is it important to know this?

Recently a message was left on my grandparent's answering machine, the message told them their auto coverage was about to expire and to call back to have it renewed. My grandfather immediately called his auto insurance agent thinking they were talking about his auto insurance rather than a warranty. His agent reassured him everything was just fine, however how many of us might have just called the number back and accidentally entered into an agreement with this company?

So what should you do?

I haven't found any quick answers or easy fixes, however the Federal Trade Commission provides several recommendations on how to stay safe and protect yourself and others. It includes links to the National Do Not Call Registry, the ability to File a Complaint, and several great explanations about auto warranties (Service Contracts).  In addition suit has been filed recently to try and stop this deception.

In the mean time, if you get a call, don't react; just tell them you will contact them back if you're interested. Thanks for reading and please forward this information along to your friends and family to keep them aware as well.

Why is Disaster Recovery a part of Information Security?

I attended an event last week.  You know the kind where everyone was required to go around the room and introduce themselves and describe what position and responsibilities they had at their company.  When it was my turn, I mentioned I was responsible for Information Security, Disaster Recovery, IT Risk Management and IT Compliance.  Later on, during a networking break, an individual came up to me and was curious why Disaster Recovery responsibilities were included in a department that focused on Information Security and Risk Management type activities. 

 

I have had this one asked of me before so I had my answer ready.  I explained that the term "Information Security" is really an umbrella of activities that are focused on three areas commonly referred to as CIA or Confidentiality, Integrity and Availability.

 

The Confidentiality piece is easy to understand as Information should only be accessible to the people who are authorized to access to it.  

 

Integrity is also an easy one to follow as only the appropriate people should be able to update information.  Preserving the integrity of information is important so that good business decisions can be made from it and that it can be trusted.

 

But when it comes to Availability, the reason that it is included under the Information Security umbrella is not always obvious.  Basically, information security is providing accurate information only to the appropriate people when they need it.  In a business interruption, this is still the case (and arguably even more important!).  Also, during a business interruption when things become chaotic, controls that allow only the authorized people access to information they can trust at the time they need it, can save your business.  Protecting the Confidentiality, Integrity and Availability of information at all times, regardless of the situation is what Information Security all about.

 

On a side note, in the unfortunate event of a business interruption, the same laws that govern protecting your company’s information still apply.  For example, if a company has an interruption that requires them to execute their disaster recovery plans, they will still need to comply with the regulations that they normally do during regular operations such as GLBA, HIPAA, PCI, State Breach Disclosure and other laws.   This means that systems and processes that protect access to information such as ACF2, RACF, Active Directory, LDAP, etc... must be included in recovery plans.  Often, information security controls are overlooked during business interruption situations.  This approach really can get you into trouble.

 

After talking a little while, my new friend understood the alignment of Disaster Recovery and Information Security a little better.

Gotta Wear Shades

Spring is in bloom and the sun is shining. If you’re like me, you’ve got your sunglasses out and are ready for summer.

Did you know that researchers have developed a compound called hexaarylbiimidazole (HABI) which almost instantaneously changes from clear to dark blue when exposed to ultraviolet light? Well it’s true. Chemical engineers at Aoyama Gakuin University in Japan have been working with light-sensitive properties of photo chromic materials like HABI.

 If added to Plexiglas or other lens materials it allows sunglasses to instantaneously darken in sunlight and turn clear equally rapidly whenever the wearer moves indoors.

An alternative application for this technology is for a new generation of optical data-storage devices.  The on/off ability of HABI could replace the magnetic on/off used in today’s storage devices. With its stability and quick transition, this material is thought of as being a significant step for use in data processing and storage.

Now you might be wondering how this applies to security. Well, the introduction of new technology lends to the possibility of new vulnerabilities for someone to exploit.

Until that happens, enjoy your summer.

Jeff Gibson

A/S/L/P - Bridging the Internet Generation Gap

April 23, 2009 is national “Take Our Daughters and Sons to Work” day.  This day was founded in 1993 as a way to introduce children and young adults to career opportunities as well as demonstrate how skills learned at school will be applied later in life.

As much as our daughters and sons can learn about our careers; there is much that they can teach us about the Internet and Internet safety.  I propose as an extension to “Take Our Daughters and Sons to Work” day, that parents spend an extra hour or two at home with their children to learn about their world. 

If you have never watched your child, niece or nephew navigate a computer and the Internet; you will be shocked the first time you sit down with them.   Ironically, they may be able to identify ways to optimize and/or automate your daily activities.  Thank goodness for child labor laws; otherwise, your next boss would probably be twelve!  Our children are light years ahead of us when it comes to finding information on the Internet.  Unfortunately, many still lack the practical experience to determine when they encounter a dangerous or unhealthy situation.

Remember how excited you were when you received that letter from half way around the globe as your pen pal reached out to you?  Today’s children communicate daily with friends and relatives around the world.  Through social networking sites such as Facebook and My Space, long lost friends or new ones are only a few keyboard and mouse clicks away.  Twitter, Jaiku and Pownce are a few other places where kids are sharing information about their daily lives.  Using cell phones, these posts can happen anytime, anywhere giving the world up-to-the-minute updates. Celebrities like Erika Badu have gone as far as blogging their childbirth experience.

While this information is harmless when shared among friends and family; it may have serious consequences when obtained by the wrong person.  Cyberbullying and cyberstalking are examples of overt Internet crimes.  Online predators are manipulating our children to engage in dangerous and sometimes deadly situations.  Despite the popularity of news programs like NBC Dateline’s, “To Catch a Predator;” there continues to be increases in online predation.

This leads us all the way back to what started this blog; Take Our Daughters and Sons to Work Day.  This is a great opportunity to reach out to your children and learn what they have encountered on the Internet.  Find out what sites they visit regularly.  If they have a Facebook or My Space account, it might not hurt to set up one of your own to monitor their online activities.  Ensure they are not posting private information such as their address and/or phone numbers online.  Be aware when they are blogging their whereabouts.

Finally, a kilobit of prevention is worth a gigabyte of cure.  If you don’t have an Internet filter installed on your home computer(s)…get one.  There are many free ones available.  You can download a couple of them here and here.  Get involved with your children’s social networks. Besides ensuring they are not disclosing sensitive information, you may find yourself catching up with old friends and making new ones.  Keep the computers in an open location as opposed to the children’s rooms.  There is no reason to wait until somebody comes up with “Take Your Parents to the Internet” day, to start protecting our children today.

ICYC (In case you're curious), if you don't understand what the title of this post means; it wouldn't hurt to know the lingo your children use to communicate over IM (instant messenger) and txt (text messaging).  You can find a list of text lingo here.  What you find there may surprise you.  Especially when you find yourself the AITR.

Beware of Easy Money

    With the current economic conditions, there have been an ever increasing number of online promotions promising easy money by luring people into cash gifting programs or clubs.  In fact, the BBB warns …”cash gifting is not a legitimate way to make a few extra dollars, and in fact, is nothing more than a pyramid scheme...” or better known as “Ponzi schemes”.

     Schemers have gone digital by moving their operations to the Internet and are marketing their programs as a way to make some easy money. Web sites, Google ads, and YouTube are used to lure they’re victims into the schemes.

     According to the BBB, there are almost 23,000 cash gifting videos on YouTube with nearly 60 million views. The creators of these videos typically boast about a new program they discovered to help people make money through either cash leveraging or cash gifting.

     Some schemes are portrayed as fundraisers or programs to help people help themselves. They ask for an initial participation fee of up to $5,000 and have the participant convince additional people into the scheme in order to make money. The fee is then used to pay people further up the pyramid.

     The BBB advises people to ask themselves three questions in order to evaluate dubious money-making opportunities:

• Do I have to make an “investment” or give money to obtain the right to recruit others into the program?

• When I recruit another person into the program, will I receive what the law calls “consideration” (that usually means money) as a result?
• Will the person I recruit have to make an “investment” or give money to obtain the right to recruit and receive “consideration” for getting other people to join?

     If you answered “yes”, then you’re looking at a scheme. Don’t be surprised though if the person tempting you is a friend, co-worker, or neighbor. Just because you trust that person, beware, they may have fallen victim to the scheme.

 Good Luck!

 Jeff Gibson