October 2022 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Freezing and Bursting Pipes
by Jim Hale Aug. 30, 2023

Aug. 30, 2023

As a pool CORSA has all too many high severity losses every year due to freezing and bursting pipes. In fact, freezing/bursting pipes in the aggregate accounts for much of our yearly property losses as a pool. Attached is some additional information on this all too common loss for our members. Extracted from the document: "Surprisingly, ice forming in a pipe does not typically cause a break where the ice blockage occurs. It's not the radial expansion of ice against the wall of the pipe that causes the break. Rather, following a complete ice blockage in a pipe, continued freezing and expansion inside the pipe causes water pressure to increase downstream -- between the ice blockage and a closed faucet at the end. It's this increase in water pressure that leads to pipe failure. Usually the pipe bursts where little or no ice has formed. Upstream from the ice blockage the water can always retreat back towards its source, so there is no pressure build-up to cause a break. Water has to freeze for ice blockages to occur. Pipes that are adequately protected along their entire length by placement within the building's insulation, insulation on the pipe itself, or heating, are safe." James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209

1 1

First Amendment Audits
by Frank Hatfield April 21, 2023

April 21, 2023

Over the last few years citizen activists have been conducting "First Amendment Audits" with increasing frequency. This phenomenon does not appear to be led by an organization; rather, audits are conducted by individuals interested in videoing law enforcement and other public officials and offices. Although conducted by individuals, organizations such as the ACLU provide guidance and encourage First Amendment audits. (See ACLU: https://www.aclu.org/know-your-rights/protesters-rights/#i-want-to-take-pic….) Frequently, these video audits are posted online and, if a perceived First Amendment violation occurred, the videos are the basis for a civil lawsuit. Now is a good time to review and update or create, if necessary, your County's protocol with regard to citizens videoing County operations. Fortunately, counties and public offices, such as Union County, have prepared well to withstand a "First Amendment" without incident. Union County, specifically Sheriff Patton, was kind enough to share the attached memorandum regarding recent "First Amendment Audit" activity and permit it to be distributed by CORSA broadcast email. Thank you Union County. The attached is not legal advice nor should it be construed as such. Should you require a legal opinion please contact your Prosecutor's Office or legal counsel. Frank Hatfield, Esq. CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

2 1

Dog Kennel Question
by Jonette Jackson Nov. 1, 2022

Nov. 1, 2022

Hello, For the Counties that have Dog Kennels. Do you have either of these agreements in place that you can share: Veterinarian agreement and one for a Veterinarian Technician? Lorain County is looking into having this position at the Kennel before the end of the Year. Jonette Jackson Safety Risk Administrator Lorain County Board of Commissioners Human Resources Department 226 Middle Avenue, 4th Floor Elyria, OH 44035 (440) 329-5227 Phone jjackson(a)loraincounty.us<mailto:jjackson@loraincounty.us> www.loraincounty.us<http://www.loraincounty.us/>

7 6

NACo Offering Free Cyberattack Simulation
by Jim Hale Oct. 31, 2022

Oct. 31, 2022

Today is the last day for FREE registration! >From 1:00 p.m. to 2:00 p.m. on November 14-18, NACo will host a cyber simulation course concerning security readiness for cyberattacks. NACo is partnering with the Professional Development Academy and their community of CISOs, CIOS, risk managers and cyber leaders to launch cyberattack simulation training. Registration for this training course is FREE until October 31. CCAO encourages members to take advantage of this opportunity to learn more about cybersecurity, as the threat of cyber-attacks are likely to only grow in coming years. You can register here<https://ccao.us13.list-manage.com/track/click?u=1f5c0866c294fa6f8d5669b2e&i…>. Please contact NACo Chief Information Officer Rita Reynolds at rreynolds(a)naco.org<mailto:rreynolds@naco.org>, or the general help address at nacomeetings(a)naco.org<mailto:nacomeetings@naco.org>, with questions concerning the program or if you have difficulty registering. James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D8ED08.6927D8D0] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Cybersecurity Presentation & Reimbursements
by Frank Hatfield Oct. 31, 2022

Oct. 31, 2022

Happy Halloween. In addition to Halloween, today is the last day of Cybersecurity Awareness Month, however, we must continue our cybersecurity efforts year round. To that end, CORSA is pleased to sponsor at the CCAO/CEAO Winter Conference a cyber session at 8:30 am on December 8th. "The Bad Guy Sitting in Your Inbox!" or technical term Business Email Compromise (BEC) - This session will provide a better understanding of the current cyber threat landscape and how you can protect yourself and your county from falling victim. We are very excited that Tony Rucci, Cybersecurity Consultant, will conduct this session which includes a Live Darkweb Demo and various examples of BEC. Attached is Tony's impressive biography. Also attached is information pertaining to CORSA's 2022 Cybersecurity Reimbursement program. There is still funding available for those members that have not taken advantage of this program in 2022. Please don't delay submit your applications without delay but not later than 12-31-22. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01D8ED01.E0A835A0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

vehicle operation policy
by Jenny Phelps Oct. 28, 2022

Oct. 28, 2022

Good morning, I am wondering if anybody has a policy that specifies what to do if a person is driving a county-owned vehicle and it breaks down or has a flat tire while they're out in the field. Obviously there will be a lot of variables including the driver's occupation, where they are, time of day, etc. Thank you! Jenny Phelps Loss Control Program Coordinator office: 419-774-6318 fax: 419-774-3581 -- CONFIDENTIAL: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

7 6

Cybersecurity Awareness Month - Week 4
by Jim Hale Oct. 24, 2022

Oct. 24, 2022

Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally. https://www.cisa.gov/cybersecurity-awareness-month This year, we will focus on four key behaviors which allow users to feel empowered to take responsibility for personal data safety online. WEEK 4 - The Importance of Updating Software Your data is valuable. As the world grows evermore connected via the internet, bad actors have greater opportunities to inappropriately access your data. If your valuable data ends up in the hands of a bad actor, the data can be used to cause financial, personal, and legal harm to yourself and others. Fortunately, you have the power to reduce the likelihood of becoming a victim of cybercrime! Updating software We use various software packages daily to perform our jobs, complete banking transactions, communicate with healthcare providers, purchase goods, and for personal enjoyment such as using a streaming service or playing a videogame. When a company develops software, they do so with security in mind. However, humans are not perfect and make mistakes when creating software products which can ultimately lead to vulnerabilities in the software. Companies regularly create patches or updates for identified vulnerabilities in their products to maintain security and keep their customers safe. Once a company creates a security update and shares it with their customers, it is up to the customer to apply the updates to ensure their data remains safe. Software vulnerabilities are a primary avenue bad actors use to access personal or otherwise sensitive data. Keeping your software up to date greatly reduces the likelihood of becoming a victim of cybercrime! [cid:image001.png@01D8E785.96E97AE0] James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image002.png@01D8E785.96E97AE0] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Cybersecurity Awareness Month - Week 3
by Jim Hale Oct. 17, 2022

Oct. 17, 2022

Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally. https://www.cisa.gov/cybersecurity-awareness-month This year, we will focus on four key behaviors which allow users to feel empowered to take responsibility for personal data safety online. WEEK 3 – Recognizing Phishing and Malicious Emails With the increased use of online resources to conduct school and work, phishing messages are a common occurrence in today’s world. Phishing occurs when a bad actor sends fraudulent emails, text messages, or Teams messages in an attempt to get individuals to disclose sensitive information. While not every unsolicited email is a phishing attack, it should be inspected for other suspicious elements that may help you identify if it's legitimate. According to the Verizon Data Breach Report, phishing attacks account for more than 80% of reported security incidents. Identifying malicious emails Be on the lookout for the following characteristics that can help you identify phishing messages: * Unsolicited. Be cautious of emails that you were not expecting to receive. * Too good to be true. If it sounds too good to be true, it probably is. Part-time job scams often offer to pay an exorbitant amount of money for a simple task. * Asking for personal or financial information. Report emails asking for personal information. * Deceptive web links. Hover your mouse on the hyperlink to view its true destination. If you don't recognize it, don't click it. * Variations of legitimate addresses. For example, an email address ending in @ohio-edu.org instead of @ohio.edu. * Fake senders address. Click the sender's name to view the email address. * Requesting urgency. The intention of urgency is to influence users to act quickly to prevent them from noticing suspicious elements. * Fraudulent sites often don't start with HTTPS. The "s" stands for secure. Never sign in to websites that are not using HTTPS. * Misspelled words and bad grammar. Phishing emails often contain misspellings and grammar issues. Types of phishing messages * Email impersonation or spoofing is a forgery of a message so it appears to have originated from a legitimate sender. This is a popular tactic by attackers since the recipient is more likely to open a message from a familiar source. These attacks often turn into gift card scams where the attacker influences the individual to buy gift cards. * Part-time job scams often target college students or alumni who may be searching for job opportunities. These scams are fake job offers that are usually too good to be true, offering high wages for little work. Be wary of any unsolicited emails with this characteristic, especially ones that send a check prior to you beginning any work. The scammer often will request you to wire a portion of the check back to them, and you will lose that amount of money. * Emails tagged as malware have been identified to contain a link or an attachment that directs your machine to install malicious software. Generally, malicious software can delete or steal personal information, slow down your computer, encrypt your files and hold them for ransom, or display unwanted advertisements. * Extortion email messages threaten the recipient and demand a payment, often in the form of a cryptocurrency like Bitcoin. A popular extortion category is known as sextortion, where the attacker will claim they have malware installed on your computer that captured embarrassing photos of you. Attackers may also leverage previously breached credentials for services tied to your email address to provide a level of authenticity to their message. * Vishing is a type of social engineering attempt that takes place over the phone. A random number or spoofed phone number calls and a bad actor attempts to collect valuable personal information by claiming they are a debt collector or other type of customer service representative. Additional Information: https://www.ohio.edu/oit/security/cybersecurity-awareness-month/phishing CORSA University: https://corsa.localgovu.com Course Name: Protection from Ransomware and Phishing Attacks Also see attachment. James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” [cid:image001.png@01D8E20C.59AA7D60] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Cybersecurity Awareness Month - Week 2
by Jim Hale Oct. 11, 2022

Oct. 11, 2022

Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally. https://www.cisa.gov/cybersecurity-awareness-month This year, we will focus on four key behaviors which allow users to feel empowered to take responsibility for personal data safety online. WEEK 2 - Using Strong Passwords Tips for creating strong passwords<https://www.ohio.edu/oit/security/cybersecurity-awareness-month/strong-pass…> * Plan for a minimum of 10 characters, using special characters, capital letters, punctuation, and numbers. Not sure if your password is long enough? Hive Systems updates their recommendations for password length(opens in a new window)<https://www.hivesystems.io/blog/are-your-passwords-in-the-green> yearly based on current technology being utilized by bad actors. * Don't use predictable passwords such as passw0rd, 12345, or test1. * This includes obvious connections to the company or brand. For example, don't use bobcat or Rufus as your OHIO password. * Keyboard patterns also make weak passwords, such as qwerty or 1qaz2wsx. * Consider using a phrase instead of a word. Phrases make it easier to have long passwords and can be difficult to guess if you incorporate special characters. * Too many passwords to remember? Use a password manager. These tools will generate secure random passwords for your sites and store them in a central place. All you need to remember is the password you set for your password manager's account. [cid:image002.png@01D8DD8A.92225AE0] Additional resources: https://www.cnet.com/tech/mobile/keep-your-passwords-strong-and-secure-with… https://support.microsoft.com/en-us/windows/create-and-use-strong-passwords… https://www.cisa.gov/uscert/ncas/tips/ST04-002 James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D8DD8A.32B4BA80] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0