- CORSA-broadcast - lists.corsa.org

Holiday Loss Control Tips
by Frank Hatfield Nov. 25, 2024

Nov. 25, 2024

The holiday season is here. We wish you a happy and safe season. Please take a moment to plan for a safe holiday season in the following three areas: 1. At your facilities; 2. In the cyber universe; and 3. on the roadway. Below and attached are general tips to assist with your preparation, with links to more information. As always, feel free to contact Jim Hale or myself regarding CORSA loss control resources. We wish you, your peers, friends and family a happy and safe holiday season. PREPAR FOR HOLIDAY CYBER ATTACKS: Attackers strike the most during holidays and weekends when companies are vulnerable and understaffed. ⚠️ Attacks are more common during non-business hours, mostly due to less staff available to protect the company. ⚠️ Large, profitable companies tend to be the main targets but small businesses with less protection are also a target. ⚠️The attacks that occur during non-business hours take longer to investigate and resolve, which may slow response and notification. Action Items Protect your organization with these practices: ✅ Review cyber incident response plans, resiliency plans, and communications plans. ✅ Reiterate cybersecurity user awareness and training program tips that include guidance on how to report incidents. ✅ Tune endpoint protection, regularly update, and enable real-time detection for antivirus software on all hosts. ✅ Make (and test restore) an offline backup of your data. ✅ Confirm multi-factor authentication (MFA) is working as intended for all services possible. ✅ Confirm software and operating systems are up to date to download the latest security patches. ✅ Scan for open and unused ports and remove any application not deemed necessary for day-to-day operations. ✅ Add an email banner to emails received from outside your organization to warn employees. More Information 🔒 FBI - Ransomware Awareness for Holidays and Weekends https://www.cisa.gov/uscert/ncas/alerts/aa21-243a 🔒 Why do cyber-attacks increase during holidays? - Security Boulevard https://securityboulevard.com/2022/12/why-do-cyber-attacks-increase-during-… https://www.linkedin.com/pulse/prepare-now-holiday-weekend-cyberattacks-ris… PREPARE FOR HOLIDAY TRAVEL ON AND OFF THE JOB More Than 502 People May Die in Preventable Traffic Crashes Over Thanksgiving https://www.prnewswire.com/news-releases/more-than-502-people-may-die-in-pr… National Safety Council urges all drivers to share the road responsibly by following these safety tips during this holiday season—and always: * Prepare before you go: Before hitting the road, make sure your car is safe for driving. Vehicle owners should check the oil, put air in the tires, and check for and repair open recalls. Visit ChecktoPrtect.org<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=181857447&u=https%3A%2F%2Fw…> to see if your vehicle has an open recall, and get it repaired for free. * Buckle up: Lack of seat belt use is a top cause of fatalities in crashes. Buckle up, while also making sure you have appropriate car seats installed correctly<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=3783644550&u=https%3A%2F%2F…>. * Designate a sober driver or arrange alternate transportation: Holidays are a cause for celebration, but alcohol is only one cause of impaired driving. Drugs, including opioids, marijuana and some over-the-counter medicines, can cause drowsiness, alter visual functions and affect mental judgment and motor skills. * Slow down: Speeding is a factor in more than a quarter of all traffic fatalities<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=795979627&u=https%3A%2F%2Fi…>. Drive the speed limit or below it if conditions dictate. Be sure to pay close attention to those walking and biking in order to keep all road users safe. * Drive distraction-free: Thousands have died in car crashes involving cell phone use. Put your phones away and #JustDrive. * Look before you lock: Pediatric vehicular heatstroke is still the leading cause of non-crash motor vehicle-related fatality for children. So far in 2023, 19 children in the U.S. are reported to have died<https://c212.net/c/link/?t=0&l=en&o=3953261-1&h=1235261407&u=https%3A%2F%2F…> because of this completely preventable tragedy. Always check your back seat for children or animals when you reach your destination. PREPARE FOR YOUR FACILITIES FOR THE HOLIDAYS See attached. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.” CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

U.S. Department of Health and Human Services Issues First Enforcement Action Under HIPAA Security Rule Risk Analysis Initiative
by Frank Hatfield Nov. 13, 2024

Nov. 13, 2024

County governments that are regulated in whole or in part by HIPAA need to be aware of a recent enforcement action against a county ambulance authority which was clearly designed to put counties big and small on notice of the importance of paying close attention to the Security Rule requirements under HIPAA. Attached please find a Cybersecurity, Data Protection & Privacy Update. Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image001.png@01DB35E3.9CFDD210] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Ohio State Highway Patrol Warns of Increased Deer-Involved Crashes During Fall Months
by Jim Hale Nov. 13, 2024

Nov. 13, 2024

OSHP Crash Dashboard set to Deer-Related crashes for the period of 1/1/2019 to 11/12/2024 [cid:image001.jpg@01DB35AF.9B0F4620] OSHP Crash Dashboard: https://statepatrol.ohio.gov/dashboards-statistics/ostats-dashboards/crash-… The Ohio State Highway Patrol (OSHP) is urging motorists to be especially cautious during the fall months as deer-related crashes rise significantly. Since 2019, there have been 109,507 deer-involved crashes on Ohio roadways. While most of these crashes-95%-resulted in only property damage, there have been 44 fatal crashes, leading to 45 deaths. The majority of deer crashes occur during the fall. From 2019 to 2023, nearly half (47%) of these crashes happened in October, November, and December, with November accounting for 22% of all deer-related incidents. Colonel Charles A. Jones, Patrol Superintendent, advised drivers to stay focused and practice safe driving habits. "Practicing safe driving habits and staying fully focused on the road increases your chances of spotting deer before it's too late," he said. "If you do strike a deer, prioritize your safety by moving to a secure location, turning on your hazard lights, and reporting the incident." The counties with the highest number of deer-related crashes include Stark (3,138 crashes), Richland (2,880), Hancock (2,725), and Defiance (2,560), which together account for 10% of all deer-involved crashes in Ohio. Additionally, more than 100 deer crashes have occurred in nearly every county across the state since 2019. To reduce the risk of a collision with wildlife, OSHP recommends the following tips: * *Scan the road ahead for wildlife, especially in rural areas. * Use high-beam headlights when possible, as they help to illuminate the road further. * Be extra cautious at dawn and dusk, when deer are most active. * If a collision is unavoidable, brake firmly but do not swerve as this can cause you to lose control of your vehicle. Motorists are also reminded that they can dial #677 from their mobile phones to reach the nearest Ohio State Highway Patrol post in the event of an emergency on the road. For more detailed crash statistics, including a statistical map of deer-involved incidents, visit the Ohio State Highway Patrol's OSTATS Dashboard<https://statepatrol.ohio.gov/dashboards-statistics/ostats-dashboards>, which provides data on traffic safety and crash trends across the state. Stay alert, drive safely, and help reduce the number of deer-related accidents this season. James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 " The leader in providing Ohio Counties with exceptional value, service, and protection of assets."

1 0

Driving & Drug policies
by Dawn Fry Nov. 12, 2024

Nov. 12, 2024

Good morning, I was wondering what other counties have for their driving and drug policies? If you'd be willing to share both driving and drug policies? We are interested in knowing when and who they test including post-accident and if any modifications have been made to who would not apply if medical marijuana was used by an employee. For example anyone not safety sensitive, driving on behalf of the county, etc. Thanks, [Dawn's Signature (002)]

2 1

Don't Inadvertently Give Email Access to Bad Actors
by Frank Hatfield Nov. 7, 2024

Nov. 7, 2024

Halloween has passed, but there's plenty of spooky things lurking online where we live a good portion of our lives these days. The data cookies we create online may give bad actors access to our email and, as we all know, theft by way of business email compromise is on the rise. We can expect criminal activity to increase during the holiday season. Below is an FBI press release issued this week on this topic and recommendation on how to reduce the risk of you and your county/agency from falling victim. As always, please be safe and feel free to contact us regarding CORSA loss control services. Frank Cybercriminals Are Stealing Cookies to Bypass Multifactor Authentication The FBI Atlanta Division is warning the public that cybercriminals are gaining access to email accounts by stealing cookies from a victim's computer. A "cookie" is a small piece of data that a website sends to your computer, allowing the website to remember information about your session, such as login details, preferences, or items in your shopping cart. "Remember-Me cookies" are tied specifically to a user's login and often last for 30 days before expiring. This type of cookie helps a user login without having to keep putting in their username, password, or their multifactor authentication (MFA). Typically, this type of cookie is generated when a user clicks the "Remember this device" checkbox when logging in to a website: [Atlanta Remember This Device Screenshot] If a cybercriminal obtains the Remember-Me cookie from a user's recent login to their web email, they can use that cookie to sign-in as the user without needing their username, password, or multifactor authentication (MFA). For these reasons, cybercriminals are increasingly focused on stealing Remember-Me cookies and using them as their preferred way of accessing a victim's email. Victims unknowingly provide their cookies to cybercriminals when they visit suspicious websites or click on phishing links that download malicious software onto their computer Here are tips to protect yourself from putting yourself at risk: * Regularly clear your cookies from your Internet browser. * Recognize the risks of clicking the "Remember Me" checkbox when logging into a website. * Do not click on suspicious links or websites. Only visit sites with a secure connection (HTTPS) to protect your data from being intercepted during transmission. * Periodically monitor the recent device login history from your account settings. Anyone who is a victim of an account takeover or Internet scam should report it to the FBI Internet Crime Complaint Center (IC3) at www.ic3.gov<http://www.ic3.gov/>. https://www.fbi.gov/contact-us/field-offices/atlanta/news/cybercriminals-ar… Frank Hatfield CORSA Assistant Director fhatfield(a)ccao.org<mailto:fhatfield@ccao.org> 614-560-1474 614-220-0209 Fax www.corsa.org<https://urldefense.com/v3/__http:/www.corsa.org/__;!!Op5JcThCjWm-UA!zzz1QnD…> [cid:image002.png@01DB30DB.5D4A40C0] " The leader in providing Ohio Counties with exceptional value, service, and protection of assets." CONFIDENTIALITY NOTICE: This e-mail message (including any attachments) is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy this message and all attachments.

1 0

Uniform Allowance
by Pamela S. Davis Oct. 24, 2024

Oct. 24, 2024

Does anyone have a policy regarding uniform allowance that specifically indicates dollar amounts or # of shirts, pants, etc. permitted annually? I appreciate any information you can share. Thanks! Pam Davis Human Resources Muskingum County 740-588-4371

2 2

Cybersecurity Awareness Month - Secure Our World - Week Four - Update Software
by Jim Hale Oct. 18, 2024

Oct. 18, 2024

Think Twice Before Putting Off Updates! Many people might select “Remind me later” when we see an update alert. However, many software updates are created to fix security risks. Keeping software up to date is an easy way for us to stay safer online. To make updates even more convenient, turn on the automatic updates in the device’s or application’s security settings! Keep Software Up to Date with Three Simple Steps: 1. Watch for notifications Our devices will usually notify us that we need to run updates. This includes our devices’ operating systems, programs and apps. It’s important to install ALL updates, especially for our web browsers and antivirus software. 2. Install updates as soon as possible When notified about software updates, especially critical updates, we should be sure to install them as soon as possible. Malicious online criminals won’t wait, so we shouldn’t either! 3. Turn on automatic updates With automatic updates, our devices will install updates without any input from us as soon as the update is available—Easy! To turn on the automatic updates feature, look in the device’s settings, possibly under Software or Security. Search settings for “automatic updates” if needed. Why It’s So Important to Update Promptly If a criminal gets into our devices through a security flaw, they will look for sensitive information to exploit. Technology providers issue software updates to "patch” security weak spots as quickly as they can. If we don’t install them, they can’t protect us! Software updates can also: * Fix bugs * Improve performance * Add features that can enhance our experience PRO TIP Every product you use should have auto-updates turned on by default. If you’re using a product or device that doesn’t have an auto-update option, ask your provider why not. It’s your information they’re putting at risk! Link to Understanding Patches and Software Updates: https://www.cisa.gov/news-events/news/understanding-patches-and-software-up… Secure Our World Resources & Cybersecurity Awareness Month 2024 Toolkit: https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-c… James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.”

1 0

FW: PRIMA’s 2024 National Cyber Security Awareness Month resources - Week 3
by Jim Hale Oct. 15, 2024

Oct. 15, 2024

From: PRIMA <primacomm(a)primacentral.mmsend.com> On Behalf Of PRIMA Sent: Tuesday, October 15, 2024 11:07 AM To: Jim Hale <jhale(a)ccao.org> Subject: PRIMA’s 2024 National Cyber Security Awareness Month resources - Week 3 [https://maassets.higherlogic.com/image/PRMA/PRM2417-NCSAM_24_Email_630px_ne…] Week 3 featured podcast Phishing Schemes and Risk Management Guests: Karl Miller Assistant Vice President, Sales & Compliance American Computer Estimating, Inc. Angelo Losardo Sales Support American Computer Estimating, Inc. On this week’s episode of PRIMA's NCSAM podcast series, Karl Miller and Angelo Losardo discuss phishing and its impact on risk management. Karl and Angelo explain the legal and practical definition of phishing and explain how it affects risk operations. They also provide an overview of common phishing schemes and how to combat them. Listen now<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=h9BCo5jraZqG…> [https://maassets.higherlogic.com/image/PRMA/Alliant200_2916937.png] Additional resources from Alliant Six Phishing Scams that Can Hobble Your Business The term “phishing” refers to a type of cybercrime that involves the use of emails or other electronic communication to trick the recipient into divulging sensitive information, clicking on harmful links, or opening malicious attachments. Read more<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=paZFZzj2Y5kl…> [https://maassets.higherlogic.com/image/PRMA/Travelers250px_2916926.jpg] Additional resources from Travelers Network Security Tips & Guidelines Each year, attacks on cyber networks have resulted in the loss of important data costing businesses millions. The annual Travelers Risk Index shows that many companies surveyed worry about cyber risks. Aggressive and extensive protection strategies may help you prepare against external attacks and maintain the safety of your network. Read more<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=T0dDnqtrYY9-…> [https://maassets.higherlogic.com/image/PRMA/WTW_logo_200px_2928854.jpg] Additional resources from WTW Tips on Implementing Multi-Factor Authentication The current cyber threat environment has increased the focus on authentication measures to help ensure data and systems are accessed by the appropriate people. The proliferation of usernames and passwords on the dark web has forced the need of different factors of authentication beyond the common password. Enter multi-factor authentication (MFA). Read more<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=bSbhR5OqFLCK…> The National Cyber Security Alliance (NCSA) and the U.S. Department of Homeland Security (DHS) designated October as National Cyber Security Awareness Month (NCSAM). NCSAM was designed to serve as a collaborative effort among federal, state and local governments as well as non-governmental organizations, to increase awareness regarding the significance of cyber security and provide the necessary resources to ensure people are safe and secure online. [Facebook]<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=jJ89VfXwOjkx…> [Twitter]<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=abv6IlgRyOkz…> [Linkedin]<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=EFwdj2nI4w-l…> [YouTube]<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=ACfXgg0MfmsL…> [RSS]<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=JKC45RUdvXB4…> Click here to unsubscribe.<http://www.mmsend56.com/link.cfm?r=hXPlZdzAL3Tu3eWB9PTj-w~~&pe=uYEE2FaAGey1…> 700 S.Washington Street, Suite 218, Alexandria, VA 22314

1 0

Cybersecurity Awareness Month - Secure Our World - Week Three - Recognize & Report Phishing
by Jim Hale Oct. 15, 2024

Oct. 15, 2024

Don’t Take the Bait Phishing occurs when criminals try to get us to open harmful links, emails or attachments that could request our personal information or infect our devices. Phishing messages or “bait” usually come in the form of an email, text, direct message on social media or phone call. These messages are often designed to look like they come from a trusted person or organization, to get us to respond. Stay Safe with Three Simple Tips 1. Recognize Look for these common signs: * Urgent or emotionally appealing language, especially messages that claim dire consequences for not responding immediately * Requests to send personal and financial information * Untrusted shortened URLs * Incorrect email addresses or links, like amazan.com A common sign used to be poor grammar or misspellings although in the era of artificial intelligence (AI) some emails will now have perfect grammar and spelling, so look out for the other signs. 2. Resist If you suspect phishing, resist the temptation to click on links or attachments that seem too good to be true and may be trying to access your personal information. Instead, report the phish to protect yourself and others. Typically, you’ll find options to report near the person’s email address or username. You can also report via the “report spam” button in the toolbar or settings. 3. Delete Delete the message. Don’t reply or click on any attachment or link, including any “unsubscribe” link. Just delete. If a message looks suspicious, it's probably phishing. However, if you think it could be real, don't click on any link or call any number in the message. Look up another way to contact the company or person directly: * Go to the company's website and capture their contact information from the verified website. Search for the site in your web browser or type the address yourself if you’re sure you know it. * Use another way to reach the person to confirm whether they contacted you. For example, if you get a strange message from your friend on Facebook, and you have their phone number, text or call them to ask if they sent the message. Link to Avoiding Social Engineering and Phishing Attacks: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phish… Link to Using Caution with Email Attachments: https://www.cisa.gov/news-events/news/using-caution-email-attachments Secure Our World Resources & Cybersecurity Awareness Month 2024 Toolkit https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-c… James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.”

1 0

Cybersecurity Awareness Month - Secure Our World - Week Two - Stay Safer Online: Enable MFA
by Jim Hale Oct. 7, 2024

Oct. 7, 2024

Turn on MFA for each account or app! 1. Go to Settings It may be called Account Settings, Settings & Privacy or similar. 2. Look for and turn on MFA It may be called two-factor authentication, two-step authentication or similar. 3. Confirm Select which MFA method to use from the options provided by each account or app. Examples are: * Receiving a numeric code by text or email * Using an authenticator app: These phone apps generate a new code every 30 seconds. Use this code to complete logging in. * Biometrics: This uses our facial recognition or fingerprints to confirm our identities. Now that we’ve set up MFA, when we log into our accounts, it may challenge us to complete the MFA step that proves our identities. It only takes a moment but makes us much safer from hackers! Turn on MFA for every account or app that offers it. Enabling MFA will protect things like: * Banking information * Online purchases * Social media * Email * Businesses * Your identity PRO TIP Check to see whether your email accounts, banks, healthcare providers, and other important accounts offer MFA and enable it by default. If they don’t, ask them why not. It’s your information they’re putting at risk! Phishing Resistant MFA is Key to Peace of Mind - https://www.cisa.gov/news-events/news/phishing-resistant-mfa-key-peace-mind Secure Our World Resources & Cybersecurity Awareness Month 2024 Toolkit https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-c… James Hale, ARM-P, ARM-E Risk Control Consultant County Risk Sharing Authority 209 East State Street Columbus, OH 43215 614.246.1630 FAX 614.220.0209 “ The leader in providing Ohio Counties with exceptional value, service, and protection of assets.”

1 0