3 Reasons Email Scams Still Work

With the help of movies and other media, our image of the email scam artist has evolved in the past 10 years.  

We used to picture some greasy guy, still living in his mother’s basement, with a thirst for dirty money.  

Now, when we think of email scam artists, we think of young 20-something’s (still living in their parents’ basement), doing it just because they can.  

And this image is somewhat correct – for the common con artist.  If you’re lucky, this is the one that has you in their sites, and the product is of some dubious quality.

However, the actual picture of the perpetrators of the mass scams (think Cryptolocker), is quite different.

The CyberCriminals of today that let loose the mass email scams are organized, skilled, and informed.  They use family deaths, holidays, or any other ‘in’, where the potential victim may be more vulnerable.

Their goal?  

To separate you from your money, or your information (which eventually lands them money).

These CyberCriminals may be behind phishing emails, pretext calling, and emergency queries, all of which are designed to appear normal, and intend for you to take action on them.  The action is designed to appear ‘simple’ and ‘innocent’,  such as clicking a link, answering a question, or providing access to something.  

The technology that can stop them is just one part of the equation.  Your employees can unravel the most secure technology, with a simple answer, a click of the mouse, or other action.

3 Reasons Why Scam Emails

and Other Social Engineering 

Remains a Threat to All Companies:

1.  We Are Helpful By Nature.

One of the most successful social engineering techniques is the “Request for Help”.  Whether it’s on the phone, in person, or email.  The person engaging your employee may be posing as another employee, a customer, vendor, or member of the media.  They are asking for assistance.  They always throw in some urgency, for effect.  Whichever method they contact your employee, they never allude to, or throw any suspicion on the harmful effect your employee’s assistance may have on the company.

For example, a person could pose as the Senior Vice President of the company, call the switchboard (or random employee), and create a situation that elicits  a feeling of urgency, and wanting to help, and wanting to impress your senior:

“My laptop crashed, and I am operating off my tablet, which isn’t configured for the corporate VPN.  So, I can’t get to my corporate email, but I desperately need to reach out to my team.  Would you be so kind as to forward the employee director to my personal email?  I need to contact them right now, my meeting with an important client is in an hour.”

What would your employee do?  Would they deflect?  Have you prepared them for the false escalation that would accompany a denial?  Such as demands for their name, their supervisor’s name and contact information to ensure punishment of the employee?

Have you prepared senior management for this situation?  What if this really does happen to them?  What is the protocol?  Do they know it?

What if a man shows up at the side door of one of your company buildings.  He’s wearing a jacket with the company logo and, to the casual observer, appears to be an employee heading into the office via the side entrance.  He’s wearing an ID tag that may, or may not be, real.  What he doesn’t have is the building’s PIN codes or an ID with a valid near-field communication capability to get through the card swipe.  He simply adjusts his pace, or loiters so he may enter behind an employee with legitimate access.  Once inside, he wanders around and collects laptops, smart cards, hard drives, and papers.

How would your employees address someone following them through the door?  Would they hold the door closed, and demand that they swipe their badge or enter their PIN code?  Or would they be polite and hold the door open and go about their daily business?

2.  We Are Curious By Nature.

Curiosity is encouraged from the time we are in diapers.  We are encouraged to ask questions, try new experiences, read new things and stay current.  The social engineering professionals (and yes, they are professionals), attempting to set their technological hook into your company-issued devices and, by extension, the network, are crafting their emails and social networking posts to entice your employees to act, and click.  They use everything from natural disasters, epidemics, economic concerns, elections, tax time, famous deaths, family deaths, or any absurdity, all designed to pique your employees’ curiosity, so that they will take action, and click.

How would you implement a “No-Click Policy”.

3.  We Are Multi-Taskers By Nature.

In this always-connected, always-on world of virtual meetings and engagement, employees may be talking on the phone and scanning their inbox at the same time.  Social engineering pros are counting on your partial-attention, when they begin to conduct surveillance prior to mounting an attack.  Multiple innocuous queries can be made across the enterprise via pretext calls about bring-your-own-device policies, or accessing social networks via company networks.  In every instance, the information gleaned, is the base upon which a scam package is created, which appears to be normal and within company policy to the recipient.

How Do You Combat Email Scams

and Other Social Engineering?

 1.  If you are using a data loss prevention system, you already know that you have to invest both time and energy to implement a data classification regime, which assists in tuning out the noise or false positives.

2.  You must ensure adherence to the philosophy of least-privileged access (need-to-know).

3.  Include a robust security information and event management process to ensure knowledge of attempts to access information and successful out-of-pattern access to information.

These foundational elements need to be coupled with a comprehensive Security Awareness Program that is provided continuously.

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got Cyber-Bugs?

Call 1-204-800-3166

For Cyber-Extermination!

What is PCI Compliance?

PCI compliance is a term that has been in the news a lot over the past couple years.  

But what is it?  

‘PCI Compliance’ or ‘PCI Security Compliance’ is Payment Card Industry Security Compliance.  It addresses any business that accepts credit card or debit card for payment, and is a standard that has emerged as the ‘bench test’ for whether or not your retail operations are a security risk for credit card information theft.

The rising incidence of stolen cardholder account data is a major concern for all businesses that accept payments by credit or debit card.  As a result of these thefts, merchants and financial institutions suffer fraud losses and unanticipated operational expenses, and consumers are inconvenienced significantly.  

What Does It Mean To Me?

If you collect or store credit card information, and if it is compromised, you may lose the ability to accept credit cards at your business, or you may face higher processing rates.  In the U.S., you may also be libel, not only for the credit card information compromised, but for non-compliance for new Security Awareness Training guidelines if your employees have had little or no security awareness training.  If you store credit or debit card information, no matter what country you are in, you are required to follow PA-DSS Compliant Applications (Payment Application – Data Security Standards)

To protect your business, your customers, and the integrity of the payment system, each of the card companies has in place a set of requirements governing the safekeeping of account information.  

• Install and maintain firewall to protect cardholder data.

• Do not use vendor-supplied default system passwords.

• Protect stored cardholder data.

• Encrypt transmission of cardholder data across network .

• Use and regularly update anti-virus software.

• Develop and maintain secure systems and applications.

• Regularly test security systems and processes.

• Maintain a policy that addresses information security.

There are 4 different levels of PCI Compliance, depending on the number of eCommerce and regular transactions your business does annually.

To check if you are following the compliance standards, visit the PCI Security Standards Council – the organization that manages these standards.  This is an excellent website that also allows you to perform a self-assessment.  

So that covers the legalities of the electronic safekeeping of your information.

But..

Being PCI Compliant Does Not Ensure Safety

To rely solely on the PCI DSS checklists to secure cardholder data is similar to a pilot relying only on the pre-flight checklist before takeoff, then colliding with another plane during takeoff.

In reality, the goal of effective security controls is to prevent security breaches from occurring, and when they do, allow quick detection and recovery.

This requires not only following a checklist, but understanding the organization’s compliance and security objectives, understanding what the top risks to achieving those objective are, having adequate situational awareness to identify where you need controls to mitigate those risks, and then implement and monitoring the correct production controls.  

The Human Factor 

The U.S. Department of Health and Services has stated that bad or no security awareness training is a main cause of compliance failures.  This is true not only for health care, but all industries such as banking, finance, manufacturing, and technology.

Your employees are your company’s biggest asset.  They can also be your company’s weakest link.

Trend Micro reports that 91% of successful data breaches started with a spear-phishing attack.

Make sure your employees are up-to-date in their security awareness training.

Don’t Know What to Look For In Suspicious Emails:  http://tbyd.ca/email-red-flags/

For all the latest virus/malware alerts go to:  http://tbyd.ca/category/alerts/

Got Bugs In Your System?

Call 1-204-800-3166

For Cyber-Extermination!