Tag Archives: Social Security

How to Fight Organized Cybercrime

Kris Covino, CTO and co-founder of Date.com once received an e-mail that appeared to come from the United Kingdom. The writer explained that he had encountered a lot of fraudulent activity on Date.com, and asked for advice on how to detect fraudulent behavior. Covino wanted to be helpful. “I responded with information on some anti-fraud databases, places to check if a photo of a supposed Date.com user had been used in online scams, and an online discussion group about scams,” he says. “It was pretty comprehensive and I sent it off…but something about it bothered me.” So Covino checked the sender’s e-mail address against Date.com’s database of known frauds, and it matched up with a known scammer in Nigeria. “The scammers had proactively contacted me to find out how they could disguise themselves better!” Covino says. Not only that, at the same time he was answering the e-mail, the company’s customer service staff was fielding phone calls in which the caller claimed to be a Date.com user who’d been banned from the site, and asking for detailed information on how to avoid being banned in the future. There’s no question that in the past few years cybercrime has taken on new dimensions. “Ten years ago, it was teenagers with pony tails sitting in their garages,” says Fred Rica, principal at PricewaterhouseCoopers. “We now see a high level of organization, a high level of sophistication, and a high level of funding. Whether it’s coming from a nation-state, or organized crime, or somewhere else, they seem to have a lot of resources at their disposal.” And they operate across international borders. “We found many crime rings employed multiple teams that focused on different parts of a fraud operation,” Covino says. “For example, one team located in the U.S. would register free user accounts, but when it came time to input stolen credit card numbers to create fake pay accounts — which is illegal here — that was done from offshore. Then yet another team located predominantly in a few specific regions would use those accounts to perpetrate romance scams within our community.” Romance scams might include getting to know a Date.com member by e-mail or chat over a period of months, and then asking him or her to cash a check, for example. Cyber-gangs prey on small companies “If you ask a small business about safety, the response is often: ‘Who would hack me? I have nothing of value,’” reports Dirk Morris, CTO and founder of Untangle, an open-source security gateway for small businesses. They’re wrong. Organized cybercriminals are after two things that every company, large and small, has. The first is computers, which, if vulnerable, can be used as part of a botnet, sending out spam or performing other tasks without their users’ knowledge. The second is personally identifiable information, such as credit card or Social Security numbers, but also log-ins and passwords that could give the cybercriminals access to users’ accounts. In fact, organized cybercrime often targets small companies rather than larger corporations. “It’s just too easy to exploit small or medium-sized businesses,” says Ron Plesco, president and CEO of the National Cyber Forensics & Training Alliance. “Large corporations have more funds to remediate and mitigate. Small businesses don’t, and the bad guys know it. They’re concentrating on small businesses, and have been for the past year.” How you can avoid being a victim of cybercrime Here are some steps that can help. Get the best security you can afford. You can’t match a large company’s security arsenal, and that’s okay. All you need is enough to make your company an unappealing target. “If the door to your house is locked, you have an alarm sign in the window, and a sign that says ‘Beware of the dog,’ a thief will probably go on to the next house,” Rica explains. It works the same with cyber-gangs: if you make it difficult to gain access, they’ll go bother someone else. Know your network patterns. It’s smart to review logs and usage on a periodic basis. For instance, by examining logs, Covino was able to determine that a user who appeared to be in the United Kingdom was actually in Nigeria when the scammer’s proxy server stopped working for a few moments, revealing the user’s actual location. Know your customers’ patterns. “You have to understand your customer base and have some information about how they use the site,” Covino says. “It’s impossible to fight this without some of that information.” Just as important, be aware of what user behaviors should be taken as red flags. For Modern Tribe, which sells Jewish themed t-shirts and other Judaica, that turned out to be large orders for t-shirts with overnight delivery and a shipping address that didn’t match the credit card billing address. The first time the company received such an order, it billed the credit card number and sent out the t-shirts for overnight delivery — and received an irate phone call a few days later from the credit card’s owner who had not authorized the charge. By then, it was too late to stop or recover the shipment, so Modern Tribe wound up eating the cost of the t-shirts and expedited shipping. However, there was a second order in process that also involved a large number of t-shirts, expedited delivery, and a shipping address that didn’t match the card’s billing address. “We immediately suspected that the second order was also fraudulent, so we looked into it, and when it turned out to be false, we were able to stop it,” says Jennie Rivlin, Modern Tribe’s founder. Since then, she says, her firm has received many such orders, but since they know the pattern, they can take extra steps to make sure an order is real before filling it. “We have had some larger orders where the billing and shipping address didn’t match, so we contacted the customers and it turned out to be fine,” Rivlin says. “But it was well worth taking that extra precaution.”

Time to Take a Look at Digital Signatures?

Aurora Lifetools helps disabled people win Social Security claims. The firm typically works with clients whose claims have been turned down as too small by law firms that traditionally handle such matters, although Aurora is not a law firm, and its professionals who represent claimants are not attorneys. Since the sums involved aren’t huge, Aurora’s success depends on its ability to represent large numbers of claimants. Electronic signatures are a huge help to that effort, according to Drew Hyde, senior partner. “About 12,000 people apply for Social Security Disability every day — that tells you how big the market is,” he says. The company’s staff of nine, using electronic signatures combined with customer relationship management and database technology can enroll about 200 cases a day in Aurora’s system, he adds. “Without electronic signatures, those same nine people could pull in about 35 cases a day — maybe.” And, even if the company had a staff of thousands, some clients would be impossible to help without digital signatures, he says. “In the old days, we couldn’t take on anyone with less than a week to go before a filing deadline,” he says. It would simply take too long to get the papers certifying Aurora as the client’s representative signed and in place in time to submit a claim or appeal. Today, Aurora can complete the process of interviewing and signing up a new client by phone and Internet in about 12 minutes, Hyde says. “Now, someone can call us at 3 p.m., and we can submit the claim at 3:45 and protect that client’s rights.” The time is right to move to digital signatures In 2000, the Electronic Signatures in Global and National Commerce (ESIGN) Act decreed that a properly obtained electronic signature has the same legal standing as a handwritten one. Since then, adoption of electronic signatures has been slow, except in certain industries, such as financial services. But acceptance of digital signatures has been building to a critical mass in the last year or two, perhaps in part because the general public has grown comfortable with the basic concept of a legally binding Internet transaction, such as filing an online tax return or clicking “Buy It Now” on eBay. At the same time, evolving technology has made digitally signing easier, according to Jason Lemkin, CEO and co-founder of EchoSign, an electronic signature service. “It wouldn’t have been practical in 2000, because you needed today’s browsers and Ajax [asynchronous Java Script and XML] to make the experience as easy and elegant as it is today,” he says. At the same time, as business in general becomes more Web-oriented, using paper contracts seems less and less logical. “When everyone’s using Salesforce.com and LinkedIn, it doesn’t make sense to have to use FedEx or a fax machine in order to close a deal,” he says. Avoiding revenue loss But there’s another reason to consider electronic signatures today — one Lemkin says has created an upsurge in EchoSign’s business in the past few months. “The most important thing in today’s economy is revenue assurance,” he says. Electronic signatures help by allowing companies to close a legally binding deal in minutes, while a customer is still on the phone. “When you have customers who want to buy, you don’t want to make them dig up a fax machine or go out to the mailbox — because they might not do it,” he says. Revenue assurance is the biggest benefit of using digital signatures for Hcareers, a job board for the hospitality industry. “With many of our one-time transactions, we would simply work by e-mail confirmation,” notes Jim Finn, vice president of sales. That made life easy from a logistical point of view, but customers occasionally reneged on their deals. “We had a certain percentage of write-offs,” Finn says. “It wasn’t a large percentage, but we weren’t really happy with any.” Today, Hcareers customers must digitally sign using Agreement Express, showing their consent to the site’s terms and conditions, which include a commitment to pay for services used. The result: “We’ve had 80 percent fewer clients being sent to collections in the six months after implementing digital signatures,” Finn says. Working with digital signatures comes with other advantages as well, he says. “It’s far more efficient than a fax machine, and better for the environment. My contracts are all in cyberspace, so I can print them if I need to — and I don’t have two file cabinets standing outside my office.” In fact, he says, “From an efficiency standpoint, electronic signatures are the only way to go about securing contracts.”

2009 Tech Security Forecast

Great, you may be thinking, now that it’s 2009 I’ll be getting a smart phone to use for work. Just great, your IT manager may be thinking, now that it’s 2009 they’ll be getting smart phones to use for work. IT experts predict a substantial uptick this year in the number of small businesses using smart phones — as well as flash drives, social networks, and faster Internet connections. While that might make employees more productive, it also increases the security risks a small business faces. Last year saw the start of a new wave of cyber crime that put spam on smart phones, phishing and virus attacks on Facebook, and even malware on flash drives, according to IT security experts. Those threats will only increase this year, says Derek Manky, a cyber-security project manager at Fortinet, a manufacturer of intrusion protection systems and other IT security equipment. Small businesses are at greater risk because chances are they have fewer IT staff and don’t take as many precautions to avoid threats, says Brett Scudder, an IT security consultant and proprietor of IT Security Suite Network in New York City. “We’re seeing a lot more work coming from” small businesses, Scudder says. IT security trends in 2009 According to Manky, Scudder and other computer security experts, here are trends to watch in 2009: 3G phones — Web-enabled smart phones and the 3G networks they run on will become the newest playground for cyber criminals, who started launching worm attacks on cell networks last year. “2009 won’t necessarily open the flood gates, but it is an indication that this will be a significant trend and will overflow in 2010,” Manky says Social networks and online games — More worms and viruses circulating on Facebook and other social networks as well as on online games will jump to company networks as employees use laptops or home PCs for work and pleasure without having proper security measures in place. USB storage devices — As use of flash drives and USB memory cards grows, so will the appearance of worms and malware that hop on for the ride, and then infect inadequately protected company networks. Databases – Cyber criminals will continue breaking into networks to launch botnets, but also to go after specific information stored in databases there, including Social Security and credit card numbers and bank account information — data they can sell on the Internet black market. Faster Internet connections — As 10 gigabyte Ethernet connections go from luxury item to commonplace network pipe, companies’ existing security measures will have trouble keeping up with the increase in volume, making networks more vulnerable to attack. “The shear volume of traffic will make it difficult to identify what’s good traffic and what’s malicious,” says Anthony James, senior vice president with Fortinet, the IT security hardware company. The economy — Due to the recession, IT departments will be asked to maintain current service levels with the same or less money. As a result, interest should pick up in integrated security hardware and software that performs several functions, such as combination intrusion protection systems and firewalls. SIDEBAR: Protect Your Small Business from Threats In light of many potential threats, what can a small business do? Create and maintain strong IT security policies. Update written policies with information on newer technologies such as smart phones and flash drives so employees know what they can and can’t do. Include rules covering how employees can log onto company networks, for example, either from an official company machine or one that’s passed certain security requirements. Restrict access. Block employees’ ability to log onto high-risk types of websites or domains, such as peer-to-peer networks, where the risk of picking up viruses or malware is greater. Patch early and often. Regularly install patches and updates from Microsoft, anti-virus, firewall, and other security vendors for desktop machines, laptops, and servers. Educate employees. Having policies isn’t enough. Companies need to use every means possible to inform employees about them, including listing them in employee handbooks, newsletters, e-mail bulletins and on a company’s website, wiki, or blog.

2009 Tech Security Forecast

10 Steps to Database Security

March 1, 2008: a laptop containing unsecured confidential data is stolen from an employee’s car, endangering the privacy and financial well-being of thousands of people — and a company’s reputation. Feel like you’ve read this before? Once only the stuff of nightmares, this unfortunate scenario has become almost commonplace. In this latest instance, the laptop belonged to an employee of San Jose, Calif.-based Stock & Option Solutions (SOS), a stock-plan manager and subcontractor to Agilent Technologies Inc., of Santa Clara, Calif., a life-sciences and measurement firm. The laptop contained a database listing the names, addresses, and Social Security numbers of 51,000 Agilent employees, retirees, and stakeholders, as well as information about their stock holdings. Despite a strict Agilent database-encryption policy, which covered SOS as well, the laptop version was unencrypted, confirms Agilent spokeswoman Amy Flores. “They blew it,” she says simply. Cautionary tale about databases This latest case should serve as yet another cautionary tale. Data such as Social Security or credit card numbers are not only crucial to a business, they are worth their weight in gold to those in the identity theft racket. Moreover, compliance with regulatory mandates, such as Sarbanes-Oxley requirements, requires companies, and their contractors, to keep an airtight lock on relevant data if they want to win and maintain lucrative business deals. And yet, database administrators (DBAs) probably only spend 7 percent of their time tending to database security, estimates Noel Yuhanna, principal analyst for database security at Cambridge, Mass.-based Forrester Research. If anything, DBAs spend more time trying to increase internal access to a company’s database, so that it can be used optimally by the accounting or sales staff. And for small businesses, where the DBA could have countless other duties, too, the problem might be greater. Sometimes insiders at fault Which brings us to another tough statistic — a January 2007 Forrester Research report estimated that 70 percent of all database breaches involve insiders. Even those employees who administer the database need to be viewed as potential risks to its safety. Awareness of the scope of this problem is growing, however. A separate Forrester study found in October 2007 that enterprise spending on database security and auditing is likely to double by 2010 to nearly $900 million annually. What should a small or mid-sized business do to protect its database? Here are some tips from the experts: What’s Your Risk? “If your database is on the Internet, you have to protect it from hackers. Even if not, you have to protect it from insiders. And then you need to consider the laptops, thumbdrives, anything else that can include the data,” says Sushil Jajodia, professor of information technology and director of secure information systems at George Mason University, in Fairfax, Va. Figure out the scope of your risk first. Conduct a Vulnerability Assessment. Tools are out there that can help you check how well your existing systems work to protect your database. Products such as Imperva’s Scuba, an open-source assessment tool, can point out flaws in existing programs. How Many Databases Exactly? Make sure you track down any and all copies of your company’s databases that might be floating around. There may be more copies than you think, so make sure they are all found and eventually protected. Develop a Clear Policy…and Stick to It. “Insiders need to know what they can and cannot do” with critical information, and how it should be stored, says Jajodia. “They need to understand the policy and know what will happen if it’s violated. Usually, that’s enough and people will do the right thing.” Insiders can include not only employees, but third-party contractors, too. Go Shopping for New Tools. DBAs should seek out the newest database security releases instead of relying on what’s on their systems now, says Forrester’s Yuhanna. For example, the latest offerings from Oracle, IBM, SQLServer, and Guardium offer far more advanced features. Guardium’s appliance, for example, features continuous tracking of all database activity, including failed logins, and includes an email alert service that can let others know of any suspicious activity. Make Sure the Tools Get Used. Make sure any software is properly installed. If encryption software for laptops is purchased, make sure it’s installed on every laptop in the office. In a recent case involving a laptop theft from a National Institutes of Health (NIH) employee, the laptop was not encrypted despite the existence of a U.S.-government-wide encryption policy, notes Jajodia. Control Access. Only certain employees should have access to the office database, and those employees who need only parts of the database to do their work should only have access to those parts. Products such as Applimation’s Informia subsetting solution or EMC’s Database Xtender can ensure that the sales force, for instance, only sees the specific data they need and nothing more. Don’t Give DBAs Sole Responsibility. Remember that most database breaches happen from the inside, so make sure someone is checking up on the DBA, too, notes GMU’s Jojodia. “This is the typical weakness, where a separation of duties isn’t followed,” he says. “There have to be checks and balances,” Newer product offerings can help by ensuring that even DBAs cannot make changes without notice. Handle Old Data with Care. Develop a solid strategy for storing databases that have outlived their usefulness, or old equipment containing such data. Remember that even old data can be misused if in the wrong hands. To store sensitive data, consider off-site archiving options with limited access, says Yuhanna. Should You Dump it Instead? Legal experts note that keeping certain old data could add to your company’s risk in the event of an e-discovery case. If you decide to dump the data, wiping software, which overwrites your hard drive with unreadable gobbledygook, is one option: consider such products as WipeMaSSter or Active@KillDisk. Other options include degaussing (frying with an electrical impulse to render it unreadable) or destroying a hard drive outright. To be sure, protecting your company’s database is a challenging, time-consuming task. And, as Agilent’s Flores warns, the proverbial chain is only as strong as its weakest link. But nonetheless, making your best effort could help inoculate your company from all kinds of unforeseen dangers.

Safeguard Your Biggest Asset — Your Data

Do you know where your data is? If your company maintains databases, runs e-mail marketing campaigns, sells something online, or gives salespeople laptops, the answer could be “everywhere.” The more places a company’s data resides, the greater the possibility it could fall into the wrong hands, accidentally or by theft or hacker assault. With so much at stake, it behooves businesses to establish controls to ensure data is private, secure and stays that way. One method for doing that is a privacy audit, in which a company reviews its information handling practices to track where data is stored and moved, if it’s vulnerable to leaks or theft, and whether employees adhere to stated privacy and security practices or industry regulations. Data breaches and lost laptops Small business owners who don’t think they need to check privacy practices are fooling themselves, advises Mike Spinney, spokesman for The Ponemon Institute, a privacy think tank in Traverse City, Mich. Consider: Since January 2005, 216 million data records of U.S. residents have been exposed due to security breaches, according to the Privacy Rights Clearinghouse (PRC), a non-profit consumer privacy advocate in San Diego, Calif. According to the PRC’s online listing of data breaches, many of those occurred at small businesses. The most common causes of security breaches are lost or stolen laptops or other portable devices like USB drives, according to a November 2007 benchmark study of data breaches at 35 U.S. companies by The Ponemon Institute. A separate survey published by The Ponemon Institute in November 2007, found that of 893 U.S. IT professionals, 51 percent copied confidential company information to a USB memory stick even though the majority of them (87 percent) believed their company’s policy forbade it. That even IT professionals should exhibit such cavalier attitudes toward data privacy “is kind of shocking,” says Spinney, the Ponemon Institute spokesman. Setting up a privacy audit Routine privacy audits could uncover and prevent such behaviors, privacy industry experts say. To perform an audit: Decide what data to analyze: all employee and customer records, or a subset of sensitive information, like Social Security numbers. Use spreadsheets, employee interviews, technical monitoring, and blind shopping or testing to create a chart showing where data is collected, processed, transferred, or deleted and what applications or vendors are used for each step. Use the data flow chart to measure the company’s day-to-day information handling practices against its stated policies and any industry rules or regulations. If the two don’t match, take the appropriate steps to change them. At most small businesses, an IT manager, CFO, or CEO could spearhead an audit. Small businesses could also hire a privacy consultant, or use their outside legal counsel or accounting firm, if those firms provide such services, says Jeff Nicol, of PrivacyReady.com, a privacy industry consultancy in Hood River, Ore. Audits aren’t cheap. A small business can expect to pay around $20,000, Nicol says. That’s pretty pricey, so companies could consider scheduling a full audit once every three years or do partial audits each year, Nicol says. Between audits, companies can use security assessment software to keep systems running smoothly, Nicol says. Software like Watchfire from IBM, Web Vulnerability Scanner, from Acunetix, Hailstorm from Cenzic, or WebInspect from SPI Dynamics can check that a company’s use of Web applications complies with stated privacy directives. Online sellers can test their privacy practices by going through the assessment process necessary to get an online privacy seal from TRUSTe, the non-profit privacy trust organization. SIDEBAR: Securing laptops and educating employees About those laptops: security experts recommend putting passwords on everything, and using encryption software such as Credant Mobile Guardian Shield or KeyPoint Alchemy from RedCannon Security. Another suggestion: enroll employees in online courses like the Privacy Directions series from MediaPro. “Technology (is) a big part of having decent security, but the weakest link is workers,” Nicol says. “Proper policies, training, and monitoring all are critical to see that folks know and follow good information security practices.”

How to Avoid Scammers, Spammer and the Rest of the Bad E-guys

The first e-mail message was sent sometime in the early 1970s by Ray Tomlinson, an English computer engineer working for the Defense Department’s Advanced Research Projects Agency. Nobody remembers what it said: possibly “testing” or “QWERTY.” Tomlinson wasn’t thinking about history; he was just trying to create a quick, informal way for a closed universe of research scientists to communicate with one another. Ease of use was the point, not security. Defense scientists 30 years ago, after all, did not have to worry about armies of malicious nerds with laptops and cable modems. The openness of e-mail, though, the thing that makes it so revolutionary, is also what makes it so vulnerable to viruses, worms, ID theft, denial-of-service attacks, and a host of other threats. Scammers are constantly cooking up new ways to use your e-mail system against you. Phishing attacks, for instance. Your employees or customers get an official-looking e-mail saying there is a problem with, say, their credit card account. Would they please click on the link below, then type in their account or Social Security number? MessageLabs, a security firm that tracks phishing attacks, says the number of phishing e-mails grew to 4.5 million in November 2004 from 337,050 that January. Then there’s spam. The Radicati Group estimates that 45% of all e-mail is spam; other experts think it may be as much as 80%. According to Ferris Research, an e-mail and communications consulting firm, the worldwide cost in lost productivity and resources devoted to fighting spam will be $50 billion in 2005, more than a third of that coming from U.S. companies. It’s not all bad news, though. Anti-spam laws have started to show some teeth. In April, Jeremy Jaynes, who was reportedly sending out 10 million junk e-mails a day, was convicted of felony charges in Virginia and sentenced to nine years in prison. Couldn’t have happened to a nicer guy. As you may have noticed, though, spam, viruses, and the rest haven’t gone away. You still have to protect yourself. Which defense is best for you is a function of how big your business is and how much control you want over your security. Many fixes can help not only with keeping your system safe but also with archiving messages and making sure your system complies with your policies and the law. One solution may not be enough. “You cannot expect to buy a single layer of security protection and sleep at night,” says Sara Radicati, of the Radicati Group. Your choices fall into three main categories. Managed Services Letting somebody else do it is an attractive option if you have a modest (or nonexistent) IT staff. The tradeoff is loss of control: You’re trusting an outsider with a key part of your business. Managed providers offer a range of security services that include spam filtering, virus protection, encryption, mail monitoring for compliance with regulations or company policy, and even archiving. Fees are typically per user, per month or year, and the price generally drops the more licenses you buy. Most vendors offer 30-day free trials. Postini’s Perimeter Manager Small Business Edition (starts at $25 per user per year) includes protection from spam, phishing, and viruses. It also provides defense against directory harvest attacks, in which cyber miscreants try to get your employees’ e-mail addresses by bombarding your server with messages sent to every possible address–jfried@inc.com, johnfried@inc.com, etc.–and seeing which ones bounce back. Perimeter Manager handles only inbound e-mail, however. If you need to keep tabs on internal or outbound mail, too, you can upgrade to Postini’s enterprise edition (starts at $33 per user). SingleFin’s Global Gateway Service includes e-mail, Web, and instant messaging content filtering, as well as archiving ($12 a month, or free for businesses with fewer than 10 users). A light version of the suite, which simply marks spam and forwards it along to you and also filters viruses out, is free for any number of users. MessageLabs offers anti-virus, anti-spam, content, and policy control services. Pricing is based on company size. A business with 250 to 499 employees, for instance, pays a monthly $3.83 per feature per user. Other big players worth checking out in managed services are Frontbridge, Symantec, and McAfee. Appliances Not refrigerators or microwave ovens. These are security hardware systems–literally boxes that contain e-mail watchdog and filtering systems. They are the fastest-growing segment of the security industry, according to the Radicati Group. They are generally easy to install and customize and they leave your own tech people in charge. Appliances are, however, not cheap. IronPort’s C-series comes in four sizes, depending on the number of people in your business. The midline C10 (around $9,000) is designed for companies with up to 1,000 employees and features anti-spam and virus protection, as well as content filtering for policy enforcement and monitoring. CipherTrust’s IronMail appliance (starts at $5,995 for the S-10 model, which is designed for companies with 100 or fewer users) has strong compliance tools. Other companies that make security hardware include Borderware, Barracuda Networks, Mirapoint, and Alladin. Software Security software is plentiful and comparatively cheap. Most security experts, though, say this stuff is most effective when used in combination with an appliance or a managed service. They also warn that given the constant evolution of viruses and other threats you (or your IT staff) may be constantly managing patches and updates. WebRoot’s Spy Sweeper Enterprise ($300 for a one-year subscription with 10 licenses) and PepiMK Software’s SpyBot Search & Destroy (free) will keep your business computers clean of spyware programs, which can steal your data or even turn your computers into spam-generating “zombies.” Symantec’s Norton AntiSpam 2005 ($320 for a 10-user pack) will clean your computer of junk mail; Computer Associates’ Server Protection Suite ($1,055 for five users) offers a range of security tools, including anti-virus, anti-spam, and spyware protection; Clearswift’s MIMEsweeper ($2,628 for 100 licenses) series has a variety of monitoring software solutions; Sophos’ PureMessage Small Business Edition ($2,850 for 100 users) offers protection from viruses and spam; TrendMicro’s NeatSuite for Small and Medium Businesses ($59.34 per user for 25 to 100 users) has anti-virus, anti-spam, and content security.

Security Lapse

I got a letter the other day from Time Warner, where I briefly worked some years ago. It was a sincere-enough-sounding note just to let me know that the guys in the data center may have inadvertently let my Social Security number and other private information fall into unknown hands. No need for me to take it personally—the company had done the same thing to some 600,000 present and past employees when it lost a boxful of backup tapes from a truck. Companies seem to be surrendering a lot of valuable data these days to hackers and other miscreants, at least when they’re not busy fending off the latest crippling virus or worm. What can you do about it? I’m not going to give you the standard lecture on the importance of protecting your computers. I bet you’re a little tired of hearing that sort of thing. Instead, I’m going tell you something different about computer security—something you won’t hear from vendors, IT whizzes, or even security professionals. You’re not going to like it, but you need to understand it. First, a little background: In 1992, a troubled, profoundly untalented young hacker known as Phantom D managed to tear through at least 1,000 computer systems over the course of a year, including those at military weapons research laboratories, leading computer vendors, and ATM networks. I know a thing or two about the case because journalist Charles C. Mann and I wrote a book about Phantom D in 1997. What we learned at the time from some of the world’s leading security experts was that breaking into even the most sensitive sites on the Internet was a cinch—so easy that anyone with time on his hands could do it. Our prediction: The situation wasn’t going to get better. Indeed, it would probably get worse—no matter how much effort people made to stem the tide. This is not the sort of thing that Web surfers and corporations want to hear, and the computer-security community all but conspires to oblige them. Think about it: If you’re a security consultant, a corporate IT honcho, or a law enforcement official paid to make computing safe, how quick are you going to be to shout from the rooftops that there’s no way to get the job done? For that matter, how willing are you to accept this fact yourself? Which brings me back to Time Warner. There’s no need to pick on the media giant; it’s been in great company in recent months, most recently CardSystems Solutions, where a hacker attack in June exposed 40 million credit cardholders to a risk of fraud. Bank of America, Wachovia, ChoicePoint, and LexisNexis also have been stung recently. People read these stories and shake their heads over the lax security at the target companies. It may even make you think about calling up your IT director and beefing up your own company’s computer security. But that reaction is part of the problem. The fact is, companies like Time Warner and Bank of America have been doing a pretty good job of meeting or exceeding industry standards for protecting their computer systems and data. And it’s not like IT bosses everywhere else are asleep at the wheel. Barry MacQuarrie, the CIO for Xpitax, a tax outsourcing firm in Braintree, Mass., notes that security consistently ranks as the top priority in surveys of accounting industry CIOs. “We have three levels of passwords, we filter all e-mail twice before it reaches our firewall, and we run antivirus on everything internally, MacQuarrie says. So do plenty of other firms. And yet the hackers keep getting inside, the viruses continue to rage, and data disappears. What’s the problem? The world’s faith in the holy trinity of computer security—firewalls, intrusion-detection systems, and antivirus software—is misplaced. Jim Settle, the former head of the FBI computer-crime squad and now a computer-security consultant in Haymarket, Va., offers this assessment: “They don’t work. Duh. Sure, they’ll keep out casual hackers who get discouraged easily or don’t have the latest tools, but that’s about it. Settle is often hired to test computer-security systems by trying to break in, usually just after a few million dollars’ worth of state-of-the-art security software has been installed. In nearly 50 efforts, he’s never failed to get inside, and only once was he even detected. Managers ask the question: Is our data safe? Any honest expert can give you the answer—without knowing a thing about your systems. No, your data is not safe. Managers ask the question: Is our data safe? In fact, there’s really no need to wonder about that. Any savvy, experienced, and honest security expert can give you the answer—without knowing a thing about your company’s systems. No, your data is not safe. And here’s that thing I promised you wouldn’t want to hear: There’s nothing you can do about it. Why? First of all, the very thing that makes the Internet so useful, exciting, and transformational—it connects everyone to everyone else, it’s anonymous, and it’s controlled by no one—is what makes it so easy for some jerk in Latvia to hook into your PC in Topeka. Completely protecting a network would require anticipating an essentially infinite number of techniques that might be used to break in; hackers, on the other hand, need to discover only one. What’s more, when security experts discover a new vulnerability, they usually try to keep it a secret, for obvious reasons, which hampers the development and distribution of fixes. Hackers, by contrast, not only share information freely, they also widely and immediately distribute tools that automate the hacking process so any of a vast army can join in on the fun. You could hardly design a more hospitable environment for hackers if you tried. That’s not to say you can’t lower your risks slightly. One cheap and easy technique is to encrypt everything on your network. It will slow performance, and it won’t keep hackers from stealing your data, but any lost data will be scrambled and worthless. Another technique is to enforce a draconian password policy—reject any password that’s a name or a word, even if spelled backwards; force password changes every 30 days; make it a serious offense to write down a password in the workplace. Of course, even if you did all this and more, someone in your company could still cough up a password in response to an e-mail from a skilled “phisher, or take work home on a disk and get hacked on his home computer, or simply lose a laptop computer full of sensitive data—like the laptop lost by a Virginia travel agency in May containing account information on 80,000 Justice Department employees. I think the smartest move is simply to accept the excellent chances of getting hit, no matter how safe anyone tells you your network is. That will get you thinking about what kind of data you collect, how long you keep it, and what you’ll say to employees and customers if it’s lost. If your computers contain any account information, documents, or e-mail that could, in the wrong hands, bring down your company, then you’re sitting on a time bomb. Unless, that is, you’re pretty sure you can do a much better job of protecting data than the U.S. government has in protecting the top-secret nuclear weapons information on its computers. Meanwhile, do me a favor, will you? If someone whispers to you that he wants to sell you something that fell off the back of a truck, let me know—it could be my Social Security number.

TechnoFile: Identity Crisis

By now, you’ve heard that identity theft is among America’s fastest-growing crimes, with nearly 10 million cases last year alone, and you’re probably already taking measures to prevent yourself from becoming a victim. For instance, you use a paper shredder to convert old bills, receipts, and bank documents into confetti. You review your credit-card statements monthly, looking for mystery charges; you obtain your overall reports from the three major credit-reporting agencies annually, looking for accounts you never authorized. You don’t leave personal mail — incoming or outgoing, opened or sealed — sitting in the open where someone could walk off with it. Your best friend couldn’t guess your PIN. You guard your Social Security number like a jealous lover. Congratulations. You’ve taken some big steps toward shielding your own identity. Now how about doing the same for everyone whose personal information is sitting in your company’s computers? After all, an ID hijacker needs only a Social Security number, a birth date, and a few other details to open bank and credit-card accounts in somebody else’s name. Chances are you’ve collected all kinds of confidential data about your employees, contractors, and customers. If you’ve stored it on your systems, it’s vulnerable to theft. Obviously, standard security measures, such as firewalls, provide some protection against cyberthieves. So do commonsense practices. “You can do a lot by just not storing that information” in the first place, says Phebe Waterfield, security analyst for the Yankee Group, a Boston-based technology research and consulting firm. She recommends using something other than Social Security numbers for identifying employee records or customer accounts. And, of course, you should never store confidential data on laptop computers, floppy disks, or CD-ROMs — all easily lost or stolen. But given how quickly ID theft is growing (80% in one year, according to a Gartner Inc. survey, those precautions aren’t enough to safeguard sensitive information. Besides, you may not want to wall off your systems; you probably need to share some information with employees, contractors, clients, partners, and others. Instead, consider developing a comprehensive identity- and access-management campaign. Translated, that means that you provide information access on a “need-to-know” basis. You monitor who’s looking at what. And you verify that all users are who they say they are. Among the technologies used in identity and access management are: Authentication. These tools verify that the user logged on as Webster J. Parker is, in fact, Webster J. Parker. The most common version, the lowly personal password used again and again, won’t deter serious thieves, who can quickly crack the code. More sophisticated options include handheld “keys,” such as smart cards, and “two-factor” solutions, which require both a password and a physical device, such as a token, for access. Single sign-on (SSO). Generally, these solutions let companies provide each authorized user with one secure identity — often a user name paired with a smart card or token — for accessing all company systems. That prevents the out-of-control proliferation of log-in names and passwords that can compromise security. Biometrics. These devices identify users based on unique physical characteristics, such as handprints, retinas, facial features, or voices. Fingerprint and thumbprint readers that can be attached to individual computers are already on the market for less than $100 apiece. However, keep in mind that even legitimate users may object to providing prints or consider a retina scan invasive. And voice and facial-recognition technology are far from foolproof; currently, variables such as laryngitis or eyeglasses can distort the results. Account administration. This practice, often called “provisioning,” refers to managing users’ system-access accounts. That’s far more important than it sounds. Dormant accounts — for instance, those previously assigned to former contractors or ex-employees — can provide loopholes for thieves seeking access to private information. While small businesses can manually add and delete accounts, fast-growing companies may need technology that automates the process. Digital signatures. These e-signatures verify who’s sent a message or signed a document. Because they’re encrypted and include a time stamp, they’re difficult to fake. At this point, it’s impossible to guarantee that any technology can shield people’s identities. Recently, consumer activists and reporters demonstrated just how easily anyone in the know can buy supposedly private information — they effortlessly purchased public officials’ Social Security numbers and personal credit reports from online vendors. Even so, businesses are increasingly being expected to safeguard their customers’ private information — and being held accountable if they don’t. California recently passed a tough new law that, among other things, requires companies to seek customer permission before sharing their financial information and to print only the final few digits of credit-card numbers on purchase receipts. Congress is considering related requirements in its proposed amendments to the 33-year-old Fair Credit Reporting Act. Ultimately, then, taking action to protect your customers may be the best way to protect yourself. America’s Fastest-Growing Crime In September 2003, the Federal Trade Commission released a survey showing that 27.3 million Americans have been victims of identity theft in the last five years, including 9.9 million in the previous year alone. ID theft cost financial institutions, businesses, and consumers nearly $53 billion last year alone, according to the survey. Average loss to businesses was $4,800; the average loss to consumers, $500 — and untold hours trying to recoup their reputations. The Three Major Credit Reporting Agencies Following are the three major U.S. credit-reporting agencies. All sell consumers copies of their personal credit reports. You may be entitled to receive reports at no charge if you’ve been denied credit, if you suspect fraud, or if you live in states that require the agencies to provide you one free copy annually. All three agencies’ Web sites contain extensive information on preventing and responding to personal ID theft. Equifax Inc. Experian Trans Union LLC Gartner Inc. Survey A July 2003 survey by Gartner Inc., the Stamford, Conn.-based research and consulting firm, found that identity theft rose nearly 80 percent between June 2002 and June 2003. RESOURCES Discussion Join the Fresh Inc. discussion on identity theft. Information on preventing, detecting, and responding to personal identity theft: Articles, Publications “What’s Next: They’ve Got Your Number,” column by Robert X. Cringley (Inc., August 2003). CSO magazine: Executive-level articles, white papers, research summaries, and other information. Information Security magazine: Articles, buyers’ guides, e-mail newsletters. Agencies Federal Trade Commission: National Resource for Identity Theft site. Also see the FTC’s ID Theft Data Clearinghouse. Internet Fraud Complaint Center: FBI and White Collar Crime Center’s site providing information for spotting scams and filing compliants. National Infrastructure Protection Center: Computer-related wing of the U.S. Department of Homeland Security. U.S. Department of Justice: Identity Theft and Fraud site: Offers advice on preventing and responding to ID theft. Organizations 101-identitytheft.com: Resources, advice, and links for more information and assistance. American Privacy Consultants PrivacyToday.com offers headlines and information. Computer Security Institute: Conferences, courses, materials, and information on corporate ID theft and other information-security topics. Electronic Privacy Information Center: News, information, and links on privacy-related issues. Fightidentitytheft.com: Resources, advice, and links. Human Firewall Council: Security and ID-management related resources for managers. Identity Theft Resource Center: Resources, comprehensive information, and links, including advice on recognizing scams. Identity Theft University-Business Partnership: Michigan State University School of Criminal Justice project to help businesses secure competitive and personal information. Internet ScamBusters: Tracks and reports on online crime and fraud, include ID-theft schemes. Privacy Rights Clearinghouse Vendors of identity access and management solutions include: ActivCard Corp. BMC Software Inc. Courion Corp. IBM Corp. Microsoft Corp. Netegrity Inc. RSA Security Inc. SystemTools Software Inc. (Hyena Total System Administration) Vasco Data Security International Inc.

Rental Health

The Fourth Annual Inc Web Awards: Killer Apps Company: SafeRent, in Denver URL: www.saferent.com What we liked: The technology lops days off and eases what used to be a lengthy, painful, and often subjective decision-making process The only thing as stressful as waiting for a doctor’s call is waiting for a call from a potential landlord. Would-be renters fret for days about whether they’ll snag that desirable roof, while apartment owners try to calculate the likelihood that some young applicant attired in a nice suit will skip out, leaving the joint looking like Marilyn Manson stayed there. Or both parties can get an answer in minutes. That’s the promise of SafeRent, which in four years has screened applications for more than a million apartments in every state except North Dakota. The $12-million company offers landlords and property managers access to the usual renter credit reports and eviction histories. But it also applies a proprietary statistical model, developed at Harvard University, which takes such data as an applicant’s income and credit history, combines it with information about the lease, and compares all that with a database of more than 100,000 anonymous renter histories. Based on the income, debt, and bill-paying patterns in those histories, the model calculates a score that is used to predict whether this particular rental agreement “will end happily for the landlord,” says Linda Bush, SafeRent’s CEO and one of its founders. In other words, SafeRent knows whether comparable kids in suits renting comparable apartments have generally paid up on time. SafeRent’s customers own or manage, on average, 5,000 rental units and pay $7.95 to $14.95 per search. They use SafeRent’s Web site to create profiles of their properties (how old they are, how much they rent for) and to set a level of risk that they find comfortable. (Usually, the more upscale the property, the lower the acceptable risk.) When an applicant comes calling, the landlord or property manager plugs in rental and deposit amounts and enters the applicant’s name, address, Social Security number, and income information into the site, and within 30 seconds, the system returns a recommendation: accept, decline, or accept with conditions such as an additional deposit. Landlords and property managers, in turn, feed rental histories from their own properties back into SafeRent’s database, increasing the size of the sample against which to compare new applicants. “It helps the landlords cut down significantly on bad debt,” says Bush. “But it also helps renters. There used to be a series of hoops to jump through. They don’t make three times the rent, so they’re out. They make three times the rent but they’ve been 30 days late twice, so they’re out. We evaluate all the information together, and we put it in perspective. We’re helping responsible consumers get a place to live.” The Fourth Annual Inc Web Awards Killer Apps Printing Money Rental Health Lab Retrievers Take My Payroll, Please Hoof and Math Please e-mail your comments to editors@inc.com.

Tag Archives: Social Security

Popular Posts

CHANNELS