All is Not Lost; We Can Thwart Cyber Crime

There once were the good old days when phishing email messages were easy to spot. They were from an unknown person, full of typos and grammatical errors, and often used broken English. They sometimes included a sob story that was truly not believable. Not anymore. The hackers are becoming more clever and using actual logos (or very good renditions of them), have better language skills, and are making the messages appear to come from a friend or colleague. These make it very difficult to detect fact from fiction when it arrives in your in box and to know how to address them.

There are a few tips for this. First, figure out the company’s individual risks. Are you a financial institution or a large organization that frequently wires large sums of money? If so, identifying phishing should be at the top of your list as a training topic. That is frequently how hackers convince those with authorization to perform wire transfers to send money to their accounts. Business email compromise (BEC) is becoming a big business. According to the FBI’s Internet Crime Complaint Center (IC3), there have been more than 220,000 victims of this resulting in over $3.1 billion in losses. Over $960 million of those were in the U.S. between October 2013 and May 2016.

The common pitfalls that strike all organizations and include not only compromises due to phishing and wire transfer fraud, but also ransomware and other malware, unpatched machines, and lack of network segmentation.

All is not lost however. Phishing attempts can be identified with some training and education. There are often still typos and missed punctuation. Look closely. Sometimes it may be an extra space between words that gives pause.

A good training program is not difficult to set up. If it’s not reasonable to do it yourselves, there are many organizations that provide this service and there is one for every budget. Within this should be information on identifying phishing and instruction on what to do if someone accidently executes malware as a result of falling for a phishing scheme. Test employees and anyone who connects to your network. Yearly is not enough. Quarterly is recommended and if you can do it more often, do so.

Watch for subtleties such as the way the email is written. If the sender would never use a word of phrase in a particular way, question it. There is a recent example of an attacker requesting a wire transfer, but was thwarted because the attacker used the word “please” in the message to the accountant. This was apparently not normal for that executive.

Implement and follow a process where multiple approvals are required for money transfers and don’t be afraid to go outside the email chain. Often the best way to ensure fraud does not occur is to use the phone or your feet. Don’t subvert the policies. No matter how nicely or sternly someone asks for a wire transfer, go to the effort to get the additional approvals.

If there is any suspicion at all, pick up the phone, walk to his or her office, or send a new email message to the requester. Don’t hit the reply button. You will find out very quickly if it is a fraud attempt.

For those in charge of protecting networks, implement defenses. Having firewalls in place at the perimeter is mandatory, but those can be vulnerable too. Even better is to segment the internal network. If there is a reason to seat people in different areas, perhaps it makes sense to separate the networks too. If a virus gets into one area, it won’t necessarily make to everywhere else this way.

Put a patch policy in place. This is something that may seem elementary, but it is often overlooked. Keeping all devices updated with security and critical patches is paramount.  A 2015 Google study found that companies largely fail to put patching and updating systems at the top of the priority list. Putting at the top can significantly lower risk of a data breach occurring because of a vulnerability for which there was a patch available but not applied.

Don’t forget to include devices that are serviced by outside vendors in the patch program. Often, these machines such as camera systems and card access systems don’t get attended to for long periods of time. Put in contracts that regular (quarterly or immediately when it’s security-related) patching takes place.

Small and medium-sized companies are becoming targets of choice these days. Taking some time to implement good security practices can do wonders to lower your risks.