Secure Value

When bad things happen to good social people - recovering from a hijacked social media account

Bad things happen to good people.  And unfortunately as online hacking increases it is also true that bad things happen to social people.  As more of us crowd online for the benefits “bad guys” are joining online as they see the social network as a network of victims for the taking. 

It is best to work hard to actively protect your computer.

But even then bad things happen to good people.  Reacting quickly to a negative event is important. 

How do you know if your account has been hacked or highjacked?

• Are you seeing unexpected communications from your account?
• Are you getting replies from friends to messages you didn’t send?
• Are account changes occurring that you didn’t make or approve (like following, unfollowing, blocking, liking, etc.)
• Have you received notification that from your provider that you have recently changed settings (particularly passwords or email addresses associated with the account)?
• Have you received notification that you are logging onto another computer, when you are certain you are not?

If you think you’ve had an account highjacked it is best to start with the help or support site of the compromised tool.  Many offer services to support users that have been hacked.  I've listed some top firms here:

• Facebook
• Twitter 
• Gmail 

If you have had an account on another service hacked go to support or help or customer service.  Search for their recepei to recover the account.  Frankly, with some newer services the suppor just might not be in place yet for that sort of thing.  Register with their suppor however they accept support tickets.  And then google that service with the terms "hacked account" or "compromised account".  Chances are you aren't the first.  But only go to web if the information provided by your provider doesn't help.

Follow the instructions to recover your account.  Depending on what has happened it might be a quick fix or it might be huge pain.  Regardless do it quickly.  The longer the compromise stays active the more damage can occur.

While you are recovering your account you also want to ask yourself the following questions:

Did I use a common password for the compromised account that I share with other accounts? 

If you do, change all of your passwords.  Use strong passwords and don’t reuse them sight to sight.  If you don’t want to bother changing passwords your compromise just might grow from a seemingly benign social media tool like Facebook or Twitter into your work email, your bank account or something else of much greater value.

Is your anti-virus up to date?

If yes, scan your entire device.  If no, update it and then scan your entire device.  (If you are one of my highly social friends that is Mac-based stop snickering.  Find an anti-virus program for your machine, update it and scan it.  As the MacOs grows in popularity it is becoming a target for malware writers, too).

Did your compromised account connect to other services?

Services like Facebook Connect and Google’s Connected accounts can use your credentials to log into other services.  Check to make sure those accounts were not connected to any other services, and if they were check to make sure nothing in those accounts has been compromised.  Remember your mobile devices as well, if you have a device like an Android phone a decent amount of your personal data is backed up using those same credentials.  This means that the attacker now has all of your phone contacts and any other information backed up with Google. 

Are you certain your browser and its add-on components are up to date, patched and secured?

Check the security of your browser and its add-on components with Qualys BrowserCheck.

Is the information on your system backed up and easily recoverable?

If yes, good for you.  This could have been a lot worse but at least you had all your important work in a place it could be recovered.

If no, count yourself lucky.  Now go back your data up!

 

Information Owners Should Be Held Accountable for Breaches NOT Just Technical Staff

I have read several articles on the recent breach at the Texas Comptroller of Public Accounts site.

If you have an interest you can get a good summary from Computerworld's Texas fires two tech chiefs over breach as well as the announcement from the Comptroller's web site.

The story is not unlike many other breach stories we've seen over the years.  A mistake is made.  Information including individually identifiable information is exposed.  Somebody from the technology department is sanctioned or terminated.  Other corrective actions are taken.  End of story.

In information security there is a concept of information ownership.  An information technology department that fits properly into a business is providing a service to the business units, but those business units are considered the information owners.  IT has a responibility to provide appropriate quality services to meet the information owners needs.  But the information owners should be accountable to what is done with the information.

Here's a rough analogy.  I own a car.  I am the owner.  The Ohio Department of Transportation provides the infrastructure for me to use my car.  If the road fails and I wreck I as the owner (or driver) am responsible to maintain control.  

From an information ownership perspective in the case of a breach you rarely see sanctions laid down on the assigned information owners.  If information ownership was properly assigned and maintained the owner would have a responsbility to make sure the information was properly managed by the service providers from IT.

An information owner is the individual or departmental unit who creates, acquires or manages information through a business process.  When setting up a governance process I prefer an individual within the department has formally assigned ownership.  That assigned owner is then responsbile for understanding the value of the information, obligations the organization has to protect information of that type and value, proper handling procedures given those obligations and oversight of the organization's handling of the information.  In the case of many of these breaches an information owner overseeing the technical processing of this information would have had a chance of correcting the fault before it resulted in a breach. 

 

 

 

 

 

 

 

Related articles

• Texas Data Breach Exposed 3.5 Million Records (informationweek.com)
• I am marketing, why am I on the security committee? (secure-value.com)

Favorite Epsilon Hack Articles

Image via Wikipedia

Have you heard?  A email marketing firm called Epsilon was hacked.  Millions of email addresses and some names were stolen.  The people that owned those addresses and names were customers of some 50 big brand household name companies. 

The buzz about this hack is phenomenal. Over the last few months the following firms have had breaches or electronic break-ins:  Google, Adobe, GE, Gawker, mysql.com and RSA. But not the buzz Epsilon has generated.

The buzz wasn't there for those incidents though many of them were more sophisticated attacks with greater losses.

Why?

I think it is because it touched so close to home with millions of consumers of brands we all know and trust.  Conversations were happening in the executive suite because the wives (or husbands) were getting the emails at home. And that got leadership thinking "it could've been us! it could've been worse!"

I've had more conversations with business management and above level staff at our clients about this than all the other hacks this year combined.  Because of that we are publishing a special edition Jacadis newsletter to sift through the facts, the hype and the impact from Epsilon.

We can't cover it all, however, so we've listed our favorite articles covering the Epsilon hack news:

Wall Street Journal:

Insulating Your Firm from Third-Party Breaches 

PaulDotCom:    

How Heavy Drinking Can Improve Security         

CSO Online:

FAQ: Epsilon email breach   
About 50 clients hit by Epsilon breach 

Schneier on Security:

Epsilon Hack    

 

Krebs On Security

Epsilon Breach Raises Specter of Spear Phishing

After Epsilon: Avoiding Phishing Scams & Malware

 

What are you reading on it?

After Epsilon: Avoiding Phishing Scams & Malware

Related articles

• Aftermath of Epsilon Hack ... More FUD on Horizon, Third Party Verification Gets Boost, Confirm You Have Strong Passwords ... (secure-value.com)
• Correlation Between Epsilon Hack & Tax Season (imperva.com)
• More Epsilon fall out (moncurdg.wordpress.com)
• Hackers access Epsilon email database exposing email addresses (slashgear.com)
• Analysis: Epsilon hacking shows new "spear-phishing" risks (reuters.com)
• Epsilon data breach: What's the value of an email address? (zdnet.com)

SMB Business Associates Tips and Tricks - Creative Way to Handle Complaints

Image via Wikipedia

How do we handle security and privacy complaints, reports and questions in a consistent, affordable manner?

I am working with a small long term facility company.  They have 3000 employees serving beds in 5 facilities.  They are working to become compliant with HIPAA and HITECH. 

Problem

 My client this week was struggling with how to best handle HIPAA security notifications, HIPAA privacy complaints, general HIPAA questions as well as other customer services issues.  Their "old way" of doing it, originally created to meet compliance with the Privacy Rule in 2003, was to have a different number for each issue.  No single office or employee was responsible for logging calls, tracking issues, etc.  Their calls weren't high volume but it just takes 1 poorly handled complaint or report to create regulatory penalty chaos.  They felt the risk wasn't being adequately managed.

Solution

They have decided to consolidate all of their HIPAA contact points as well as their general customer service contact points into the workload of their IT help desk.  The IT help desk staff will be given HIPAA Security and Privacy training as well as some advanced custom training to help them triage calls and direct them to the proper internal resource.  They will use their help desk ticketing system to log the calls.  The Security and Privacy Officers at the organization will get reports as will the compliance committee.  As issues are resolved they will be reported back to the help desk ticketing system as closed tickets.

Benefits:

They will save some money by consolidating phone lines as they today have seperate phone lines for several of the functions that are to be consolidated.  They already have plans to implement a new help desk ticketing system.  This consolidation will simply provide them an extension of the benefits from that seperate project.  Had they already had that in place there wouldn't be any additional costs.  They will make a small investment of time and dollars to train their help desk staff. 

They have lowered their risks, improved their reporting performance, extended the value of the help desk staff to the company all for a minimal investment.

The regulatory burden on small and mid-sized business is substantial.  Sometimes you can think your way around the added costs of a regulation by using existing assets for new purposes.  Do you have assets already in place that you can leverage to meet the costs of compliance?

Related articles

• Jacadis HIPAA Workshop Candidate for Columbus Innovation Award (secure-value.com)
• We Don't Think We Are HIPAA Compliant, Where Do We Start? (secure-value.com)

Encryption is Good. Training is Better!

Image via Wikipedia

This is just a brief Monday morning for your information note.

Jacadis is a sponsor and I am a speaker at next week's Information Technology Audit and Control Conference sponsored by the ISACA Pittsburgh Chapter.   I'll be speaking on security awareness. 

Working on my presentation, I found this great quote relating security awareness and encryption in the case of a reported HIPAA breach:

Encryption is good.  Training is better.

It is a quick read.  Adding to the linked blog entry will only water it down.  Enjoy!

Data breach reporting sites useful for entrepreneurs whose businesses work with protected data

When I am working with enterpreneurs who provide services into markets that have protected data I am often asked "Where can I go to see a list of data breaches?"

Reviewing reported data breaches can provide a lot of value if you are in a business that handles protected or highly confidential data.

1.  Lessons can be learned from other's mistakes.  Look into the details of breach announcements and ask yourself "could this happen to us?" and "how would we respond if this happened to us?"

2.  If you outsource to the Cloud, to a business services provider or in some other way share data you are obligated to protect it is good to use these lists to make sure you don't have a vendor with data protection problems.

3.  Breach types tend to repeat in certain industries.  If you are in health care for instance loss and theft, primarily of physical assets, abound.  If you control physical assets in the health market what are you doing to protect them?  Others in your vertical are having challenges maintaining control of them.  Do you have those same challenges?

4.  Finally, I am a big believer that firms that provide services into regulated markets like health care, retail and publicly traded firms can create a competitive advantage if they treat security as a service to be provided to their customer.

Here are 3 lists we use:

The Privacy Rights Clearinghouse Chronology of Data Breaches

Health and Human  Services "Wall of Shame" reporting and documenting Breaches Affecting 500 or More Individuals which is required by the HITECH Act.

A well done blog DataBreaches.net

Have you found another data breach reporting site that I should include?