November 2023 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

items
by Sherry Carnahan Nov. 30, 2023

Nov. 30, 2023

Good morning, I hope everyone had a great holiday! Does your Board pay for the security at the fair? Do you pay deputies directly from a general fund budget or do you pay the fair Board? Is your security provided by associate deputies that are part of a 501 3c? If so, is this ran through the general fund budget? For those of you who do vacation payouts, do you only do it once a year? What procedure do employees need to follow to apply for this? Is this verified through the Commissioner's Office? Do you have a separate line item to account for this? Sherry Carnahan County Administrator Defiance County Commissioners 419-782-4761 PLEASE NOTICE MY EMAIL HAS CHANGED. It is scarnahan(a)defiancecounty.oh.gov.

6 5

CCAO Winter Conference Multi-Factor Authentication Session
by Frank Hatfield Nov. 29, 2023

Nov. 29, 2023

For those attending CCAO's winter conference next week we strongly encourage you to attend the informative session on MFA. Below is the time and location of the session. I hope to see you there. Thursday, Dec. 7th (8:00am - 9:10am) CCAO/CORSA Session: Let's Talk Multi Factor Authentication (MFA) Room: Pheoris West A - 3rd Floor Description: Multi Factor Authentication (MFA) is becoming an increasingly popular discussion topic, but what is it? This session will cover some of the basics of MFA, what may be driving the discussion in your County, and how Wood County implemented their MFA solution. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01DA22BC.BA0BC320] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Be Safe on the Road & Online
by Frank Hatfield Nov. 21, 2023

Nov. 21, 2023

We wish everyone a Happy & Safe Thanksgiving. As a reminder, please be safe on the roads especially given increased vehicles (as well as deer) on the road this week. Also, prepare for elevated cyber threats over the long holiday weekend. Below is more information on these topics that we circulated prior to previous holiday breaks. Again, all this best to you and yours this Thanksgiving. The United States has the Most Per Capita Traffic Deaths of Any Developed Country There have been 343% more traffic deaths in American than German in 2023 despite there being no speed limit on the Autobahn. Over Memorial Day weekend 2023, Ohio had the highest number of traffic deaths since the 20203. Obviously, the roads are more dangerous than ever. We strongly encourage members to take advantage of in-person defensive driver training and online training at CORSA U. All courses offered by CORSA are available to member counties at no cost to the county and count toward the 2023 Loss Control Incentive. For more information on in-person defensive driving classes or to schedule a class please contact Frank Hatfield, CORSA Risk Control Manager, at fhatfield(a)ccao.org or (614) 560-1474. Online CORSA U defensive driving classes and/or model driver eligibility criteria may be found at www.corsa.org. Cybercriminals Work Overtime on Holidays The Cybersecurity and Infrastructure Security Agency (CISA), part of the Department of Homeland Security, warns that holidays are a period of elevated cybersecurity threats4. Organizations should prepare for increased holiday security threats including but not limited to: Beware of Employees Taking Work/Hardware on Vacation; Avoid Open wi-fi and Public USB Ports; Focus on Training and Messaging About Holiday Cyber-Risks; and Be Prepared to Implement an Operations Continuity Plan, if necessary5. As part of your cybersecurity risk control and training programs please take advantage of CORSA no cost resources such as online cybersecurity training courses through CORSA University and/or template cybersecurity policies and protocols accessible at: www.corsa.org<http://www.corsa.org>. Additionally, in 2023 CORSA members are eligible for a two cybersecurity reimbursement grants up to limited amounts for: 1. Implementation of cybersecurity measures; and 2. Multifactor Authentication. For more information, please contact Frank Hatfield, at (614) 560-1474 or fhatfield(a)ccao.org or Jim Hale at (614) 246-1630 or jhale(a)ccao.org. Have a safe and happy holiday. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01DA1C6D.CA5CE6F0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

PTO vs Sick and vacation time
by Diane Davis Nov. 21, 2023

Nov. 21, 2023

Does anyone use PTO instead of Sick and vacation time? If so, can you share your policy with me. -- Diane Davis Washington County Director HR/Safety/Wellness Coordinator 223 Putnam St Marietta Ohio 45750 740-373-6623 Ext 2015

2 1

Employer Drug & Alcohol Policy
by Frank Hatfield Nov. 15, 2023

Nov. 15, 2023

As you may know, CORSA's Best Practice Personnel Policy Manual (BPPM) Drug and Alcohol Policy provides, in part: "The use of marijuana in any form for any purpose, authorized for medicinal purposes or unauthorized, will be treated the same as the use of all other Schedule 1 controlled substances, illegal drugs, or the abuse of legal drugs." (emphasis added). Marijuana remains a Schedule 1 controlled substance under federal law even after passage of Issue 2. Accordingly, CORSA's BPPM Drug & Alcohol Policy will remain unchanged. We suggest, solely from a loss control perspective, members do the same. It is also advisable to communicate to staff that the drug and alcohol policy will remain unchanged, even after the passage of Issue 2, and reissue a copy of the policy. Should you contemplate a change to your current drug and alcohol policy/practice we recommend you consult the Prosecutor's Office or legal advisor prior to making change(s) or implementation of same. Look for the County Commissioners Association (CCAO) to provide a comprehensive overview of Issue 2 inclusive of employment and non-employment matters soon. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01DA1649.CA56C9C0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

county administrator
by Diane Davis Nov. 8, 2023

Nov. 8, 2023

Does anyone have a job description for a County Administrator? -- Diane Davis Washington County Director HR/Safety/Wellness Coordinator 223 Putnam St Marietta Ohio 45750 740-373-6623 Ext 2015

7 6

FW: 2 Upcoming OHPELRA Events | Register Today!
by Frank Hatfield Nov. 7, 2023

Nov. 7, 2023

I hope everyone is well as we close in on the holidays and year's end. Human resource and employment issues in public safety continually evolve and require public employers to stay up with changes to effectively manage and staff agencies in order to reduce operational and legal risks. OHPELRA's upcoming public safety conference is a source of great HR training and opportunity to network with peers regarding common issues. I've had the good fortune to attend and present at OHPELRA conferences over the years and always found them beneficial. Should you be interested in attending this year's public safety conference please see the email below and attached flyer. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!O4CzxfmRVTuqTgpu!k9PaN…> [cid:image001.png@01DA117B.209842B0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments. From: National PELRA <no-reply(a)npelra.org> Sent: Monday, October 9, 2023 6:07 PM To: Dawn Huston <dhuston(a)co.delaware.oh.us> Subject: 2 Upcoming OHPELRA Events | Register Today! CAUTION EXTERNAL EMAIL DO NOT open attachments or click on links from unknown senders or unexpected emails View as a webpage<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnationalpelra.growthzon…> [https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fres.cloudinary.com%2fmi…] REGISTER TODAY<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnationalpelra.growthzon…> Registration closes in 2-weeks! [https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fres.cloudinary.com%2fmi…] REGISTER TODAY<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnationalpelra.growthzon…> [https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fres.cloudinary.com%2fmi…]<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnationalpelra.growthzon…> This email was sent on behalf of National PELRA located at 288 Hawthorn Village Commons, Suite 103, Vernon Hills, IL 60061. To unsubscribe click here.<https://linkprotect.cudasvc.com/url?a=https%3a%2f%2fnationalpelra.growthzon…> If you have questions or comments concerning this email contact National PELRA at info(a)npelra.org<mailto:info@npelra.org>.

1 0