September 2024 - CORSA-broadcast

Business Email Compromise: The $43 Billion Scam
by Frank Hatfield Dec. 13, 2024

Dec. 13, 2024

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The scam is frequently carried out when an individual compromises legitimate business or personal email accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds. The scam is not always associated with a transfer-of-funds request. One variation involves compromising legitimate business email accounts and requesting employees' Personally Identifiable Information, Wage and Tax Statement (W-2) forms, or even crypto currency wallets. Losses associated with BEC scams quadrupled last year to an astonishing $43 Billion according to the FBI statistics below. Just last week about $4 million in federal funding intended for housing assistance in Kentucky was stolen after someone directed that money to a private bank account. (Source: https://www.cnn.com/2022/08/29/politics/kentucky-4-million-cyber-theft/inde… ) "These types of attacks can be especially impactful to state and local governments that may do business with dozens, if not hundreds, or different vendors," Hassold, who is now director of threat intelligence at cybersecurity firm Abnormal Security, told CNN. FBI SUGGESTIONS FOR PROTECTION * Use secondary channels or two-factor authentication to verify requests for changes in account information. * Ensure the URL in emails is associated with the business/individual it claims to be from. * Be alert to hyperlinks that may contain misspellings of the actual domain name. * Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate. * Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender's address appears to match who it is coming from. * Ensure the settings in employees' computers are enabled to allow full email extensions to be viewed. * Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits. Source: FBI Public Service Announcement https://www.ic3.gov/Media/Y2022/PSA220504 CORSA is committed to keeping members informed of and protected against threats to their financial assets and systems. BEC and/or payment fraud is on the rise which creates considerable exposure to governmental entities, including CORSA members. Current technology provides sophisticated criminals the tools to create or alter checks or divert payments via BEC or social engineering. In addition to the FBI's above recommendations, CORSA strongly encourages members to enroll in the anti-fraud services Positive Pay and ACH Positive Pay. The Ohio Auditor of State also recommended enrolling in the above anti-fraud services to guard against check fraud. (See: Auditor of State Best Practices https://ohioauditor.gov/publications/bestpractices/best%20practices%20sept%…) Positive Pay is a service that essentially requires bank customers to provide their bank with a list of checks that are to be paid, while payment is withheld for any checks that don't match the customer's list. The ACH Positive Pay service allows a customer to set parameters on payments. For instance, payments that occur regularly with similar amounts can be set up to pay automatically, while any payments that fall outside normal transactions will be suspended until authorized. Most banks offer Positive Pay and ACH Positive Pay for a fee. In CORSA's experience fees vary, but customers are able to significantly lower fees through negotiation. Should you have questions regarding Positive Pay or ACH Positive Pay contact Thisbe Butcher at tbutcher(a)ccao.org<mailto:tbutcher@ccao.org> [Chart depicting Reported Loss Associated with BEC/Cryptocurrency Complaints for the years of 2018, 2019, 2020, and 2021.] Frank Hatfield CORSA Risk Manager fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<http://www.corsa.org/> [cid:image002.png@01D8BD3E.0B6EC360] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 2

Driving Policy Language for Personal Vehicles
by Jonette Jackson Oct. 1, 2024

Oct. 1, 2024

Hello, Lorain County is asking if you would share your policy for County Employees who operate their personal vehicle on county Business. Thank you, Jonette Jackson Safety Risk Administrator Lorain County Board of Commissioners Human Resources Department 226 Middle Avenue, 4th Floor Elyria, OH 44035 (440) 329-5227 Phone jjackson(a)loraincounty.us<mailto:jjackson@loraincounty.us> www.loraincountyohio.gov<http://www.loraincountyohio.gov> www.loraincountyohio.gov/jobs<http://www.loraincountyohio.gov/jobs>

4 4

Cybersecurity Awareness Month - Secure Our World - Week One - Use Strong Passwords
by Jim Hale Sept. 30, 2024

Sept. 30, 2024

Strengthen Your Passwords with Three Simple Tips: A strong password follows ALL THREE of these tips. 1. Make them long At least 16 characters—longer is stronger! 2. Make them random Two ways to do this are: Use a random string of mixed-case letters, numbers and symbols. For example: * cXmnZK65rf*&DaaD * Yuc8$RikA34%ZoPPao98t Another option is to create a memorable phrase of 4 – 7 unrelated words. This is called a “passphrase.” For example: * Good: HorsePurpleHatRun * Great: HorsePurpleHatRunBay * Amazing: Horse Purple Hat Run Bay Lifting Note: You can use spaces before or between words if you prefer! 3. Make them unique Use a different strong password for each account. For example: * Bank: k8dfh8c@Pfv0gB2 * Email account: legal tiny facility freehand probable enamel * Social media account: e246gs%mFs#3tv6 PRO TIP: USE A PASSWORD MANAGER It’s hard to remember all these strong passwords and we don’t want to save them in a file on a computer. Instead, use a password manager. For most people, generating and remembering long, random and unique passwords for every account is not possible. Rather than write them down, use a password manager! A password manager is an easy-to-use program that generates, stores and even fills in all your passwords. Password managers tell us when we have weak or re-used passwords and can generate strong passwords for us. They can also automatically fill logins into sites and apps as we move from one to another. When we use a password manager, we only need to remember one strong password—the one for the password manager itself. (Tip: Create a memorable long “passphrase” as described above.) There are many password managers to choose from. Some are free, like the built-in password managers in your web browser, and some cost money. Search a trusted source for “password managers” like Consumer Reports, which offers a selection of highly rated password managers. Read reviews to compare options and find a reputable program for you. When we use a password manager, we are much more likely to use a long, random and unique password on every site. And that makes it much harder for someone to steal our valuable information! PRO TIP: Check to see whether your email accounts, banks, healthcare providers and other important accounts enforce strong password requirements. If they let you use a short password or a dictionary word, ask them why. It’s your information they’re putting at risk! How often do I change my password? If your password is long, unique and complex, our recommendation is that you don’t need to ever change it unless you become aware that an unauthorized person is accessing that account, or the password was compromised in a data breach. This recommendation is backed up by the latest guidance from the National Institute of Standards and Technology<https://pages.nist.gov/800-63-3/sp800-63b.html>. For many years, cybersecurity experts told us to change our passwords every few months. However, this constant change isn’t helpful if your passwords are each long, unique and complex. In fact, if you change your passwords often, you risk reusing old passwords or falling into bad habits of creating similar or weak passwords. Stop Online Crime with Strong Passwords 0 YouTube link: https://youtu.be/FZoB7yUGh7Y Secure Our World Resources & Cybersecurity Awareness Month 2024 Toolkit https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-c… James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.”

1 0

Cybersecurity Month & CORSA Cyber Reimbursement
by Frank Hatfield Sept. 30, 2024

Sept. 30, 2024

Tomorrow, October 1st, is the first day of cybersecurity month. Since 2004, the President of the United States and Congress have declared October to be Cybersecurity Awareness Month, time dedicated for the public and private sectors to work together to raise awareness about the importance of cybersecurity. As a CORSA member, and local government, you're very aware that the importance of cybersecurity has increased over the last two decades. Jim Hale, CORSA Loss Control Coordinator, will again this year issue cybersecurity newsletters throughout October. Also, if you haven't taken advantage of CORSA Cybersecurity Reimbursement Program this year, we encourage you to do so without delay. Attached is information on CORSA's 2024 program. As always, thank you for what you do for your County/Agency and CORSA. Be safe. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image001.png@01DB1306.97B4ED70] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

CyberOhio
by Frank Hatfield Sept. 5, 2024

Sept. 5, 2024

The County Commissioners Association "Counties Current" publication August 26, 2024, contained the story below with regard to Ohio's CyberOhio initiative to promote cybersecurity through state grants. Also, attached is more information on the program. Look for more information on cybersecurity from CORSA throughout October which is Cybersecurity Awareness Month. Local government cybersecurity grants available CyberOhio<https://cyber.ohio.gov/priorities/assisting-local-government-entities/assis…>, an initiative by the state to bolster cybersecurity in Ohio, has two grant opportunities for local governments open. First, the Cybersecurity Software and Services Grant<https://dam.assets.ohio.gov/image/upload/v1721418270/cyber.ohio.gov/ROUND%2…> is intended to assist local governments in acquiring security software and services. Examples include implementing multi-factor authentication, server protection programs, and more. Grants can be up to $20,000. The second program is the .gov Migration Grant<https://dam.assets.ohio.gov/image/upload/v1722015262/cyber.ohio.gov/Round_2…>. This grant program is intended to assist local governments transition their websites and emails to the ".gov" type. This domain type is only available to U.S.-based government entities, allowing users to have more confidence that they are receiving genuine information and that the emails they may receive from government entities are legitimate. Grants under this program may be up to $9,500. Applications for both programs are open until September 16. CCAO encourages counties to consider applying for these funds as the threat of cyber attacks will only increase going forward. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image001.png@01DAFF89.3C6ADE10] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0