On Sept. 28, 2018, Facebook announced that nearly 50 million user accounts were compromised in a data breach. The breach, which can be traced back to July 2017, is one of the largest in the company’s 14-year history.
While investigations are ongoing, the company said hackers exploited a software vulnerability in Facebook’s "View As" feature to steal access tokens and gain control of user accounts. Access tokens are effectively digital keys to specific accounts, and stealing them allows attackers to view private posts or compose status updates without the knowledge of the affected user.
In addition, the attack allowed the hackers to see anything that users can see on their own profile, including the names and birth dates of friends and family members. Such information could be used in future phishing attacks.
In response to the attack, Facebook reset 90 million logins automatically, fixed the software vulnerability and informed law enforcement officials. While the company says that users do not need to change their passwords, individuals experiencing login issues should navigate to Facebook’s Help Center.
As a safety precaution, users are encouraged to log in and out of all of their accounts on every device. Users can see all of the devices they’re currently signed into here.
To learn more about the breach, read Facebook’s official blog post.
Read more
If you’ve ever shopped around for insurance, you’ve likely been asked if you want to bundle your policies—in other words, combine your home or renters, auto and life insurance policies with the same carrier. Although you have the option to shop around individually for each policy, it almost always makes sense to have the same carrier cover as many of your policies as possible.
Benefits of Bundling
- The discount—Most policyholders bundle their policies because of the promise of a discount. The amount varies by provider but can generally range between 5-25 percent.
- The option of a single deductible—With bundled policies, your deductible may be cheaper in the event of a claim that affects multiple policies. For example, if your home and auto policies are with two separate carriers, and a hailstorm damages your home and your car, you’re responsible for paying both your home and auto deductibles before receiving payment. But if you bundle your policies, your provider may offer you the option to pay only the higher of the two deductibles.
- Less chance of being dropped—If you’ve made claims or gotten tickets, having your policies bundled with one provider can decrease the chance of them dropping you.
-
When it Doesn’t Pay to Bundle
It isn’t always better to bundle your policies with one insurance carrier. Here’s when it may be better to split them up:
- If you have tickets or past claims that make your auto insurance expensive—In this case, it may be cheaper overall to buy each policy from separate providers.
- When premiums increase—Bundling discourages people from price shopping, which makes it easier for providers to increase their rates. Most assume that you won’t go through the effort of shopping around when your policies renew.
- If policies aren’t technically bundled—Some carriers may insure you with an affiliated company. Although you may get a discount with that company, you’ll lose the convenience of paying your premium with one familiar provider.
A Few Tips to Consider
Although discounts are the main reason people bundle their insurance policies, never assume that bundling is the cheapest option. Your needs and circumstances will dictate whether you should combine your policies with one carrier. Consider the following tips:
- Shop for new coverage when your policies renew, and ask for the price of the individual premiums as well as the price of the bundled premium so you can decide whether it is worth it. Just make sure you compare the same coverage when shopping for quotes from each carrier.
- Ask if the provider uses a third-party insurance company. Remember that you may save money but lose the convenience of dealing with one provider and a combined bill.
- Ask an independent insurance agent to get prices from multiple companies so you don’t have to do the legwork. An agent that is loyal to a particular carrier may be able to offer discounts that you can’t get alone.
With multiple factors contributing to the price of your insurance premiums, it is important to shop around in order to get the best rate for your insurance needs. Feel free to contact Scurich Insurance to determine if bundling is right for you and help you take advantage of all available discounts.
Read more
One of the first things hackers do when they attempt to infiltrate computer systems is to try using any common or stolen passwords. And, if your employees aren’t careful to use effective passwords and change them regularly, both they and your business can be exposed to data breaches, phishing schemes and other costly cyber attacks.
Most people don’t manage their passwords effectively because of the misconception that strong passwords need to be long and difficult to remember. However, there are a few simple steps you can relay to your employees in order to ensure that passwords are both hard for hackers to figure out and easy to manage:
Build passwords around familiar phrases. Long passwords are harder for computer programs to guess, so using a long but familiar phrase, like a favorite song lyric or quote, is a great start to making a password.
Use a password management service. Many people write their passwords down on paper or in a word processor, but keeping them anywhere insecure makes it easier for hackers to access them. Instead, encourage your employees to use a reputable password management service to keep all of their login credentials safe. Contact us today for more resources that can help improve your cyber security, including our new “Employee Cyber Training – Passwords” video.
Read more
Cyber security researchers recently announced the discovery of two major security flaws that could allow hackers to bypass regular security measures and obtain normally inaccessible data. The flaws, referred to as Meltdown and Spectre, are both caused by design flaws found in nearly all modern processors. These vulnerabilities can be exploited to access all of the data found in personal computers, servers, cloud computing services and mobile devices.
Because Meltdown and Spectre are both caused by design flaws, experts believe that they will be harder to fix than traditional security exploits. Additionally, software patches that have already been released to help address the vulnerabilities can cause computer systems to slow down significantly, which may impact their ability to perform regular tasks.
Researchers believe that Meltdown and Spectre may be limited to processors manufactured by different companies, but also warn that the design flaws that contribute to Meltdown and Spectre have been present for years. Here are some key details about each flaw:
- Meltdown: This flaw can be used to break down the security barriers between a device’s applications and operating system in order to access all of the device’s data. Meltdown can be used to access desktop, laptop, server and cloud computer systems, and can even be used to steal data from multiple users who share one device. Although researchers have only been able to verify that Meltdown affects processors made by Intel, other processors may also be affected. Many software developers have already released updates that prevent hackers from exploiting Meltdown.
- Spectre: This flaw can be used to break down the security barriers between a device’s different applications and access sensitive data like passwords, photos and documents, even if those applications adhere to regular security checks. Spectre affects almost every type of computer system, including computers, servers and smartphones. Additionally, researchers have confirmed that the design flaw that enables Spectre is present in Intel, AMD and ARM processors that are used by nearly every computer and mobile device. Software developers are currently working on a patch to prevent the exploitation of Spectre, but some experts believe that future processors may have to be redesigned in order to fix the vulnerability.
When Meltdown and Spectre were originally discovered in 2017, researchers immediately
reported them to major hardware and software companies so work on security fixes could begin without alerting hackers. As a result, services and applications offered by companies like Microsoft, Google, Apple and Amazon have already been updated to help defend against the flaws. However, you shouldn’t rely solely on a software patch to protect against these vulnerabilities. Here are some steps you can take to protect your computer systems and devices from Meltdown and Spectre:
- Update all of your devices immediately, and check for new updates regularly. You should also encourage your friends, family members and co-workers to do the same.
- Contact any cloud service providers and third-party vendors you use to ensure that they are protected against Meltdown and Spectre. Cloud services and computer servers are especially vulnerable to the exploits, as they often host multiple customers on a single device.
- Install anti-virus and firewall systems to protect against regular malware. Researchers believe that hackers need to gain access to a device in order to exploit Meltdown or Spectre, so keeping your devices free of malware can help prevent data theft.
For additional risk management updates, contact Scurich Insurance today.
Read more
According to the Identity Theft Resource Center, data breaches increased 40 percent in 2016, with a total of 1,093 reported breaches. This trend continued in 2017, with over 1,120 cases reported by October. Businesses, both large and small, are increasingly reliant on the internet for daily operations, creating attractive and potentially lucrative targets for cyber criminals.
With such heavy use of and reliance on computers and the internet by both large and small organizations, protecting these resources has become increasingly important. Learning about cyber attacks and how to prevent them can help you protect your company from security breaches.
Cyber Attacks Compromise Your Company
Cyber attacks include many types of attempted or successful breaches of computer security. These threats come in different forms, including phishing, viruses, Trojans, key logging, spyware and spam. Once hackers have gained access to the computer system, they can accomplish any of several malicious goals, typically stealing information or financial assets, corrupting data or causing operational disruption or shutdown.
Both third parties and insiders can use a variety of techniques to carry out cyber attacks. These techniques range from highly sophisticated efforts to electronically circumvent network security or overwhelm websites to more traditional intelligence gathering and social engineering aimed at gaining network access.
Cyber attacks can result directly from deliberate actions of hackers, or attacks can be unintentionally facilitated by employees—for example, if they click on a malicious link. According to historical claim data analyzed by Willis Towers Watson, 90 percent of all cyber claims stemmed from some type of employee error or behavior. The high-profile Equifax, Snapchat and Chipotle data breaches were all caused by employee error or behavior.
A breach in cyber security can lead to unauthorized usage through tactics such as the following:
- Installing spyware that allows the hacker to track Internet activity and steal information and passwords
- Deceiving recipients of phishing emails into disclosing personal information
- Tricking recipients of spam email into giving hackers access to the computer system
- Installing viruses that allow hackers to steal, corrupt or delete information or even crash the entire system
- Hijacking the company website and rerouting visitors to a fraudulent look-alike site and subsequently stealing personal information from clients or consumers
Cyber attacks may also be carried out in a manner that does not require gaining unauthorized access, such as denial-of-service (DoS) attacks on websites in which the site is overloaded by the attacker and legitimate users are then denied access.
The Vulnerable Become the Victims
The majority of cyber criminals are indiscriminate when choosing their victims. The Department of Homeland Security (DHS) asserts that cyber criminals will target vulnerable computer systems regardless of whether the systems belong to a Fortune 500 company, a small business or a home user.
Cyber criminals look for weak spots and attack there, no matter how large or small the organization. Small businesses, for instance, are becoming a more attractive target as many larger companies tighten their cyber security. According to the industry experts, the cost of the average cyber attack on a small business is increasing exponentially and shows no signs of slowing down. Nearly 60 percent of the small businesses victimized by a cyber attack close permanently within six months of the attack. Many of these businesses put off making necessary improvements to their cyber security protocols until it is too late because they fear the costs would be prohibitive.
Simple Steps to Stay Secure
With cyber attacks posing such a prominent threat to your business, it is essential to create a plan to deal with this problem. Implementing and adhering to basic preventive and safety procedures will help protect your company from cyber threats.
Following are suggestions from a Federal Communications Commission (FCC) roundtable and the DHS’s Stop.Think.Connect. program for easily implemented security procedures to help ward off cyber criminals. These suggestions include guidelines for the company as well as possible rules and procedures that can be shared with employees.
Security Tips for Your Company
Cyber security should be a company-wide effort. Consider implementing the following suggestions at your organization:
- Install, use and regularly update anti-virus and anti-spyware software on all computers.
- Download and install software updates for your operating systems and applications as they become available.
- Change the manufacturer’s default passwords on all software.
- Use a firewall for your internet connection.
- Regularly make backup copies of important business data.
- Control who can physically access your computers and other network components.
- Secure any Wi-Fi networks.
- Require individual user accounts for each employee.
- Limit employee access to data and information, and limit authority for software installation.
- Monitor, log and analyze all attempted and successful attacks on systems and networks.
- Establish a mobile device policy and keep them updated with the most current software and anti-virus programs.
Security Tips for Employees
- Use strong passwords (a combination of uppercase and lowercase letters, numbers and special characters), change them regularly and never share them with anyone. Never repeat a password across accounts.
- Protect private information by not disclosing it unless necessary, and always verify the source if asked to input sensitive data for a website or email.
- Don’t open suspicious links and emails; an indication that the site is safe is if the URL begins with https://.
- Scan all external devices, such as USB flash drives, for viruses and malicious software (malware) before using the device.
Securing Your Company’s Mobile Devices
Gone are the days when contact names and phone numbers were the most sensitive pieces of information on an employee’s phone. Now a smartphone or tablet can be used to gain access to anything from emails to stored passwords to proprietary company data. Depending on how your organization uses such devices, unauthorized access to the information on a smartphone or tablet could be just as damaging as a data breach involving a more traditional computer system.
The need for proper mobile device security is no different from the need for a well-protected computer network. Untrusted app stores will continue to be a major source of mobile malware which drives traffic to these stores. This type of “malvertising” continues to grow quickly on mobile platforms.
Most importantly, stay informed about cyber security and continue to discuss internet safety with employees.
Don’t Let it Happen to Your Company
According to the DHS, 96 percent of cyber security breaches could have been avoided with simple or intermediate controls. Strengthening passwords, installing anti-virus software and not opening suspicious emails and links are the first steps toward cyber security. In addition to the listed tips, the FCC provides a tool for small businesses that can create and save a custom cyber security plan for your company, choosing from a menu of expert advice to address your specific business needs and concerns.
A data breach could cripple your small business, costing you thousands or millions of dollars in lost revenue, sales, damages and reputation. Contact Scurich Insurance today. We have the tools necessary to ensure you have the proper coverage to protect your company against losses from cyber attacks.
Read more
Businesses gather a lot of information from their customers, including personal identifying information (PII). Because of the sensitivity of this information, many states have adopted standards that businesses must follow to safeguard PII. These standards often include data security breach notification requirements.
In California, these laws are enforced by the California attorney general’s office. This Cyber Security Law Summary provides an overview of California’s data breach notification requirements. Businesses can use this information to understand their responsibilities in protecting PII of California customers.
Cyber security Responsibilities
California law requires businesses and individuals that own, license or maintain PII about Californians to safeguard that information. Businesses must implement reasonable security procedures and practices to protect PII from unauthorized access, destruction, use, modification or disclosure.
Under California law, “owning” and “licensing” includes retaining an individual’s PII in an internal account for the purpose of conducting transactions with the individual in question.
Businesses that disclose PII to a third party must have a contract in place requiring the third party to implement and maintain reasonable security procedures and practices.
The responsibility to safeguard PII begins when the information is first acquired and remains in effect until the information is properly disposed of. This means that businesses must also take reasonable steps to dispose of customer records that are within their custody.
Adequate disposal methods include shredding, erasing and otherwise modifying the records where the information is stored to make them unreadable or undecipherable. Businesses can use any means necessary to dispose of PII properly.
Affected Entities
Breach notification requirements apply to individuals and businesses in California that own, license or maintain PII about Californians. Under these laws, a business is any group that is organized, chartered, or holds a license or authorization certificate under California law or the law of any other state, the federal government or of any other country. This definition of business includes any sole proprietorship, partnership, corporation, association and financial institutions. The term also includes any entity that disposes of records.
Certain businesses are exempt from California’s breach notification law, including:
- Health care providers, health care service plans or contractors regulated by the Confidentiality of Medical Information Act;
- Financial institutions that are subject to the California Financial Information Privacy Act;
- Businesses governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy and security rules;
- Entities that obtain information under an agreement authorized by the vehicle code and that are subject to the confidentiality requirements of the vehicle code; and
- Businesses that are regulated by state or federal laws that provide greater protections to PII than what is required under California’s breach notification laws. This last exemption is possible because compliance with stricter state or federal laws will be considered compliance with California laws.
Affected Information
Under the breach notification law, PII includes an individual’s first name or first initial and last name in combination with one or more of the following:
- A Social Security number;
- A driver’s license number or California identification card number;
- An account, credit or debit card number, in combination with any required security code, access code or password that would permit access to an individual’s financial information;
- Medical information (meaning any information regarding an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional);
- Health insurance information (meaning an individual’s health insurance policy number or subscriber identification number, any unique identifier used by a health insurer to identify the individual, or any information in an individual’s application and claims history, including any appeals records); and
- Information or data collected through the use or operation of an automated license plate recognition system.
PII also includes a username or email address, in combination with a password or security question and answer that would permit access to an online account.
PII does not include publicly available information that is lawfully made available to the general public from federal, state or local government records.
What is a Security Breach?
Under the law, a security system breach is an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of the PII maintained by another person or business.
Determining whether a breach took place under the law depends on whether the affected information was encrypted or unencrypted, as shown in the table below.
|
Encrypted Information |
|
Unencrypted Information
|
|
Notification must be given if:
- The business reasonably believes the information has been acquired by an unauthorized person;
- The encryption key or security credential was, or is reasonably believed to have been, acquired by an unauthorized person; and
- The business that owns or licenses the PII reasonably believes that the encryption key or security credential could render that PII readable or usable.
|
|
- Notification must be given if the business reasonably believes that the information was acquired by an unauthorized person.
|
Data Breach Notification
California law requires businesses to provide written notice of a breach to the security of their systems if they own or license computerized data that includes PII.
|
Who must be notified?
|
Businesses must notify any person whose PII was compromised as a result of a data breach (as defined above).
In addition, any business that is required to notify more than 500 California residents as a result of a single breach must submit a single sample copy of that notification to California’s attorney general.
Businesses that maintain, but do not own or license, PII must inform the entity that owns or licenses the information of any security breach if the PII was, or is reasonably believed to have been, acquired by an unauthorized person.
|
|
Mandatory Notification Content
|
A valid data breach notification must be written in plain language and must be titled “Notice of Data Breach.” This notification must include the following information (if available at the time the notification is sent):
- The name and contact information of the reporting person or business subject to these requirements;
- A list of the types of PII that was or is reasonably believed to have been compromised by the breach;
- The date of, the estimated date of or date range for the breach;
- Whether notification was delayed as a result of a law enforcement investigation;
- A general description of the breach incident;
- The toll-free numbers and addresses for the major credit reporting agencies (if the breach exposed a Social Security number, driver’s license number or California identification card number);
- An offer to provide appropriate identity theft prevention and mitigation services for affected individuals for at least 12 months (if the entity providing the notification was the source of the breach); and
- Instructions on how to take advantage of the 12-month identity prevention and mitigation services offered (as applicable).
|
|
Optional Notification Content
|
The following information may be included in a breach notification at the discretion of the entity sending the notice:
- Information about what has been done to protect individuals whose information has been breached; and
- Advice on steps affected individuals may take to protect themselves.
|
|
When to Send the Notification
|
Data breach notifications must be made as soon as possible, without unreasonable delay. Timely notifications must take into account legitimate needs to cooperate with law enforcement, determine the scope of the breach and restore a reasonable integrity of the data system. For example, the notification requirement may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
|
|
How to Send the Notification
|
Under California law, breach notification can be sent in print, electronically or through a substitute notice, as defined below.
The use of electronic notices is acceptable, as long as all timing, content and formatting requirements are met. Electronic notifications must also follow federal laws regarding electronic records and signatures in commerce.
A valid substitute notice must include:
- An email notice (when the business has an email address for the affected individuals);
- Conspicuous posting, for a minimum of 30 days, of the notice on the internet website page of the business, if the business maintains one. Conspicuous posting means providing a link to the notice on the home page or first significant page after entering the business’ website. The link must stand out from the surrounding text by using larger type, contrasting type, font or color to the surrounding text. The text may also stand out by using symbols or other marks that call attention to the link; and
- Notification to major statewide media.
Substitute notice may also be provided if the business demonstrates that the cost of providing notice would exceed $250,000, the affected class of subject persons to be notified exceeds 500,000 or the business does not have sufficient contact information.
|
Required Format
The notice must be designed to call attention to the nature and the significance of the message. This includes making sure that the title and headings are clearly and conspicuously displayed and using a font type that is 10 point or larger.
In addition, the data breach notice must organize the information according to the following headers:
- What happened
- What information was involved
- What we are doing
- What you can do
- For more information
Safe Harbor
A business that maintains its own notification procedures as part of an information security policy for the treatment of PII is in compliance with the notification requirements mentioned above if it:
- Notifies individuals in accordance with its policies in the event of a breach; and
- The notification takes place within the time constraints mentioned above.
Enforcement
Businesses cannot waive any of the responsibilities imposed on them by California’s breach notification laws. Any business that fails to comply with these requirements may be required to pay damages and penalties to injured customers by a civil court. Any business that violates, proposes to violate or has violated notification requirements may be subject to these sanctions.
The amount of damages depends on the extent of the harm or injury caused to the customer. The penalty is typically $500 per violation, but a court may order the penalty to be as much as $3,000 per penalty for willful, intentional or reckless violations.
A “customer,” for these purposes, is any individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business.
Unless the violation is willful, intentional or reckless, a business that fails to provide adequate, complete and accurate notification to affected individuals can raise a complete defense against court penalties if it strives to remedy inadequate, incomplete or inaccurate notifications within 90 days of discovering an issue.
Read more
