Staying Safe after the Anthem Breach. Dartmouth College 3/25/15 ITS Security Team

Transcription

1 Staying Safe after the Anthem Breach Dartmouth College 3/25/15 ITS Security Team

2 Anthem Breach Reported on Feb 4, million records exposed Current and former members since 2004 Data exposed: o Names o Birthdays o SSNs o Address o Employment Info o

3 Agenda Identity Theft Protection o Anthem s Offerings o Do-it-yourself steps o Monitoring Services Simple Steps for Security o Protecting Your Credentials o Protecting Your Devices o Protecting Your Information

4 Iden/ty The2 Sta/s/cs Bureau of Justice Statistics (DOJ) million people and $24.7 billion in losses 3 Categories of ID Theft o Misuse of an existing financial account o Misuse of personal information to open new account o Misuse of personal information for other fraud Most (15.3 million people) were victim to misuse of existing account "Victims of Identity Theft, 2012"

5 Iden/ty The2 IRS Fraud IRS and GAO Statistics from 2013 Identity Thieves continue to file millions of false returns for refund fraud IRS prevented 81% of all attempts ($24.2 billion) However, $5.8 billion still lost o Estimated ~ 1 million returns "Identity Theft and Tax Fraud" Report to Congress, GAO Jan 2015

6 Iden/ty The2 Medical Fraud Why? o Use stolen identity to receive covered health care services o Prescription drug fraud o Fraudulent billing by providers (bill for patients they did not see) Stats: o On the rise: 19% increase from 2012 to 2013 o 1.8 million victims in 2013 o $12 billion in losses "2013 Survey on Medical Identity Theft" Ponemon Institute

7 Watch out for scams

8 Anthem Response Official Site: Notifying by Mail Only o No s until you register o No phone calls Providing 2 years Identity Protection for free

9 All Clear ID Anthem contracted with AllClearID AllClear Secure: Identity repair o No registration needed o Call if you are a victim of identity theft AllClear Pro: Identity Protection o Register for all family members through website o Yes they need your SSN(s) o Credit monitoring service

10 and 2 years from now? Identity Protection Options Do-It-Yourself Methods Subscription Services

11 Do- it- yourself Protec/on Credit Reports Fraud Alerts Credit Freezes Banking Alerts Healthcare Vigilance

12 DIY- Credit Reports Fair Credit Reporting Act (FCRA) requires the 3 national credit reporting agencies to Each provide a free credit report once every 12 months Or when: o Denied credit or other adverse action o Unemployment o Victim of ID theft Does not include credit score but the companies will be happy to sell it to you!

13 DIY- Credit Reports (2) Three Credit Report Companies: Experian Equifax TransUnion Lot s of scams and attempts to sell reports! Always use: Or link through

14 DIY- Fraud Alerts Sign up for Fraud Alert through any of the Reporting Companies o Call or use their web form o They must notify the other two With Fraud Alert, businesses must verify identity before issuing credit. Free service but must renew every 90 days

15 DIY- Credit Freeze Credit Freeze: Prohibits reporting companies from releasing your information for new inquiries NH and VT cost $10 each to place freeze o Must place separately at each company o Experian, Equifax, TransUnion website or 800 number Additional charges to temporarily or permanently remove o $5 VT o $10 NH

16 DIY- Banking Alerts Credit Reports and Monitoring do not apply to existing account activity Check your bank activity often Sign up for Banking Alerts o Typically set up through online banking o or call when certain activities occur

17

18 DIY- Healthcare Vigilance Limited fraud detection services Monitor your EOB s and other insurance mailings Review health records

19 Iden/ty The2 Protec/on Services Typically $ a month Credit and Database Monitoring Provide investigator and case management services ID Theft Insurance-may cover: o Legal Costs o Loss of work/travel/expenses for remediation o Unauthorized Electronic Funds Transfer reimbursement Most do not monitor misuse of existing accounts

20 Simple Steps for Security: Understanding the Risk Motives for Cyber Attacks: Cyber- Crime Intellectual Property Theft Espionage (Personal, State, Corporate) Hacktivism Messing around Everyone and Every System is a potential Target

21 Targets for Compromise Usernames and Passwords (Credentials) o Gain access to your personal information o Gain access to your employer s information Personal Data o Financial Accounts o Personally Identifiable Information (SSNs) Intellectual Property/Confidential Data Laptops, Workstations, Mobile Devices o Access your information o Access your employer s information o Use to further their attacks

22 Understanding the Risks: Creden/al Compromises How? Phishing Easily-guessed Malware

23

24 Understanding the Risks: Account Compromises

25 Securing Your Creden/als: Passwords Password tips Use more than 8 characters o Passphrases Include special characters, numbers, upper/ lowercase Use Dartmouth password only for your Dartmouth account Do not re-use important personal passwords!!!

26 Want to Stay Safe Online? Go Green! Green address bar means that the site has gone through extra verifica7on.

27 Securing Your Creden/als: Enhanced Authen/ca/on Moving beyond password Knowledge-based Authentication (KBA) o AKA Security Questions In addition to user/pass, provide: o Answer to preset security question or o Confirm data from your records Dartmouth expanding KBA soon o Security questions when using new computer and other scenarios o Applies to most applications

28 Securing Your Creden/als: Mul/- Factor Authen/ca/on Sign-up for 2-step Verification when offered o Also known as Multi-factor Authentication o Usually requires a username/password plus o A one-time PIN sent to or displayed on mobile device 2-Step Verification for important transactions o Most Financial Institutions o o Social Media

29

30 Simple Steps for Security Secure your devices: Physically secure devices from theft Set a passcode/password lock on all mobile devices o Prevents access if lost or stolen o Encrypts the data on many devices For Recommended settings: o Securing your ipad on Computing s website o Applies to iphones, ipads and easily applied to Droid devices

31

32

33 Securing Your Devices: Protect Against Malware Think before you click! o Phishing attacks can trick you into providing personal information o Clicking unexpected pop- ups (even Cancel or Close ) can infect your computer. Use Task Manager to close browser Use Alt- F4 to close window MAC Use Force Quit

34 Protec/ng Your Informa/on: File Encryp/on If you need to store, transfer, or share sensitive data consider file encryption In MS Office, Adobe, and many other applications simply set a password Zip file and other archive methods can encrypt multiple files and folders

35 Securing Your Data: File Encryp/on

36 Protec/ng Your Informa/on: Offline Lock up your records Limit what you carry Shred receipts, credit offers, insurance forms, bank statements o to stop credit offer mailings Only share health insurance info when necessary SSN ask? o Why they need it o How will it be used o How will they protect it o What happens if you don t share

37 Resources Anthem Breach anthem.allclearid.com Credit Reporting Credit Report Companies

38 Thanks! ITS Security Team Adam Goldstein Sean McNamara Steve Nyman Chief Information Security Officer Information Technology Services