Fort Walton Beach Council agenda — 10-28-08 regular agenda — reading text

The person responsible for this plan is: Kim M. Barnes Customer Service Administrator 850- 833- 9624 The Governing Body Members of the City are: 1. Mavor Mike Anderson 5. Councilman Bill Garvie 2. Councilman Mike Holmes 6. Councilman Wayne Pullen 3. Councilman Virail Miller 7. Councilman Jim Hartwell 4. Councilman Dennis Reeves 8. Councilman Mike Minich City of Fort Walton Beach - Identity Theft Prevention Program Page 1 of 5 Risk Assessment The City of Fort Walton Beach has conducted an internal risk assessment to evaluate how at risk the current procedures are at allowing customers to create a fraudulent account and evaluate if current ( existing) accounts are being manipulated. This risk assessment evaluated how new accounts were opened and the methods used to access the account information. Using this information the City was able to identify red flags that were appropriate to prevent identity theft: Q New accounts opened In Person Q, New accounts opened via Telephone Q New accounts opened via Fax Q Account information accessed In Person Q Account information accessed via Telephone ( Person) o Account information is accessed via Web Site Detection ( Red Flags): The City of Fort Walton Beach adopts the following red flags to detect potential fraud. These are not intended to be all- inclusive and other suspicious activity may be investigated as necessary: Q Identification documents appear to be altered 1:1 Photo and physical description ' do not match appearance of applicant J Other information is inconsistent with information provided by applicant o Other information provided by applicant is inconsistent with information on file o Application appears altered or destroyed and reassembled IJ Personal information provided by applicant does not ' match other sources of information o Lack of correlation between the social security number range and date of birth o Information provided is associated with known fraudulent activity e. g. address or phone number provided is the same as that of a fraudulent application) , o Information commonly associated with fraudulent activity is provided by applicant ( e. g., address that is a mail drop or prison, non- working phone number or phone number associated with answering service/ pager). o Drivers License number, address, or telephone number is the same as that of another customer J Customer fails to provide an of the information requested City of Fort Walton Beach - Identity Theft Prevention Program Page 2 of 5  o Personal information provided is inconsistent with information on file for a customer o Applicant cannot provide information requested beyond what could commonly be found in a purse or wallet Q Identity theft is reported or discovered Response Any employee that may suspect fraud or detect a red flag will implement the following shall be reported to the response as applicable. All detections or suspicious red flags Customer Service Administrator. ' o Ask applicant for additional documentation Q Any employee who becomes aware of actual or fraudulent use of a customer or potential customer' s identity must notify the Customer Service Administrator o Notify law enforcement: The Customer Service Administrator will notify the City of Fort Walton Beach Police Department at 850- 833- 9537 of any attempted or actual identity theft a Do not open the account Q Close the accou nt o Do not attempt to collect against the account but notify authorities Personal Information Security Procedures: The City of Fort Walton Beach adopts the following security procedures. will 1. Paper documents, files, and electronic media containi~ g secure information be stored in file cabinets. the 2. Only specially identified employees with a legitimate need will have access to cabinets. 3. Files containing personally identifiable information are kept in file cabinets except when an employee is working on the file. 4. Employees lock their computers when leaving their work areas. 5. Access to offsite storage facilities is limited to employees with a legitimate business need. City of Fort Walton Beach - Identity Theft Prevention Program Page 3 of5 6. Visitors who must enter areas where sensitive files are kept must be escorted by an employee of the City. . 7. No visitor will be given any entry codes or allowed unescorted access to the office. 8. Access to sensitive information will be controlled using " strong" passwords. User names and passwords will be different. 9. Passwords will not be shared or posted near workstations. 10. Password- activated screen savers will be used to lock employee computers after a period of inactivity. When 11.. installing new- software, immediately change vendor-supplied default passwords to a more secure strong password. 12. Anti- virus and anti- spyware programs will be run on individual computers and on servers daily. 13. Computer passwords will be required. 14. The use of laptops is restricted to those employees who need them to perform their jobs. 15. Laptop users will not store sensitive information on their laptops. 16. Employees never leave a laptop visible in a car, at a hotel luggage stand, or packed in checked luggage. 17 .If a laptop must be left in a vehicle, it is locked in a trunk. 18. The computer network will have a firewall where the network connects to the Intemet. 19. Monitor incoming traffic for signs of a data breach. 20. Monitor outgoing traffic for signs of a data breach. 21. Check references or do background checks before hiring employees who will have access to sensitive data. 22. New employees sign an agreement to follow the city's confidentiality and security standards for handling sensitive data. ' 23. Access to customer's personal identify information is limited to employees with a need to know." City of Fort Watton Beach - Identity Theft Prevention Program Page 4 of 5