TECHNOLOGY GUIDE 5: Protecting Your Information Assets

PROTECTING YOUR INFORMATION ASSETS TG 5.1 Introduction TG 5.2 Behavioural Actions to Protect Your Information Assets TG 5.3 Computer-Based Actions to Protect Your Information Assets Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada LEARNING OBJECTIVES Explain why it is critical that you protect your information assets. Identify the various behavioural actions you can take to protect your information assets. Identify the various computer-based actions you can take to protect your information assets. Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada TG 5.1 INTRODUCTION There are a number of behavioural actions that you should take to protect your information assets: General behavioural actions Computer-based actions Behavioural actions are those that do not specifically involve a computer. Computer-based actions relate to safe computing. Copyright John Wiley & Sons Canada

TG 5.2 BEHAVIOURAL ACTIONS TO PROTECT YOUR INFORMATION ASSETS Take action to protect information assets such as: Personal Information Social Insurance Number Credit Cards Debit Cards Financial Accounts Personal Mailbox Dealing with old records Click on the link in this slide to review a website that offers protection of your personal assets. Copyright John Wiley & Sons Canada

WHAT TO DO IN THE EVENT OF IDENTITY THEFT If your social insurance number has been compromised, contact Service Canada; in the event of passport theft, you would contact your local passport office. If you believe your mail is being diverted, contact your local Canada Post office. Cancel all affected credit cards and obtain new credit card numbers. Consult a lawyer for the type of paperwork that may be required to deal with disputes with financial institutions or credit-granting organizations. In 2012, there were more than 12.6 million victims of identity theft reported in the United States, and over 22,000 in Canada. Copyright John Wiley & Sons Canada

WHAT TO DO IN THE EVENT OF IDENTITY THEFT (CONTINUED) Organize your paperwork, including the names, addresses, and phone numbers of everyone you contact about this crime. File a detailed police report. Send copies of the report to creditors and other agencies or organizations that may require proof of the crime. Get the name and phone number of your police investigator, and give it to your creditors. In all communications about the crime, use certified, return-receipt mail. Copyright John Wiley & Sons Canada

WHAT TO DO IN THE EVENT OF IDENTITY THEFT (CONTINUED) Get your unique case number from each credit agency, and ask each agency to send your credit report. Tell each agency to issue a fraud alert. Get the document that you need to file a long-term fraud alert, which lasts for seven years and can be cancelled at any time. Ask the credit agencies for the names and phone numbers of lenders with whom recent accounts have been opened in the affected time frame, so you can identify fraudulent accounts that have been opened. The fraud alert requires mortgage brokers, car dealers, credit companies, and other lenders to scrutinize anyone who opens an account in your name for 90 days. Copyright John Wiley & Sons Canada

WHAT TO DO IN THE EVENT OF IDENTITY THEFT (CONTINUED) Point out all entries generated due to fraud to each agency. Ask each agency to remove the specified fraudulent entries. Tell each agency to notify anyone who received your report in the last six months (or the affected time frame) that you are disputing the information. You may be able to order a “credit freeze” with the two major credit agencies. Be alert for change-of-address forms in your mail. If debt collectors demand payment of fraudulent accounts, write down the name of the company as well as the collector’s name, address, and phone number. Tell the collector that you are the victim of identity theft. Send the collection agency a registered letter with a completed police report. If this does not work, refer the agency to your lawyer. Copyright John Wiley & Sons Canada

TG 5.3 COMPUTER-BASED ACTIONS TO PROTECT YOUR INFORMATION ASSETS Determine what sites users of your computer have visited on the Internet Access social networking sites safely Detect malicious software Protect your system when computing wirelessly. Recover from a disaster Protect your privacy when using the Internet and e-mail Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada DETERMINING WHERE PEOPLE HAVE VISITED ON THE INTERNET USING YOUR COMPUTER Identify the Internet sites that anyone who uses your computer has visited. To do this, check the browser history. You will not be able to check the browser history of someone who uses private browsing on your computer. All modern browsers have a “private browsing” mode in which the viewing history is not recorded Copyright John Wiley & Sons Canada

THE DANGERS OF SOCIAL NETWORKING SITES Well-known social networking sites include Facebook, Twitter, LinkedIn, YouTube, MySpace, and Flickr. Never post personal information about yourself or your family in chat rooms or on social networking sites. In fact, you should Potential employers are now searching social networking websites for information about you. Social networking websites have privacy features that give users more control over their information. Copyright John Wiley & Sons Canada

DETERMINING WHETHER YOUR COMPUTER IS INFECTED There are several signs to look for if you think your computer system is infected with malicious software or malware: Shuts down unexpectedly refuses to start normally exhibits erratic behaviour system unexpectedly runs out of memory system continually runs out of main memory (RAM) system displays an unusually high number of error messages programs take longer to load than normal, or run very slowly programs act erratically monitor displays strange graphics or messages e-mail program sends messages to all your contacts Copyright John Wiley & Sons Canada

COMPUTER ACTIONS TO PREVENT MALWARE INFECTIONS Never open unrequested e-mail attachments, even if the message is from someone you know and trust. Never open attachments or web links in e-mails from people you do not know. Never accept files transferred to you during Internet chat or instant messaging sessions. Never download any files or software from websites that you do not know or files or software that you have not requested. Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada TEST YOUR SYSTEM It is a good idea to test your system. Several websites provide security tests: ShieldsUP! Norton Security Scan McAfee My SecurityStatus AuditMyPC Click on the links above to read about the variety of services available to test your computer system. Security tests send different types of messages to your computer to evaluate how well it is protected from a variety of attacks. Copyright John Wiley & Sons Canada

TEST YOUR SYSTEM (CONTINUED) Install the following to protect your computer: security suite anti-malware product firewall antispyware product monitoring software content-filtering software anti-spam software proactive intrusion detection and prevention software Click on the links above to read about the variety of products available to test your computer system. Security suites are software packages that contain various security products, such as anti-malware software, spam protection, e-mail fraud protection, spyware detection, intrusion detection, monitoring software, and others. A personal firewall is software installed on your home computer that permits or denies communications to and from your computer based on your security settings. Monitoring software logs keystrokes, e-mails, applications, windows, websites, Internet connections, passwords, chat conversations, webcams, and even screenshots. Content filtering software can block access to undesirable websites, and it can record and view all of the websites that you or other users have visited. It also can record both sides of chat conversations. Copyright John Wiley & Sons Canada

TEST YOUR SYSTEM (CONTINUED) To protect your computer: manage patches use a browser other than Internet Explorer use an Operating System other than Windows You should download and install all software patches (for example, patches for Windows) immediately. You might consider using a browser other than Internet Explorer, such as Firefox (www.mozilla.org), Opera (www.opera.com), Safari from Apple (www.apple.com/safari/), or Google Chrome (www.google.com/intl/en/chrome/browser/). The two main alternatives to Windows 8 and Vista are Apple’s Mac OS X and Linux. These two operating systems are not invulnerable, but both are based on UNIX, which makes them inherently more secure than any version of Windows. Copyright John Wiley & Sons Canada

PROTECTING YOUR PORTABLE DEVICES AND INFORMATION There are two common-sense precautions that many people forget: Keep your laptop in an inconspicuous container. Laptop cases with your company logo simply draw the attention of thieves. Do not leave your laptop unattended in plain view; for example, in the back seat of your car where it can be seen. Instead, lock it in the trunk. Copyright John Wiley & Sons Canada

STRATEGIES TO PREVENT THEFT OF PORTABLE DEVICES Use alarms Two-factor authentication Data encryption Encrypt your entire hard drive, including your applications Use laptop-tracing tools or device reset/remote kill tools Click on the links above to read about the variety of products available to help prevent theft of portable devices. Alarms are battery powered, they are independent of the computer operating system, and they operate whether the laptop is on or off. Two-factor authentication means that you must have two forms of identification to access your laptop or notebook. The first authentication factor is a token or a biometric. The second factor is your personal password. Data encryption provides additional protection by turning data into symbols that can be deciphered only by an authorized person. Copyright John Wiley & Sons Canada

Protect your Computer and Wireless Area Network Prepare for personal disasters Secure a home based wireless area network Hide your service set identifier (SSID) Use encryption Filter out media access control (MAC) addresses Limit Internet Protocol (IP) addresses Sniff out intruders Take precautions when using a public hotspot Test your wireless network Use wireless security software Prepare for personal disasters such as fires and floods: safety deposit box, fireproof safe, make regular backups of your key files and keep these backups off site and encrypt your backup files if they contain sensitive information. For SSID security: (1) change your default SSID to a unique SSID, and (2) configure your wireless home network to stop broadcasting the SSID. To avoid broadcasting in the clear, you must use encryption with your wireless home network. Every piece of networking hardware has a unique identification number called a media access control (MAC) address. You can compile the MAC addresses of all computers on your home wireless network, then instruct your router to connect only with these computers and deny access to all other computers attempting to connect with your network. Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada USING A PUBLIC HOTSPOT Precautions to take when using a public hotspot: Use virtual private networking (VPN) technology to connect to your organization’s network. Use Remote Desktop to connect to a computer that is running at your home. Configure your firewall to be “on with no exceptions.” Visit only websites that use secure sockets layer (SSL) to conduct any financial or personal transactions. Copyright John Wiley & Sons Canada

Copyright John Wiley & Sons Canada CHAPTER CLOSING It is critical that you protect your information assets There are several behavioural actions you can take to protect your information assets such using credit cards with your picture on them, paying close attention to your credit card billing cycles, limiting your use of debit cards, etc. There are many computer-based actions you can take to protect your information assets such as testing your system, running free malware scans on your computer, having an anti-malware product on your computer and have it set for automatic updates, etc. Copyright John Wiley & Sons Canada