1-888-643-2217 Email ABEX
Keeping you updated

Category Archives: Cyber Liability

7 Cybersecurity Practices Your IT Managed Service Provider Should Be Addressing

Targeted ransomware attacks against IT managed service providers (MSPs) are on the rise with potentially catastrophic implications for both the MSP and the customers who depend on them.

Both the frequency of attacks and the associated ransom demands are climbing, not to mention the reputational impact and potential litigation the MSP may face from disgruntled customers who are unable to access their network.

CFC put together the following basic best practices that MSPs should be putting front of mind to protect themselves, and by extension, their customers:

  1. MFA for MSPs, please
    It’s crucial that MSPs implement advanced multi-factor authentication (MFA) on all applications to reduce the risk of a malicious third-party intrusion. This process is used to ensure that a person is who they say they are by requiring a minimum of two pieces of unique data that corroborates their identity. This unique data comes in three forms – something you know (i.e. your password), something that you have (i.e. a one-time passcode generated by an app or hardware token), or something you are (i.e. fingerprint, retinal pattern, voice signature or facial recognition). A significant number of cyber incidents could be avoided simply by implementing advanced MFA. Find out more.
  2. Password123 really is as easy as ABC
    Simple and commonly used passwords enable intruders to easily gain access and control of a computer, whether they are taking advantage of unchanged default settings or running brute force attacks. It may sound simple, but strong, long, unique passwords that are changed regularly are a must for all MSP employees. Keeping track of passwords can be difficult – one little trick is to use sentences as passwords, but you can also use one of a number of handy and affordable password managers on the market.
  3. Whoa! Back it up!
    MSPs should not only be doing regular backups of their data, but ensuring that those backups are bulletproof. This means storing these outside the network and offsite and testing them regularly. To find out how failed backups affected one of the technology firms CFC insures, check out this cyber claims case study.
  4. Responsibility for cybersecurity
    Given the potential widespread impact of a breach emanating from an MSP, every MSP should have a written cybersecurity program with a person assigned a role as a cybersecurity officer who has relevant experience and qualifications. Cybersecurity should not be considered an afterthought or an upsell – it should be a number one priority for all MSPs, with someone internally designated to lead the charge on cyber protection and risk mitigation.
  5. Know your client
    Sales are one thing but are you aware of what your client’s expectations and needs are?  Different industry segments have vastly different requirements – including uptime requirements and backup frequency. Taking on clients and treating them all equally without understanding their specific requirements can have disastrous consequences in the event of a cyber event. Clients in the healthcare, legal and financial sectors, for example, hold and rely on a lot of sensitive information and thus should be treated differently. A  significant outage from a cyber event can be disastrous for them – and in turn for the MSP too!
  6. Know your vendor
    Even if an MSP has the most robust security program possible, their data is only as secure as the weakest vendor that has access to their data. It is therefore critical that all MSPs have a vendor due diligence program to ensure their cybersecurity practices meet minimum standards. This is crucial in mitigating and avoiding threats.
  7. Know your weaknesses
    It might sound obvious, but all MSPs should implement an effective vulnerability management program which identifies and remediates security vulnerabilities in software. Vulnerability management is not just about patching (though very important!) but about making informed decisions and properly prioritizing the most serious security vulnerabilities first.

Source: www.cfcunderwriting.com

What Makes Up a Cyber Policy

Cyber insurance policies tend to be modular in nature, meaning that they consist of a variety of different coverage areas. For many, that has led to confusion around how exactly this cover fits together to create a uniform whole.

To help explain this further, CFC has dissected their cyber policy section by section to show how each part of this body of coverage functions. Check it out below or download it to be able to adjust the document size or to share with your clients.

Source: www.cfcunderwriting.com

Nursing Home Faces Huge Financial Loss from Social Engineering

Social engineering involves the use of deception to manipulate individuals into carrying out an act, such as transferring money, handing over confidential information, or clicking on a malicious link, and it’s causing serious financial harm to organizations around the world.

Any organization that transfers funds electronically can be susceptible to social engineering attacks, and entities operating in the care sector are no exception to this. Many care homes not only receive funds electronically in the form of payments from residents and their families or funding from government bodies, but they also disburse large amounts of money in the form of payments to members of staff and to third party suppliers and contractors. All these transactions make for a tempting target for cybercriminals, who are constantly on the lookout for opportunities to intercept fund transfers and divert them to fraudulent accounts.

One of CFC policyholders affected by such a loss was a company providing assisted living facilities for elderly residents across three sites.

In this case, the care home was the victim of what is sometimes known as “CEO fraud”. CEO fraud typically describes a situation in which a fraudster impersonates the CEO or another senior executive of an organization and instructs an employee to make an urgent payment to a fraudulent account for a particular reason.

Password protection problems

In this instance, the fraud appears to have stemmed from a targeted brute force attack on the care home’s CEO’s business email account. A brute force attack is where a hacker uses a computer program to crack passwords by trying numerous possible password combinations in rapid succession, with the program typically trying a long list of the most commonly used passwords. The longer and more complex the password, the more difficult and time consuming it is for the program to crack.

Unfortunately, the CEO’s email account did not have a strong password in place. With the password lacking in both length and complexity, the program was able to crack it. To make matters worse, the care home did not have multi-factor authentication enabled for remote access to email accounts, meaning that as soon as the CEO’s password was cracked, the hacker was able to gain access to his account without having to go through a second verification procedure, such as inputting verification code or number.

Having gained access to the CEO’s email account, the fraudster was able to spend time perusing the CEO’s inbox and outbox, gathering valuable information about how wire transfers were processed at the company as well as establishing the working relationship that the CEO had with members of the care home’s finance team. What’s more, the fraudster was also able to access the CEO’s calendar and establish what the CEO would be doing on any given day.

Having worked out the CEO’s schedule from his calendar, the fraudster waited until the CEO was on holiday. With the CEO not on site at the care home and with reduced chances of the scam being uncovered, the fraudster chose this moment to strike.

The first step was to send an email impersonating the CEO to a member of the care home’s finance team. The fraudster used a method known as email spoofing, which is when someone sends an email from one email address but labels it as being sent from a different address. Fraudsters use programs or websites which enable them to make an email look as though it has come from a legitimate email address, as well as allowing them to alter the address that the recipient responds to. The fraudster sent an email that appeared to come from the genuine email address of the care home’s CEO, and any response to the email was sent to a remarkably similar looking email address set up by the fraudster.

So while the emails sent by the fraudster appeared to come from the CEO’s genuine email address of Joe.Bloggs@XYZresidentialcare.com, any response to that email would automatically be sent to Joe.Bloggs@XYZresidentilcare.com, ensuring that the CEO wouldn’t see any response from the member of the finance team to the email and uncover the scam.

The fraudulent email explained that the CEO had received notice of an outstanding payment of $47,584 that needed to be paid urgently to a firm that had supposedly provided some management consultancy work for the care home a few months ago. The email included the account details that the funds needed to be sent to and the fraudster was keen to stress that the payment had to be made the same day.

Fine tuning the scam

The fraudster also added some subtle touches to the email to make it look as authentic as possible. The CEO addressed the member of the finance team using an abbreviated version of her full name, which the fraudster appears to have picked up from viewing previous email correspondence between the CEO and this member of the finance team. The fraudster also mentioned that he was enjoying his holiday and would be busy all day and signed off with the CEO’s genuine email signature.

In normal circumstances, the member of the finance would have confirmed the details of the transfer with the CEO in person. But with the CEO on holiday, and with the email appearing to come from the correct address, along with the use of her nickname and a genuine email signature, the employee assumed that the request was genuine. Not wanting to disturb the CEO while on holiday and conscious that the payment was urgent, the employee paid the funds into the account and sent an email confirming this to the account run by the fraudster.

Seeing that the initial ruse had worked, the fraudster sent a similar email the following day, this time requesting a payment be made for $39,731 to another account. The employee arranged the payment once more, meaning that some $87,315 in total was transferred to accounts controlled by the fraudster.

The scam was only discovered a week later when the CEO returned to the office and the payments were brought up in conversation. The care home reported the incident to local law enforcement and tried to get the recipient banks to recover the funds, but most of the money had been withdrawn from the accounts. One of the banks was able to recover a meager $600, leaving the care home $86,715 out of pocket. Fortunately, the care home had purchased cybercrime cover on their cyber policy with CFC and were able to recover most of the loss.

The key driver for cyber claims? Human error

This claim firstly illustrates how CEOs and senior executives are prime targets for cybercriminals. These individuals usually act as the face of their companies and tend to have bigger profiles on company websites and social media accounts, allowing cybercriminals to gather valuable information about them. In addition, cybercriminals know that employees are instinctively less likely to question instructions from CEOs and other senior executives. Individuals in leadership roles need to be especially conscious of sticking to good cybersecurity practices, such as having good password management in place. Likewise, employees need to be alert to suspicious emails from senior executives, particularly in instances where an urgent payment request is made, and have robust callback and authentication procedures in place.

Finally, this claim also discredits one of the most common objections to cyber insurance: namely that by investing in IT security, organizations have no need for cyber insurance. But most cyber incidents are a result of human error. With increasingly sophisticated attacks like this on the rise, it makes it very difficult for employees to tell the difference between a real email and a fake one. Furthermore, with more and more financial transactions being carried out electronically, the number of opportunities for cybercriminals to steal these funds has never been greater. Having good training and authentication procedures can certainly help reduce the risk of an event like this, but it’s impossible for any business to be completely impervious to attacks. This is why cyber insurance should be a part of any prudent organization’s risk management program, acting as a valuable safety net should the worst happen.

Source: www.cfcunderwriting.com

City Government Falls Victim to Social Engineering

Social engineering involves the use of deception to manipulate individuals into carrying out a particular act, such as transferring money, handing over confidential information, or clicking on a malicious link, and it’s causing serious financial harm to organizations around the world.

Any organization that transfers funds electronically can be susceptible to social engineering attacks, and entities operating in the public sector are no exception to this. Public entities not only receive funds electronically in the form of grants from central government and tax receipts from local residents, but they also disburse large amounts of money both internally to different departments and externally to third party suppliers and contractors. All these transactions make for a tempting target for cybercriminals, who are constantly on the lookout for opportunities to intercept fund transfers and divert them to fraudulent accounts.One of our policyholders affected by such a loss was a local government for a city with a population of around 140,000. The city government’s responsibilities include public transportation, car parking facilities, social housing, parks and recreation areas, and recycling and waste disposal, and more.

Fraudster glimpses prime opportunity

The scam all began when an employee from the city’s finance department fell for a credential phishing email. Credential phishing emails are used by malicious actors to try and trick individuals into voluntarily handing over their login details, typically by directing them through to a fake login page.

In this case, the employee received an email purporting to be from Microsoft. The email explained that the employee’s email account details needed to be verified in order for them to continue to use Outlook without disruption. With the email appearing to come from an official source and with the employee not wanting to suffer any disruption to her work, she clicked on the link included in the email. The link took her through to a seemingly legitimate landing page with Microsoft branding in place, where she inputted her email login details. Assuming that her account had been verified, the employee gave no further thought to the incident. However, by inputting her credentials on this login page, the employee had inadvertently passed on her details to a fraudster.

To make matters worse, the city government had not enabled multi-factor authentication on staff email accounts, so the fraudster was able to use the credentials to access this employee’s account remotely. This allowed the fraudster to monitor communications to and from the account and gather valuable information about any upcoming transactions.

As it happened, the city government was in the process of building a new social housing development and had contracted a third-party construction firm to carry out the building work on the project. The construction firm would send regular invoices for the work carried out to the city’s finance department, who would then arrange for a payment to be made to the construction firm’s bank account. The fraudster managed to find the email correspondence between the employee in the finance department and the finance director of the construction firm, and in the process, the fraudster established that the latest invoice, totaling $213,456, had been sent over and was due to be paid within a few weeks. Having spotted a lucrative opportunity, the fraudster chose this moment to strike.

Scam set up in a flash

The fraudster’s first step was to set up a forwarding rule in the employee’s email account. Forwarding rules are settings that can be applied to an email account which ensure that certain emails are automatically forwarded to a specific folder or to another email account. In this case, the fraudster set up a forwarding rule that meant that any emails that featured the construction firm’s genuine domain name were automatically marked as read and sent directly to the account’s deleted items folder.

The next step was to set up an email address impersonating the construction firm’s finance director. To the untrained eye, this was exactly the same as the finance director’s, but crucially omitted a character from the domain name. So rather than reading Joe.Bloggs@XYZconstruction.com, it read Joe.Bloggs@XYZconstuction.com.

The final step was to send an email to the employee in the city’s finance department from this fake account. In the email, the fraudster explained that the construction firm’s usual account was being audited and that meant that they were pausing all transactions while this was taking place. The email then went on to explain that a temporary account had been set up as an alternative and that all upcoming invoice payments should be sent there in the meantime, with the fraudster attaching a document with the new account details attached.

The fraudster also added some touches to the email to make it look as authentic as possible. For example, the fraudster forwarded the original email correspondence between the city government’s employee and the construction firm’s finance director to the fraudulent email address, with the fraudster then responding to this email correspondence and making it look as though the fake email was part of the original email chain. The fraudster also signed off with the finance director’s genuine email signature and the document with the fake account details featured the construction firm’s genuine logo and address details.

With the fraudster’s email forming a part of the original email chain and coming from a seemingly identical email address, along with a plausible excuse for changing the account details temporarily, the employee in the city’s finance department never doubted the legitimacy of the request and the construction firm’s account details were changed, resulting in $213,456 being sent to the fraudulent account.

Discovered too late

It was only when the construction firm’s finance director called up the city’s finance department a few weeks later to inquire about the status of the payment that the scam was finally uncovered. The banks involved and local law enforcement agencies were immediately notified about the scam and attempted to recover the loss, but by this point it was too late to retrieve the funds as they had already been transferred out of the
fraudulent account.

With the lost funds deemed unrecoverable and the construction firm still expecting its invoice to be paid, the city government had no choice but to pay the invoice again, resulting in a significant financial loss. Thankfully, however, the city was able to recoup the stolen funds under the cybercrime section of its cyber policy with CFC, which provides cover for social engineering-style losses such as these.

Follow-up with a call and other key takeaways

This case highlights a few key points. Firstly, it illustrates why any organization that is undertaking a construction project should be extra vigilant when it comes to funds transfer fraud. Cybercriminals know that any construction project is likely to require sizable transfers of money, which makes it a particularly lucrative and tempting area for them to target. Any organization involved with a construction project, whether it’s the entity that’s paying for the project or the contractors carrying it out, should be on their guard to prevent funds from being intercepted by fraudsters.

Secondly, it shows just how skillful cybercriminals are becoming at parting innocent organizations from their money and how difficult it is to spot a fake. In this case, the fraudster managed to successfully impersonate Microsoft and manipulate the city’s employee into handing over her login details; set up a forwarding rule to prevent any genuine emails from the construction firm from reaching the employee and jeopardizing the scam; set up a fraudulent email address that was virtually identical to the construction firm’s finance director’s address; make it look as though the fake email sent to the employee was part of the original email chain, and make use of the finance director’s genuine email signature and the construction firm’s logo and address on the document containing the fake account details.

Finally, it highlights the importance of having call back procedures in place. Call back procedures work by ensuring that whenever a new payee account is set up or a change of account is requested, the request is verified by having a member of the accounts department call the person or company requesting the change on a pre-verified number to confirm that it is legitimate. If the city’s finance department had had this procedure in place and the employee had followed it, it’s highly unlikely that the funds would have been intercepted. Having call back procedures in place, alongside staff training on phishing risks and multi-factor authentication on email accounts, can significantly reduce an organization’s exposure to funds transfer fraud. Nevertheless, it’s worth noting that none of these methods are fool-proof and it’s very difficult to eliminate this risk entirely, especially when human error is factored in. And that’s why cyber insurance can be such a useful purchase, providing a valuable safety net when things go wrong.

Remote Working Vulnerabilities Hit School Hard

The CFC case study below explains how hackers accessed a school’s systems through remote desktop protocol and held data to ransom.

The education sector is no exception to the massive technological changes that have occurred over the past 20 years or so. Schools in particular are now increasingly dependent on their computer systems to provide students with a 21st century education. Both teachers and students now regularly make use of computer technology in the classroom, whether that be through delivering PowerPoint presentations on interactive whiteboards, conducting interactive learning on tablets and laptops, completing online assessments and tests, or using software programs for compiling student grades and monitoring classroom attendance. Schools are also seeing a shift away from paper filing and are storing more and more of their important data in an electronic format.

Although the use of computer technology has undoubtedly brought many benefits to schools, their increasing dependence on computer systems and electronic databases also makes them vulnerable to cyber losses. If teachers and staff are unable to gain access to their computers, whether that be as a result of a malicious cyber attack or a non-malicious system failure, it can result in serious operational disruption for the school. And if a hacker gains access to sensitive electronic data held by the school, it could have a negative impact on the school in terms of both its finances and its reputation.

One of CFC policyholders affected by a cyber loss was a private school responsible for educating approximately 800 students aged 11-18, with the school catering for both day and boarding students.

The incident began when a hacker managed to gain access to the school’s computer systems through the remote desktop protocol (RDP). RDP allows remote users to connect to the desktop of another computer through a network connection and is typically used by schools to allow staff and students to access their networks whilst they are not on school premises. In this case, the port that the school used for RDP access was exposed directly to the internet. Hackers are constantly using scanning tools to identify vulnerable organizations and establish any weak points that they may have in their cyber security, and an RDP port that is exposed directly to the internet is one of the most common that they look out for.

Having identified this area of weakness, the hacker looked to gain access to the school’s network by initiating a brute force attack against a local administrator account. A brute force attack is where a hacker uses a computer program to crack passwords by trying numerous possible password combinations in rapid succession, with the program typically trying a long list of the most commonly used passwords. Generally speaking, the longer and more complex the password, the more difficult and time consuming it is for the program to crack. Unfortunately, however, the school’s local administrator account had a weak password in place that had been used as a default but never been changed. With the password lacking in complexity, the program quickly cracked the password. What’s more, the school did not have multi-factor authentication enabled for RDP access, so as soon as the password was cracked, the hacker was able to gain access to the school’s network without having to go through a second verification procedure.

Upon gaining access, the hacker took the opportunity to unleash ransomware across the school’s computer systems. Ransomware is a type of malicious software that works by encrypting data on a network, and then demands that a ransom be paid in exchange for a decryption key to regain access to the data. In this case, the ransomware had encrypted multiple servers, effectively locking the school out of its computer systems, and the hacker demanded a payment of 2 bitcoin for the decryption key. In many cases, it’s possible to mitigate ransomware attacks by recovering from back-up. However, the school’s back-ups were contained on one of the servers encrypted by the ransomware, rendering them useless.

Fortunately for the school, the ransomware attack occurred over the course of a school holiday, but without being able to restore from back-ups, the school recognized that a great deal of disruption would ensue if its computer systems were still unavailable once students returned. For example, the school would be unable to have ready access to highly important information, such as the financial information needed for accounting purposes, details about prospective students for the next school year and critical information about students under the school’s care, such as medical records and dietary requirements;  teachers would be unable to make use of interactive whiteboards to provide presentations to students; students would no longer be able to use e-learning courses in the classroom or complete online assessments; and boarding students would be unable to complete homework assignments on schools computers in the evening.

With the prospect of significant operational disruption looming over the school, it was at this point that the incident was notified to CFC’s incident response team. The team’s first priority was to establish what ransomware variant had been used in the attack by looking at a copy of the ransom note and a sample of the encrypted files. Having identified the likely ransomware variant, the team then carried out some research to see if there was any way of removing the ransomware without paying the ransom demand. One of our incident response partners produces a regularly updated list of freely available decryption keys for known ransomware variants. Luckily for the school, the team were able to find a decryption key online. With the decryption key to hand, the school was able to begin the process of decrypting the affected data and applications without having to pay the ransom.

However, even though the school had managed to regain access to its computer systems, there was still a question mark over whether the attack had resulted in a data breach. The ransomware attack had impacted servers containing sensitive data, including parents’ names, phone numbers, and residential addresses; data on past and present students, such as grades, attendance, disciplinary and medical records; information on staff, such as contact details, addresses and bank account details; and information on prospective students who were likely to be inducted in the next school year. As the school was subject to local data breach notification laws, it meant that if it transpired that some or all of this data had been accessed or exfiltrated in the course of the attack, the school would have to notify the affected individuals, potentially resulting in a regulatory investigation and damaging the school’s reputation in the eyes of staff, students and parents alike.

In order to address this issue, we engaged one of our incident response partners to conduct a forensic investigation to establish how the hacker had gained access to the insured’s computer systems and whether they had accessed any sensitive data whilst they were there. Unfortunately, when the hacker had carried out the attack, they had set up a temporary user profile, which meant that there was no way of knowing for sure what folders the hackers may have explored and what files may have been opened.

Nevertheless, our incident response team and our forensic partners were able to establish some pertinent facts about the case. First, based on previous incidents and threat intelligence, the ransomware variant used during the course of the attack was not known to be capable of accessing or exfiltrating data. Second, the bandwidth usage logs obtained from the school’s internet service provider did not show high levels of traffic during the period that the hacker had access to the school’s computer systems, indicating that there had not been any major data exfiltration from the school’s network. Third, the hacker was only logged on to the school’s computer systems for a short period of time, suggesting that they were primarily focused on deploying the ransomware rather than seeking out sensitive data.

Given this, our forensic partners determined that the hackers main motive appeared to be financial gain through the use of ransomware, rather than the theft of sensitive data. After engaging legal advice to determine whether a data breach notification would be required, the lawyers advised that, based on the findings of the forensic investigation, no notification would be needed in this instance, thus ensuring that the school’s reputation was not damaged unnecessarily.

The total cost of carrying out a root cause analysis, network security assessment, forensic investigation and engaging legal counsel came to £17,560, all of which was covered by the school’s cyber policy with CFC.

This claim highlights a few key points. Firstly, it highlights the importance of securing the remote desktop protocol (RDP) effectively. If organizations are using RDP, they should make sure that it is not directly exposed to the internet and use a virtual private network (VPN) instead. In addition, businesses should ensure that they have good password hygiene in place and enable multi-factor authentication for any remote access to the network. If the school had had these measures in place, it is highly unlikely that the hacker would have gained access to its computer systems.

Secondly, it highlights the importance of having a good data back-up policy. In this case, the school had been prudent enough to back up its data. However, by not saving these back-ups external to the school’s servers, it meant that when the ransomware started encrypting, it encrypted the back-ups too. Ideally, businesses should maintain daily offline back-ups to help prevent back-ups from being compromised during the course of an attack.

Finally, this claim highlights the value of cyber insurance. When you buy a cyber insurance policy, you are not just buying a promise to pay valid claims. You are also paying for a service to help and advise you when things go wrong. In this case, CFC’s incident response team and our partners were able to provide threat intelligence on the ransomware variant and obtain a free decryption key, enabling the school to regain access to its computer systems; conducted a root cause analysis to establish how the hacker got into the system, enabling the business to identify and remedy any cyber security weaknesses; and conduct a forensic investigation that allowed us to determine that the ransomware attack had not resulted in a data breach, thus preventing the school from conducting an unnecessary notification procedure and needlessly damaging its reputation.

Source: cfcunderwriting.com



Receive notifications of new posts automatically.


Like us on Facebook

Connect with us on LinkedIn