Elamb Cybersecurity

Category: Main Digg

  • Nigerian Dating Scams: the eHarmony story, Damon A. Basinas

    I just wanted to share my eHarmony experience with the world so that unsuspecting single women can be alert to this kind of dating scam. This scam was pretty smooth…to an extent. It didn’t work on me but I don’t want anyone to fall for it.

    Here’s the story. I was a member of eHarmony and was matched to a nice man with similar interests, etc. We went through the eHarmony process and eventually started open communication on our own. We communicated through email, yahoo messenger, and later by phone. This process took months. He said he lived in Tampa and had a little boy. His wife had died tragically during childbirth. This man claimed to be a vet who worked as an independent contractor for the World Animal Health Organisation. He had just recently moved to Tampa he said. He said he was Greek but went to college in England. I live on a farm and know a lot about animal health, plus I am scientist currently working in the health care industry. I am educated and somewhat bright.

    He was a very sweet guy…sent some nice pictures of himself and his son, said all the right things, wrote a lot–he played his part well. I was skeptical though for the following reasons: he began most of his correspondence when he was “out of the country on assignments”. The first “job” he spoke of was in England. I asked about his son and school and he said that he hired tutors wherever he went to educate his child during these trips because he couldn’t stand to be without him. I thought this odd since that would be extremely expensive and a difficult way to raise a child. How would this child receive credit for his education from multiple countries? hmmmm; next for a person with an advanced education it seemed his English, spelling, writing, etc. were quite poor. Now we all get sloppy during instant messaging and emailing but this was worse than expected; when asked about his job specifics he was vague–the connection would be lost, he didn’t answer or his answers were kind of “off”. I have a farm with horses, chickens, cats and dogs, I know a lot about animal health and had some questions for him and his answers were not as expected. I also received vague information on the organization he worked for; he said he had his main residence in London, England…was still in the process of getting set up in Tampa Florida.

    Suddenly, he had a job in Nigeria– vaccinating an endangered species of peacock? The “reserve” was just outside of Lagos…scam city. He was charming and very attentive. Talked a good game. Claimed to be in love with me (how you can be in love with someone you never met over the internet, I’ll never know). Wanted to give me the world. Too good to be true. He even started to call. Once from England and then from Nigeria. He had somewhat of an English accent mixed with something else…the connections were always bad and he was difficult to understand. It was hard to hold a conversation. That and the time difference… we mostly stuck to email and chatting. He did make it more realistic by having a child talking and laughing in the background during one of his calls (his “son”). I wasn’t entirely convinced he was real but it he had me going to an extent. I wanted very much for him to be real. He asked me to send him something personal so he “could feel closer to me”. He wanted my iPod filled with all my favorite music or a digital camera so he could share his experiences with me (he can afford tutors but not a digital camera???. He gave me the hotel “address” to send the package too. It was a PO Box. I sent a package. It contained a little gift I had made (nothing of value) and a handwritten letter. He kept asking me what I had sent and I said it was a surprise–surprise sucker, nothing of value here.

    The Nigerian thing bothered me. I started surfing the net and read about all the scams. His project seemed to take weeks. He had every excuse. He never gave much detail. I waited for the “big emergency” to come up that would lead him to ask me for money. I hoped it wasn’t true but I knew it was going to happen.

    After nearly a month it happened. He claimed to have made medical mistake administering the vaccine to the rare birds. He said he made a dosage error. I asked him the specifics and sadly he didn’t know enough to answer my questions correctly. I know a lot about vaccines and birds. He claimed about 150 birds became ill because of his error and he was panicked because his career was at stake. He said he talked the reserve workers into staying quiet about this while he “contacted someone in China to request a medication that would make them better.” At this point, it was a huge joke but I kept up my side to see where it went. So sure enough, he kept quiet for a few days to make me worry a little, then told me he had sent almost all his cash to China for this medication–which much to our relief saved all of the fictional birds! Amazing! Now, however, he was broke. He had almost no money. He saved his career and reputation but he was in trouble. Couldn’t pay his hotel bills, food, transportation…what a mess. He at first claimed there were no banks (Lagos is a huge city–the commercial/industrial hub of Nigeria EVEN my bank has a branch there!) I pointed out that that couldn’t be true and then he broke down and “confessed” to me that he didn’t have any freed up cash in his London account…all of his money was in stocks and bonds! REALLY? I WAS SHOCKED! Even his credit card was no good…he had it canceled because of illegal activity (probably his). He said he didn’t have time to get a new one and besides he said “I’m in a third world country, no one takes credit cards here”. Wow, in a city of that size? Horrible. BTW, the hotel he gave me didn’t check out right. The address he gave didn’t match the address on the internet and it wasn’t in the right area of Nigeria. What could I do? He then asked for a “loan”. I told him at first I couldn’t pay but later decided I wanted to get as much info as I could from him so I could post it on every web site I could find. So I wrote a sweet letter saying I was so worried for him that I asked to borrow the money from a family member and wanted to get it to him as soon as possible. What did I need to do? He wrote back and ask for $1000 to be wired via Western Union (sound familar?). I claimed I was worried about that (gee no banks but we have Western Union hmmm)and would feel more comfortable sending the money directly to the hotel– what was that address and phone number? A phony address was given but not a phone number. He “couldn’t find it and would have to give it to me later.” I insisted that I needed it to properly send the package. Then he said “he was going to be too busy with lectures and meetings to keep a watch for it at the hotel and that I maybe should just send it to his driver (a man he has known only for a month?)” I argued that was unwise but then later asked for that name and address. I’m waiting for that to be emailed. He wanted to know when the money would be sent. I said in a few days. Then connection was lost again and I couldn’t finish my conversation. I’m not sure I’ll hear back from him now. I think he knew I was on to him. Anyway, here is what he has given me so far. I’ll bet he has 10 other women going on this same story as we speak!

    Damon A. Basinas
    Age: 41 birth date 08/12/67
    Son: Milo birth date 08/10/2000

    Cell Phone: 234-803-347-4079

    London Address:
    136 Gilbourne Road
    Plumstead, London SE18 7NX

    Nigerian PO Box 3537
    Apapa, Lago Nigeria

    Nigerian Hotel:
    WhiteLeaf Hotel & Suites
    14 Devon Drive
    Ikeja, Engu Lagos Nigeria
    (this isn’t the hotel address)

    Email address:
    dbasinas@yahoo.com

    Western Union site:
    Enugu Nigeria

    Other Info:
    I have pictures too of some good looking man with a cute kid. Says he was educated at Yorke (should be spelled York) University, England. Says he has three dogs and a place in Tampa Florida. Wife died in childbirth. Mother raised him on her own in Greece. Mother died of breast cancer in 1995. He moved to England for school in 1985. It just goes on.

    So everyone, be careful! Don’t EVER send money. I will post an update if he gets back to me with any more info. but I doubt I’ll hear from him. I was duped to an extent but don’t feel bad because I didn’t fall for it or lose any money. He was a great actor but just not good enough. The only thing I lost was a little time and energy. I’m know others weren’t so lucky. I’m off now to post this EVERYWHERE I can LOL.

    Good luck!

    If you are looking for real relationships online, here are some good resources on how to make it happen!

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

  • Dangers on the Internet

    Dangers on the Internet
    This is a follow up to my post Why is Internet Safety Important

    Dangers of the Internet are relative to the perspective of those accessing it. That is to say, on the Internet “dangers” are completely dependent on who is accessing what data from where and what their intentions are for accessing it. For example, researching a list of poisons could be a considered “dangers to the Internet” if a seriously disturbed person intends to kill his or her spouse. On the other hand, if a parent is just wondering what house hold products are poisonous with the intention of protecting her children, can that be considered a danger?

    So protection from dangers on the Internet should be proactive and involve human judgment at some level. Policies must be written, planned and implemented in advanced or ad hoc to suit the environment and the users accessing the Internet. Children at a school with access from the classroom will more than likely be different from employees at a skating rink.

    Even the items commonly considered dangers on the Internet relate directly to how much access individuals and organizations allow to and from the web. Common “dangers” may include (but should not be limited to) the following:

    Accessibility to personal – applies to educating users on the dangers of putting personal information on the Internet and protecting organizational data bases

    Sensitive data – For a school sensitive data is likely linked to the grades and personal information of staff and student, but for a business sensitive information could include proprietary information that would hurt the bottom line if it were leaked to competition.

    Financial fraud & criminal hackers/scammers- This applies to educating users about criminal hacker techniques such as malware, social engineering, email and website phishing

    The access of impressionable and/or psychologically disturbed individuals to potentially harmful and destructive information – This is rather subjective however it should be a concern to schools from elementary – colleges, rehabilitation facilities and mental institutions. There are ways to block certain obvious material with web-blocker type applications, but no one can stop them all. Monitoring is a must if this danger is to be handled seriously.

    The risks and damage of these dangers are dependent on the environment & the users involved. It is up to the system owners to ensure that the policies are properly planned, implemented and maintained as exposure to any Internet danger can disrupt the safety, mission and/or values of an organization or individual.

  • Why is Internet Safety Important

    Dangers on the Internet
    The amazing freedom and availability of the Internet lends itself to a few major dangers: Pr0n, malware and how to perform illegal and/or dangerous activities.

    Whether it is a curious person seeking these things out or the child accidentally clinking the wrong link and getting bombard with explicit pop-ups, the items lists can be harmful to an impressionable mind. Policies must be enforced.

    There are a few groups that should have limited exposure to certain types of information on the Internet. Children, mentally handicapped or psychologically damaged people in settings such as schools, homes, rehabilitation or correctional facilities and group homes should be blocked, tracked and monitored while accessing the Internet. Certain information could destroy them if they don’t yet have the capacity to understand or put certain information in the proper context.


    Protection from Pornography & Malware

    In a professional setting there should be a written policy against accessing and/or downloading unacceptable material such as pornography. These items should be actively blocked whether in a working environment or at home among minors accessing the same system. Allowing impressionable or fragile minds unlimited access to certain graphic material is irresponsible. The law is also a good reason why Internet safety is important. If you are the owner or charged with immediate control of the system being used for illegal activity, you could be partially or wholly liable for the activity. An example is substitute teacher Julie Amero

    On October 19, 2004, Julie Amero was substituting for a seventh-grade language class at Kelly Middle School in Norwich, Connecticut. The teacher’s computer was accessed by pupils while the regular teacher, Matthew Napp, was out of the room. When Julie took charge, the computer started showing pornographic images.

    On January 5, 2007, Amero was convicted in Norwich Superior Court on four counts of risk of injury to a minor, or impairing the morals of a child. Her sentencing was delayed four times after her conviction, with both the prosecution and judge not satisfied that all aspects of the case had been assessed.[1] The felony charges for which she was originally convicted carry a maximum prison sentence of 40 years

    – wikipedia

    The Kelly Middle School systems were actually infected with malware that allowed the explicit pictures to pop up.

    Access to Dangerous information

    From the Columbine shooters to the Virginia Tech massacre, most of the killers had a recorded history of mental illness and/or psychologically instability. In many cases, they used public and/or home computers belonging to their parents to research bomb making or even purchase guns.

    Controlling access is the best way to get on the Internet safely. Maintaining privacy of users is another important step in Internet safety, however that is a matter of educating users particularly if the frequent Social networks such as facebook or myspace. They need to be instructed about the dangers of stalkers, perverts and predators looking specifically for impressionable minds.

    We are the keepers of these impressionable and fragile minds. That is the reason Internet safety is important and why we must be mindful of these subjects.

  • Gaping hole opened in Internet’s trust-based BGP protocol

    For all the viruses, malware, and exploits that crawl around the web, fundamental flaws in the system are supposed to be few and far between, but the last two months have proven to be an exception to the rule. In July, Dan Kaminsky revealed his discovery of a DNS flaw that could be exploited to direct unwitting users to malicious web addresses, Now, practically on the heels of that announcement, a hacker team that presented at DEFCON has demonstrated how a fundamental design error in the Internet’s border gateway protocol (BGP) can be used to invisibly eavesdrop on all traffic originating from a particular set of IP blocks.

    Neither of these attack vectors are hacks in the typical sense of the word, as Wired’s own report explains. Instead of injecting malicious code into a system or systems, the DNS and BGP assaults take advantage of inherent structural weaknesses in the Internet itself. When the ARPANET was under development in the late 60s and early 70s, its designers chose to implement trust-based protocols. At the time, this made sense; ARPANET was a communications network between a relative handful of university and government institutions. The Internet of today has grown beyond the projected size of ARPANET by multiple orders of magnitude. The fact that it has scaled as well as it has is a testament to the engineers who built its foundation as well as those that came later, but the trust-based protocols that made sense in the 1970s don’t make sense today.

    read more | digg story

  • Romance Scam

    From Russian brides to Nigerian date scams, romance scams are rampant on the Internet.

    Avoid these scams by being suspicious. Don’t allow your desire to find that special someone to cloud your judgement. They will promise you the world and say whatever it takes to keep your interest.

    This is how I think of the Internet: There are billions of people on the Internet. You have a great chance of meeting someone especially for you somewhere in the world. With 7 billion human beings 3.5 billion being the gender of your choice there are likely more than a dozen perfect fits for you. Its true, but for every one of your soul mates that has put their bios on Internet, there are a thousand false profiles pretending to be that perfect someone.

    Romance scams are especially vicious because they are reach for your wallet/bank account through your heart. Once they have you hooked they are after your money.

    ONLINE DATING SCAM TACTICS:

    Step 1) Take the Bait

    You meet someone on a dating site (Adult Friend Finder, Match, okcupid, etc). This person has posted a picture of themselves and they are gorgeous!
    Their profiles says something like:

    I am a caring ,loving, honest, respectful and i believe in god and real people to hop to meet meet my real love here

    There profile seems perfect. They sounds sweet, loving and caring. Their picture (if they have one) looks incredible. They seem to live pretty close.

    What’s really going on? More than likely it is some ugly dude from a third world country who just learned to use a computer. They found a hot picture and posted it on the dating site. They are the exact opposite of what ever they said on their profile: they are uncaring, dishonest and don’t respect anyone… not even themselves.

    Step 2) The Out of Country Story

    You send them a message. They reply and tell you that they’d rather talk to you on email (usually hotmail or yahoo). They then proceed to tell you that they are currently in another country (Nigeria, Ghana, Mali, England), but they have some sort of connection to the states in your local area. They’ll say they’re relatives are there or they do business their and they’d love to meet you sometime.

    What’s really going on? They really are outside of whatever country you are (usually Nigeria, Ghana, West Africa – this is one of the top scams in that region).

    Step 3) Relationship Deception

    What they do next is get a steady relationship with you. They will send more pictures. They will want to know more about you so they can cater to your ego. They will tell you they love you, tell you how good you look, how great you are. Basically, anything get the relationship going.

    What’s really going on? They are lying to you and 20 other people on 5 or 6 different dating sites.

    Step 4) A Crisis: they Need Money

    There are various lies they may use to get money. They will ask for cash to buy the ticket to come visit you or they will tell you a tragedy has occurred and they need your help maybe even with a promise to pay you back.

    What’s really going on? They are attempting to take your money and spend it on bullshit.

    Clues to Spot Dating Scams:

    – Pictures look too professional. Magazine quality photos should be a dead give away. If they send a series of pics and each one looks like a “model posed” photo shoot, be suspicious.
    – BAD GRAMMAR & SPELLING. They are typically not very well educated and it will sometimes come through loud the clear via very choppy English and slight stupid logic. Sometimes it is as bad as a 3rd grader (a dumb 3rd grader).
    – Western Africa. Be suspicious of ANYTHING from from Ghana, Mali and especially Nigeria.
    – Too much love, too fast. They will almost immediately start talking about “I love you”, “I miss you” – don’t be flattered… they don’t love you… trust me.

    Disclaimer: Miracles do happen. Maybe you’ve just met a West African supermodel, with bad grammar, who has fallen madly in love with you in the course of two or three emails.

    Conclusion:
    I’ve dealt with these scammers on ebay, email, dating sites and in chat rooms and one thing I’ve noticed is that they are actually not very smart. They are just ruthless. They take advantage of people’s trust, kindness and generosity. They are not so much predators as they are parasites that jump from host to host. They feed on the infrastructure and wealth of Western Civilization and have nothing at all to contribute to humanity but ignorance and greed. The sad thing is that these few greedy, idiots are giving ALL West Africans a bad name on the Web and these nations (particularly Ghana & Nigeria) are among the richest nations in Africa with the greatest potential of having great success in any and all endeavors. Its a real shame.

    If you are looking for real relationships online, here are some good resources on how to make it happen!

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

    Avoid dating scams

  • Subject: For your Consideration *SCAM*

    Dear Friend ,

    I am Mr john kofi, the chairman, contract award and tender committee of Economic community of west African States (Ecowas)with sub-head office in Accra Ghana. I got your contact during my search for a reliable person to entrust huge sum of money transfer project with. My colleagues and I involved in this project have Agreed to seek your mutual partnership into this huge Money transfer project.

    We wish to transfer some money to your personal or company Account.This fund originated from over invoiced Contract bills awarded by us for the supply of pharmaceutical and Medical equipment to the ECOMOG Peacekeeping Mission In Liberia and Sierra-Leone civil wars. This over invoiced sum was deliberately hatched out and Carefully protected with all attendant lope holes Sealed off.The original executors of the contracts have been Duly paid through E.R.D.B (Ecowas Resources Bank) This over invoiced sum is suspended in an escrow account awaiting claims by any foreign person/company we may front as the owner. Based On the law and ethics of our service to Economic community of West African States, we as Civil servants are not allowed to operate a foreign Account.

    You are offered 50% of the total sum as commission,50% will be held on trust for us.However note that if per-adventured there is any expenditures that is needed for the successful execution of this transaction,we shall share the burden. The project is expected to be completed within 7 days if you accord us maximum co-operation. We solicit for your unreserved confidentiality in this project. There is no risk involved.Call me upon the receipt of this mail for more details on the procedure if the need arises or you respond via email if you accept if you accept this proposal.Further information will be sent to you as soon I hear from you.

    Thanks,Sincerely yours,
    Mr john kofi.

  • Church Data Security

    Whether government, corporate or faith-based file security is important.

    No matter the denomination, church file security is especially important because it may not only deal with money, and privacy but the sanctity of the church community. The member, guest and family information must be protected just as much as the preacher, reverend, deacons, bishops, nuns, and/or administrators.

    Coordination of church file security:
    It is important to first identify what are the churches sensitive data. You may have in your mind what is or isn’t important files to protect for the church, but you may not have the authority or prerogative to make such an important determination. Even if you do, it important to get ideas from the staff and or clergy of what files should be protected and what level of protection should be considered. And interview or meeting with information owners is the first step.

    Access to the church files:
    Anyone with access to the church files should sign a user license agreement. This is a standard for security no matter what organization you enter. This is to make sure that those who are trusted with access understand what they can and can not do when entering the system. Items in a basic user license agreement include: what can be copied and/or installed on the system, what can and can not be done while accessing church files, whether or not church files are monitored for heightened security. User License agreements are usually done when multiple people have access to a medium to large network with critical resource (i.e. privacy data, financial information, sensitive data). They are also done for software, website/forum and data base access.

    You can find examples of a user license agreement on the Internet.

    What Church Files to Protect:
    Files in a church community may include mission, member, drive, donation and service information that need to be protected. Any files dealing with any money should be protected always. Personal files of church members should be protected as well as data bases with potentially sensitive information. Even if the church has NO sensitive information, the files that allow any access from the Internet (such as webpages or ftp files and folders) should protected with various levels of security including: Username password (don’t EVER use anonymous for FTP), mandatory user registrations, and file permission lock down.

    The reason this is important even for churches with no sensitive information, is that some malicious hackers like to use other organizations resources to upload viruses, spam, scams and pornography.

    Regulations to consider:
    The Privacy Act of 1974 make it mandatory to protect the personal information of all individuals

    No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, MORE

    Health Insurance Portability and Accountability Act (HIPAA) is another important law to consider when addressing church file security. Among other things, HIPAA deals with the protection of peoples medical and health history.

    File Permission:
    Files that are sensitive for a church should have some permissions assigned to them to allow only authorized users (system administrators, missionaries, clergy, secretaries) access. This is one part of the access control. Most operating systems have this capability. Don’t forget that not only computers need to be protected, routers, switches and databases also need adequate security.

  • Certification & Accreditation Change

    Standard-issue security
    Certification and accreditation process for national security systems to extend to the rest of government. A two-year-old effort to standardize processes for certifying and accrediting government IT systems could soon bear fruit, according to officials from several agencies.

    The Committee on National Security Systems is preparing instructions for implementing a unified certification and accreditation (C&A) process that could be used on all national security systems, including those in the Defense Department and intelligence community, said Tony Cornish, chairman of the CNSS’ C&A working group.

    At the same time, the National Institute of Standards and Technology plans to update its C&A guidance for systems covered by the Federal Information Security Management Act, said Ron Ross, a senior computer scientist and FISMA implementation lead at NIST.

    “We are very close to producing a unified C&A process for the entire federal government,” Ross said in July at a government security symposium hosted by Symantec. “Within the next six to eight months, you are going to see a plethora of new things coming out” from CNSS and NIST.

    CNSS’ instructions will be incorporated into NIST guidelines in its 800 series of special publications. Ross said a major update of SP 800-53 Rev. 2, “Recommended Security Controls for Federal Information Systems,” is expected in December, and a draft of the first revision of SP 800-37, “Guide for the Security Certification and Accreditation of Federal Information Systems,” is expected to be released for comment soon.

    A single, governmentwide approach would make it easier for agencies to share data and cooperate with one another and with states, foreign allies and the private sector.

    It could enable reciprocity, or the acceptance of other agencies’ C&A processes, without requiring recertification, and also could streamline acquisition processes by making it easier for vendors and developers to meet one set of standards.

    C&A is a process for ensuring that IT systems are operating with an appropriate level of security. In the certification phase, the security of the system is documented; for accreditation, a designated authority signs off on the system’s fitness to go into operation. The concept has been around for some time, but there has been little standardization.

    “In the past, we each had our own set of policies, and we didn’t look at each other’s,” said Sherrill Nicely, deputy associate director of national intelligence at the Office of the Director of National Intelligence.

    FISMA requires C&A of information technology systems, but that does not apply to national security systems. And within the national security community, the military and intelligence sectors each have had their own way of doing things.

    “Since about 1993, the Defense Department had its program, the Defense IT Security Certification and Accreditation Process,” said Eustace King, DOD chief of acquisition and technology oversight. “It worked pretty well” in a time before DOD’s emphasis on network- centric systems and information sharing, but it lacked enterprise visibility.

    That C&A program was replaced with the Defense Information Assurance Certification and Accreditation Process. DOD was moving to the program in 2006 to harmonize military and intelligence processes when, a year later, it was expanded to include the rest of the national security community by bringing in the CNSS.

    Through NIST, C&A procedures eventually will be standardized across all of government. However, policies do not change mind-sets, and old habits still remain one of the primary challenges to a standardized process. At DOD, there is a reluctance to accept reciprocity — that is, to give full credit to another agency’s C&A process without recertification, King said.

    The intelligence community faces a similar hurdle, said Sharon Ehlers, an assistant deputy associate director of national intelligence.

    “The cultural change has been the biggest challenge,” Ehlers said. “When it is not invented here, people don’t want to look at it.”

  • Lasers Could Send World’s Most Secure Messages Through Space

    New experiments using Heisenberg’s uncertainty principle extend the range of quantum cryptography, an advanced method of communicating in unbreakable code. Finding a way to keep snoops from tapping into other people’s information is a challenge that has gone to the subatomic level. First proposed in 1984, quantum cryptography (QC) promises to send

    read more | digg story

  • Church File Security

    Whether government, corporate or faith-based file security is important.

    No matter the denomination, church file security is especially important because it may not only deal with money, and privacy but the sanctity of the church community. The member, guest and family information must be protected just as much as the preacher, reverend, deacons, bishops, nuns, and/or administrators.

    Coordination of church file security:
    It is important to first identify what are the churches sensitive data. You may have in your mind what is or isn’t important files to protect for the church, but you may not have the authority or prerogative to make such an important determination. Even if you do, it important to get ideas from the staff and or clergy of what files should be protected and what level of protection should be considered. And interview or meeting with information owners is the first step.

    Access to the church files:
    Anyone with access to the church files should sign a user license agreement. This is a standard for security no matter what organization you enter. This is to make sure that those who are trusted with access understand what they can and can not do when entering the system. Items in a basic user license agreement include: what can be copied and/or installed on the system, what can and can not be done while accessing church files, whether or not church files are monitored for heightened security. User License agreements are usually done when multiple people have access to a medium to large network with critical resource (i.e. privacy data, financial information, sensitive data). They are also done for software, website/forum and data base access.

    You can find examples of a user license agreement on the Internet.

    What Church Files to Protect:
    Files in a church community may include mission, member, drive, donation and service information that need to be protected. Any files dealing with any money should be protected always. Personal files of church members should be protected as well as data bases with potentially sensitive information. Even if the church has NO sensitive information, the files that allow any access from the Internet (such as webpages or ftp files and folders) should protected with various levels of security including: Username password (don’t EVER use anonymous for FTP), mandatory user registrations, and file permission lock down.

    The reason this is important even for churches with no sensitive information, is that some malicious hackers like to use other organizations resources to upload viruses, spam, scams and pornography.

    Regulations to consider:
    The Privacy Act of 1974 make it mandatory to protect the personal information of all individuals

    No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, MORE

    Health Insurance Portability and Accountability Act (HIPAA) is another important law to consider when addressing church file security. Among other things, HIPAA deals with the protection of peoples medical and health history.

    File Permission:
    Files that are sensitive for a church should have some permissions assigned to them to allow only authorized users (system administrators, missionaries, clergy, secretaries) access. This is one part of the access control. Most operating systems have this capability. Don’t forget that not only computers need to be protected, routers, switches and databases also need adequate security.