TAX-AIDE Security Phishing 2015 SMT/TCS Training - Dallas1

TAX-AIDE Security in Tax-Aide ● Unintentional disclosure of private information continues to rise ● The security of taxpayer accounts and personal information is a top priority for the AARP Foundation Tax-Aide program. ● It is the Program’s responsibility as an Authorized IRS e-file Provider to have security systems in place to prevent unauthorized access to taxpayer accounts and personal information by third parties 2015 SMT/TCS Training - Dallas2

TAX-AIDE Security in Tax-Aide ● For victims of identity theft, consequences can last for years; causing financial problems, credit issues, benefit losses, and legal problems. ● Cost to the AARP Foundation Tax- Aide program reputation and the good work that you all do SMT/TCS Training - Dallas3

TAX-AIDE Security in Tax-Aide ● When data is lost or stolen in the program taxpayers are given free credit monitoring for a year at AARP Foundation Tax-Aide expense 2015 SMT/TCS Training - Dallas4

TAX-AIDE Anti-virus and Firewall Software ● AARP Foundation Tax-Aide recommended anti-virus and firewall software program must be used to protect all AARP purchased and donated computers ● If a personally owned computer is being used, the program recommended anti- virus software or other anti-virus and firewall software must be installed 2015 SMT/TCS Training - Dallas5

TAX-AIDE Security – What You Can Do ● Make sure all computers are running the following Windows operating systems: 7 and 8; this includes personal and site computers ● If a personal or site computer cannot be upgraded to a newer operating system or the site or individual has determined that they will not be upgrading the computer, contact the National Office 2015 SMT/TCS Training - Dallas6

TAX-AIDE Security – What You Can Do ● During the season, the operating systems of all computers containing taxpayer data must be password-protected. All TaxWise accounts must also be password- protected. Passwords must not be shared with anyone who is not an AARP Foundation Tax-Aide volunteer. If you must have a written password reminder, keep it away from the computer, carrying case, or anything tax related and in a location that is not visible to others (consider putting it in your wallet or billfold, which is usually with you and something you take care to protect) SMT/TCS Training - Dallas7

TAX-AIDE Data Security Password ● Password guidelines: ● Minimum length – eight (8) characters for Windows, and TaxWise™ accounts. ● At least one letter and one number in the password. ● Choose a password that is not a dictionary word or someone’s name. ● Do not use TaxWise, TW, Tax-Aide, AARP or any word in the password similar to something that is obviously related to the program SMT/TCS Training - Dallas8

TAX-AIDE Data Security Documents ● It is the policy of the AARP Foundation Tax-Aide that Sites or EROs do not keep any forms or documents with taxpayer identity and/or SSN number on the document, unless it is mandated by the IRS or a state/local taxation or revenue agency. This includes W-2s, 1099s, and Form ● Form 8453 if used for mailing supporting documents to the IRS is an example of a form that can be retained. The NTC recommends scanning the document and deleting after receipt of the Acknowledgment. ** Refer to the scanning document “Tax Return Attachments” on OneSupport for instructions on using scanning in the Tax- Aide Program SMT/TCS Training - Dallas9

TAX-AIDE Security Policy Info ● Read the Confidentiality and Security of Taxpayer Data Section 8 in the Policy Manual It is divided into four sections  Data Security  Taxpayer Data Retention (TWD only)  Physical Security  Reporting a loss 2015 SMT/TCS Training - Dallas10

TAX-AIDE Security Training ● Make sure you train and inform other TCs and EROs in your area on: The importance of security Where they can obtain information 2015 SMT/TCS Training - Dallas11

TAX-AIDE Phishing Focus ● The use of fake s to obtain personal confidential information ● Historically aimed at getting access to individual financial accounts ● Historically easy to recognize ● Typical example next SMT/TCS Training - Dallas12

TAX-AIDE 2015 SMT/TCS Training - Dallas13 1,2 – Correct Header and Address 3 – Correct links 4 – Bad Grammar and Spelling 5 – Fake account login Easy to recognize because of “Out of Context” , broad distribution, incorrect To: or cc:, bad spelling and grammar

TAX-AIDE Phishing – more recently ● Now used to get private network access to obtain bulk rather than individual data. ● The initiator for every recent major data breach, examples Office of Personnel Management Home Depot, Target, Maybe Anthem Typically administrator access credentials are stolen so encryption, anti-malware software etc are ineffective at data loss prevention SMT/TCS Training - Dallas14

TAX-AIDE Phishing and Tax-Aide ● Every management position in Tax-Aide has CCH TaxWise authentication credentials with access to 100s or 1000s of valid tax returns. ● Tax returns are the best single source of information for fraudulent monetary gain ● Every management position in Tax-Aide must be wary of phishing s!! 2015 SMT/TCS Training - Dallas15

TAX-AIDE Learnings - 1 ● Good phishing s are very hard to detect Context of the is the only real clue If there is any doubt check the header for any inconsistencies Any further doubt query the apparent sender in a separate (DO NOT USE REPLY!!) 2015 SMT/TCS Training - Dallas16

TAX-AIDE Learnings -2 ● Good phishing Websites are very hard to detect Look for any differences in the web address Look for http vs https If https, click on green lock icon to look at certificate chain If in doubt do NOT click the link, type the known web address into the browser 2015 SMT/TCS Training - Dallas17

TAX-AIDE General Admonitions ● All general Tax-Aide staff to volunteer communications come out in “SMT Roundup” not from individuals ● Wherever possible use 2 factor authentication, then if your name and password is stolen your account still cannot be accessed ● everywhere-you-should-enable-two-factor- authentication-right-now everywhere-you-should-enable-two-factor- authentication-right-now ● ?hl=en ?hl=en 2015 SMT/TCS Training - Dallas18

TAX-AIDE Phishing Info Links ● for-spotting-a-phishing- / for-spotting-a-phishing- / ● privacy/phishing-symptoms.aspx privacy/phishing-symptoms.aspx ● SMT/TCS Training - Dallas19

TAX-AIDE 2015 Recommended Updates And Off Season Storage

TAX-AIDE What Needs to be Updated? ● Microsoft Windows operating system ● Anti-virus and anti-malware software ● Printer drivers ● Adobe Flash and Adobe Reader 2015 SMT/TCS Training - Dallas21

TAX-AIDE Windows Updates 2015 SMT/TCS Training - Dallas22 Microsoft provides updates for Windows OS software and Windows-based hardware, usually on second Tuesday each month (“Patch Tuesday”) Resolves known issues and protects against known security threats Updates required software such as:  Microsoft.net framework (latest version)  Printer drivers  Wireless network card drivers Updates should be installed to a computer before adding the computer to any network

TAX-AIDE Windows Updates Tips 2015 SMT/TCS Training - Dallas23 Tax-Aide images include Windows updates through the date of the image; additional updating will be necessary Computers not used for many months will require lots of time to update – re-image to save time Automatic Windows updates should be enabled for all Important updates – these will download in background and be installed when computer is shut down Run Windows Update manually if desired to download and install Optional updates

TAX-AIDE Microsoft Security Essentials (MSE) MSE is a free* download from Microsoft ● Simple to install, Easy to use, Recommended for all Win 7 computers used in Tax-Aide ● Pre-loaded on the Tax-Aide Windows 7 images ● Frequently updated to ensure that your PC is protected by the latest technology…download the latest version for personal or loaned computers essentials/ essentials/ ● See Detailed Video at *Your PC must have a genuine Windows license activated to install Microsoft Security Essentials 2015 SMT/TCS Training - Dallas24

TAX-AIDE Windows Defender For Windows 8, 8.1 ● Replaces Microsoft Security Essentials on Win 8 systems ● Pre-loaded on the Tax-Aide Windows 8 images ● Operation is very similar to MSE 2015 SMT/TCS Training - Dallas25

TAX-AIDE Printer Drivers ● A brand new printer has drivers on a CD that are already over 1 year old ● Check for printer driver updates and download latest version (to flash drive) from manufacturer website prior to every Tax season see Printer Driver Downloads link in Favorites of Tax- Aide Image OR Print Drivers for Tax Aide Guide in One Support>Technology>Networking) ● HP LaserJet 1022 had issues with Windows 7 in latest version resolved issue 2015 SMT/TCS Training - Dallas26

TAX-AIDE Adobe Reader Updates ● Adobe Reader is required by TWO and is included with Tax-Aide images ● Updates are usually issued on Patch Tuesday Some out-of-cycle updates when severe vulnerabilities are discovered ● Best to allow Adobe Reader to automatically install updates Updates occur in background, unobtrusive If not initially configured, change settings in Adobe Updater 2015 SMT/TCS Training - Dallas27

TAX-AIDE Adobe Flash Updates ● Adobe Flash is not installed as part of Tax-Aide Windows images and TWO does not require Flash ● BUT: personally-owned computers usually have Flash installed for other reasons, so users must update to avoid security issues 2015 SMT/TCS Training - Dallas28

TAX-AIDE Adobe Flash Updates – How To ● Internet Explorer: Flash updates must be performed manually (except for Win 8 machines). Go to this page to check Flash version and access updates: ● Google Chrome: Flash is automatically updated when Chrome updates are distributed, but users can also use site above to check version and manually install updates if desired 2015 SMT/TCS Training - Dallas29

TAX-AIDE Computer Security Info Krebs on Security Blog ● ● An excellent source of information on software vulnerabilities and available updates 2015 SMT/TCS Training - Dallas30

TAX-AIDE Off-season Equipment Storage ● Districts are responsible for the adequate storage of their equipment. Some options: Distributed Storage - individual volunteers Centralized Volunteer Storage - by Site or District 2015 SMT/TCS Training - Dallas31

TAX-AIDE Off-season Equipment Storage Tips ● Remove toner cartridges from printers before storing Wrap tightly in black plastic, e.g., a garbage bag ● Temperature and humidity guidelines: See One Support document: Technology>Equipment>Equipment Purchasing, Repair, and Storage ● Avoid floodable floors, freezing/hot attics, bare cement, etc. ● Allow equipment to reach close to room temperature before powering on 2015 SMT/TCS Training - Dallas32

TAX-AIDE IMAGING Art Rudeseal, CO1 D18 TC NTC Imaging Team 2015 SMT/TCS Training - Dallas33

TAX-AIDE AARP Tax-Aide System Images ● Keeping systems up to date problematic ● Volunteer’s time is the issue Windows and anti-malware update AARP recommended software updates Hardware Driver updates ● Correcting corrupted systems Many “dead” systems only need re-imaging. Any systems with any unusual behavior should be re- imaged immediately SMT/TCS Training - Dallas34

TAX-AIDE Solution is System Imaging ● A customized Windows Operating System installation ● Customizations for the hardware and software specific to the AARP Tax-Aide program ● Can be sent out as a DVD or downloaded and either burned to a DVD or copied to a USB flash drive ● Demo Video at Imaging Demo VideoImaging Demo Video ( SMT/TCS Training - Dallas35

TAX-AIDE Available Images ● Windows 7 Pro SP1 32-bit image ● Windows 8.1 Pro 64-bit image with Windows 8.1 Update ● Images include: Windows update downloads to date of image AARP Tax-Aide required software and settings Links to printer driver software ● Windows XP must not be used for any purpose in the Tax-Aide program SMT/TCS Training - Dallas36

TAX-AIDE Image Installation ● System to be imaged must be connected to the Internet via a wired connection ● DVD or USB Flash Drive installation ● Windows 8 DVD install requires Dual- Layer DVD ● Generally flash drive installation is recommended ● Always store Product Key in database Resolve personnel turnover issue 2015 SMT/TCS Training - Dallas37

TAX-AIDE Image Contents ● Windows Setup includes many drivers – usually enough to allow Internet access ● Windows Update will download other drivers as needed and do any updates ● Auto-install Windows product key ● Applications used by Volunteers pre installed: TIA, Adobe Reader, CutePDF Writer, 7-Zip ● Settings are set for secure volunteer usage SMT/TCS Training - Dallas38

TAX-AIDE Windows Users ● Users: Administrator Installer Volunteer ● All configured as members of the Administrators group ● Consider demoting the Volunteer user from admin to standard user 2015 SMT/TCS Training - Dallas39

TAX-AIDE Windows Passwords ● Must be changed annually, per AARP Tax- Aide policy ● The IRS Volunteer password for the current year is used for the Installer and Volunteer users ● Administrator password: Is not disclosed Can be changed locally from any user that is a member of the Administrators group 2015 SMT/TCS Training - Dallas40

TAX-AIDE Windows 7 image ● Can be used to upgrade eligible systems to Windows 7 professional. For example Windows 7 Home Premium and Windows XP ● Office viewers removed from Windows 7 image to allow continued use of a standard single- layer DVD. Recommend use of LibreOffice if Office viewers are needed Another alternative is to use the Office applications built in to Microsoft’s OneDrive, or the Google apps built into Drive 2015 SMT/TCS Training - Dallas41

TAX-AIDE Windows 8 Image ● Windows 7 is the OS of choice for Tax-Aide. AARP systems ship with Windows 7 ● Tax-Aide Windows 8 image removes “Modern” tiled interface, replaces it with Windows 7 style desktop interface. For volunteer users, indistinguishable from Windows 7 ● No Office viewer applications. Use Microsoft OneDrive online office applications, or Win 8 Word viewer application 2015 SMT/TCS Training - Dallas42

TAX-AIDE Win 8 Image Requirements ● Windows 8 (64 bit only) ● Unified Extensible Firmware Interface (UEFI) capable computer All Windows 8 capable computers Many modern Windows 7 systems can support UEFI with a bios selection. ● This image is not intended for use with older systems – use Windows 7 for these systems SMT/TCS Training - Dallas43

TAX-AIDE Windows 8 Licensing ● “Core” is approximate equivalent of Windows 7 home premium Machine label = Windows 8 ● “Professional” = Windows 7 pro Machine label = Windows 8 pro ● Tax-Aide image is Professional only ● OEM Windows 8 Pro systems have the Pro license key built into the BIOS. This key will be used by the image. ● To upgrade Win 8 Core to Win 8.1 Pro apply to Taxaidetech for access to national Windows 8 Pro license key. If you have previously ordered Win 7 Techsoup licenses you may automatically have Win 8 licenses in the Microsoft VLK account SMT/TCS Training - Dallas44

TAX-AIDE Win 8 Local Donated Systems ● Entry point of Windows 8 systems into the program. ● The “Modern” interface causes issues for many volunteers. ● Win 8.1 Update is configurable to traditional “desktop” look – beyond many volunteer’s skills ● Alternatives: Win 7 – Apply to TaxaideTech to use the National License Key to downgrade to Windows 7. Win 8 – Use this Windows 8 image with the system’s built in Pro key or apply to TaxaideTech to use the Windows 8 Pro National License Key. ● To apply to TaxaideTech, open a One Support request with Form = Technology: Software and Subtopic = How to Obtain Image 2015 SMT/TCS Training - Dallas45

TAX-AIDE Which OS? ● The primary or default OS for Tax-Aide usage is Windows 7 ● Windows 8 is being supported to allow upgrade of locally donated Windows 8 computers to a standardized Windows 8 system image SMT/TCS Training - Dallas46 If in doubt use Windows 7

TAX-AIDE Product Key Management ● Windows 7 or Windows 8 National License Key ● OEM COA if Windows 7 Pro was previously installed ● Key in Bios if Windows 8 Pro previously installed ● Techsoup Microsoft Windows 7 or 8.1 Volume License Key (VLK) – always Pro edition ● Key is stored in a national database that is contacted by imaging software ● Keys stored in database by Entry during imaging, if network available Entry in annual inventory spreadsheet Entry by TaxaideTech as an inventory update 2015 SMT/TCS Training - Dallas47

TAX-AIDE Drivers ● After Image installation and Windows Update processing systems are ready to do taxes. ● No more drivers need to be added. ● In some cases drivers for some system hardware will not be present. ● Adding these drivers does no harm but is additional unnecessary work SMT/TCS Training - Dallas48

TAX-AIDE Printer Drivers ● Links to commonly used Printer Drivers are included in the Windows 7 image. ● Links to the 64 bit drivers for the Windows 8 image are an in-process investigation SMT/TCS Training - Dallas49

TAX-AIDE Where do I find the images? ● Images and usage instructions are available at AARP Tax-Aide NTC Resource Website ( ) SMT/TCS Training - Dallas50

TAX-AIDE 2015 SMT/TCS Training - Dallas51

TAX-AIDE Availability ● Windows 7 & 8 Images for TY2015 are planned to be released mid-August ● They will be updated in November so that they are up to date when most systems are pulled from storage SMT/TCS Training - Dallas52

TAX-AIDE Issues - DVD ● Image DVD Fails to boot correctly(should be <1min to first user interaction) or Fails with an error during image installation ● Always due to data corruption Check ISO download validity, see website Use CDCheck to validate DVD DVD readers on older computers also have issues with modern DVDs 2015 SMT/TCS Training - Dallas53

TAX-AIDE Issues – Flash Drive ● Flash drives must be formatted with the correct file system: NTFS for Windows 7, FAT32 for Windows 8. ● Some brands and models of USB flash drives do not work for this application. ● Some flash drives work in USB 2.0 mode but not in USB 3.0 mode Some computers have some USB 2 ports and some USB 3 ports. Try a USB 2 port if a USB 3 port is not working. Some computers have a BIOS setting that controls whether a USB port operates in USB 2 or USB 3 mode. Try USB 2 mode if USB 3 mode is not working SMT/TCS Training - Dallas54

TAX-AIDE Imaging & Tax-Aide Inventory Agent Chris Hughes Chairman NTC NTC TCS Aug 2015 Webinar55

TAX-AIDE Imaging Status ● 23 July 2015 Windows 7 image available ● There will shortly be another image with updated imaging software Later drivers Double layer DVD required, flash unchanged ● Windows 8 image to be updated ● Will be moving to Online Inventory System as Imaging authorization source NTC TCS Aug 2015 Webinar56

TAX-AIDE Donated systems ● Must install Taxaide Inventory Agent first ( ) ● Send a request to OneSupport (oneSupport > Technology Software > obtain an image) ● OIS states – we need asset tag or serial to identify OIS record ● EIR states – we need EIR spreadsheet line for the system. Attach in OneSupport ● Ultimately OIS entry will be used to authenticate system for reimaging NTC TCS Aug 2015 Webinar57

TAX-AIDE Why reimage ● Brings all systems to a known state ● Faster than running Windows update after multi month storage ● Downside is any system personalization Windows auto installs modern printers Use the cloud rather than desktop personalization NTC TCS Aug 2015 Webinar58

TAX-AIDE Tax-Aide Inventory Agent ● Agent software that should be on every Tax-Aide system. ● Reports in system technical data to database ~monthly ● OIS states – the data is visible on system detail page and in spreadsheet downloads ● EIR states - access the data here NTC TCS Aug 2015 Webinar59

TAX-AIDE TIA Update ● Recently added GeoLocation to TIA ● Obtain Longitude, Latitude, accuracy from TIA data and use in the webpage ● Not all system’s TIAs have updated themselves for this capability yet. It will happen automatically. NTC TCS Aug 2015 Webinar60

TAX-AIDE District Name change ● To change TIA Asset tag, or District on a system run TIAEditAssetTagEtc.exe available on ● To force a manual database update, run this same program NTC TCS Aug 2015 Webinar61