Information Security Tips from Westfield Insurance

The Problem with Honest People

The problem with honest people is that they don’t think too seriously about how the things that they do or information that they share could be misused or be used against them.

It’s not the nature of good people to think like bad people.  I can hear people saying: “No one cares about my information.  I don’t have anything that people would want to steal.  Bad things happen to other people, not me.  I am just one person in a million; there are better targets out there.  etc…”   It’s not until something actually happens to them, or someone that they know, that they realize the truth.

Please! Please! Please! All you honest and good people living in modern world, think a little bit more about it!  What could a malicious person do with your information if they wanted to?  Even the simple messages you post on Facebook or Twitter.  Malicious people do exist.  I see it regularly in my career as an Information Security professional.  Only in hindsight does the light bulb go off for the victim.  Also, the victim might not be the person who’s information is misueed, many times one person’s information is misused to victimize another who trusts them.  Social networking sites are a ripe field for this kind of information to be harvested.

Here are some tips I ran across that talk about basic security precautions on social networking sites.  These are just some common sense things that can help reduce the probability and impact of information misuse: http://www.bankinnovation.net/profiles/blogs/10-ways-to-prevent-social-1

Even if you don’t think that YOUR information will be stolen or misused, don’t give anyone the opportunity to prove you wrong.  Keep being honest but be "Information Misuse" aware!

Bill Murray leads the IT Risk Security and Compliance team at Westfield Insurance.   Sharing Knowledge. Building Trust

Phone and Voicemail Security Reminders

With all the recent buzz and excitement around the iPhone 4, Droid 'Incredible', Droid 'X', and similar, there are a number of articles and blogs related to information security and privacy concerns associated with those devices.   ITBusinessEdge.com has an informative 2-part series on aspects of phone security, for example.  But, what people often overlook as a potentional information security and privacy risk is the digital work phone sitting on their desk.

We use our work phone every day.  For some, it is joined to their ear as much as their mobile phone is joined to their hip.  For others, it is simply a paper weight.  Nevertheless, the digital desk phone of today is a fairly sophisticated computing device and should be viewed as a potential access point to your company network and information.  It is for this reason, we should always assume phone and voicemail systems are 'open systems' subject to the risk of unauthorized access.  As a result, many of the mitigating control concepts we apply to laptops, smartphones, and other devices, should also be applied to your digital work phone.

Below are just some of the practices we should keep in mind to help ensure the security and privacy of information when using phone and voicemail systems.

Hardware and Software

• Do not rely on the phone's default security settings
• Never alter or disable the phone's authorized software or security settings
• Ensure the phone's security settings are in compliance with company policies and standards
• Never alter or disable the phone's authorized security settings
• Lock down physical ports on the phone if they are not part of your company's standard configuration or usage parameters
• Never alter or disable the phone's authorized software
• Never install unauthorized software on the phone

Policy and Awareness

• Always follow your company's 'Acceptable Use' Policy
• Do not share your vociemail password
• Always confirm the individual you are speaking with is authorized to discuss the information
• Always protect your conversations when in public and in the office
• Do not leave voicemails containing information that must be kept secure and private
• Never intentionally alter time stamp, routing details, or other information used to track calls
• Keep in mind, most organizations have a 'no assumption of privacy' policy

Robert Salandre manages Information Security Policy and Awareness at Westfield Insurance.   Sharing Knowledge. Building Trust

A Key to Decreasing ID Theft Exposure

No one wants to have their identifying particulars stolen and abused.   To help, there is the security concept of using one secret (a key) to unlock keys to other services.   The concept is simple, here is a real world analogy – in a car dealership, the service area has a bunch of keys to inventory and customer vehicles.  That collection of keys is kept in a locked wall-mounted cabinet.  Upper management are the only people with the keys to the “key locker.”

On your personal computer, there’s another commonly used example, in most browsers you can set your security preferences so that the username and password fields at different web sites are automatically supplied.  They are stored in a browser-managed repository which is the equivalent of the “key locker” described above.  Using this auto-fill feature alone is a net decrease in your security because, once turned on, anyone that can walk up to your computer, start up the browser and instantly be logged into your various web site accounts without having to know any credentials.  But there is simple way to mitigate this risk.  For example, in say FireFox, IE 8 or Opera you can also set a “Master Password” that is used to keep people other than yourself from getting at those passwords.  This master password is the equivalent of the key to the key locker in our physical world example.   This gives you the best of both worlds because now you only have to remember a single password which, in turn, allows you to set the underlying stored passwords to very hard to guess, long, complicated nonsense strings because you are planning to never have to remember/type them!

Another example of this security concept is in the world of payment card (credit, debit, etc.) clearing house services like PayPal, Google Checkout, PaySafeCard.  These are services that you give various credentials to and they provide clearing house service to merchant sites that have signed up to use their services for payments.  Here’s how it works:

First you sign up for the payment service of your choice, let’s say PayPal:

• you create an account at the payment service using a unique string such as your email address
• you fill out the payment service’s profile by providing contact information and credit card, debit card or checking account information
• depending on the service, you may need to verify that a tiny transaction against the card or account in question goes through

That’s it!  Now, you can use any online vendor that supports that payment service (look for, say, the PayPal logo, although it may not be displayed until you go to checkout):

• go to a merchant site such as Walmart and put some stuff in your virtual shopping cart
•   proceed to check out and notice that there is a PayPal option, choose it
• Walmart’s website sends you to PayPal, giving PayPal the bill you need to OK payment of (vendor and dollar amount)
• you confirm your PayPal password and then tell PayPal which of your accounts to debit
• when you hit “confirm payment”, PayPal debits your card/account on behalf of Walmart and then transfers the funds (not the payment information!) from your account to Walmart
• PayPal also sends you email confirmation and tells you what merchant name to expect to see on your credit card statement
• PayPal sends your browser back to the merchant site where your payment is confirmed in the form of a receipt (and usually another email) and information about order shipment

So, behind the scenes, the payment service deposits the payment (minus their transaction fee) into the merchant’s account without ever sharing your payment information with anyone!

Why bother with that?  In the case of Walmart.com, there is probably little reason for concern but in the case of a small company, say Tom’s LiveBait-by-Mail, you might be a bit leery of giving away your credit card information.  Also, if you signed up multiple credit/debit cards and one or more bank accounts then you can choose which to charge the payment against at checkout time.  So, as long as the payment service is super-secure, it’s a net win because the fewer places that get their hands on your card info the better.

Is there a downside to using these services?  Well, I suppose these particular processors are in a position to know a lot about your cross vendor buying habits and history.  Plus, of course, they are an inviting target for hackers because they store so much account information (although they are extremely aware of and well staffed to store and police said information).

So – keep this “key to the keys” idea in mind when you need to minimize complexity and exposure.

John Brady is Information Security Architect Engineer at Westfield Insurance. Sharing Knowledge. Building Trust

The Payment Card Industry Data Security Standard (PCI DSS)

There are a number of regulations and standards that have been established to protect the privacy of individuals and to prevent fraud.  One of these standards is called the Payment Card Industry Data Security Standard.  Here is an overview of how it was established and what it is:

Comprised of Visa, MasterCard, American Express, Discover, JCB, and Diners Club, the Payment Card Industry (PCI) developed the Data Security Standard (DSS), initially based on Visa’s Cardholder Information Security Program (CISP), to help prevent payment card fraud and identity theft.  It encourages and enhances cardholder data security and privacy by facilitating a broad adoption of a consistent, global data security standard.

The principle goal of the data security standard is to protect cardholder data at all times, whether processed, stored, or in transit.  The PCI DSS has been universally adopted by all major payment card brands and is governed by the PCI Security Standards Council (PCI SSC). 

Unlike laws such as the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the Leahy Personal Data Privacy Security Act of 2009, and Massachusetts 201 CMR 17, all of which are enforced by federal or state governments, the PCI DSS is NOT a legal or regulatory directive but, rather, a contractual obligation.  The standard is enforced through a mandatory ‘contract chain’, whereby information security and privacy requirements are passed from payment card companies, to merchant banks and card processors, and eventually merchants, via contract language.  As a result, compliance to the PCI DSS transcends both industry and geography and necessitates heavy involvement, if not oversight, from an organization’s legal team.

The PCI DSS consists of 6 main control objectives, is comprised of 12 primary requirements and contains approximately 210 individual controls.  The control objectives address:

• Building and Maintaining Secure Networks
• Protecting Cardholder Data
• Maintaining a Vulnerability Management Program
• Implementing Strong Access Control Measures
• Regularly Monitoring and Testing Networks
• Maintaining an Information Security Policy

Failing to effectively manage and protect information while it is processed, stored, and transmitted, can be unlawful and negatively affect business reputation, customer base, employee morale, and revenue. 

Both customers and employees expect their personal information to be protected by the organizations with which they do business.  They are no longer willing to overlook an organization’s failure to keep their personal information secure and private.  Therefore, it is imperative organizations be aware of and educated on all Information Security and Privacy requirements with which they must be compliant; this includes not only applicable laws and regulations but contractual obligations as well. 

Bill Murray leads the Information Security and Disaster Recovery team at Westfield Insurance. Sharing Knowledge. Building Trust

Email Attachments

Did you ever get an email with an attachment and wonder if your getting ready to open a  file infected with a virus? You already know you should never open an attachment from someone you don’t already know, right?

If you suspect a file is infected or just want to make sure it’s safe, there is a quick and easy way to check if it’s infected or safe. Instead of opening the file, save it to a folder on your hard drive and remember that location.

Now open your favorite browser (IE, firefox, etc) and type in the URL http://www.virustotal.com. VirusTotal is a great site that will allow you to check the file against 40+ different Anti-Virus (AV) programs for free! All you need to do is upload the file by pressing the “Browse” button and navigate to where you saved the attachment. When you have selected it, press the “Send File” button to upload it.

Once the file is uploaded, it will begin scanning. When it’s completed, typically in less than a minute,look to see if any of the AV programs found the file as a virus. Here's a sample report.

My rule of thumb is that if even one AV program tags it as a virus, DO NOT OPEN IT! As you can see in the example I used, there was no virus detected. This would give me enough assurance that the file was clean that I would open it.

Just to be completely clear, even if you scan the file and no viruses are detected, there is no positive guarantee the file is clean. It just means that it does not contain a virus previously seen by the site's AV vendors. But if over 40 vendors have not seen it, it will be safer than if you just opened it without checking.

Thanks for reading!

Jeff Gibson is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust

Parental Controls Online - 6 Questions to Ask Your Family

8S22SRE498JM

Have you ever noticed how your child's favorite TV shows are directing them to the Internet to watch extra episodes and access special content like games and other shows? My daughter is just now starting to show interest in our family laptop, finding it wherever we might be hiding it. We keep putting off establishing parental controls, but it's only a matter of time before she figures out how to make the laptop work.  As a family we will be nervous with not only the content she will be introduced to, but the wide variety of identity theftand other serious dangers that lurk within. Struggling with allowing her to learn while keeping her safe is a big challenge, one every parent is going to encounter.

This led me on a path of research, searching the web for keywords like "family safe internet software" and "parental controls for the internet."  I saw quite a few sites selling software solutions like NetNanny, BSecure, and free tools like K9webprotection. There were others which carried with them some recommendations like FocusontheFamily and ConsumerSearch, which suggest pre-reviewed products to use.

Looking at all of the options, I can understand how it would be difficult to choose the best product for your family. Here are a few questions to help identify your family’s need for a tool like this:

1) Who in your family needs protecting? Yourself? Children? Adults who are wary of the Internet? Guests?
2) What devices do you need to protect? Smart phones? Laptops/Desktops? Wii?
3) What applications does your family use? Internet browsers? Instant messaging? Social networking sites like Facebook or Myspace?
4) What operating systems and versions do you have? Mac? Windows? Linux?
5) What are you willing to spend to keep your family safe from these dangers?
6) What kind of monitoring do you want to have access to? Web surfing logs? Online game play? Instant messaging usage?

Let me know your thoughts on this topic! Please chime in and let us know what you do to keep your family safe.

Jacob Harris is a Vulnerability and Forensics analyst at Westfield Insurance. Sharing Knowledge. Building Trust.

Information Security Awareness and Training... Yes, it's required.

Over the years, one of the questions I have been asked most frequently is, "Do we really need to have an Information Security awareness and training program?"  The question is often followed up by a statement calling into question the perceived value of awareness and training.  My standard response is typically along the lines of, "Yes.  It is required and, perhaps more importantly, the right thing to do." 

Setting aside the value-based approach of 'doing the the right thing' to keep information secure and private, most people are surprised to learn Information Security awareness and training is a compliance obligation often required by law, industry regulation, and or business contract.  Additionally, it is called out in numerous 'best practice' frameworks. 

So, in the spirit of ongoing Information Security awareness and to assist those who have requested more information on this subject, I've decided to list a just a few of the numerous laws, regulations, and frameworks applicable to North America.  Bear in mind some are industry specific.  I hope this proves helpful.

Laws and Regulations (North America)

Health Information Portability and Accountability Act (HIPAA):   §164.3

Canada Personal Information Protection Electronic Documents Act (PIPEDA):   Schedule 1 Clause 4.1.4(c), Scedule 1 Clause 4.7.4

Privacy Act of 1974:   §552a(e)(9)

Fair and Accurate Credit Transactions Act (FACTA):   §151, §213(d)

FACTA Red Flag Rule:   §41.90(e)(3), §222.90(e)(3), §334.90(e)(9), §571.90(e)(9), §681.2(e)(9), §717.90(e)(9)

Leahy Personal Data Privacy Security Act:   §302(b)

Tlaxcala Law:   Article 27

FFIEC Information Security:   Page 7, Page 62

NERC:   CIP-004-1

FDA 21 CFR Pt 11:   §11.10(i)

Massachusetts 201 CMR 17.00:   §17.04(8)

 

Business Contracts

Payment Card Industry Data Security Standard (PCI DSS):   §12.6

 

'Best Practice' Frameworks

ISO 17799 / ISO 27002:   §8.2.2

ITIL Security Management:   §4.2.2.2

AICPA Privacy:   ID 1.1.1

NIST 800:  numerous sections 

 

(Important Note: Compliance obligations are not 'one size fits all'.  What one organization must be compliant with may not hold true for another organization, even if they are within the same industry.  It is aboslutely essential to develop an organization specific compliance framework reflective of all compliance obligations known to the organization.)

Social Media and Policy

In the broadest of definitions, people have been blogging for centuries.  Whether on a soapbox in the middle of town square or on the world stage of the Internet, people tend to gravitate towards public forums, where they can voice their opinions, make observational comments, or simply rant.  So, in today’s rigorous environment of governance, risk, and compliance, how does social media impact one’s corporate citizenship and the organization for which they work? The answer is, in a word, policy.

As with all business risk (and, ‘yes’, the use of social media is a business risk), policy is often implemented as a mitigating control.  At the heart of a well written policy should lay a clearly defined behavioral expectation related to a particular risk, as set forth by executive leadership.  In the case of social media, the intent of the policy will typically revolve around its acceptable professional use.

 

Policies related to social media can vary greatly from organization to organization.  This is tied to multiple variables, which may include, but are not limited to: the type of risk, corporate culture, the organization’s levels of acceptable risk (what some may refer to as ‘risk appetite’), contractual obligations, industry regulations, and an ever growing number of laws.   Compounding the issue is the speed and totality in which social media has been generally adopted.  As a result, the pervasive and permeating use of social media and its relationship to the workplace is still a fairly new challenge with varying ramifications.

 

As the business impact of social media continues to grow, discussions and issues related to both compliance and non-compliance are becoming commonplace.  I leave you with the following: 

 

• The FTC is now addressing the use of social media in Marketing:

http://www.adweek.com/aw/content_display/community/columns/other-columns/e3i5bf1e98f0ce98d79ff2629077ea6b78a

 

• The use of social media is finding its way into guidelines and regulations:

http://blogs.bankinfosecurity.com/posts.php?postID=499

 

• Individuals are being fined for violating policy via the use of social media:

http://sports.yahoo.com/nba/blog/ball_dont_lie/post/Dwight-Howard-has-to-pay-35-000-just-for-blogg?urn=nba,237611

At the Nexus of Social Networking and Business

In a recent blog post I suggested that, while social networking (e.g., facebook, myspace, twitter, orkut, LinkedIn, etc.) is here to stay, one needs to be somewhat circumspect in using them.  I focused mostly on “apps” within these social networking communities.   These apps often want access to your personal information or want you to install or run some program at their behest.

As a follow-up, I’d like to discuss some general ways in which you can improve the likelihood that you will not get your personal or business systems hacked while still being able to enjoy the fruits of these dynamic, fast-growing communities.

• Think before you click on anything asking:

- for access to your personal information (on various sites, they may be called “applications”, games, “e-cards”, “gifts” like a virtual cup-of-coffee, virtual bouquet of flowers, a snowball).  Do you trust the requestor?  Do you even know their privacy policy?

- you to install some “missing piece of software” (e.g., a dll, driver, codec) and perhaps offering to forward you to the site where you  can install it now and then proceed with your original task.  Do you know the software provider?

• Review your privacy settings periodically, there are many recommendations  in this regard in the mainstream media (see table at bottom).

• When the social network provider notifies you that their privacy policy has been changed – READ the new privacy policy!  There have been cases where the provider has retroactively instituted new default access rules rendering previously private parts of user profiles open to the public!

• Don’t lend the use of your computer (laptop, desktop) to anyone that might be reckless with it.  If the borrower surfs to an infected web site and your account on the PC becomes infected then they have unwittingly put your personal information at risk.  To mitigate the danger – always create a separate account for other users (either one account per person for regular users, or) a shared guest account for people that just want to use a browser for short time.  When creating such accounts do be sure they are not endowed with any administrative powers.  Delete all the files they leave behind and perform a virus/spyware scan.  Don’t think of it as being distrustful, think of it as good hygiene.

• Taken to its logical extreme, you might seriously consider having a completely separate system for when you are working on your high privacy stuff (employee personal info., online banking, personal/business financials,  tax returns, medical bills/records, …).   This will almost guarantee that your private information stays that way. **

Although it may sound like I need to lighten up, if you read some of the horror stories about people that have  experienced ID theft, you may decide I am not being adamant enough!  Of course, you have to find a happy medium for your circumstances.  Hopefully, the list above will help you make more informed decisions before you click.

--------------------------

Site Policy	Privacy Recommendation
facebook	High level: NY Times Very detailed: AllFacebook
MySpace	For better privacy control, switch from profile 1.0 to profile 2.0.  MySpace recommendation
LinkedIn	Walk-through: Network World LinkedIn recommendation
twitter	Creating a non-public  twitter account

** If you are computer savvy enough to know about virtual machines (VM) – you can get much of the same degree of isolation using a separateVM, instead of a separate piece of physical hardware.

How many certifications does a security professional really need?

I was reading an article several days ago about another information security certification that has come out.  I then searched for, and found, a website:

http://www.csoonline.com/article/485071/The_Security_Certification_Directory

that has compiled a list of a bunch of them.  As I browsed through it, I recognized some of them that have been around for a while, but there were several new ones that have snuck into the world while I was not looking.

There are certifications for information security management, security technology, vulnerability testing, hacking and now even anti-hacking… Hmmm, anti-hacking?  How many information security certifications does the world really need, I wonder?  Certifications in general, in my opinion, are becoming more of a racket than a value proposition.

Advice for people wanting to get into the security profession:  take some classes, read some books, and get real world experience but don’t think that 3 or 4 or 5 certifications after your name will get you hired, respected, etc....  Valuable information security professionals are practical thinkers, down to earth, have a broad technology background, are self starters and have a passion for innovation and problem solving.  And they don’t usually have a trail of certifications following their names.

The Overly Eager Bird Catches a Worm

The social network phenomenon has shown many benefits.  These sites, such as facebook (FB), have great potential for people seeking friends to hang out with online.  Businesses too are finding it desirable to create a company presence on FB, myspace, twitter, etc.  Given their explosive growth, however, these sites have also attracted an unsavory element looking to exploit such new fertile ground.

Do you recall, back in the early 2000s, when email phishing was a relatively new phenomenon?  Eventually people became savvy about not following links that arrived in email messages from businesses with which they had no established relationship.  You see, in order to compromise your system, eventually the bad guys have to get you to act on their behalf ... so at some point, they have to present you with some “stuff to click on” ... thereby tricking you into giving your operating system (Windows, MacOS, linux, etc.) the go-ahead to install their evil code.

In a similar vein – have you noticed that when you go to play a game on a social site, say FB, you are presented with a dialog-box saying something like "This application requires access to your FB profile.  Do you wish to grant access?”  This is the FB security layer warning you that this application is trying to access your FB profile.  This is like a stranger asking to look through your wallet and record whatever they feel like while they’re in there browsing.  Alarm bells should be sounding in your head!  Let’s see ... a game that’s all sorts of fun to play and has really nice graphics, and which must have taken some people a lot of time to develop, all apparently, “for free”!  Too good to be true?  Gee whiz -- that's a little like those emails I occasionally get from "banks" promising to consolidate all my debt into a "Zero down, 0% APR loan” ... too good to be true indeed.

So, while most FB applications/games are not bogus fronts for bad guys that want access to your personal information, it is also true that some of those ostensible applications are in fact phony.  So be very careful before deciding to unleash these apps on your private information.

In another example of social networking abuse, there was recently a worm blazing its way through FB accounts called KoobFace ("facebook" spelled sideways, sort of).  KoobFace arrives as a FB message from a FB friend in your FB inbox.  When you open it, you are told to check out a YouTube video.  When you click on the link to the video you are sent to a fake YouTube site.  When you try to start the video playback, you are told that your system is missing an important piece of video playback software called a codec (engineering speak for coder-decoder).  It asks if you want to install the missing codec.

Let’s step back here.  At the request of a site that looks like YouTube, you are about to install and run some piece of software!  Are those internal alarms bells clanging loud and clear yet?  They should be.  The supposed missing codec is really a worm.  If you OK installation -- your system is infected.  The worm begins executing immediately, making a few "adjustments" to your Windows Registry to make sure it gets restarted whenever you reboot.  It then proceeds to wander about in your browser cookie cache finding out which social networking sites you belong to.  For each site, it authenticates and then sends messages, in your name, to all your friends!  Of course, those messages are just more infect-o-grams like the one you fell for.  And so the worm turns...

The lesson here is: think twice before accepting requests to "access" your social networking profile(s) from applications, games and gifts.  Moreover, think three times about saying yes when some web site that you have followed a link to recommends you OK installation of software you supposedly need!  If you believe you really might be running an old version of a plug-in, anti-virus program, etc., you should still always refuse the unsolicited pop-up style request.  Instead, you should explicitly type in the URL for the software maker and check if there you are missing codecs or updates to the software.  If there are updates then update your software and retry playing the video. 

If your software is already up-to-date, or if you get the pop-up again after updating, then assume the pop-up is malicious and just skip playing it!  It cannot be worth the inherent risk.  You might even go the extra step to inform the sender of your suspicions.  For example, in this particular case, the “sender” would be surprised you even got an email from them!  You’ll recall, in our scenario, it was the worm that sent it.  This is often how people find out their system is infected so you are doing them a big service.

To read further, here is a link to a technical explanation of how the koobface worm works.

Got an App for that?

You see all the commercials about mobile device apps?  Nowadays it seems just about everyone has an app for just about anything.

So what does this have to with security? Well, it appears that there have been some malicious apps that target the financial industry. Google has removed a number of malicious apps this past December.

This is a phishing derivative which gets the victim to voluntarily download the app from a well-known app provider such as Google, Apple, Research in Motion, Palm, and others instead of redirecting them to a fraudulent URL. Once the app is downloaded and executed, the application can collect personal and financial information entered by the mobile subscriber, or collect sensitive data that resides on the mobile device. App stores are working to validate these programs but with the popularity and quantity of apps, some will get through unchecked. There are several reasons that indicate why this will get worse before it gets better.

Financial institutions are pushing for additional services for mobile banking. As they add more transaction-based services, there is additional information for the fraudsters to get. Currently, in most mobile banking app, for example, they can only get your balance and last five transactions. When they add transactions like the ability to move between accounts, additional account numbers and passwords will be exposed to theft.

The people committing the fraud are very aware of mobile capabilities. A malicious app could go undetected for long periods of time. When it is noticed and determined to be malicious, it could take longer to notify those affected and get them to uninstall it.

Most people are not ready for mobile apps fraud.  Criminals will prey on the naivety of mobile subscribers who believe the apps they are using are legitimate (perhaps because of the reputation of the place from which they downloaded it).

How do you prevent yourself from becoming a victim? One way is be very suspicious of apps that require sensitive information to be used like social security number or account number(s). You could contact your financial institution and see if they have validated the app to accomplish the same function (perhaps downloadable from the institution’s own web site).

Read the full article “Fraudulent mobile applications will threaten mobile banking security” here.

How to Stay Clear of Census Scams

Every ten years Uncle Sam asks each of us to provide some information through a Census, in an effort to distribute billions of dollars into appropriate infrastructure and services projects each year. It's purpose is important, however it also opens the door to scammers and criminals alike, who can't wait to take advantage of situations like this.

How will you be counted?

A form will be sent to your home via the mail, which will ask 10 questions, and no it isn't available on the Internet for 2010. These questions are aimed at determining the number of residents per home, and a minimally invasive set of information about each resident. You won't be asked to share your social security number at any time. It's very important that you fill out the form and send it back, or a "Census Taker" may visit your home to gather your answers in person.

What should you be aware of?

Legally you must provide the answers to the Census, whether via the form, a Census Taker who visits your home, or both.

Scams which may pose as the 2010 Census are sure to be in abundance. These scams may come across as emails, websites, telephone calls, or even people knocking at your door.

Do we have any tips for protecting your information?

• Online Information

Read through the 2010 Census website, and contact them if you have any questions or concerns.

Remember, the 2010 Census will never ask for your information online, via email or a website.

• The Form

Know how to identify the census form, any request will be clearly marked as coming from the U.S. Census Bureau and as OFFICIAL BUSINESS of the United States.

• Census Taker

A Census taker may visit your home even if you mailed the form back. Your form may have gotten lost or not arrived yet, you still need to provide the Census Taker with the answers shown on the form you received.

Identifying a Census Taker can be confusing, remember they will not ask to enter your home, if they do, be wary.

It's a good idea to ask to see 2 forms of identification, the first will be a badge with the persons name, and the second could be any form of photo identification, like a drivers license, or state id.

If a census taker contacts you via the phone, you still need to provide the information which is on the official form, but it's a good idea to gather the persons name, the office they work from, the date and time they called, and a phone number to reach them back on. Most scammers won't provide you this information.

• The information you share

Remember you only need to provide the answers to the questions which are on the form, you don't need to provide any other information.

Your information security "chain" breaks at its weakest link

I have been reading a lot of articles lately about information being stolen by foreign intelligence agencies, e-mail systems getting hacked into and millions of dollars of intellectual capital lost  Here are some current examples of this happening:

http://www.csmonitor.com/USA/2010/0125/US-oil-industry-hit-by-cyberattacks-Was-China-involved

http://www.msnbc.msn.com/id/34923887/ns/technology_and_science-security/

This led me to think about the activities we should be doing to reduce the risk of things like this from happening to our companies or ourselves.  There are some very simple common sense things that can be done to protect information that you care about.

I have broken this down into three basic steps:

Step 1: Understand what you need to protect

The first (and most important) thing that you need to do is identify what information is critical to your company and what information you legally need to protect.  Really take the time to think about it.  Most state privacy breach laws state that you need to protect peoples names in association with their Social Security Numbers, any account numbers that have a PIN and any credit card numbers.  These are easy ones, but how about your customer contact lists?  new product ideas?  customer order histories?  etc… What information do you really need to ensure that you don’t lose and doesn’t get out of your control?  In addition to data loss, think about data integrity.  When you open a spreadsheet, how confident are you that someone has not accidentally or intentionally changed some numbers?   How important are the decisions you make from your data.  The controls you place around preserving the integrity of data need to match its importance.

Step 2: Inventory where it is stored

The next thing to do is to identify where all of this information is located.  In addition to the primary location, system or application, also identify where copies, backups, extracts and derivatives are stored. You may have great security around your PeopleSoft system, for example, but store all the reports that are generated out of it on a share drive that is readable by everyone.  Ask yourself these questions:

• Are there any reports, spreadsheets or extracts produced by core systems that contain critical information?
• Is the same level of security placed on these reports, spreadsheets or extracts as on the original information itself?
• Where do you store and how do you protect your system backups?
• Could someone gain access to a system backup and restore the information to their computer?
• Can you reduce the number of locations that your critical information or copies of it are stored?
• Are you relying on third parties to protect your information when it is in their systems?  Do they have the appropriate security controls in their environment?

Step 3: Align security controls with business risk

Finally, assess the security controls that you are using to protect your information.  You should align your controls across systems based on the value of the information you are trying to protect.  You must take a holistic view of your data and approach its protection aligned with its risk of loss or corruption wherever it is stored.  Do not haphazardly place security controls on systems just because they have some checkboxes in their setup screens to allow them to do fun things like expire passwords, disable accounts after failed attempts, etc... Don't apply extra security where it is not needed.

Know what information you want to protect and protect all locations that this information is stored consistently.  Your information chain will break at its weakest link.

The bottom line is that if you know exactly what you need to protect, have identified and minimized the locations that this information is stored and are confident that the controls in place to access or modify that information are appropriate, you have significantly reduced the chances that your information will be lost, stolen or altered.

4 steps to protect your data in an online transaction

Hello readers of the Westfield Insurance Information Security Tips blog!  I am new to Westfield, joining the InfoSec team in the capacity of Information Security Architect.  Previously, I was an information security consultant working predominantly in banking and pharmaceuticals.

 

You may be asking, "What is Information Security (IS) Architecture?"  In its broadest sense, architecture in the IT industry involves marrying an enterprise's business objectives to its current and future technology capabilities.  A good architecture does this by leveraging what is already present, or when needed, carefully introducing new types of technology.  When properly architected, the IT environment adapts smoothly to constantly changing business demands.  Information Security Architecture tries to achieve these same outcomes but within the specialized domain of information security.

 

What tips does an architect have regarding day to day information security?  Well, let’s take a security architecture concept and apply it to your situation.  For example, consider the idea of ensuring the confidentiality of sensitive information.  This idea is broadly applicable everyday on the web.  From an architectural perspective it is helpful to think about the two states of confidential information, namely, at rest (e.g., stored in a file) and in transit (e.g., whizzing across the Internet from server to laptop).

 

Take a scenario where you keep your credit card and expiration date in a file on your PC (you can remember your CVV, that three digit code on the back of your credit card, because it's so short).  Doing this makes it so much easier for you go shopping on the web because you can just cut and paste your information quickly, conveniently and without worrying about typing errors, etc.  So you surf to your favorite shopping site, find the widget you want to buy, follow the checkout process, open the credit card file, cut and paste your credit card information, submit it, and in a few days your stuff arrives.

 

Let's talk about your information's confidentiality during the 4 steps in an online transaction:

 

1)   In your computer file: First, if you saved your credit card information on your computer, it is sitting in a file.  Here it definitely should have been encrypted in such a way that only you could decrypt and read it, for example, using a password protected file encryption such as the free GNU Privacy Guard.

2)   On the merchant's order form: Next, you cut and pasted it to the online merchant’s checkout page.  Did you make sure the browser was indicating that the communications were protected by verifying that there were no browser warnings about unrecognized or expired digital certificates?  These certificates are used to help you make sure that you’re really at the web site of the merchant you think you are.  Some browsers use a color coding scheme in the URL field and green is usually the color indicating the site’s authenticity has been successfully verified. 

3)   In transit on the web: When you submit your credit card information, the data will suddenly be in transit across the Internet!  Prior to submitting anything, make sure it is protected in transit by confirming the URL of the page where you entered your personal data begins with the string https://... Instead of the normal http://... .  That extra ‘s’ in https is for security and it means the data stream between your browser and the merchant’s web server is encrypted.

4)   On the site receiving your info: And finally, after you press Submit, if you get any browser warning about information being sent unsecured, your browser is warning you that, although the page you were on was secure, the place you’re submitting the credit card info. to may not be.  When you recieve such warnings while transacting confidential information you should cancel out of the transaction and perform your purchase via a different medium (e.g., over the phone).

 

So, from an InfoSec architecture perspective, assuring that the encryption infrastructure is guarding your information at rest and in transit is all part of your personal information security architecture.

Virus Scanner Scam

Christmas is just around the corner. Only 10 shopping days left. Many retailers are sending out emails to get you to shop online this season. I know I receive a couple dozen everyday. There are some good deals out there and there are no lines to wait in.

 With everyone online trying to get their list of presents bought, I thought I would recommend that everyone be extra careful when online this season. This brings me to the reason I am writing this article.

 A few days ago, I received a call from a colleague worried that they had gotten a virus. I started to ask some questions about why they thought they were infected. Turns out, a webpage popped up and told them they were infected. Since I knew what antivirus program they were using, I asked if it quarantined the virus. I was told that the system showed a lot of Trojans and wanted them to download a security solution.

I had them take a screen shot so I could see what they were looking at. As you can see from the screen shot below, this looks very real but is truly a scam. One indicator was that the DVD shows it as an “E” drive and their DVD drive was really their “D” drive. I instructed them to close out by pressing the “X” and close the browser.

 

When that was completed, I had them use their legitimate virus scanner to scan the entire drive to make sure nothing was loaded on their computer. It scanned clean as expected.

 Thanks for reading and have a safe and Merry Christmas!

Secure shopping reminders for Cyber-Monday

It's Cyber-Monday, the biggest on-line shopping day of the year, and that means it's time for Cyber-Monday scams. And there are a lot of them this year. Online shopping can be safe but you have to be careful where and how you shop. It's not really that much different from safe shopping at a physical store or over the phone. Be suspicious.

• When shopping online, type the merchant's URL in by hand instead of following any "convenient" link in an email or instant message. Those links can be spoofed in a phishing attack which looks like legitimate advertising.
• Look for the prefix https in the address line. This indicates that you are on an encrypted connection to the merchant's website. You can also look for the little yellow padlock icon in the bottom right of the browser. Be careful, however. Sophisticated hackers can spoof these signs
• Read the site's privacy policy carefully and use common sense about the offer. If it sounds too good to be true, it probably is. If you don't trust the company to protect your personal information, shop somewhere else.
• Make sure your own protections (anti-virus, firewall, patches) are up-to-date and running.
• Use a credit card, not a debit card. If your credit card is stolen or the number misused, federal law limits your liability to $50 (as long as you comply with the notification requirements). If a debit card number is compromised, you could lose the entire amount in the account to which the debit card is linked.
• Check your statement carefully for charges you don't recognize. Report any anomalies to your bank and report a lost or stolen card immediately.
• Consider keeping a separate credit card with a low credit limit just for internet purchases.

And in the theme of Cyber-Monday scams, here's one that isn't.

There are allegations online that a Facebook-based promotion being run by the Australian mall company which shares our name is a scam. They are letting Australian customers sign up for a lottery for a $10,000 gift card in exchange for all kinds of semi-confidential information (basically the same information you'd give up for a discount card, though) and the inclusion of a Facebook app to your account. Many people have accused the Facebook app of being virus-infected and/or the sign-up of being a phish. It actually checks out, though. Despite the skepticism (which I consider entirely appropriate and healthy in our current online environment), the mall's promotion has been confirmed. Hoax-slayer.com has a good writeup describing their confirmation of the promotion.

Whether you shop with the Westfield mall is up to you. Take a few minutes to research any such offer and company before you sign up, though. Being suspicious of an offer that seems too good to be true is an excellent habit to build.

3 Ways to Help Avoid Unauthorized Software

Last week at work, I received an e-mail letting me know of a "lost and found" item that I needed to claim.  So I stopped down at the security office thinking, “Hmm ... did I lose something with my name on it? Did someone see me drop my umbrella or something else I wouldn't have missed yet?”

 

Long story short; I had turned in 2 dollar bills found on the ground back in April, and since nobody had claimed it, I was now the owner.  As Earl would say, “Karma did that.”  But this made me think about all of the things people do to cut corners, or take advantage of someone else’s misfortune.  I'm by no means a knight in shining armor, but I try to be as honest as I can. 

 

I thought about this more as I read an article about a virus infecting the iPhone.  The virus only affected the phones which had been "hacked" or modified to run unauthorized software knowingly by the owner.  Many of us have called, e-mailed or asked the big software companies like Microsoft and Apple to protect us from security vulnerabilities, and they've tried, but often people install unapproved software which removes any chance they had at protecting their own information.  The software industry often calls this "Piracy", but in reality it's also hurting the people taking advantage of it in the long run.  Sure you can get access to all the cool new features of a "hacked" iPhone, xbox or any number of other devices, but in the end is it worth losing any or all information on your device, or even voiding your warranty?

 

Sometimes people don’t realize that they are running unauthorized software on their iPhone or other device.  Here are 3 ways to help determine if software is unauthorized:

 

1. Avoid installing packages with the words "Hacked" or "Free", unless they are approved by the company who sells the device.  All too often people create applications without considering the security ramifications. Despite their best intentions, they may be opening you up to some big vulnerability.

 

2. Avoid those e-mails which offer you a link to the latest software download or add-on for your device.  Remember if you didn't request the e-mail, it's probably a scam.

 

3. When in doubt, ask questions and search for answers. Vendors have customer support for a reason; they are often the best resources for those hard-to-find answers.

 

How are you keeping your information safe this holiday season?

Information Security Concerns in a Pandemic

For a while now, we have been working on the development of a pandemic plan for our company.  Information Technology supports this plan in many ways.  Through the use of technology we can increase the number of employees who can “work at home” and use Virtual Private Networking (VPN) software to remotely connect into our systems to perform their work.  Getting employees out of the office but still having them be productive is a form of “Social Distancing” that can reduce the risk of exposure to disease.

A component of any pandemic plan needs to be communication on what can and can’t be done from an Information Security perspective, even in a pandemic situation.  For example, we only allow company configured machines to connect to our network, even over a VPN connection.  However, not all of our employees have laptops so many, therefore, cannot work at home.   It must be reinforced that information security policy is still policy even in a pandemic, and employees who do not have company laptops must not use email to send documents or data to themselves to work on using their home (or any non-company owned) computer.  This is the same for taking work home on portable USB drives or other media.  Even if you have the best intentions and only want to help your company, you are putting your company at risk of your data being intercepted, copied or lost resulting in a privacy breach.

Why be so paranoid?  Our employees are only trying to be more efficient and effective in a time where 20%-30% of the company might be out sick.  It can't be that bad, right?  Wrong.  A big reason why is “endpoint protection”.  Your company’s endpoints (workstations and laptops) have known, approved and licensed software on them, they have anti-virus software running on them, they are regularly patched for security vulnerabilities and they are free of peer-to-peer sharing software.  Some of your employees' home machines MAY be up to your company’s standards, but what if even one is not?  When your employee is done with their work, are you sure that no backup or temporary files will linger behind?  How many of your employees have children that use the home computer to share music or files?  How about viruses or malware infecting your corporate network once this work is brought back into your production environment?  What if the employee actually loses the USB drive?  Not to mention the risk of a shared or compromised gmail or yahoo mail account.

All of these scenarios can cause data leakage or data loss that can lead to a privacy breach.  According to the most recent Ponemon study that reports on the costs and causes of privacy breaches, “Over 88% of all cases this year involved incidents resulting from negligence.” This leaves only 12% as a result of malicious activity.  This 88% is composed of employees who think that they are doing the right thing, are trying to help and believe that nothing bad can happen.

So, please reinforce to your employees and peers that it is not safe to trust public networks, infrastructure or non-company owned equipment to store or work on company confidential materials.   Even in a pandemic situation were your workforce may be diminished and people are looking for innovative ways to “keep the lights on”, information security policy is still in effect and information security risks, and their consequences, outweigh lost productivity.

National Cyber Security Awareness Month

“Our Shared Responsibility” is this year’s National Cyber Security Awareness theme. This theme is meant to reinforce that cyber security is not only government and industries responsibilities but each computer users.

By following a few simple steps, you can keep your personal assets and information secure. If each computer user does their part to keep safe, this will improve the overall security cyberspace.

 Listed below are the top tips from the National Cyber Security Alliance on ways to keep you safe online. Additional information on each point can be found at their website http://www.staysafeonline.org/top-tips.

• Know who you are dealing with online.
• Keep your browsers and operating system up to date.
• Backup important files.
• Protect your children online.
• Use security software tools as your first line of defense.
• Use strong passwords or strong authentication technology to help protect your personal information.
• Learn what to do if something goes wrong.

 While the month of October is National Cyber Security Awareness month, we all need to practice good cyber security all year long.