From: James Dorrian On Behalf Of Information Security

Sent: Wednesday, August 22, 2007 9:01 AM

To: FNFS_ALL
Subject: Information Security Reminder: Sharing Credentials, Removable Media, Paper
Documents

Good afternoon,

There are a couple of security topics that need to be addressed this month:
Sharing of Login Credentials
Recently it was discovered that several employees were sharing login credentials (username and
password) for an external system. Username and password information should NEVER be shared
between users. If one of the people logging in under that account chooses to do something malicious,
the blame could fall to the wrong individual. If another person gains access somehow then the difficulty in
finding the correct offender becomes more difficult. Treat your username and password as your driver’s
license; you wouldn’t loan it to a coworker.

Removable Media (USB thumb drives, CDs, etc)

To every extent possible, removable media should not be used. If using removable media is the
only option, it should have the ability to be encrypted. No customer sensitive data should ever
be stored on removable media. As noted by the recent incident listed below, the loss of a
single USB storage device can result in the compromise of thousands of people’s sensitive
information.

August 7, Merrill Lynch A storage device apparently was stolen containing

2007 (Hopewell, NJ) sensitive personal information, including Social
Security numbers, about some 33,000 employees.

Hard Copy (Paper) Documents

Reports of customer sensitive information including loan numbers, debtor’s information, or other
personally identifiable information (PII) should never leave our facilities. Even within our
facilities hard copy documents should be protected appropriately by storing them in a locked
drawer or file cabinet. When the document is no longer needed, it must be placed in a shred bin
for proper disposal.

July 19, 2007 Cricket Documents stolen from store result in loss of 300
Communication credit card numbers.
s
August 1, Lifetime Fitness Staff had discarded customer records in easily
2007 (Dallas, TX) accessible trash cans behind the businesses.
Information that was discarded contained names,
addressed, Social Security numbers and credit card
information, as well as the date of birth of several
children.
As always, please let me know if you have any questions or concerns.

V/r,
James M. Dorrian
Assistant Vice President – Security and Compliance
FIS LPS Technology Solutions
(904) 470-7899 (W)
(904) 524-6027 (C)