October 2023 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

MFA
by Michele Long Oct. 19, 2023

Oct. 19, 2023

Guernsey County is trying to discover what MFA platform that counties are using for computer logins, if any. Any answers you could give me would be greatly appreciated . THANKS Michele Long Clerk, Guernsey County Commissioners 740-432-9205 ********** Confidentiality Notice ********** This electronic transmission and any attached documents or other writings are confidential and are for the sole use of the intended recipient(s) identified above. This message may contain information that is privileged, confidential or otherwise protected from disclosure under applicable law. If the receiver of this information is not the intended recipient, or the employee, or agent responsible for delivering the information to the intended recipient, you are hereby notified that any use, reading, dissemination, distribution, copying or storage of this information is strictly prohibited. If you have received this information in error, please notify the sender by return email and delete the electronic transmission, including all attachments from your system. All electronic transmissions sent to and from this domain (guernseycounty.org) are archived and may be viewed by other parties than the intended recipients.

3 2

closings
by Randy Paul Oct. 17, 2023

Oct. 17, 2023

How do counties handle closings for 1. Bad Weather-before work, during work? 2. When the building has no water or electricity? If the weather is level 3 before work, a commissioner calls me/clerk and I text/call all department heads/elected officials on my personal cell. Sometimes we are told to come in at mid-morning/a certain time to allow for roads to be cleared off. If the weather changes throughout the day and appears to be coming to a level 3. The Engineer or Sheriff will alert a Commissioner and we broadcast thru email a time to leave and go home as long as you can get there safely. If we have no water, our Maintenance makes sure each restroom has a bucket of water for employees to manage the toilet. (some employees will NOT do this-so others pitch in) Each office is expected to have a case of water bottles, hand sanitizer and a couple gallons of drinkable water on hand at all times. If the electric goes out, that is usually building by building. If over 2 hours and doesn't appear to be coming back on, then the elected official can make the decision to send employees home. Most times it is right back on around the 2 hr. time. If an employee is sent home due to any of these conditions, they are paid-available if needed. Our basic question is how do you contact employees (we are very rural) prior to work to let them know to not come to work, or come in at a certain time. PLEASE NOTE MY EMAIL ADDRESS HAS CHANGED Randy Paul Clerk to the Board Hardin County Commissioners One Courthouse Square, Suite 100 Kenton, OH 43326 randy.paul(a)hardincountyohio.gov<mailto:clerk@co.hardin.oh.us> 419-674-2205

6 5

Cybersecurity Awareness Month - Week Three - Recognize and Report Phishing
by Jim Hale Oct. 16, 2023

Oct. 16, 2023

Phishing scams are online messages designed to look like they're from a trusted source. We may open what we thought was a safe email, attachment or image only to find ourselves exposed to malware or a scammer looking for our personal data. The good news is we can take precautions to protect our important data. Learn to recognize the signs and report phishing to protect devices and data. Stay Safe with Three Simple Tips: 1. Recognize Look for these common signs: * Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately * Requests to send personal and financial information * Untrusted shortened URLs * Incorrect email addresses or links, like amazan.com A common sign used to be poor grammar or misspellings although in the era of artificial intelligence (AI) some emails will now have perfect grammar and spellings, so look out for the other signs. 2. Resist If you suspect phishing, resist the temptation to click on links or attachments that seem too good to be true and may be trying to access your personal information. Instead, report the phish to protect yourself and others. Typically, you'll find options to report near the person's email address or username. You can also report via the "report spam" button in the toolbar or settings. 3. Delete Delete the message. Don't reply or click on any attachment or link, including any "unsubscribe" link. Just delete. The attached tip sheet can be distributed freely. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D9F534.55A34C10] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Cybersecurity Awareness Month - Week Two - Stay Safer Online: Enable MFA
by Jim Hale Oct. 10, 2023

Oct. 10, 2023

MFA provides us with extra security by confirming our identities when logging in to our accounts, like entering a code texted to a phone or one generated by an authenticator app. MFA increases security-it can make us significantly safer online. Even if our passwords become compromised, unauthorized users will be unable to meet the second step requirement and will not be able to access our accounts. Implement Phishing Resistant MFA Phishing-resistant MFA is designed to prevent MFA bypass attacks in scenarios like the one above. Phishing resistant MFA can come in a few forms, like smartcards or FIDO security keys. Security keys are small external devices that either connect to your computer or phone through a port, a biometric or via Bluetooth to enable secure login to websites and applications. Since only the key owner has physical access to their device, phishing scams don't work, and even weak passwords have an extra layer of protection. See the attached Implementing Phishing-Resistant MFA fact sheet for implementation guidance. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D9F534.55A34C10] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Distracted Driving
by Frank Hatfield Oct. 5, 2023

Oct. 5, 2023

On April 4th Ohio's revised distracted driving law takes effect. Namely, use of a "handheld electronic wireless device" (aka cell phone) while driving a motor vehicle is now a primary offense. This means a driver may be pulled over solely for use of a cell phone. Ohio's roads are more hazardous than ever due in large part to distracted driving. According to the Ohio State Highway Patrol, there have been nearly 62,000 distracted driving accidents (1,800 fatal) since 2018. https://www.nbc4i.com/news/local-news/distracted-driving-law-in-ohio-goes-i… It is a good time to review and update your vehicle use policy to ensure compliance with the law, if necessary. There's a good chance your current policy is compliant as it likely contains catchall language such as: "employees who operate motor vehicles on the job shall comply with all applicable traffic laws." Nonetheless, it is wise to communicate to employees the change to Ohio's distracted driving law and issue/reissue to employees your vehicle use policy. You may also consider scheduling employees for in-person CORSA defensive driver training or online training at CORSA U. (See attached flyers). In-person and online training are at no cost to members. Please contact me with questions or if you need anything. Stay safe. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01D9621F.24F64D90] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 1

Policy regarding recording
by Jenny Phelps Oct. 4, 2023

Oct. 4, 2023

Our County Home is asking if anybody has a policy that they would be willing to share regarding recording or taking photos in hallways where the residents' rooms are? Maybe another County Home or Board of DD would have a policy they can use? Thank you, Jenny Phelps Loss Control Program Coordinator office: 419-774-6318 fax: 419-774-3581 -- CONFIDENTIAL: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

1 0

Position description
by Jenny Phelps Oct. 3, 2023

Oct. 3, 2023

Does anybody have a landbank project manager position description that they would be willing to share? Thank you, Jenny Phelps Loss Control Program Coordinator office: 419-774-6318 fax: 419-774-3581 -- CONFIDENTIAL: This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error, please notify the system manager. This message contains confidential information and is intended only for the individual named. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately by e-mail if you have received this e-mail by mistake and delete this e-mail from your system. If you are not the intended recipient you are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited.

2 1

Cybersecurity Awareness Month - Week One: Use Strong Passwords
by Jim Hale Oct. 2, 2023

Oct. 2, 2023

Since 2004, the President of the United States and Congress have declared the month of October to be Cybersecurity Awareness Month, a dedicated month for the public and private sectors to work together to raise awareness about the importance of cybersecurity. This is the 20th Cybersecurity Awareness Month and it has grown into a collaborative effort between government and industry to enhance cybersecurity awareness, encourage actions by the public to reduce online risk and generated discussion on cyber threats on a national and global scale. https://www.cisa.gov/cybersecurity-awareness-month Week One: Use Strong Passwords https://www.cisa.gov/secure-our-world/use-strong-passwords YouTube: https://www.youtube.com/watch?v=FZoB7yUGh7Y&embeds_referring_euri=https%3A%… A strong password follows ALL THREE of these tips: 1. Make them long At least 16 characters-longer is stronger! 2. Make them random Two ways to do this are: Use a random string of mixed-case letters, numbers and symbols. For example: * cXmnZK65rf*&DaaD * Yuc8$RikA34%ZoPPao98t Create a memorable phrase of 5 - 7 unrelated words. This is called a "passphrase." To make it even better, get creative with spelling and/or add a number or symbol. For example: * Strong: HorsePurpleHatRunBaconShoes * Stronger: HorsPerpleHatRunBayconShoos * Strongest: HorsPerpleHat#1RunBayconShoos 3. Make them unique Use a different strong password for each account. For example: * Bank: k8dfh8c@Pfv0gB2 * Email account: LmvF%swVR56s2mW * Social media account: e246gs%mFs#3tv6 It's hard to remember all these long passwords and we don't want to save them in a file on a computer. Instead, use a password manager. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D9F534.55A34C10] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0