Moving Home

Right, after months of inactivity and struggle with Blogger, I have moved myself to Wordpress:
http://stephanfreeman.wordpress.com

I've had all sorts of problems here and have decided that I'll be more able to update my blog from there.

Hope to see you soon!

Webamil insecurity

There are reports today that Google is considering quitting China after many Gmail accounts were hacked, belonging to human rights activists, both inside and outside China, apparently by the Chinese government. This poses an interesting question: how many people using Gmail or any other free, web-based mail system, are sending and receiving information that they consider confidential, with little or no idea about whether their accounts are secure.

You get what you pay for
It’s true: if you don’t pay for a service, why should you have any expectation that the provider is under any obligation to you? If you look at Microsoft’s “Terms of Service” for Hotmail, it clearly states that it provides no warranties for the service. In addition, the content may be stored pretty much anywhere in the world. So, how can people assess the risk of storing confidential information in these systems?

Auto forwarding mail
I have also come across people who automatically forward all of their work emails to an external Gmail or Hotmail account as they find it easier to use than the company-provided mail system. It might have more features; have a prettier user interface; whatever... However, this could potentially create a serious headache for the company or organisation concerned. Authentication to web-based mail systems is usually weaker, employing simple password-reset routines, where people can set their own questions (I saw one who had written, as his secret question “What is Captain Kirk’s middle name”. Not exactly the hardest thing to find out).
People routinely using webmail for very sensitive information, where the implications of disclosure include risks to people’s lives, should really reconsider whether using something like Gmail, Yahoo mail or Hotmail is a good idea in the first place.

There are a few solutions. Stick to your company’s mail system and consider using encryption, or try to use encrypted mail with webmail accounts. Encryption brings a whole new raft of issues I won’t go into here, but some companies already provide an integrated, but paid for, service to do this, like Hushmail.

But never forward email out of a company automatically to an external source without checking with your IT department first – there may be many more serious implications than you might realise.

Why patching is so important (even for Mac users)

All software has bugs. Some are never found. Some aren’t important. A few are dangerous. It is estimated that Windows XP had 40 million lines of code and Mac OS X 10.4 had about 80 million. It is sadly inevitable that some of these bugs will be exploitable by people who want to hijack your machine for their own reasons.

You might ask yourself “why?”. It’s a perfectly reasonable question. Most of us have far better things to do with their time than to try to get into other people’s computers. You might also suggest that you haven’t got anything worth stealing on your PC anyway, so even if someone did take the time to create an exploit, why bother?

There are a number of reasons for all of this, but it all boils down to one thing: money. The criminal economy on the Internet is huge. And increasing. These criminals don’t care who they target as they operate, mainly, on scale. They ensnare vast numbers of machines, unknown to their owners, to do their bidding through the use of bot nets. Essentially, they use these huge networks of computers to attack company websites and to extort protection money from them. They are also used to send spam, break encryption codes and hide child pornography. As a sideline, they also harvest personal information from the machines they infect and often steal passwords to bank accounts.

So, what can you do about it?

Patch! In Windows, make sure automatic updates are enabled. In Mac OS X, check the Software Update link from the Apple menu (more information).But not just the operating system... If you’re using a PC, download the Secunia Personal Software Inspector. It’s free and shows you all of the programs installed on your PC and whether it’s insecure.

Macs are vulnerable. Even Apple themselves recommend using anti-virus products on OS X. I personally have seen a number of Macs infected with bot nets and Apple have been slow, in the past, to update software that has known bugs in it.

Patching is no substitute for running an anti-virus scanner, but is equally as important. AV scanners will often stop an exploit from working, so it’s best to remove the vulnerable code. It’s worth bearing in mind that AV scanners will also stop things from being installed intentionally by a user of a machine if it’s infected with something.

LSE provides free anti-virus for home use to students and staff here. Other free and paid-for anti-virus products exist.

I’d be interested to know your experiences. Do you patch? Have you had problems in the past with malicious software? Send in your comments...

Web Passwords

Passwords can be a pain. There are thousands of websites across the Internet that require passwords. Traditional advice has been to use different passwords for different applications. This is plainly impossible. A typical user of the Internet probably has passwords for their MSN, Gmail, YahooMail, Flickr, Picassa, Facebook, MySpace, Bebo accounts, as well as for their bank, mobile phone company, energy company, and innumerable other sites, some of which they've probably forgotten that they signed up for.

So, instead of saying each account should have a different password, I'd suggest that the best thing to do is to have a few passwords, but to have some rules around the ones that you use regularly.

1. Always pick a good password. There's a guide here that offers some ideas.
   
2. Don't use the same password for a mail account that you used to set up a social networking account with. For example, if you use the same password for Hotmail as you do Facebook, and one or the other gets "broken in to", it's likely the other will, too. And then it's incredibly difficult to regain control of either.
   
3. Do change them occasionally.
   
4. Consider what you're protecting. Don't use the same password for all your important accounts (e.g. bank, email) and use a separate password for account for sites you're not overly bothered about (e.g. that Fraggle Rock appreciation site you signed up to)
   
5. Don't share them! I know this sounds obvious but don't let anyone else have your password – think about what you're giving the access to. This is especially true for passwords at university or in the workplace – the risk is much greater than simply to your data as it could impact the whole organisation.
   

These aren't simply theoretical risks. In the last few months, I have dealt with situations including the hijacking of a Facebook and related Hotmail account – believe me when I say that this is not easy to resolve – and several instances where people have sent their usernames and passwords to scammers.

The reason scammers want your username and password in a place like a university is because they want to send spam through the universities mail system. Unfortunately, this can lead to the whole university being blacklisted as a spammer and no-one will be able to send or receive email.

Please take care of your passwords.

Webmail Passwords

It was bound to happen. Large lists of account details have been leaked that were compromised through phishing, where the owners of the accounts replied to emails requesting their passwords and, in some cases, the login details to alternative accounts. We put out a message at LSE fairly frequently that people should never hand out their usernames and passwords to anyone – hopefully a fairly unambiguous statement. And yet, we still get people doing it.

I have tried to do a little research into why people continually reply to these messages, and the answer I usually get is that the email making the request "looked official".

If you have any ideas on how to get the message across, I'd be very interested.

Hacking Facebook

I just got pointed towards an article that shows that your Facebook account password is worth $100. It's impossible to tell whether this is genuine or not without sending $100 via Western Union to the Ukraine (and what is it about Western Union and scams??) but it does raise some interesting questions about how much people would be willing to pay to hack into someone else's account. I have had people come to me with this same issue and it's really difficult to regain control - it is a free service, after all.

More on this soon...

Digital Certificates

Lots of people have been discussing digital certificates with me lately, with several certificates having to be re-issued due to certificate chain problems. I thought I'd take the time to explain how these things work in simple terms.

Most people come into contact with certificates when either setting up a web server that uses SSL (Secure Sockets Layer) to encrypt data in transit or encrypted e-mail. The two main functions of a certificate are to provide encryption using the keys contained with them and provide assurance that the owner of the certificate is who they say they are. Certificates issued inside an organisation for solely internal use, the second point might not be so important as assurance can be gained through talking to the person who issued the certificate. However, under most circumstances, people need independent assurance that the owner is who they say they are.

Certificate Authorities

A request can be made to have a certificate digitally signed by an independent organisation (certificate authority) which people already trust, making the process of accepting a certificate as valid seamless. However, how does an end user trust the certificate authority? Surely, we still have the same problem in providing identity assurance with these organisations, otherwise we wouldn't be able trust their digital signatures? This has, in the most part, been solved by pre-installing the certificates of these organisations into applications like e-mail clients and web browsers that are likely to come across these signatures. If you want to take a look to see who you trust by default, try going into Tools -> Internet Options -> Content and click on the "Certificates…" button. One of the tabs across the top will be labelled "Trusted Root Certification Authorities". In Firefox in Windows, simply go to Tools -> Options -> Advanced -> Encryption (on a Mac, just go to Preferences -> Advanced -> Encryption) and click on the "View Certificates" button. One of the tabs will be entitled "Authorities". Different browsers and e-mail clients will have similar options.

The reason that these authorities are trusted is because they have stringent verification methods to ensure that certificates are only issued to the correct people or organisations.

However, there is a problem with this model, one which manifested itself at LSE, where a root Certification Authority changes its signing key and certificate pair to one that is not already present in all browsers or clients. The only way to automatically trust certificates signed with the Certificate Authority's new key is to manually install it, which is not recommended. Apart from the obvious danger that the person doing the installing has to do equivalent checks on the identity of the certificate to provide the same level of assurance as the other certificates in the root Certificate Authority list, having to get every client that may connect to that device is a nightmare.

It is by far safer to have certificates signed by a key that is already in the client. This is why most Certificate Authority's certificates have very long lifetimes, equivalent to the expected lifetime of the equipment of the client, to prevent manual updates.

The point of all this is that the client doesn't need to refer back to the root Certificate Authority every time it comes across a certificate signed by that particular CA. Nor do they even, necessarily, require a route back to the CA at any point, as long as the CA's credentials are held locally.

Expiry and revocation

Certificates all have an expiry date. It is assumed that the "private key" (that which is used to decrypt information or digitally sign other messages/certificates) will get compromised at some point. The more protection given to a certificate, the less likely it will be compromised and, therefore, the safer those certificates dependent on it will be. This paper describes the ways in which an organisation might protect its own certificate signing key.

If a private key does get compromised, it is possible (albeit hard) to revoke that certificate and any child certificates using a certificate revocation list (CRL) that is incorporated into the certificate itself. This process is, however, a bit flakey, as it defeats the purpose of being able to do offline verification of certificates based on locally-held, trusted credentials of CAs.

Trouble with unsolicited email

Many organisations have policies that state that it is unacceptable to send emails to large numbers of users either inside or outside the organisations if you don't have the recipients' consent. Mass emails present their own problems, especially with attachments. Here's a quick run down as to why.

Spam

The general term for mass unsolicited emails is "spam". The sorts of emails typically associated with spam are those for dodgy investments ("pump and dump" schemes), growth pills, religious messages, phishing attempts, viruses and everything in between. Many organisations have invested in anti-spam filtering technologies to reduce the amount of junk that they receive (see my previous posting relating to scam/phishing emails for some statistics). The technologies to identify spam is always a "best guess", using a variety of techniques, which means that some spam gets through and some legitimate emails get blocked.

At a very basic level, there are two main methods for preventing spam. Firstly, there are blacklists where servers who are known to send spam are prevented from sending any emails whatsoever to the organisation protected by anti-spam filtering. Secondly, emails that are received from "clean" servers have their content assessed to see if it matches the profile of known spam. If the score from this assessment is higher than the threshold decided upon by the protected organisation, it won't get through and, in many cases, the sender's servers are automatically added to the blacklist (or "greylist"). Rules vary for different products, but may include:

• Sending to a large number of people
  
• BCC'ing instead of sending to explicit addresses
  
• Not including a standard greeting ("Dear Sue," for example)
  
• Having a reply-to set differently to the sender's address
  

Organisation impact

A key point is that black-and greylists are shared and so if an organisation gets blacklisted it won't be able to communicate with any organisation using that black- or greylist. Members of an organisation can, quite unwittingly, get their organisation blacklisted, thereby causing a lot of inconvenience to their colleagues.

Which is why organisations take it seriously.

Data Protection

All of the discussion above is quite apart from whether the email addresses should have been collected in the first place and then used for the purpose of sending emails. If in doubt, talk to your data protection manager.

Disk Space

I also have to put a short note in here about disk space. While most modern email systems will store a single copy of an email destined for multiple recipients on an email server, as soon as the email is copied off, forwarded or archived, a copy is made and the amount of space it takes up doubles. So, mass emails that have 1MB attachments can take up significant amounts of space if sent to a large number of people. And disk space is not free.

LSE resources

If you're at the LSE and do want to send emails to large numbers of people, please see the LSE's policy on internal email communications and the Conditions of Use for IT Facilities.

Internet Explorer vulnerability

UPDATED: A lot of people have been asking me about this in the last two days and I thought I'd summarise my observations here. Please leave a comment if you think I've got something wrong or I haven't answered a particular question.

The Issue

It seems that Microsoft have had a bug in Internet Explorer 5.01 (released in November 1999) that exists right up to the latest beta of IE 8. Essentially, someone can write a web page that references a non-existent page element causing an error within IE that allows code to be run on the local machine as if it were the current user of the machine. Usually this would manifest itself by using IE to download a piece of code from a 3^rd website and silently install it, compromising the PC. (Before anyone comments that I've over simplified the problem, I have no intention to get into invalid pointer dereferencing in DHTML arrays in this blog.)

This only affects Internet Explorer – not Firefox, Safari, Opera or Chrome (although I'm still a bit sceptical about the patching regime for Chrome at the moment and am hesitant to recommend it).

Impact

Because the vulnerability essentially means that an attacker can install anything they like on your machine, anything could have been happened. I don't mean to panic people, but I honestly don't have any idea how much information or how many machines have been compromised in this way since the vulnerability was discovered.

Let's get the issue into perspective. We know that at least 10,000 websites have been compromised and, if visited with a vulnerable web browser, will infect your PC. However, given that there are approximately 110.1 million websites being operated, with a total of 550 billion web pages on the Internet, the proportion of the total affected is small.

It's also fairly safe to say that most of the "big" sites like the BBC, Microsoft, Yahoo, Google, Blogspot and other sites that have big operations behind them will very quickly find compromises in their sites and fix them – they can't afford the publicity. Those sites being compromised are the smaller sites, being hosted in a chicken shed at the end of the garden.

I'm definitely not saying this isn't an issue – it is a huge problem. However, equally, I'm not saying we should all run for the hills.

What is happening and what can I do?

Microsoft have stated that they've brought forward a patch for this problem to 1pm EST. This will hopefully solve the problem. There are a few things that you can do, in addition to patching your machine by visiting the Microsoft Update Centre. IMPORTANT: if you're using a PC supported by LSE, or any other organisation, and it's on the corporate/work network, patching should be done automatically, as it is at LSE. There is a big difference between running a personal computer and having a reliable network with several thousand on at the same time on a corporate network. Please don't change the configuration of a work PC. If in doubt, contact your support team (at LSE, these can be found here).

If using your own PC, consider the following:

• Ensure your anti-virus product is up-to-date
  
• Make sure you have a properly configured firewall on your PC
  
• Consider using a different web browser
  
• Patch regularly
  
• Only visit web sites you trust
  
• Change your passwords regularly
  
• Don't use the same password for every website
  

It's also important to note that this whole sorry episode could well be repeated next week, with another vulnerability, or in a different browser. Please be sensible when surfing the web.

I'd welcome any feedback.

UPDATED (18.55, 17/12/2008): Microsoft have released an update page. See: http://support.microsoft.com/?kbid=960714

The Twelve Scams of Christmas

I know I'm a bit late getting to this topic (Philip Virgo got there first) but I think it's worth blogging about this, too. Here is the only (?) Christmas carol to be adapted for information security:

The Twelve Scams of Christmas

Twelve Phishers phishing
Eleven Spammers spamming
Ten Bots a' herding
Nine Virus writers coding
Eight Snoopers snooping
Seven Worms a' spreading
Six Crackers cracking
Five Tro-jan Horses
Four Logic bombs
Three Software patches
Two Denials of Service
And a hacker at your back door!

Credits go to Philip Virgo, Margaret Smith (plus the other ISAF members) and the countless members of IT Services at LSE who had to endure this being actually sung to the music of "Twelve Days of Christmas".

The links go to GetSafeOnline. For more information, see the links on the right. I'll blog on each topic over the next few days.

The Anatomy of a Phishing Scam

We've been suffering from a plethora of phishing scams over the last few weeks at LSE. To put this into context, Messagelabs stop in excess of 250,000 spam e-mails from arriving at our mailboxes every week, which represents 25% of the total (1,108,000). So, when one does get through, it is a bit unusual. In the main, these don't cause a lot of disruption as most people are conditioned to ignore them. However, there's always someone who does reply and the IT department spends quite a bit of time clearing up the aftermath.

So, here is my one top tip to not getting caught:

Never, ever send your password to anyone by e-mail.

It's quite simple. No-one should ever ask you to disclose your password by e-mail and you should never, under any circumstances, give it to anyone.

What happens if you do

Here at LSE, we have a set of Conditions of Use for IT Facilities which clearly state that you shouldn't do this. Most organisations with an information security policy say the same thing. Generally, you can expect your account to be suspended as a minimum.

However, that's not all. Scammers will use the details that they have gained to abuse the account they have access to steal information and, most likely, send spam out from the account. This means that the account gets blacklisted. Which is a pain.

Phishing for Bank Details

This is obviously a subset of a much wider attempt to con people into handing out personal detail, either directly or trying to convince them that they are on a legitimate site. Many people have received e-mails, purportedly from their bank, asking them to log in by clicking a link in the e-mail and filling in all of their authentication information.

There is a simple way to avoid being duped by one of these e-mails. Never click on the links in the e-mail: always go directly to your bank by manually typing their website address in the address box of your browser.

Browser defences

On top of this, many web browsers now (or will soon) incorporate anti-phishing tools. For example, Mozilla Firefox has a feature that, if turned on, automatically blocks access to known phishing site.

If in doubt, don't click. And another tip: don't reply to these scam e-mails with some sarcastic comment: it only confirms your address and you'll end up getting more spam.

Encryption issues

Many people ask me about the issues surrounding encrypted devices and whether they can (or should) encrypt data. So, to clear up any confusion, here's my take on this issue.

First point: Encrypting data, especially on removable devices, is a good idea

Given recent events relating to the loss of sensitive data (like, the loss of nursery data on a USB stick, Government user IDs stolen from a parked car, the banks losing customer data, Number 10 staff losing their Blackberry's in China… This list is endless), it is blindingly obvious that some form of protection for data while not stored in a physically secure environment is needed. The losses actually reported are dwarfed by those that companies elect not to report. There is a great debate going on about whether companies should be compelled to report these sort of breaches under Data Protection legislation, as currently most organisations don't have to.

In addition, individuals should ensure that their own data is adequately secured. It's not just companies that have this problem. How many people store their passwords to their online banking on their laptops and then carry them around with them all over the place? And, given that most operating systems have built in encryption capabilities these days (Microsoft Windows XP and Vista do, as does Mac OS X), people should really consider turning these on.

Second point: There are lots of different applications for encryption

There's device encryption, full disk encryption, e-mail encryption, SSL encryption for websites and other types of traffic, VPNs… Plenty of different applications for very different purposes. And managing this becomes a bit of headache…

Third point: In an organisation, it's not that simple…

Having said all of the above, it would easy (but wrong) to assume that it's very simple to implement encryption in an organisation. It isn't. There are three choices: 1. Implement stand alone encryption for everyone who needs it, using a variety of different standards and without the capability to access these in the event of a disclosure requirement; 2. Implement an integrated encryption service, managing people's keys centrally (or at least having an administrative key for access in the event of a disclosure requirement), or; 3. Take the risk and don't do anything.

The trouble with option 1 is that the organisation is liable for everything that gets sent or stored from or on its systems. In the event that a request to disclose some information stored in an encrypted file or e-mail is made by the authorities, it is essential that, given the right safeguards, an organisation can access that data. If everything is set up in a standalone fashion, this becomes difficult.

Option 2, therefore, looks much more attractive, but it does come at a cost, both in terms of infrastructure and management. Many organisations opt for option 1, but ensure that each user of encryption software sign a disclosure agreement that warrants their co-operation in the event the organisation is requested for data held in a system that they, themselves, control.

Finally, option 3. I would not recommend going down this route. The Information Commissioner seems to be blowing hot and cold over the absolute requirement for device encryption, but it looks likely that principle 7 of the Data Protection Act 1998 will be breached if laptops and other personal data aren't encrypted.

Fourth point: Travelling with encrypted files

This may come as a bit of a surprise, but different countries have wildly different laws about encryption, so it is essential that people check out what the legislation is in the country that they are travelling to, in case they are accused of espionage activities (I'm not kidding!). For a comprehensive overview, the University of Tilburg, in the Netherlands, is hosting a page on the Wassenaar Arrangement. This details how different countries license the export and import of different levels of military materials. To quote:

"The Wassenaar Arrangement controls the export of weapons and of dual-use goods, that is, goods that can be used both for a military and for a civil purpose; cryptography is such a dual-use good."

As an example, I've picked Russia. It states: "A license is required for the importation of encryption facilities manufactured abroad. The export of cryptography is subjected to a tightened state control. Importers and exporters need licenses by the Ministry of Trade."

I am not a lawyer, and I suggest getting legal advice rather than ever relying on something you've read in a blog.

More information:

Surfing Safer: Advice on choosing encryption products

Laptop encryption in Russia, China

20 Years of Worms, Viruses, Trojans…..

It may come as a bit of a surprise that the first piece of malware to use the Internet to spread was released into the wild in 1988. The "Morris Worm" was written by Robert Tappan Morris, then a student at Cornell University in the US and who, embarrassingly, was the son of Robert Morris, the former Chief Scientist at the US's National Security Agency (NSA). His worm infected roughly 10% of all systems connected to the Internet at that time (bearing in mind that in 1988, the Internet had a grand total of 60,000 connections; today, this figure lies somewhere around 1.1 billion) and still holds the record for the largest percentage infection of the Internet.

Why is this relevant?

The explosion in the numbers of devices connected to the Internet has resulted in an explosion in the number of programs designed to compromise the devices connected to it. Ever since people started using the Internet, others have been trying to subvert them. It's an ongoing battle and anti-virus companies have been making large sums of money by trying to protect people from them. Sophos recently reported that they are receiving 20,000 new samples of malware every single day. And it's not the traditional e-mail attachment, promising titillating pictures of the latest B-list celeb, either; in the same report, Sophos say that they see over 16,000 new website infections every day. This means that simply by looking at a website, often from a genuine and reputable company, a machine can be infected without any interaction from the user.

It's not about fame anymore

In the good old days of virus writing, authors would write something that would throw up messages, immediately telling the user of the machine that they were infected. Some examples can be found on F-Secure's virus screenshot archive. These days, however, the whole malware space has become much darker. Viruses, worms and Trojans no longer advertise their presence but rather attempt to lurk on a users PC without their knowledge, quietly subverting the machine.

Why the shift in MO? Simple: Money.

These days, most malware is written to infect machines in order to take control of them. These "zombie" machines are then part of a "botnet", controlled by a "bot herder", who sells time on his/her botnet to the highest bidder. Essentially, these zombie machines can be used to do anything. The faster the machine and faster the Internet connection, the better. They can be used to launch "Distributed Denial of Service" attacks, where vast amounts of junk data are thrown at a particular company or website, with the intention of taking them off the net as part of an extortion exercise, or for the storage of porn. Far worse is the ability for paedophiles to store their collections on the infected PCs of unsuspecting users, allowing them to keep distance between themselves and their images.

Storm

The largest of these botnets that has been found to date is known as "Storm". According to some sources, up to 50,000,000 devices are zombies were part of Storm in September 2007. It has been reported that the bot herders running Storm were making profits of $9,600 daily, with spam being the main revenue generator.

What can I do?

Really, it comes down to ensuring your anti-virus is up to date (and this includes Mac and Linux users! I'll come on to why in another posting), ensuring your firewall is enabled and patch, patch, patch! I have been made aware of a free tool to tell you which programs installed on your PC need patching, and not just those written by Microsoft. Potentially any vulnerable component could be used to crack open the machine and zombiefy it. I really recommend downloading this application and updating those things it finds.

Social Networking Risks – Facebook and others

With the rise and rise of social networking sites, everyone is getting online and publishing more stuff about their own lives. But not everyone is fully aware of the risks that they run by putting so much information about themselves online.

The Internet never forgets

Many people don't realise that when something gets published, it is very hard to take it off the Internet. Consider this when publishing photos from the last time you had an all-night, booze-fuelled party. A number of sites offer historical archives of the web. Google offers up cached versions of web pages in its results. Historical data has caused all sorts of problems a number of companies, most recently United Airlines. Other stories keep resurfacing. The BBC and Microsoft have an ongoing issue with a story written in 2001 about Hotmail considering charging users for its e-mail service. The story (from 2006) is here.

Employers will search the web for you

Many employers will now search the web for any information they can find out about you before you get offered a job and, in some cases, will take issue with things that you post online while working for them. Here are some examples:

Policeman loses job opportunity because of his Facebook profile

Waterstones employee loses job because of blog comments

Australian man found lying about sickness through Facebook

Virgin and BA staff sacked for Facebook site criticising customers and their respective companies

And if you think you can simply delete your Facebook profile, think again. It is seemingly very difficult to actually erase yourself. While deactivating your account is simple enough, actually getting Facebook to delete your details is much harder. This has been the subject of concern by the Information Commissioner and he discusses it on this BBC page.

Watch out for the actions of others

If you do post something on your profile beware what others may do with that information. There has been a tragic case recently of a woman who was murdered by her husband, simply because she had changed her relationship status on her profile.

It's not all bad

There are ways that you can limit the risks you run by using social networking sites:

Always think about what you upload: consider what that picture of you on the drunken night out might look like to a future employer.

Don't post everything about yourself: a date of birth is essential for an identity thief – do you really need it on your profile?

Check the privacy settings: most sites, like Facebook, allow you to restrict who has access to what information.

Search online every so often to see what's published about you: it's always a good idea to see what information is available about you online.

Don't install every Facebook app: some have been found to be malicious

Only invite friends that you know: if you don't know them in person, think hard before accepting that friend request. They may be impersonating someone else.

There are sites that can help. Sophos do a really good guide to Facebook settings, there's an online video about MySpace privacy settings from SafetyClicks, and Bebo themselves have published an online safety guide.

But these settings will not protect you if you're either blogging directly, have your own website or use another service. Fundamentally, the question you have to ask yourself is: should this information be online at all.

Mobile Security – iPhones and more

Mobile devices have long been the bane of the lives of those responsible for information security. They're transitory devices, never really attached to any company infrastructure and yet hold vast amounts of corporate data. While some have tried to establish some sort of control over these devices, most people, in my experience, have decided to ignore the problem, hoping that people will implement the security controls that they have built in. It has now been demonstrated that, with the news that the PIN on Apple's iPhone can be bypassed with three button presses (http://forums.macrumors.com/showthread.php?t=551617) , this is hardly a viable way to manage these sorts of devices.

The reason that this is even a problem is the ever increasing functionality on these devices. There was a time (many moons ago) when the only data that could be extracted from a phone was the phonebook and the odd text message. Now, many phones have VPN clients, access to corporate e-mail, the web and a whole host of data. And what is a phone these days, anyway? When does it stop being a phone and actually becomes more akin to a laptop? Take a Blackberry. It works as a mobile phone, yes, but it's primary function is as a lightweight version of a laptop, having access to e-mail and storing sensitive information.

You'd think that those used to dealing with sensitive information day-to-day would be more aware of the risks of losing these devices, but apparently not: http://www.telegraph.co.uk/news/newstopics/politics/labour/2437340/Downing-Street-aide-in-Chinese-honeytrap-sting.html.

So what should we do? As individuals, we need to recognise the value of our devices, over and above that of the hardware itself. Information has value. How many of us store our entire contacts list on our phone? What would we do if that got lost? Is there any information on there that could make me or any of my contacts vulnerable to identity theft?

Think about the following:

• Always use whatever security features come with the phone, be it a PIN or whatever. It might seem a bit pointless given the above, but Apple will fix this. And there is a work around (which is strongly advised for all Apple iPhone users).
  
• Don't store people's birthdays and full addresses in your phone. Someone's date of birth is an important piece of information to an identity thief.
  
• Delete data that is sensitive. PINs, credit card numbers, passwords, they shouldn't be there.
  
• Back up your data. Make sure that you do it regularly so that if your device does get stolen, it's fairly straightforward to get back to where you were.
  
• Delete those old text messages. Or at least back them up, too.
  

If you do lose your phone, it would be worth contacting those people that you have got extended details for and let them know.

Companies have a number of options. I'll cover these in a later post.