Play it safe: keep your data from prying eyes.

You've seen the identity theft ads on television that feature people boasting about what they've bought using someone else's credit card and identification. There's the attractive woman who sounds like a computer geek itching to buy a 45-inch plasma TV, and the disheveled man who sounds like a teenager and talks of buying clothes. Funny ads, yes. But they point to the serious issue of keeping personal information private and secure.

In the past, this sort of credit card fraud occurred when individuals improperly handled credit card slips and other personal information. Fortunately, most firms now make a habit of shredding documents they no longer need.

And simply throwing documents, unshredded, into a dumpster isn't a safe security measure because the practice of "dumpster diving" has been used in business parks for years to obtain personal and confidential information.

SB 1386

California lawmakers stepped into the identity theft prevention arena after a hacker broke into a state computer server that housed payroll and other employee records and personal information.

For approximately 45 days, state employees were not informed that their information was at risk.

As a result, then-California Sen. Steve Peace introduced SB 1386 to remedy the notification issue, and the resulting law took effect July 1, 2003.

The law states that if two parts of information about a California resident that could be used for identity theft are reasonably believed to have been acquired by an unauthorized person, you must notify the affected party unless you have been instructed not to do so by authorities during an active investigation.

Protected sensitive data includes a person's name and one or more of the following: Social Security number; driver's license number; California ID number; credit card number; or debit card number in combination with the password code.

Think of the information residing in the computers at your office--or on laptop computers. Do you have files with names of clients, Social Security numbers, driver's license numbers or other information that could be used to steal their identity? Of course.

[ILLUSTRATION OMITTED]

Do you send information to vendors or banks via e-mail? Probably.

All such practices present opportunities for hackers to steal information--and if this happens, you must notify your clients, which can cost you money in terms of time and effort to make these notifications. But by taking the right steps, you can keep the information safe.

ENCRYPTION

Similar to your policies regarding document shredding, you should inform and educate your employees on the handling of the data: Where is it being stored? Where and to whom has it been sent? Beyond that, you must encrypt the information.

Laptops, which are the easiest devices to steal, are the easiest to bring into compliance. Using software such as a PGP drive (www.pgp.com), you can mount an encrypted drive space and store client data inside the mounted hard drive--all without a major financial investment. Some of this software can run as low as $50. A small price to pay for peace of mind.

Also ensure that no one sends out information that contains identify theft information via e-mail unless it is encrypted. Either set up digital certificates in your e-mail system (see your e-mail program for details) or consider a third-party program, such as Hypersend.com, to send e-mails to clients or banks using encryption.

But the situation gets a little trickier if you store your information on a file server. None of the tax preparation software vendors I have contacted have been willing to state that they support using either PGP encryption or the built-in Windows 2000 or 2003 Encrypted file system.

While some of the tax preparation programs do allow the use of user names and passwords, the fact that the data is not encrypted makes it vulnerable. Think of the years of tax preparation data on your servers and the affected clients.

How can we minimize this risk until vendors include encryption as part of their software? We need to ensure that other security measures are in place and are being monitored.

SOFTWARE PATCHES

A rigorous schedule of computer protection should be followed to ensure--and document--that you are performing due diligence in protecting that data. Ensure that you are on operating systems that you patch for software updates and consider either configuring an auto-update feature or invest in patch management software, such as Shavlik's Hfnetchk or St. Bernard's UpdateExpert.

If you are running Windows 98 or Windows ME, security patches for these operating systems are not disclosed and you must make a free phone call to Microsoft to obtain them. To obtain this patch, call [phone], choose option 3 and ask for hotfix for Windows 98 and Windows ME for KB 828028E.

OTHER STEPS

Next, ensure that your network and any standalone computers and laptops have firewalls to block those ports and allow you to open only those ports necessary for your business work. Any computer, file servers, standalone computers, laptops--even the computers that your employees use at home--should have a firewall. If a computer can get out to the Internet, even on a slow dial-up connection, it needs firewall software to provide the barrier you need--at a minimum--to ensure that your data is safe.

Install antivirus software on all computers and make sure that the auto update is configured to regularly bring down virus "dat" files. While many computers come with antivirus, it typically expires after 90 days.

Do not allow any peer-to-peer music file swapping software inside your network. Ensure that laptops do not have "file and printer sharing" enabled under network connections. To see if this is enabled, click on Start, Control Panel and then on Network Connections. Select the network or modem device and ensure that file and printer sharing is not checked.

You may want to visit Microsoft's Security Protect site at www.microsoft.com/security/protect and follow the steps listed or order the security CD-ROM to assist you in patching and protecting your system.

CONSULTANTS

If your needs are greater than you can handle, consider hiring a consultant to perform a security audit of your organization. This comes with a greater financial cost, but it's a small price to pay if you consider what will happen if your client information is compromised.

Computers allow us to perform many tasks easier and more accurately. But they need regular maintenance and care to be operated in a safe and secure manner. Make sure you get this maintenance to keep your--and your clients'--identities secure.

{FOR MORE INFORMATION}

Details about securing your computers and notifying clients of possible data theft can be found at www.privacy.ca.gov/business/bph1.28.04.pdf and www.privacy.ca.gov/recommendations/secbreach.pdf.

If you believe an intrusion has occurred, there are various high-tech crime units throughout the state you can contact, depending on your location:

San Diego--Computer and Technology Crime High Tech Response Team (www.catchteam.org)

Northern California (Napa)--Northern California Computer Crimes Task Force (www.nc3tt.org)

San Jose--San Jose High Technology Crime Detail (www.sjpd.org/hitech.html)

Sacramento--Sacramento Valley Hi-Tech Crimes Task Force (www.sachitechcops.org)

Los Angeles--High Technology Crimes Unit of Los Angeles County (http://da.co.la.ca.us/cpd/idtheft.htm)

by Susan Bradley, CPA 

Susan Bradley, CPA, CITP, MCP, GSEC is a partner with Tamiyasu, Smith, Horn & Braun in Fresno. You can reach her at [e-mail].