Information Security Tips from Westfield Insurance

Shredded documents can be unshredded

Shredding is the ultimate defense, right? Once it's shredded, it's gone!

No longer. It was always vulnerable if your attacker had the shredded chaff and plenty of free time. Think of the shredded embassy documents from the Iranian Hostage crisis of 1979. Those students reconstructed the pages with nothing more than scotch tape and patience. More recently, methamphetamine users have been hired by identity theft ringleaders to do the same thing.

Bill Wilson of the Big I recently found a number of services which make the "unshredding" problem much more manageable. In the Enron case, the government hired ChurchStreet Technology to scan the chaff, then used computer algorithms to piece the documents together. They claim to take the recovery time from hundreds of hours down to mere minutes. It's expensive but not terribly complicated. And your trash is in the public domain - anyone can take it back out of the dumpster without breaking any laws.

So how do you fully protect your waste paper from those ID thieves with too much time on their hands?

1. If you're still using a strip-cut shredder, get rid of it now. Upgrade to a cross-cut that chops the paper into very small bits of chaff.
2. Feed your pages into the shredder vertically, that is, with the words perpendicular to the shredder blades.
3. Don't have unusual-colored paper. Or if you do, shred enough of it that it can't be easily picked out. The rule in the army used to be no less than 20 sheets of any given paper type in each shred "lot".
4. Stir the chaff before disposal. A careful attacker could exploit the fact that pieces from the same document tend to come out of the shredder close to each other and remain so in the waste bag. A few quick stirs can randomize the chaff and make reconstruction much harder.
5. Send the chaff to a paper recycler. Even the best reconstructors can't bring a page back after it's been turned into new paper pulp. Of course, you have to be sure that your waste isn't intercepted before it hits the recycler but there are several bonded shredding companies that will do that for you.

How much is enough? It depends on who's out to get you. For most home users and small businesses, one and two are probably enough. If you really have something to hide, consider three and four and look into five when your shredding contract comes up for renewal. Find the right balance, remembering that identity theft is real but that most of us are not dealing with DoD nuclear secrets.

---

Bill Wilson publishes a bi-weekly newsletter filled with useful information including a technology column in almost every issue. His target audience is an independent insurance agent but many of his topics are applicable to any small business owner. If you're not subscribed already, I recommend looking them up.

Google Desktop is evil - updated

Google continues to roll out new applications to make sharing information easier. Kudos to them for some really creative programming. From a security point of view, though, you have to wonder what they are thinking.

Their Google Apps Team Edition allows employees to sign up for the Google Applications without any assistance or oversight from IT. Team Edition contains the core applications and collaboration services like the word processor, spreadsheet, Start page, Talk instant messaging and calendar, but does not include Gmail.

In any regulated or litigious industry, this is a recipe for disaster. You might save a few bucks on word processing and spreadsheet software but you're going to pay far more the first time you have to comply with an electronic discovery request or get into a dispute based on the Terms & Conditions of the application. No only are you putting your confidential data in someone else's hands and trusting to the security of their data center with little or no evidence of their worthiness of that trust, you're also still exposing all your data to the Google search indexing algorithms. (For more, see the Tip from April 2007.)

Luckily, you can block the worst aspects of the application/data sharing without having to block off all of the google.com domain. If your internet filter has a category for filesharing or for "Network Storage and Backup", make sure that category is blocked. You should also strongly consider blocking any category about "Web chat" so you don't have to worry about electronic discovery requests for instant messages that you didn't properly control. Read more about Google Apps latest attempt to bypass the business at ComputerWorld.com.

---

Update to Suing the scareware vendors (27 Oct 2008) The Federal Trade Commission has gotten a restraining order against two companies who were marketing scareware software. It's very good to see law enforcement successfully prosecuting these scammers. Remember, however, that there are lots more out there. Always be suspicious of pop-up 'alerts' and ads warning you about "illegal porn content" or "compromised software" on your computer. Read more at the FTC's consumer alert page.

Microsoft disables old file formats

We talked last week about the problems of holding onto old documents. Microsoft just made the problem even more complicated.

In the Service Pack 3 (SP3) update for Office 2003, Microsoft is blocking a number of older file formats so they can no longer be opened by MS products like Word, Excel or Powerpoint. Microsoft is walking away from it's commitment to backwards-compatibility because many of the older file formats had weaknesses that could be exploited by hackers to insert viruses and other malicious code into your computer. By disabling the older formats, Microsoft reduces the vulnerability of the Office applications to some of those kinds of attacks.

The problem is that if you are keeping old files in their native format as part of your records retention plan, you may no longer be able to open them. (Worse, if you get sued and have to turn over those documents, the courts don't care about format compatibilities. You still have the document – it's your responsibility to make sure that they can be opened and evaluated.)

Microsoft has two workarounds for this problem – neither very good.

The first involves modifying your registry settings so your computer can still open the older formats. That is a high-risk action and I do not recommend it. Not only does it defeat the security advantage of the change, any mistake when editing the registry settings can corrupt your entire computer. Even Microsoft warns against it saying "Serious problems might occur if you modify the registry incorrectly." and "Modify the registry at your own risk."

The second is to convert all your historical documents to the newer format. Microsoft has some automated tools to help but the conversion process is much more labor-intensive and error-prone than I think Microsoft wants to admit. I would seriously question the business case for converting any but your most critical of official records.

There is a third option which I consider far better. Take this opportunity to check those old documents against your retention policy and clean out the ones that you should have gotten rid of long ago. For the few that you must retain, make sure that you are keeping your business records in a stable format. Don't save files in their native MS Word document format - convert them to pdf or even tiff. Those formats are simpler and have far fewer holes that a hacker could exploit. They're also designed to remain readable across many generations of software.

Call your IT team for instructions on how to convert an old file to an updated format.

---

Addendum:
Bill Wilson at IIABA's Virtual University published the tip above in his newsletter and received the following question.
What are the file extensions that Microsoft has abandoned? I think it would be very helpful to know as we would then be able to do searches for those file types stored on our system. Thank you.

As Bill pointed out to the caller, the file extensions alone will not tell you which file formats have been disabled since Microsoft continues to use the same file extensions for the newer versions of it's software. (A Word document carries the .doc extension whether it's Word 1.2, Word 2003 or any version in between.) Microsoft has a little bit more information about the changes here but no new answers.

You can read another article about the problem at wired.com.
Thanks to Bill for finding those extra links.

Being a packrat costs a lot of money

Holding onto old documents is hard and far more expensive than most people realize.

In the paper world, the paper just keeps piling up. The paper must be protected from theft and damage (fire and water) and if it's ever going to be useful again you need some sort of filing and record-keeping system. A proper records retention facility is expensive to run.

With electronic documents and cheap memory, many people started to think that we could now hold onto everything. A two-gigabyte thumbdrive can hold up to the equivalent of 400,000 pages of documents. That's 80 boxes of copy paper. And, being electronic, I can type in a few keywords and let the computer find the document I want. No more filing! Right?

Not by a long shot. Memory may be cheap but usable storage isn't.

Electronic storage costs explode as file formats change over time. For example, a first notice of a claim involving a minor child has to be kept for up to 24 years (the child's age of majority plus four). What word processor were you using 24 years ago? What printer was the program compatible with? What operating system did it run on? What drivers did it need to operate? What hardware did it use? When was the last time you even saw a 5¼" floppy drive, much less an old 8" floppy? How much can you afford to pay IT to keep a working version of every system and application in the company's history?

And that's assuming you can find the file in the first place. We are used to thinking of searching as being as easy as Google. In fact, searching for documents is very hard when documents are scattered across ad-hoc structures like personal hard-drives and departmental folders. Solutions that try to solve the ad-hoc storage (like Google Desktop) create new problems, especially around the security of the index.

Keeping old records also exposes you to legal costs down the road. Under the new electronic discovery rules, a company must search through all its old documents just to see if they hold anything that might possibly be relevant to the lawsuit. One class action lawsuit can run into millions of dollars just in search and review costs - and that's even if you don't find anything. If you do have a relevant document, now you have to convert it, produce it and defend it from anyone who tries to take your words out of context. That's expensive.

• If your Records Retention Policy doesn't explicitly require you to keep the record, don't keep it. Throw it away and then you don't have to worry about storage or formats. The cost of recreating those few useful things that we lose will be far less than the cost of hanging on to all the rest of the trash.
• If you do have to keep a document, think long and hard about what format to save it in. Convert the file to a more stable format such as pdf or even tiff. Those formats are designed to remain readable across many generations of software. Call your IT team for instructions on how to save a file to an alternate format.

Metadata - defined

Metadata is getting a lot of press lately, especially among companies that are wrestling with the new electronic discovery standards issued by the US Supreme Court. But what is it really?

Technically, metadata is data about other data. If the customer's address is data, the number of entries in your address book is metadata. If the body of a Word document is data, the date you last opened the file is metadata. If the values in an Excel spreadsheet are data, the formulas in each cell are metadata.

From a legal point of view, metadata is everything about the document that's not immediately visible when the document is printed. It includes all the MS Office "properties" like file size, author and character count. It also includes any hidden features such as the old versions that are still buried in the document when you leave the Track Changes option on. It includes formulae in spreadsheets and formatting commands like the print area.

For most normal uses, the metadata about a document is just background. We take it for granted and almost always ignore it. But if your metadata reveals facts that you wanted to keep private, it can be embarrassing and expensive. In one case, a major pharmaceutical company deleted some study data from a report – and got caught when the New England Journal of Medicine looked in the Tracked Changes to show the deleted comments. In another case, a confidential White House policy paper about Iraq was outed when a quick command revealed the report's author. In yet another case, officials covered up classified information with black bars, not realizing that readers could easily uncover the text by copying it from under the black and pasting it elsewhere.

When you get into a legal situation, metadata becomes even more important. Metadata is used to show "who knew it and when they knew it" – to provide the context around the document in question. Metadata can either clear you or convict you. Because of its importance, metadata must be preserved and unaltered when you are collecting documents that will be used in court. This is hard because routine Windows operations will change the metadata just by opening the file. Make sure that you have the tools you need to keep metadata intact before you get into the lawsuit.

And, of course, be very careful before you post a document publicly. Make sure you clean out the metadata that you don't want public.

Home Shredders

How secure are you from identity theft? For all that we are (and ought to be) worried about hackers and other threats to our electronic information, researchers estimate that 55% of all cases of identity theft are based on information from paper. Could someone find credit card numbers, bank account numbers or social security numbers in your trash?

Garbage left at curbside is considered to be in the public domain. That means it's not illegal for someone to take items out of your trash. And don't think that someone won't go through it just because it's mixed in with the dirty diapers. In many municipalities, all the waste is opened and manually sorted as part of the area's recycling program. In Medina County, for example, your trash is touched by about 20 people between the time you put it in your trash can and it ends at the bottom of the landfill. Your credit card statement is a great temptation.

Home-quality shredders are available for as low as $40. If you don't yet have a shredder at home, you need one. We all need to be concerned with how much of our information can be accessed from our mail, including our credit card and bank statements, and any other piece of mail that may provide confidential information. Anything that has your name, address, phone number or any kind of account number on it should be shredded before discarding. Credit cards should be destroyed by cutting the card across the number.

There are two basic kinds of shredders: strip-cut and cross-cut. Most of the cheaper shredders are strip-cut. They cut the pages into strips between 1/8 and 1/4 inches wide. Cross-cut shredders (also called "confetti-cut") will chop the strips into smaller pieces, and thus provide much greater protection. The other factors commonly used to compare shredders are durability and capacity (how many pages can it shred at a time without jamming).

Note: Keep the shredder unplugged or locked away when young children are around.

Email can come back to haunt you

This Tip was first run in October 2006. This "encore tip" is a reminder to be professional in email.

Halloween is a time for scary stories - tales of vampires and ghouls rising from the dead to terrify innocents - a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is sometimes all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

Americans have a bad habit of treating email very casually – as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the message is private and that recipient will understand the context and correctly interpret our tone.

In fact, email is more like a postcard - anyone can read it while it's in transit and any of the recipients can save it, forward it or post it to the internet. Electronic copies can remain in archives and electronic message hubs all over the Internet – places that neither the sender nor the recipient can control. Emails can be subpoenaed and forced into the public record. You have no right of privacy in your email, either sent or received. When you write an email, you must assume that it will be read by an unknown and unforeseen audience.

That unknown audience will assume that you carefully crafted and wordsmithed your message (or, if not, that the hurried email is evidence of the writer's "real state of mind"). They will not believe that you were "just joking" and won't care that you were trying to dash off a quick note. They will interpret the tone according to their own preconceptions.

Always assume that anything you write will come out at the worst possible time and in the worst possible light. Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow's newspaper.

Remember, email can come back to haunt you.

Create a "_readme" for folders

Whether you use shared folders or keep files on your personal drive, eventually others in your organization will need to find some of the files that you've created or saved. Electronic searches help some but it's still important to file your ad-hoc documents carefully if you ever hope to find them again. In order to help the rest of your team members (especially future team members) understand your new filing system, I strongly recommend creating a very small file in each folder describing the:

• purpose of the folder
• owner of the folder
• intended audience and users of the folder – who should and should not have access
• retention period – how long should we generally keep the documents in the folder^†

If you name the file _readme.txt, the underline will cause the file to sort itself to the top of the list where everyone can find it. Here's an example of one I created to describe the folder where I hold my InfoSec Tips drafts. _readme.txt

†

When deciding on the appropriate retention period, refer to your organizational Retention Policy for guidance. And remember that "forever" is technically possible but outrageously expensive for electronic documents. Westfield is 159 years old. If we say that a document should be kept "forever", we are handing our IT department a blank check to spend whatever it takes to make sure that the document will still be here in another 159 years. There aren't very many documents with that kind of business need. Make your best estimate of the realistic business need for the documents in the folder. Also remember that saying you want to keep a document for 12 months does not mean that it will be automatically deleted. You (or someone in your organization) will still have to clean out the folder when the documents are no longer necessary.

Shredding is a Federal requirement

Under Federal Trade Commission regulation, any information about an individual that is derived from a consumer report or is a compilation of such records must be properly destroyed. These days, almost all of customer information has some connection to a consumer report and is covered under this regulation (scroll to pg 32).

The regulation does not actually require shredding but for most of us, that is the only cost-effective way to comply with the regulation's requirements for destruction. Papers in regular trash are exposed to the public and any private information on those papers can be misused by an identity thief. It can cost your customers thousands of dollars to get their identity back and could be considered a violation of federal privacy laws.

I strongly recommend a "shred all paper" policy for your office because there is too much risk that a piece of personal information will be overlooked on the back side of a form or that the page was used for scratch paper while you were on the phone. It's also easier to enforce the policy when you have a simple rule like "No office paper may be thrown away in the regular trash."

Very small offices can get away with a personal shredder. If you've got more than about 10 or 15 people in the office, it's probably more cost-effective to contract with a reputable shredding vendor who will pick up and properly dispose of your paper waste. Most of the shredding vendors will provide locked bins where the paper waste can be stored until pickup. Have enough bins to be convenient for staff.

Your Records Retention Program

This article was originally published in the May 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

What you need to consider from Information Security

How is your Records Retention program? Do you have one? Are you following it? In December 2006, the U.S. Supreme Court released new rules regarding the finding and turning over of electronic documents in response to a subpoena or other court request. Among other requirements, the new rules make it clear that every company must have a records retention/destruction policy that is strictly followed.

With that in mind, your document retention/destruction policy must find the balance between potential future benefits of a document and potential future costs of holding that document.

Think through the total costs of holding a document.

Documents are accumulating at an incredible rate. Who will wade through the archives to find the relevant document? Who will remove all protected or irrelevant hits from your search, and how much will you have to pay that person? (If it is a lawyer in response to a subpoena request, the answer is "a lot.") Even if you do find the document, will you be able to open it? What operating system did it run on? What hardware did it require? What will you do about the inevitable files that go corrupt? What storage medium will you use? These are just some of the questions you must consider.

Unless you have a carefully architected solution for document storage and categorization, your costs for electronic storage can skyrocket over time. If you have a copy of the document, the court can order you to produce it, forcing you to spend money to convert it into a format that they want and can read. Good companies have been forced to spend several millions of dollars recovering old versions and restoring old systems just to get through the discovery phase of a suit.

Then there are the legal liabilities of holding onto documents longer than is necessary. We all write things occasionally that we regret. Courts have said repeatedly that as long as you still have a copy of that message, it must be turned over. However, if you destroyed it in the normal course of business and in accordance to your own policy, the courts do not normally require you to go to extraordinary measures to undelete and recreate the document.

Remember that you also need the ability to centrally suspend the destruction cycle when you receive (or reasonably believe that you will receive) a court-ordered litigation hold. Courts have been unforgiving to companies that fail to suspend their destruction programs. Have a policy and follow it stictly.

CVS sued over improperly destroyed records

The drugstore chain CVS is being sued by the Texas Attorney General for failure to properly dispose of customer records including credit card and debit card numbers, drivers license numbers and medical prescription forms with name, address, date of birth, issuing physician and the types of medication. According to news reports, the store was being closed when over 1,000 papers with confidential information were found in the dumpster behind the store. (1,000 records would be 2 reams or about 10 pounds of paper and could easily have come from a single office-sized trash can.)

Dumpster-diving for sellable information is an increasingly common problem. Last year, a local Westfield Office Manager drove into his office's parking lot early one morning and surprised a man and a woman fishing papers out of the building's dumpster. Before he could even get parked, they jumped into their pickup truck and sped away. (Because the members of the office follow Westfield's "shred everything" policy, none of our customer information was compromised but we did notify the other tenants of the building.)

Failure to properly destroy confidential information is a violation of the Federal Trade Commission's regulation on disposal. In addition, it is a violation of several Texas laws and carries potential penalties of $50,000 per violation and/or $500 per abandoned record. This one incident could cost CVS's parent company over $500,000 in regulatory fines alone. The company is also reported to be under investigation by the US Office for Civil Rights and the Illinois AG for similar failures in other states.

In addition to the legal penalties, CVS is expected to suffer in the marketplace. According to a recent study by Javelin Strategy & Research, 77% of consumers said that they would stop shopping at stores that suffer data breaches. While it's unclear how many customers will realistically carry through with that threat, independent research estimates that a security breach costs $200-300 per lost record when you include the costs of disclosure, increased call centers costs, lost employee productivity, legal fees and the loss of investor and customer confidence.

While the law requires only that confidential documents be properly destroyed, I strongly recommend a policy that all papers must be shredded when they are no longer needed - that no office paper may go into the regular trash stream. There is too much chance that a social security number or unlisted phone number will be overlooked on the back side of a page.

For offices below about 10 employees, the most cost-effective solution is usually to invest in a good quality cross-cut shredder. For larger offices, consider contracting with a shredding vendor who can provide secure bins where papers can be collected until the vendor's scheduled pick-up. Require that all paper trash be placed in one of these bins.

How do you get rid of an old computer?

It's time for spring cleaning and you finally want to get rid of that old computer that's been gathering dust for so long. What will you do with the old one? You can't just give it away or sell it. There are thieves who specialize in buying used computers on eBay just to search them for private or financial information before reselling them.

Even if you remembered to delete your files, the data is not really gone yet. (When you delete a file in Windows, all that really happens is that the file information is removed from the computer's "table-of-contents". The data is still on the hard-drive and will stay there until Windows decides that it needs to overwrite that particular space with a new file. That can take months or years.) Even re-formatting the hard-drive does not sufficiently wipe the data. You might hide it from a casual hacker that way but a determined attacker using the latest techniques will be able to reconstruct your hidden information. Read this PC World article for more.

You also can't just put the old hardware out on the curb with the weekly trash. Even if it doesn't get taken from your trash by some passerby, there are hazardous materials within most of the devices that should be properly disposed of. Here are some steps you should take:

1. Make a couple of backup copies of important data and programs by writing the files to CDs.
2. Use one of the free or relatively inexpensive software programs available that will write over the data on the hard drive. This ensures that no one will be able to access your personal information later even if they try to use data-restoration software. Click here for a review of several common programs.
3. If you can, donate or recycle the equipment. Computer manufacturers often have suggestions on their websites (see for example, Dell or HP) and may even offer free pick-up and will work with local agencies in order to donate or recycle the equipment. You can also look for local donation sites at websites such as Earth 911. Finally, many counties offer computer hardware drop-off locations at their hazardous waste collection and recycling sites (e.g., Medina, and Summit counties) .

Note: Several donation programs ask that you not delete the operating system or software from your computer, arguing that schools can't afford to replace the software. This is in general untrue. Most schools, like most corporations, buy "site licenses" and can reinstall the operating system at a fixed, discounted rate. If you do want to donate the software along with the hardware, give them the original installation disks and let them install the software themselves. Always wipe the drive before you donate it.

Using "Temporary" shared drives

Many companies have a shared drive set aside for "temporary" use. When used properly, this can be an efficient way to share short-term documents across the organization and to minimize email bloat. Users post their document to this shared folder and provide a link to the document rather than sending dozens of copies of attachments around and bogging down your email system. When the short-term need is complete, users are supposed to go back to the shared folder and delete the documents they posted.

Too often, documents posted to these "temporary" folders are hardly temporary. And, while shared, they are rarely shared properly. Users post documents and forget to delete them or fail to consider that others (who may not have a need-to-know the contents) will be able to see the documents. IT departments know that these folders have to be extremely flexible in order to work well. They rarely implement access controls or other restrictions on the use of the folder. Doing so would defeat much of the purpose of the shared folder.

• If you have a shared "temporary" folder on your network, you need to know about it. Don't let these documents fly under the radar screen.
• Consider implementing controls on the folder. Controls can include:
  • Limit access to employees only. Lock out contractors, vendors and others who don't need to see the contents of the folder.
  • Set up the folder to automatically purge all contents older than some set (and short) period. A week or two is all that you can reasonably call "temporary".
  • Never allow the posting of unprotected confidential information to a shared folder.
• Many electronic content management systems (ECM) can make the need for these temp folders obsolete. If you haven't already invested in an ECM system, ask your technology team to look into it. If you have an ECM application, make sure that your staff are taking full advantage of it and not still using the old, uncontrolled shared folders.

Protect Your Customers' Social Security Numbers

This article was originally published in the Oct/Nov 2006 edition of The Agent Newsline, a publication of Westfield Insurance.

We all know about the rising threat of identity theft, and hear how it can affect a person's life. Along with businesses, legislatures around the country are also under a lot of pressure to do something about identity theft. Here are some tips to help you keep your customers' Social Security Numbers (SSNs) and your agency safe. It's not just a good practice - in almost all states, it's the law.

• If you don't absolutely need the SSN, don't ask for it. Take the field off forms unless it is absolutely necessary.
• If you only need the SSN once, use and destroy. Don't record a copy or make a note "just in case." If you must ask for the SSN, protect it carefully:
  • Watch records that get posted on a web site. Be cautious of spreadsheets with SSNs, which can get found via a search engine. Keep documents with SSNs in secured folders.
  • For log-ons to web sites, don't use the SSN unless the web site also requires a password or PIN for access.
  • Several states explicitly ban the selling, renting, trading, etc. of any list containing the consumer's SSN, so don't give out a consumer's SSN to anyone.
  • Only print or show the last four characters from the SSN.
  • SSNs may not be printed on any ID card required for the individual to receive products or services. That means that SSNs generally may not be printed on the proof-of-insurance card. This includes embedding the SSN using a barcode, smart chip or magnetic strip.
  • Unless the message is encrypted, don't request or send SSNs via e-mail.
• When sending mail, do not print the SSN on anything mailed to the individual unless required by law. The news tends to highlight the technology-based hacks and compromises but research continues to show that most identity theft is committed based on paper records and the largest single source of stolen SSNs is still physical mail theft. (The second source is trash.)
  • If you do send a document with a SSN in the mail, be sure the SSN is not visible through the envelope. Also watch postcards, top-sealed mailers with open sides or envelope window openings.
  • The "required by law" exception applies primarily to certain HR records like your W-2. There may be a few state laws requiring us to send SSNs by mail either to a state agency or to the individual but as a general rule, avoid putting any document with the consumer's SSN in the mail unless it is strictly required.
• Destroy everything when it is no longer necessary. As soon as that retention period runs out and the record is no longer necessary, make sure that it is properly destroyed.
  • Paper documents should generally be destroyed by shredding. While the FACTA Disposal regulation allows other means of destroying paper documents, shredding is almost always the most reliable and cost-effective way.
  • Make sure that all electronic media (hard-drives, floppy-disks, thumb-drives, CD-ROMs) get sent back to your IT department for wipe. Make sure that the data has been irrecoverably destroyed first before donating or throwing away.

Email can come back to haunt you

Halloween is a time for scary stories – tales of vampires and ghouls rising from the dead to terrify innocents – a time when things that you thought were dead and buried come back to haunt you.

Unfortunately, the analogy between badly written email and the undead is all too appropriate. A hasty word can return to haunt you long after you hit the send button and thought the conversation was over. Careers have been destroyed, money lost and relationships ruined when an email returned from beyond.

The problem is that we have a bad habit of treating email as a very casual form of communication. We think of it as an extension of our last phone conversation or a continuation of the chat in the hallway. We assume that the recipient understands the context and correctly interprets our tone. When third parties read your message, however, they assume that you spent as much time crafting and wordsmithing your message as you would have in the days of typewritten memoranda. They may or may not understand (or care about) the context of the message and they will interpret the tone according to their own preconceptions.

Legally, email is a type of formal business communication. The contents of the message are not protected. You have no right of privacy in your email, either sent or received. Any email can be subpoenaed and forced into the public record. Or it could be saved, forwarded or posted to the internet by one of the recipients. When you write your emails, you must assume that it will be read by an unknown and unforeseen audience. Assume that anything you write will come out at the worst possible time and in the worst possible light.

Be professional in your email. Include enough context that the unforeseen reader understands the message. Be personable yet professional in tone. (In particular, never use sarcasm in email.) Never write anything that you would be embarrassed to see on the front page of tomorrow's newspaper. Remember, email can come back to haunt you.

Keeping your customers SAFE

This article was originally published in the Oct/Nov 2005 edition of The Agent Newsline, a publication of Westfield Insurance.

Based on recent identity theft events, it is clear that U.S. businesses are operating in an increasingly hostile environment. Identity theft remains the fastest growing category of crime in the U.S. Criminals are getting more creative and more technologically adept every day. In this age of rapidly rising threats, every company needs to take serious steps to ensure the security of the private information in their custody.

What does Westfield do to keep your information safe?
Westfield holds private infromation in trust for you and our policy holders. Rest assured, we take our responsibilities seriously. We have never suffered a serious compromise of our data or systems and work hard to keep it that way. Here's how:

• Dedicated security team. In early 2005, Westfield created and filled new roles dedicated specifically to information security. These people are charged with the coordination and continuous improvement of information security. We also formed a corporate security response cabinet with responsibility for all security-related issues. This group was formed in recognition of the increasingly blurry distinction between the physical and the electronic perimeters.
• Password protection. Westfield has password complexity standards and requires our employees to change passwords every 60 days. We continuously upgrade hardware and software in order to make sure our systems are patched for security vulnerabilities.
• External defense. We also commission external vulnerability scans and penetration tests. With your interests in mind, we regularly conduct internal scans of our systems and defenses and use that information to improve our systems.
• Disaster plan. Westfield also has moved aggressively to guarantee our ability to operate even after a potential physical disaster. Mainframe data is mirrored real-time to an off-site facility. In addition, we conduct semi-annual tests of our business continuity plans.
• Mandatory shredding policy. All office paper must be shredded. Even in this electronic age, most identity theft occurs as a result of access to physical copies of the information.

We want you to know that we take precautions to protect the private informaiton you've entrusted to us.

Shredding... It's now the law

The Federal Trade Commission's regulation on the disposal of information went into effect on June 1, 2005. According to the regulation, any information about an individual that is derived from a consumer report or is a compilation of such records must be properly destroyed. Much of the information routinely used in insurance operations has some connection to a consumer report and is covered under this regulation.

Failure to comply with the regulation could result in fines and/or in lawsuits if the information is misused to commit identity theft. This law implements the "disposal provision" of the Fair and Accurate Credit Transaction Act of 2003 (FACTA).

For more information on the FTC regulation, visit www.ftc.gov and search on "disposal".

The regulation includes several examples of ways to comply and to ensure that the consumer's private information remains protected during the disposal process. Westfield requires that all papers be secured until they are ready for disposal and has contracted with an accredited shredding company to make sure that the papers are thoroughly and properly destroyed.