Personal PrivacyIdentity protection in this wired world

Identity Theft?

Described by the federal Fair Credit Reporting Act as "the use or attempted use of an account or identifying information without the owner's permission“.

Simple Facts Federal and state authorities alike have

labeled it the country's fastest-growing white-collar crime since the late 1990s.

The number of people victimized annually was last estimated at about 10 million by the Federal Trade Commission.

It is a problem that has affected millions of Americans, including Oprah Winfrey, Bill Gates, and Tiger Woods. Chances are it has hurt someone in this room.

Cost of ID Theft? US victims spend an average of

$1,500 and 175 hours to recover www.fightidentitytheft.com

Current annual cost - $56.6 billion www.bbbonline.org.

Average loss per victim $6,383. Businesses spend an average of

$18,000 per incident. U.S. business spend over $400

billion per year just on the insider threat.

Cyber Streetwise

We shred financial documents and unsolicited, pre-approved credit card offers; check credit reports regularly; keep Social Security numbers as private as possible; delete e-mail from unknown senders as soon as it arrives; and frequently update antivirus, firewall and spam-blocking software.

But …..

We're All Vulnerable

We live in an age where everything from tax records to Social Security numbers to credit card data resides in databases that can be hacked, phished or pharmed by anyone with sinister motives and enough know-how.

ID Theft: A Growing Concern

At least 130 reported breaches exposed more than 55 million Americans to potential identity theft in 2005.

Identity theft in is the fastest growing crime in the United States.

Recent Reported Data Exposures

Department of Energy 1,500 Internal Revenue Service 291 ChoicePoint 145,000 Bank of America 1.2 million CardSystems 40 million Citi Financial 3.9 million Time Warner 600,000 Department of Veterans Affairs 26.5 million United States Air Force 33,000

ID Theft Complaints by Consumer Age

5%

29%

24%

20%

13%

9%

Under 18 18-29 30-39 40-49 50-59 60+

2005 Percentages by age

Be Vigilant

Deter identity thieves by safeguarding your information.

Detect suspicious activity by routinely monitoring your financial accounts and billing statements.

Defend against ID theft as soon as you suspect a problem.

Common Ways ID Theft Happens Common Theft Dumpster Diving Skimming Phishing Schemes Change of Address Scheme Pretexting Work-at-Home Swindle Pharming Unwanted Guests

Common Theft This is by far the most common cause

of identity theft cases. Lost or stolen identification Lost or stolen schedulers Lost or stolen PDA or computers Lost or stolen storage devices Company insiders

and …

The Red Flag! You have mail! Checks Bills Account information Pre-approved

Dumpster Diving Criminals engage in "dumpster diving"

going through your garbage cans or a communal dumpster or trash bin -- to obtain copies of your checks, credit card or bank statements, or other records that typically bear your name, address, and even your telephone number.

These types of records make it easier for criminals to get control over accounts in your name and assume your identity.

Skimming Thieves target account information

embedded in ATM, debit and credit cards by breaking into or otherwise compromising the equipment and systems used for processing payments.

The California Bankers Association reported in 2005 that scammers had taken to attaching wireless video cameras to the front of ATMs in hopes of capturing your card number and PIN from a remote location.

Phishing Schemes Phishing is the act of tricking someone into

giving out confidential information or tricking them into doing something that they normally wouldn’t do or shouldn’t do.

Gartner, a market-research firm, reports that in the 12 months ending in May 2005, phishers duped 2.4 million Americans into revealing personal info, costing victims, banks and credit card companies $929 million.

The volume of phishing e-mail has reached astounding levels at over 1.5 billion messages a day.

Change of Address Scheme Rerouting your mail is easier than you might think. If you have bank or credit card accounts, you should

be receiving monthly statements that list transactions for the most recent month or reporting period.

Check the Post Office for change of address cards on file.

If you're told that your statements are being mailed to another address that you haven't authorized, tell the Postmaster, financial institution, or credit card representatives immediately that you did not authorize the change of address and that someone may be improperly using your information.

Pretexting

ID thieves just ask for your personal information.

In one common approach, they claim to be conducting a survey on behalf of your bank and ask questions designed to get your account number, date of birth, social security number, etc.

Work-at-Home Swindle The rise of Internet use brings more

deceptive and misleading promotions, bogus travel offers, contests, lotteries, and other illegal practices on the Web.

Always use common sense. If you have a gut feeling that something is not legitimate, you’re probably right.

Make sure the company has a phone number and a physical address – not just a post office box or e-mail address.

Pharming?

Maybe you've heard of "pharming," in which legitimate websites are hit with malicious computer code that steers those visiting them to look-alike sites. Data can then be harvested without a key being struck. In a twist, there's crimeware that instead attacks browsers (Internet Explorer, for one) and does its pharming from there.

Unwanted Guests Another ripe target for identity thieves: the

wireless networks that more and more companies and individuals are setting up.

Failure to block access to these networks can allow prying eyes into your hard drive, where you may store financial information in programs like Quicken.

An unsecured wireless access point can open the door to more than just data theft.

Access into your company through mobile devices or gadgets.

But Wait! There Is More

Fake Jury Duty Con Medicare Fraud "IRS" Phishing Scam Internet Telephony Trickery Grant Flimflams Child Identity Theft The Next Targets?

Child Identity Theft An estimated 400,000 children had their identities

stolen in 2005. Two-thirds of child ID thefts are perpetrated by family

members. Instruct your children NEVER to give out any personal

information over the Internet, such as whole names, addresses, phone numbers, school names or photographs.

Instruct your children to tell you about -- and not respond to -- any messages they read that make them feel uncomfortable.

Order credit reports on your child from the three nationwide credit bureaus. The credit search should come up empty.

Eavesdroppers and Snoopers

Eavesdroppers listen to your conversations without your knowledge.

Snoopers observe your computer screen or items on your desk without your knowledge.

Bluetooth technology may provide a speakerphone behind closed doors.

The Next Targets Homeland Security has warned that cell

phones and other handhelds (like BlackBerrys) are becoming increasingly vulnerable to hackers and viruses.

Instant messaging (IM) is becoming a popular target.

More attacks on browsers with the intent of embedding crimeware on PCs.

Popular blogs and social networking sites like MySpace.com.

Safeguard Your Information Shred paperwork with personal information and financial documents

before you discard them. Don’t carry your Social Security card in your wallet or write your Social

Security number on a check. Give it out only if absolutely necessary; you can always ask to use another identifier.

Don’t give out personal information on the phone, through the mail, or over the Internet unless you are sure who you are dealing with.

Never click on links sent in unsolicited emails; instead, type in a web address you know. 

Don’t use obvious passwords. Your mother’s maiden name, or the last four digits of your Social Security number – all are obvious passwords.

Keep your personal information in a secure place at home, especially if you have roommates, employ outside help, or are having work done in your house.

Question If someone has stolen information

about your financial accounts, it’s best to wait for several weeks to see what they do with it before taking action?

The answer is?

Your best first step is to contact your credit card companies and close your accounts. Also, talk with your bank about whether to close other accounts or take other steps.

Question One of the best ways to protect your identity is

by using online passwords only you would know – like your mother’s maiden name or the last four digits of your Social Security Number?

The answer is?

This is an incorrect statement. Crooks can often find this type of information about you … and then, it’s “so long, identity!” It’s better to use random numbers and letters, and commit them to memory.

Question If the stolen information includes your

Social Security Number, you can place an “initial fraud alert” by calling one of the three nationwide consumer reporting companies?

The answer is?

Correct! Placing such an alert can help stop someone from opening new credit accounts in your name.

Question If someone has stolen your identity,

and then you notice you’re no longer receiving bills from creditors, this is a sign that your identity has been restored?

The answer is?

No! If bills stop coming, it may be a sign that someone is still “hijacking” your identity, and changing the address your bills are being sent to.

Question The names of the three nationwide

consumer reporting companies are Equinox, ExperiCorps, and TransAmerica?

The answer is?

Good eye! The actual names are Equifax, Experian, and TransUnion. If you would like a free annual credit report, visit annualcreditreport.com.

Question Identity theft refers only to the theft

of drivers’ licenses or name badges?

The answer is?

While those are types of identity theft, the term refers to a broad variety of criminal misuses of your name, Social Security Number, and financial information.

Question My employer protects personally

identifying information from hackers and other external threats. My identity is perfectly safe right?

The answer is?

While reasonable controls may be in place protecting the corporate perimeter, the REAL threat comes from the “Trusted” employee with access and control of this information.

Individual Quick Facts

Close compromised credit card accounts immediately.

If someone steals your social security number (SSN), contact one of the three nationwide consumer reporting agencies — Equifax, Experian, or TransUnion — and place an initial fraud alert on your credit reports.

Monitor your credit report. Keep in mind that fraudulent activity may not show up right away.

Consult with your financial institution about handling the effects on bank or brokerage accounts.

Contact relevant government agencies to cancel and replace any stolen drivers licenses or other identification documents, and to “flag” your file.

Watch for signs of identity theft: late or missing bills, receiving credit cards that you didn’t apply for, being denied credit or offered less favorable terms for no apparent reason, or getting contacted by debt collectors or others about purchases you didn’t make.

It’s important to protect your personal information, and to take certain steps quickly to minimize the potential damage from identity theft if your information is accidentally disclosed or deliberately stolen:

Tell Tale Signs

You are receiving credit cards that you didn't apply for.

You are being denied credit, or being offered less favorable credit terms, like a high interest rate, for no apparent reason.

You are getting calls or letters from debt collectors or businesses about merchandise or services you didn't buy.

Here's What To Do File a report with your local police or the police in the

community where the identity theft took place. Get a copy of the report or at the very least, the number of the report, to submit to your creditors and others that may require proof of the crime.

Contact the fraud departments of any one of the three consumer reporting companies to place a fraud alert on your credit report.

Close the accounts that you know or believe have been tampered with or opened fraudulently.

File your complaint with the FTC. The FTC maintains a database of identity theft cases used by law enforcement agencies for investigations.

Corporate concerns

Loss of productivity Loss of intellectual property Damage to reputation Loss revenue Executive responsibility Legal implications Damage to business

Trusted agents Attacks are perpetrated by people with

trusted insider status. Employees Ex-employees Contractors Business partners

Insiders pose a far greater threat to organizations in terms of potential cost per occurrence and total potential cost than attacks mounted from outside.

Insider threat motivators

Trust and physical access Challenge Curiosity Revenge Financial gain

Inside Attackers Profile

Male 17-60 years old Holds a technical position (86%

chance) May or may not be married (50/50

chance) Racially and ethnically diverse

Additional statistics In 92 percent of the incidents investigated, revenge was

the primary motivator. Sixty-two percent of the attacks were planned in

advance. Eighty percent exhibited suspicious or disruptive

behavior to their colleagues or supervisors before the attack.

Only 43 percent had authorized access (by policy, not necessarily via system control).

Sixty-four percent used remote access to carry out the attack.

Most incidents required little technical sophistication.

Data handled Employee social security numbers Employee salary data Employee banking data Employee health data Customer credit card data Customer banking data Customer credit history data Financial transactions Corporate financial information

Compliance implications

SOX - Sarbanes-Oxley PCI – Payment Card Industry HIPAA - Health Insurance Portability

and Accountability Act GLBA - Gramm-Leach Bliley Act DOI – Department of Insurance State specific regulations

Current numbers

Internal attacks cost U.S. business $400 billion per year, according to a national fraud survey conducted by The Association of Certified Fraud Examiners.

$348 billion can be tied directly to privileged users.

Organizational Quick Facts

Although white collar criminal charges are usually brought against individuals, corporations may also be subject to sanctions for these types of offenses.

Encourage open communication regarding issues of misconduct, and provide a confidential and anonymous mechanism for stakeholders to report fraud without fear of retaliation.

Be prepared to promptly review, assess, investigate and resolve reported issues.

Set policies and train stakeholders on important policies related to organizational risk.

Decide who will be notified about tips or incidents.

It’s important to protect your customer’s and employee’s information, and to take certain steps quickly to minimize the potential damage from critical information if it is accidentally disclosed or deliberately stolen:

2005 Law Enforcement Contact

Police Notified But Report Was

Not Made9% Police

Notified And Report Was

Made30%

Victims Did Not Notify

Police61%

Beating the Thieves Install security software and stay current with the latest patches. Always be suspicious of unsolicited e-mail. Monitor the volume and origin of pop-up ads. A change may signal something

sinister. Visit the FBI's new Web site, lookstoogoodtobetrue.gov, for tips. Use debit cards like credit cards, i.e., with a signature, not a PIN code. If you live in one of the 20 states where it's possible, place a freeze on credit

reports. This stops any credit activity in your name unless you specifically initiate it.

Keep an eye out for "skimmers" lurking in places where you use cards or keep customer credit information.

Enable encryption on wireless routers immediately upon setting up a home or corporate network.

Shop only on secure Web sites (look for the padlock or "https" in the address bar); use credit, not debit, cards; don't store your financial info in an "account" on the Web site.

Be mindful of the insider threat!

T-1 T-2 T-3http://www.experian.com http://www.equifax.com http://www.transunion.com

Identity Triad – Recommended personal credit review cycle.

T-1 = January, February, March, April

T-2 = May, June, July, August

T-3 = September, October, November, December

Monitor Your Credit Report Review and monitor your credit report! Visit www.annualcreditreport.com to obtain your free

credit report Citi Credit Monitoring Service:

http://www.creditmonitoring.citi.com Credit Expert: http://www.creditexpert.com Credit Manager: www.experian.com www.transunion.com www.equifax.com If you suspect you are a victim place a fraud alert on

your credit report.

Michael D. PetersMBA, CISSPDirector of Security ServicesLazarus Alliance Inc.

About Michael

Michael is a founding member of Lazarus Alliance Incorporated. He has more than 20 years of networking and system development experience. He is an MBA, CISSP and is certified in several products which include Sun Microsystems UNIX.

More than 14 years of his experience has been devoted to information and network security for organizations from United States Defense, Healthcare, Software Development, Manufacturing, Transportation, Insurance, Communications, and Financial markets.

Michael received his MBA in Information Technology Management from Western Governors University.

He is the creator of "SafetyNET" which is a UNIX based intrusion prevention appliance suite available only from Lazarus Alliance.

The innovator behind the Holistic Operational Readiness Security Evaluation (HORSE) project and Wiki.

A contributing author to the Sun Microsystems BigAdmin community, Wikipedia, Snort.org, SANS.org, and The White Hat Encyclical.

Michael D. Peters is currently the President of the Kentuckiana chapter of the Information Systems Security Association (ISSA) and WGU Alumni InfoSec Forum Moderator.

Guest speaker on matters of security especially concerning compliance, auditing, investigation, and best practices for secure computing to various organizations, Public Radio, technical institutions, and in University classrooms.

Lazarus Alliance Inc. Lazarus Alliance Incorporated offers professional services and products dealing exclusively in the areas of

Security Architecture and Engineering, Compliance Auditing, Risk Assessments, Penetration Testing, Incident Response, Forensic Analysis, and Disaster Recovery. Delivering security with integrated products and expert services to ASSESS, PROTECT, EMPOWER and MANAGE business processes and information assets.

The Lazarus Alliance professional security assessment auditor.s provide expert assistance to your organization in all areas of information protection and assurance. We are focused on helping companies in all industries improve their current security posture. Providing the compliance resources our clients require for ISO 17799, HIPAA, Sarbanes Oxley, Gramm-Leach-Bliley, and other legislation is the heart of the Lazarus Alliance security audit practice.

The Lazarus Alliance research and development engineers have created world-class security solutions. Lazarus Alliance protects your digital assets and business processes. We offer the SafetyNET suite of Intrusion Prevention and Intrusion Detection appliances that are available only from Lazarus Alliance. Our customers benefit from personal attention, zero-day solutions, and ingenious security solutions.

The Lazarus Alliance consulting service team empowers our clients with the expert knowledge our consultant's provide. The Lazarus Alliance consulting team provides more than security products and services, they provide value added expert level advice and information during the life cycle with our client's engagements and customer relationships.

The Lazarus Alliance security service organization teams provides managed security services to our customers leveraging the expertise and knowledge of the Lazarus Alliance research and development engineers, the Lazarus Alliance security consultants, and security service team.

www.lazarusalliance.com

References www.consumer.gov www.bbbonline.org www.ic3.gov www.banktechnews.com http://www.fivecentnickel.com www.experian.com www.transunion.com www.equifax.com www.lazarusalliance.com http://www.lazarusalliance.com/horsewiki/ http://www.ftc.gov/privacy/ http://www.issa-kentuckiana.org http://issa-kentuckiana.org/infosec/2006/