May 2023 - CORSA-broadcast - lists.corsa.org

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Distracted Driving
by Frank Hatfield Oct. 5, 2023

Oct. 5, 2023

On April 4th Ohio's revised distracted driving law takes effect. Namely, use of a "handheld electronic wireless device" (aka cell phone) while driving a motor vehicle is now a primary offense. This means a driver may be pulled over solely for use of a cell phone. Ohio's roads are more hazardous than ever due in large part to distracted driving. According to the Ohio State Highway Patrol, there have been nearly 62,000 distracted driving accidents (1,800 fatal) since 2018. https://www.nbc4i.com/news/local-news/distracted-driving-law-in-ohio-goes-i… It is a good time to review and update your vehicle use policy to ensure compliance with the law, if necessary. There's a good chance your current policy is compliant as it likely contains catchall language such as: "employees who operate motor vehicles on the job shall comply with all applicable traffic laws." Nonetheless, it is wise to communicate to employees the change to Ohio's distracted driving law and issue/reissue to employees your vehicle use policy. You may also consider scheduling employees for in-person CORSA defensive driver training or online training at CORSA U. (See attached flyers). In-person and online training are at no cost to members. Please contact me with questions or if you need anything. Stay safe. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01D9621F.24F64D90] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 1

Freezing and Bursting Pipes
by Jim Hale Aug. 30, 2023

Aug. 30, 2023

As a pool CORSA has all too many high severity losses every year due to freezing and bursting pipes. In fact, freezing/bursting pipes in the aggregate accounts for much of our yearly property losses as a pool. Attached is some additional information on this all too common loss for our members. Extracted from the document: "Surprisingly, ice forming in a pipe does not typically cause a break where the ice blockage occurs. It's not the radial expansion of ice against the wall of the pipe that causes the break. Rather, following a complete ice blockage in a pipe, continued freezing and expansion inside the pipe causes water pressure to increase downstream -- between the ice blockage and a closed faucet at the end. It's this increase in water pressure that leads to pipe failure. Usually the pipe bursts where little or no ice has formed. Upstream from the ice blockage the water can always retreat back towards its source, so there is no pressure build-up to cause a break. Water has to freeze for ice blockages to occur. Pipes that are adequately protected along their entire length by placement within the building's insulation, insulation on the pipe itself, or heating, are safe." James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209

1 1

Succession Planning
by Noble, Michelle June 1, 2023

June 1, 2023

Good Afternoon, I hope you are having a good day! Does anyone have a succession planning document/process for filling key positions? If so, do you mind sharing? Thanks so much! Michelle [cid:image002.jpg@01D7FE37.3FA65240]<http://www.clarkcountyohio.gov/> Michelle R. Noble Assistant County Administrator/HR Director Office: 937-521-2008 Cell: 937-605-2907 [Description: Description: FindUs-FB-RGB-BRC-Site-500]<https://www.facebook.com/clarkcountyohio/>

2 1

Summer Driving
by Frank Hatfield May 25, 2023

May 25, 2023

The unofficial start of summer and the increased traffic that comes with it is only a few days away. Officials say that this upcoming weekend will see 42.3 million Americans traveling more than 50 miles to visit friends and family. In fact, 2023 is expected to be the third-busiest Memorial Day weekend for travel since 2000. https://www.wkyc.com/article/travel/aaa-odot-oshp-cleveland-hopkins-interna… It is a good time to remind employees of safe driving practices. Then again, there's never a bad time for such a reminder. NHTSA's Summer Driving Tips can be found at: https://www.nhtsa.gov/summer-driving-tips. As always, you can schedule employees for in-person CORSA defensive driver training or online training at CORSA U. (See attached flyers). In-person and online training are at no cost to members. Please contact me with questions or if you need anything. We wish with you, your family and friends a safe holiday weekend and summer. Be safe. Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image001.png@01D98EE9.BABF3E80] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Cyber Risk Control Bulletin - Unpatched/Past End-Of-Life Software
by Jim Hale May 24, 2023

May 24, 2023

With the number of attacks on unpatched software increasing it is imperative that we patch all systems and applications in a timely manner. Best practice is to also immediately update or remove all components and software nearing or past their end-of-life. Where possible, enable automatic patching processes for all software and hardware devices that include authenticity and integrity validation. Leverage threat intelligence to identify active threats and ensure exposed systems and infrastructure are protected. Secure software assets through an asset management program that includes a product lifecycle process. CORSA members may be utilizing one very popular software platform - Cold Fusion. It is important to immediately check to see if your software is updated with all current patches and if the version you are using has past it's end-of-life it is immediately taken out of service. CISA (The U.S. Cybersecurity and Infrastructure Security Agency) has added a new vulnerability to its Known Exploited Vulnerabilities Catalog: CVE-2023-26360 Adobe ColdFusion Improper Access Control Vulnerability https://www.cisa.gov/news-events/alerts/2023/03/15/cisa-adds-one-known-expl… I am attaching a valuable resource published by CISA: Cybersecurity Best Practices for Smart Cities The guidance is applicable to Counties as well as Cities. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog One final note, please pay extra attention around holidays as we have seen an increase in attacks near to and on holidays. Bad actors will use the holiday as their "hook". Here is some additional information: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-243a James Hale, ARM-P, ARM-E, CPSI Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." [cid:image001.png@01D98E46.E3E2B240] CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Fuel inventory & usage policy
by Lori L Larson May 3, 2023

May 3, 2023

We are in the process of updating our internal fuel inventory & usage policy pertaining to our gasoline consumption for our fleet of vehicles. Would any of you be willing to share your policy? Thank you for your time! Lori Larson, Risk Manager Ashtabula County Commissioners 25 West Jefferson Street Jefferson, Ohio 44047 Phone: 440-576-3649 Fax: 440-576-3502

1 0