Podcasts about Business email compromise

Send us a textEver wonder why organizations with robust cybersecurity teams still fall victim to devastating attacks? The answer often lies not in fancy technology but in something far more fundamental: documentation.In this eye-opening episode, Shon Gerber takes listeners into the critical world of cybersecurity documentation hierarchy, revealing how properly structured policies, standards, procedures, and guidelines form an organization's first and most important line of defense against threats.The stakes couldn't be higher. As Shon reveals, cybercriminals stole a record-breaking $6.6 billion from US entities last year - a shocking 33% increase from the previous year. Business Email Compromise alone accounted for $2.7 billion in losses, while individuals over 60 remain the most vulnerable demographic.What separates organizations that survive these threats from those that don't? Proper documentation that actually works rather than gathering digital dust. Shon breaks down the hierarchical relationship between different types of security documentation, providing real-world examples from healthcare and financial institutions to illustrate how these documents should build upon each other to create comprehensive protection.You'll learn why policies should represent management intent, standards should specify requirements, procedures should provide step-by-step guidance, and guidelines should offer flexibility - all while avoiding common pitfalls that render documentation useless. Shon provides practical advice on creating documentation that's clear, accessible, and actually used rather than just created to appease auditors.Whether you're preparing for the CISSP exam or working to strengthen your organization's security posture, this episode provides invaluable insights into creating documentation that transforms from a bureaucratic burden into powerful protection. Subscribe to CISSP Cyber Training for more expert guidance on mastering cybersecurity essentials and advancing your career in the field.Gain exclusive access to 360 FREE CISSP Practice Questions delivered directly to your inbox! Sign up at FreeCISSPQuestions.com and receive 30 expertly crafted practice questions every 15 days for the next 6 months—completely free! Don't miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!

How many videos and quizzes have you taken to show your skills at avoiding phishing emails and other types of Business Email Compromise? Have you been shamed or had to watch additional training videos? I know that in our world of email overload, it isn't a matter of if, it is a matter of when we might fall for one of the masterfully crafted phishing emails due to AI and other trickery. Join me as I discuss this and more with Craig Taylor of Cyberhoot.

In the special edition of the Payments Podcast Paymode Series, Paul McMeekin chats with Katie Elliot about how companies can keep fraud at bay and protect their business payments, including mitigating against BEC and check fraud. She also shares tips on trends that businesses should prepare for from a fraud perspective.

How has email security evolved over the years? What challenges do organizations face in protecting against sophisticated phishing attacks? Find out on this episode of Security Noise! Business Email Compromise (BEC) attacks are becoming increasingly common and sophisticated. In this episode, Geoff and Skyler speak with Incident Response Security Consultant Olivia Cate and Director of Advisory Innovation Rocky Brockway about BEC and what you can do to prepare your organization. We discuss which types of organizations are most vulnerable, the increasing rate of BEC attacks, and the methods used by attackers. Find out more about our Incident Response services on our website.  About this podcast: Security Noise, a TrustedSec Podcast hosted by Geoff Walton and Producer/Contributor Skyler Tuter, features our cybersecurity experts in conversation about the infosec topics that interest them the most. Hack the planet! Find more cybersecurity resources on our website at https://trustedsec.com/resources.

הפרק הראשון של הפודקאסט "מנהלים מדברים סייבר" "הונאות מנהלים" היא התקפה של הנדסה חברתית דרך דואר אלקטרוני. כאשר התוקף מזייף הודעת דואר אלקטרוני כדי להערים על הקורבן לבצע פעולה כלשהי, לרוב, העברת כסף לחשבון או למיקום שבשליטת התוקף עו"ד הדס בן אברהם ונחשון פינקו מארחים את כפיר אזולאי חוקר הונאות סייבר, מנכ"ל ומייסד משותף בסולביאו בנושא הונאות מנהלים The first episode of “Managers Talk Cyber podcast.” Business email compromise (BEC) is a social engineering attack over email. In a BEC attack, an attacker falsifies an email message to trick the victim into performing some action — most often, transferring money to an account or location the attacker controls. Adv. Hadas Ben Avraham and Nachshon Pincu host Kfir Azoulay CEO & Co-Founder @Solveo about Business email compromise (BEC).

I take a look at something many overlook when it comes to security in their Microsoft 365 environment - Exposure score. In essence it is like a targeted Secure Score for a particular threat like Business Email Compromise. There is also news and updates from the Microsoft Cloud so listen along and review the show notes for more information. Brought to you by www.ciaopspatron.com Resources @directorcia Join my shared channel CIAOPS merch store Become a CIAOPS Patron CIAOPS Blog CIAOPS Brief CIAOPSLabs Support CIAOPS The way to control EWS usage in Exchange Online is changing New Microsoft-managed policies to raise your identity security posture Storm-2372 conducts device code phishing campaign Block malicious command lines with Microsoft Defender for Endpoint Clipchamp: Elevating work communication with seamless video creation in Copilot  Sharing with Microsoft Whiteboard AI agents at work: The new frontier in business automation Copilot learning hub New Certification for Microsoft information security administrators What is Security Exposure Managenet?

Michael Centrella is the Deputy Assistant Director at the U.S. Secret Service. In this episode, he joins host Heather Engel to discuss business email compromise (BEC) scams, as well as the risk they pose to small businesses across the US, including how business owners can protect their organizations, the continuing evolution of the threat landscape, and more. • For more on cybersecurity, visit us at https://cybersecurityventures.com

Top 5 Phishing Exploits of 2024: Abnormal Security Report and More | Cybersecurity Today In this episode of Cybersecurity Today, host Jim Love delves into Abnormal Security's end-of-year report outlining the top five phishing exploits of 2024 and their predictions for 2025. The episode covers cryptocurrency fraud, weaponized file sharing services, multi-channel phishing, business email compromise, and email account takeovers. Additionally, it highlights the alarming rise of text-based job scams, the takedown of a major vishing ring in Spain and Peru, and a $5 million U.S. reward to disrupt North Korean IT schemes. Stay informed on the latest cybersecurity threats and protections. 00:00 Introduction to Cybersecurity Today 00:27 Top Phishing Exploits of 2024 00:37 Cryptocurrency Fraud and File Sharing Scams 01:54 Multi-Channel Phishing and Business Email Compromise 03:10 Email Account Takeover and Future Predictions 04:39 Rise of Task Scams 06:53 Massive Vishing Operation Busted 08:42 North Korean IT Worker Fraud 11:15 Conclusion and Final Thoughts

Cyber Security Today: Navigating Novel Phishing Campaigns and Ransomware Tactics Join host Jim Love and the Cyber Security Today panel featuring Terry Cutler of Cyology Labs, David Shipley of Beauceron Security, and cybersecurity executive John Pinard. In this episode, they delve into pressing cybersecurity challenges such as novel phishing tactics using corrupted Word documents, the importance of robust offboarding processes in light of breaches at major companies like Disney, and the ramifications of a major ransomware attack on the City of Hamilton. Topics also include the recurring issue of session cookie theft, the implications of third-party cybersecurity risk as seen in the Blue Yonder ransomware attack impacting Starbucks, and the rise of hacktivism. Tune in for valuable insights and discussions aimed at improving cybersecurity measures in an ever-evolving threat landscape. 00:00 Introduction and Panelist Introductions 00:40 David Shipley's Cyber Risk Talk 02:39 Novel Phishing Campaign Discussion 06:08 Fileless Malware and Human Error 10:44 Offboarding and Internal Audits 19:48 Vendor Responsibility and Ransomware 27:06 City of Hamilton Cyber Attack 28:19 Keynote Talks and Cybersecurity Challenges 29:30 The Reality of Cyber Attacks 29:46 Ransomware and Business Email Compromise 31:21 Cyber Insurance and Its Pitfalls 32:44 Andrew Tate Hack and Hacktivism 36:04 Chinese State-Sponsored Hacks 41:26 Canadian Cybersecurity Issues 44:53 Session Cookies and Two-Factor Authentication 49:45 AI in Software Development 56:42 Concluding Thoughts and Final Remarks

Unmasking Phishing: Evolution, Techniques, and Defense Strategies Join host Jim Love and cybersecurity expert David Shipley in this comprehensive episode as they uncover the evolving threats of phishing. From traditional email scams to sophisticated AI-powered attacks, they explore how cybercriminals exploit emotional triggers and familiar technologies. The episode covers various forms of phishing, including spear phishing, vishing, and QR phishing, and offers insights into the psychology behind these tactics. Learn about the critical role of Multi-Factor Authentication (MFA) and workplace culture in fortifying defenses against these threats. Understand the financial impact, latest research, and practical steps organizations can take to protect themselves. This episode is packed with valuable information for anyone looking to safeguard against cyber risks. 00:00 Introduction and Previous Research Recap 00:22 Emerging Sophisticated Phishing Attacks 01:27 Deep Dive into Phishing with David Shipley 03:13 History of Phishing 05:46 Types of Phishing Attacks 07:36 Business Email Compromise and Whaling 09:48 Sharking and Other Phishing Variants 14:31 Phishing Beyond Emails 19:07 Understanding Social Engineering in Phishing 19:52 Research Hypothesis on Phishing 23:25 Principles of Influence in Phishing 25:51 The Psychology of Phishing: Rewards and Scarcity 26:15 Scarcity Tactics in Phishing 28:09 Authority and Consistency in Phishing Attacks 29:57 The Role of Liking and Social Proof in Phishing 32:10 The Evolution of Phishing Techniques 35:02 Fighting Back: Technical Solutions 42:48 The Importance of Emotional Intelligence 44:39 Building a Security-Conscious Workplace Culture 47:29 Conclusion and Final Thoughts

The DOJ disrupts Russia's Doppelganger. NSA boasts over 1,000 public and private partners. The FBI warns of North Korean operatives launching “complex and elaborate” social engineering attacks. Iran pays the ransom to sure up their banking system. Cisco has disclosed two critical vulnerabilities in its Smart Licensing Utility. A Nigerian man gets five years in prison for Business Email Compromise schemes. Planned Parenthood confirms a cyberattack. Our guests are Sara Siegle and Cam Potts from NSA, Co-Hosts of the new show, No Such Podcast. OnlyFans hackers get more than they bargained for.  Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. CyberWire Guest Our guests are Sara Siegle, Chief, Strategic Communications and Cam Potts, Co-Host, from NSA sharing their new podcast, No Such Podcast. The NSA launched the first two episodes of their new weekly podcast today. You can catch their trailer here. Visit their show on Libsyn.  Selected Reading US Targets Russian Media and Hackers Over Election Meddling (BankInfoSecurity) NSA Eyes Global Partnerships to Combat Chinese Cyberthreats (BankInfoSecurity) North Korean scammers prep stealth attacks on crypto outfits (The Register) Iran pays millions in ransom to end massive cyberattack on banks, officials say (Politico) DrayTek Vulnerabilities Added to CISA KEV Catalog Exploited in Global Campaign (SecurityWeek) Critical Cisco Smart Licensing Vulnerabilities Let Attackers Take Over System (Cyber Security News) Nigerian man sentenced to 5 years for role in BEC operation (CyberScoop) Planned Parenthood confirms cyberattack as RansomHub claims breach (Bleeping Computer) Fake OnlyFans cybercrime tool infects hackers with malware (Bleeping Computer) Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc. Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode of "Reimagining Cyber," host Rob Aragao interviews Craig Jones, the former Director of the Global Cyber Crimes Directorate at Interpol. Jones provides a comprehensive overview of Interpol's role in combating cybercrime, emphasizing its unique position as a non-executive body that facilitates international law enforcement collaboration among 196 member countries.Jones discusses the structure and function of Interpol, noting how it connects various national police forces to coordinate cybercrime operations, despite being unable to directly run investigations. He explains how Interpol's cybercrime efforts are organized around prevention, detection, investigation, and disruption, aiming to reduce the global impact of cybercrime and protect communities worldwide.The conversation also delves into the challenges of dealing with borderless cybercrime, such as ransomware, business email compromise, and data theft. Jones highlights the complexities of international cooperation, especially when cybercriminals operate across different jurisdictions. He also touches on the recruitment process for Interpol's cybercrime division, stressing the importance of diverse backgrounds and expertise.Finally, the discussion explores the evolving landscape of cybercrime, the rise of the cybercrime economy, and the critical role of cyber resilience in protecting organizations. Jones and Aragao underscore the importance of involving board-level executives in cybersecurity decisions and the need for a comprehensive approach to cyber resilience, emphasizing the long-term benefits of such strategies in the face of ongoing cyber threats.Follow or subscribe to the show on your preferred podcast platform.Share the show with others in the cybersecurity world.Get in touch via reimaginingcyber@gmail.com

El Business Email Compromise es es una forma de ciberataque en la que delincuentes que engañan a ejecutivos y empleados desprevenidos para que envíen dinero o datos confidenciales a cuentas fraudulentas. Los atacantes logran esto utilizando una variedad de técnicas de phishing que manipulan a los usuarios para que transfieran dinero o datos. : Los atacantes consiguen acceso no autorizado a una cuenta de correo, por ejemplo, en un despacho de abogados. A continuación, envían por correo a los clientes una factura o un enlace para pagar en línea. La dirección de correo es legítima, pero la cuenta bancaria no lo es. En Capital Intereconomía hablamos con Joël Duquenne, Analista de riesgos cibernéticos de Beazley para identificar y prevenir el BEC en nuestras compañías.

In this Brand Story episode of On Location, hosts Sean Martin and Marco Ciappelli sit down with Chris Pierson, Founder and CEO of BlackCloak, a digital executive protection company. Throughout their conversation, they explore the intersection of personal privacy, digital security, and the unique challenges faced by high-profile individuals in protecting their digital lives. Chris Pierson discusses the importance of proactive measures in digital security, emphasizing the need for executives and public figures to safeguard their personal information just as rigorously as their corporate data.The dialogue covers various critical topics, including the rising threats of deep fakes and the implications for personal and professional security. Pierson explains how these convincing digital forgeries can be used maliciously and provides strategies to identify and combat them. Additionally, the conversation delves into common cyber threats like phishing and business email compromise, with Pierson detailing practical strategies for mitigating these risks.Pierson also highlights the evolving landscape of privacy threats and the role of education in empowering individuals to take control of their digital presence. He shares insights on balancing security with usability, pointing out the vulnerabilities that can be overlooked by even the most tech-savvy individuals. Reflecting on his experience building BlackCloak, Pierson discusses key lessons learned while developing solutions tailored to the needs of high-net-worth and high-profile clients.The episode underscores the criticality of a tailored approach to digital security, addressing both technical defenses and user behaviors. Listeners are encouraged to think about their own digital habits and consider how they can better protect their personal information in an increasingly interconnected world.Learn more about BlackCloak:https://itspm.ag/itspbcwebNote: This story contains promotional content. Learn more.Guest: Chris Pierson, Founder and CEO of BlackCloak [@BlackCloakCyber]On Linkedin | https://www.linkedin.com/in/drchristopherpierson/On Twitter | https://twitter.com/drchrispiersonResourcesLearn more and catch more stories from BlackCloak: https://www.itspmagazine.com/directory/blackcloakView all of our Black Hat USA  2024 coverage: https://www.itspmagazine.com/black-hat-usa-2024-hacker-summer-camp-2024-event-coverage-in-las-vegasAre you interested in telling your story?https://www.itspmagazine.com/telling-your-story

In this Brand Story episode of On Location, hosts Sean Martin and Marco Ciappelli sit down with Chris Pierson, Founder and CEO of BlackCloak, a digital executive protection company. Throughout their conversation, they explore the intersection of personal privacy, digital security, and the unique challenges faced by high-profile individuals in protecting their digital lives. Chris Pierson discusses the importance of proactive measures in digital security, emphasizing the need for executives and public figures to safeguard their personal information just as rigorously as their corporate data.The dialogue covers various critical topics, including the rising threats of deep fakes and the implications for personal and professional security. Pierson explains how these convincing digital forgeries can be used maliciously and provides strategies to identify and combat them. Additionally, the conversation delves into common cyber threats like phishing and business email compromise, with Pierson detailing practical strategies for mitigating these risks.Pierson also highlights the evolving landscape of privacy threats and the role of education in empowering individuals to take control of their digital presence. He shares insights on balancing security with usability, pointing out the vulnerabilities that can be overlooked by even the most tech-savvy individuals. Reflecting on his experience building BlackCloak, Pierson discusses key lessons learned while developing solutions tailored to the needs of high-net-worth and high-profile clients.The episode underscores the criticality of a tailored approach to digital security, addressing both technical defenses and user behaviors. Listeners are encouraged to think about their own digital habits and consider how they can better protect their personal information in an increasingly interconnected world.Learn more about BlackCloak:https://itspm.ag/itspbcwebNote: This story contains promotional content. Learn more.Guest: Chris Pierson, Founder and CEO of BlackCloak [@BlackCloakCyber]On Linkedin | https://www.linkedin.com/in/drchristopherpierson/On Twitter | https://twitter.com/drchrispiersonResourcesLearn more and catch more stories from BlackCloak: https://www.itspmagazine.com/directory/blackcloakView all of our Black Hat USA  2024 coverage: https://www.itspmagazine.com/black-hat-usa-2024-hacker-summer-camp-2024-event-coverage-in-las-vegasAre you interested in telling your story?https://www.itspmagazine.com/telling-your-story

In this common email scam, a criminal pretending to be your boss or coworker emails you asking for a favor involving money. Here's what do to when a bad actor lands in your inbox. Learn more about your ad choices. Visit podcastchoices.com/adchoices

A report on business email compromise attacks is highlighted in this edition

Send Bidemi a Text Message!In this episode of The Cyber Case Files Podcast, host Bidemi Ologunde discussed some of the U.S. federal investigations involving cybersecurity incidents in June 2024. You can get The Cyber Case Files Podcast wherever you listen to podcasts.Part 1: Major Fraud Against the U.S. - Hoau-Yan WangPart 2: Sex Trafficking - Multiple IndividualsPart 3: Organized Crime & Money Laundering - Multiple IndividualsPart 4: Organized Crime & Money Laundering - Multiple IndividualsPart 5: Business Email CompromiseSupport the Show.

In this common email scam, a criminal pretending to be your boss or coworker emails you asking for a favor involving money. Here's what do to when a bad actor lands in your inbox. Learn more about your ad choices. Visit podcastchoices.com/adchoices

The Johannesburg High Court ruled that renowned law firm Edward Nathan Sonnenberg Inc. (ENS) was culpable for the woman's victimisation to a common cybercrime known as "business email compromise" (BEC), and that the firm was ordered to pay her R5.5 million plus interest in addition to her legal fees.However, the Supreme Court of Appeal reached a different decision this week, sustaining ENS' appeal against the six-month-old ruling. Judith Hawarden's claim was dismissed by the SCA along with two attorneys' fees. Our consumer ninja Wendy Knowler speaks with host Bruce Whitfield to shed more light on the situation.See omnystudio.com/listener for privacy information.

An alleged leak of Google's search algorithm contradicts the company's public statements.  German researchers discover a critical vulnerability in a TP-Link router. Breachforums is back…maybe. The Seattle Public Library suffers a ransomware attack. A Georgia man gets ten years for money laundering and romance scams, and the Treasury department sanctions a group of botnet operators. 44,000 individuals are affected by the breach of a major U.S. title insurance company. Microsoft describes North Korea's Moonstone Sleet. Advocating for a more architectural approach to cybersecurity. Maria Varmazis speaks with WiCyS Executive Director Lynn Dohm and a panel of N2K experts about the 2024 Cyber Talent Study. A cracked password results in a multimillion dollar windfall.  Our 2024 N2K CyberWire Audience Survey is underway, make your voice heard and get in the running for a $100 Amazon gift card. Remember to leave us a 5-star rating and review in your favorite podcast app. Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you'll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn. Learning Layer On our Learning Layer segment, host Sam Meisenberg and Joe Carrigan continue their discussion of Joe's ISC2 CISSP certification journey using N2K's comprehensive CISSP training course, CISSP practice test, and CISSP practice labs. Sam and Joe dive into Domain 6: Security Assessment and Testing and tackle the following question together: You are hiring a vendor to perform a penetration test that would simulate a breach from an insider threat. What type of test would be BEST to perform?  Blue Box Black Box White-hat hack White box CyberWire Guest Maria Varmazis, N2K host of T-Minus Space Daily, talks with WiCyS Executive Director Lynn Dohm and N2K's Simone Petrella, Dr. Heather Monthie, and Jeff Welgan about the 2024 Cyber Talent Study. You can find out more about the study here.  Selected Reading Google won't comment on a potentially massive leak of its search algorithm documentation (The Verge) Update TP-Link's Archer C5400X router now to fix remote takeover vulnerability (TechSpot) Data leak site BreachForums is back, boasting Live Nation/Ticketmaster user data. But is it a trap? (Malwarebytes) Ransomware attack on Seattle Public Library knocks out online systems (The Record) Man Sentenced for Laundering Over $4.5M Obtained from Business Email Compromise and Romance Fraud Schemes (United States Department of Justice) Treasury Sanctions a Cybercrime Network Associated with the 911 S5 Botnet (United States Department of Treasury) First American December data breach impacts 44,000 people (Bleeping Computer) Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks (Microsoft Security Blog) Cybersecurity at a crossroads: Time to shift to an architectural approach (CSO Online) How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet (WIRED)  Share your feedback. We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show.  Want to hear your company in the show? You too can reach the most influential leaders and operators in the industry. Here's our media kit. Contact us at cyberwire@n2k.com to request more info. The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

In this episode of The Cyber Case Files Podcast, host Bidemi Ologunde discussed some of the U.S. federal investigations involving cybersecurity incidents in April 2024. You can get The Cyber Case Files Podcast wherever you listen to podcasts.Part 1: Jareh Sebastian Dalke (0:32)Part 2: Banmeet Singh (4:03)Part 3: LabHost (8:10)Part 4: Avraham Eisenberg (12:16)Part 5: H. Harooni, R. Kazemifar, K.B. Salmani, and A.S. Nasab (15:14)Part 6: Niselio Barros Garcia Jr. (23:20)Support the Show.

Consumer advocate Wendy Knowler discusses BEC (Business Email Compromise) with host Bruce Whitfield. We recently delved into this subject when the High Court mandated prominent law firm Edward Nathan Sonnenbergs to reimburse a client who fell victim to a scam while making a payment for a house. The court ruled that the firm had not taken adequate measures to prevent such fraudulent activities.See omnystudio.com/listener for privacy information.

Cyber incidents are on the rise as data shows there was a 20% increase in data breaches from 2022 to 2023.  Technology has become an integral part of most businesses, especially post pandemic where many who may have avoided this reliance on tech had no choice but to adapt to survive. As a result, the question of businesses being affected by a cyber incident has become ‘when' rather than ‘if'.  However, there are a number of steps you can take to mitigate risks ahead of any potential incidents.   We invited Jack Morris, Account Director at Epiq, to discuss cyber incidents, the importance of being proactive in reducing cyber incident risk and the steps you can take to mitigate these risks.  You'll learn ·      Who are Epiq? ·      What is a cyber incident? ·      The importance of being proactive in reducing the risk of an incident ·      What can organisations do to be proactive in mitigating cyber incident risk? ·      What are forensic tabletop exercises, and how do they enhance preparedness? ·      Why might an organisation need to get an incident response retainer? ·      What role do Information Governance consultants play in reducing cyber risk?   Resources ·      Epiq ·      Isologyhub   In this episode, we talk about: [00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo. [02:05] Episode summary: Today Mel is joined by guest Jack Morris, Accoutn Director at Epiq, to discuss how to mitigate cyber incident risk. [02:40] Who are Epiq?  – Epic is a global leader in technology enabled legal services. In fact, it supports 90% of the top law firms globally! With over 8000 employees spread over 19 countries, it helps to support corporations, law firms and government agencies across the globe. [04:31] Who is Jack Morris? – Jack joined the industry relatively fresh out of university, starting at an organisation called Kroll where he was focused on data management – including overcoming ransomware infected devices and essentially allowing organisations to get access to data that was previously taken away from them. Kroll was later acquired by Duff and Phelps and went through a turbulent time of many name changes before settling on Kale Discovery. He ended up leaving a year ago and joined Epiq as an Account Director. Jack's role at Epiq includes being a facilitator, introducing law firms, corporations and cyber insurers to best in class people and technology. [06:40] What is a cyber incident?: A Cyber Incident is any unauthorised or unexpected event that compromises the confidentiality, integrity or availability of an organisation's information systems, data or network. Incidents can range from data breaches and malware infections to single mailbox compromises and insider threats. Organisations looking to combat information security risks should consider ISO 27001, as it's key principles include the confidentiality, integrity or availability of your businesses information. [08:29] Why is it important for organisations to be proactive in reducing their risk of an incident, no matter the size of your business?  – Let's look at some startling statistics: In 2022, 39% of businesses in the UK identified a cyber attack in the previous 12 months. Of this 39%, 31% of those businesses experienced attacks at least once a week. 48% of Small to Medium Businesses, globally, experienced a cyber incident in the last 12 months, with 61% of all cyber-attacks specifically targeting small business. This is the most shocking of the statistics, and why it's so important for us to be having these kinds of conversations around how business, no matter the size, need to be proactive in mitigating the impact of a cyber incident. 70% of small to medium businesses in the UK believe that they are unprepared to deal with a cyber attack (which excludes those who think they have proper processes in place but ultimately don't). Nearly 60% of businesses that are impacted by a cyber incident go out of business within 6 months following!  [12:10] Are there any particular industries that are most at risk from a cyber incident? – Cyber Incidents are not siloed to particular industries, but there are some trends that we see in the market. Looking at Q1 2024: January saw a rise in cyber incidents predominantly affecting retail, education and local government. In February we saw a significant number of breaches, impacting organisations across the full spectrum of markets. All of this to say that regardless of the size of your business and the industry you operate in, the number of cyber incidents are increasing as well as the severity of said incident. [13:35] ISO Standard trends – At Blackmores, we've seen an increase in demand for ISO 27001 and related data privacy standards across the board for all sectors. A stark difference to 10 years ago where it would mostly only be adopted by those in the managed services or tech based industries.    [15:30] What can organisations do to be proactive in mitigating cyber incident risk? – Things such as implementing a proactive incident response plan, engaging with law firms and consultancy organisations to become aware of the organisation's requirements and compliance issues arising from a cyber incident. If you were hit with an incident today, you must report any personal data breaches to the relevant regulators within 72 hours of becoming aware of an incident or there can be fines that are implicated. To deal with these types of situations, it's imperative that your organisation has established, sound relationships with law firms and consultants. [17:25] What is the importance of an incident response plan? – Implementing an incident response plan is crucial because it allows organisations to prepare for potential cyber incidents before they occur. By identifying risks, implementing preventive measures, and conducting exercises, organisations can significantly reduce the impact of incidents. Organisations should be aware of both the legal and operational issues that arise from a cyber incident – from regulatory compliance and liability concerns right the way through to loss of systems/data and brand reputation are all key considerations that have an effect on the whole of a business. [18:35] What are forensic tabletop exercises, and how do they enhance preparedness? – Forensic tabletop exercises simulate cyber incidents in a controlled environment. They involve key stakeholders discussing and practicing their roles during an incident. These exercises improve coordination, communication, and decision-making, ensuring a more effective response when a real incident occurs. The workflow here is clearly defined; implement an incident response plan, and then test that plan for robustness – engaging with external providers, like Epiq, to further add to the existing plan and to test how the organisation will manage an active incident. [19:35] Join the isologyhub – Don't miss out on a suite of over 200+ ISO tools, templates and training, sign-up to become a member of the isologyhub  [21:45] Links with Business Continuity – Response readiness plans and forensic tabletop exercises both tie into aspects of ISO 22301 – business continuity. In Blackmores' experience, a lot of organisations don't actually test their plans, so when going through the process of implementing ISO 22301, where testing these response plans are a requirement, it's a bit of an eye opener when they realise they're not as resilient as initially thought. It's always better to test these plans in a simulated environment vs a live one, so you can be assured that your plans are up to the task. [23:40] Why might an organisation need to get an incident response retainer? – We're starting to see a number of industries, particularly in regulated verticals, requiring businesses in their supply chain to meet a number of different cyber security requirements.  One, which keeps popping up, is to have a plan in place for responding to security incidents. Having a retainer can help meet these compliance requirements. [26:05] What role does Managed Detection and Response (MDR) software play in proactive incident response? – MDR solutions continuously monitor networks, detect threats, and provide real-time alerts. They enhance proactive response by identifying suspicious activities early, allowing organisations to take preventive action before incidents escalate. [27:50] What role do Information Governance consultants play in reducing cyber risk? – : Information Governance (IG) consultants specialise in helping organisation define their Information Governance Strategy encompassing data security and defining compliance policies.. They support organisations in defining: ·      Data Classification: Identifying Sensitive and PII data and categorising based on their confidentiality or regulatory requirements. ·      Retention Policies: Defining policies on retention period of records and method of disposition aligned with compliance requirements. ·      Legal Holds: Ensuring necessary data is preserved for potential litigation, internal investigation or as part of audit process. ·      Privacy Compliance: Aligning with regulations such as  GDPR, DP, DPA, CCPA. [33:30] What are Jack's top tips that the listeners can take away from this podcast session and implement today to begin mitigating their risk? – : Unfortunately mitigating cyber risk isn't a one-size-fits-all response, however I like seeing cyber risk as 3 buckets, that businesses should be aware of and measure their organisation against: Technology & Infrastructure – outdated systems, unpatched software and not fit for purpose IT infrastructure pose risks. These types of vulnerabilities are exploited by attackers, leading to data breaches, malware infections and system disruptions. So, making sure that your technology and infrastructure is fit for purpose, and up to date is a key takeaway. We spoke about Managed Detection and Response solutions earlier in the session, which is a great, cost effective way of adding an additional layer of technology security. Human Factor – for me, this is the number 1 frailty to a business. Business Email Compromise incidents increased by 67% in 2023, with Multi-Factor Authentication (MFA) being bypassed in 29% of these cases. Over recent years, cybersecurity awareness has been the aim of the game. However it is crucial that, as our understanding progresses, we switch our focus to fostering a culture of cybersecurity responsibility among colleagues and employees. Ensuring that your people are aware of cyber incident (perhaps listening to this podcast), and their role in mitigating the risks associated to a cyber incident are crucial in ensuring that your business is secure. Preparation – in just about all walks of life, preparation is key for preventing almost anything. We have spoken today about some of the key preparation themes I'm seeing in the industry, from Response Readiness plans, to MDR, to Incident Response Retainers. Getting sufficient Cyber Insurance coverage is of paramount importance to ensure that your business can respond effectively to an incident, should one occur. If you'd like to learn more about Epiq and how they can help you, visit their website. If you'd like to book a demo for the isologyhub, simply contact us and we'd be happy to give you a tour. We'd love to hear your views and comments about the ISO Show, here's how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

In 2023, Business Email Compromise, or BEC, is still a money maker for fraudsters according to the latest report by the FBI.  Here is a quick look at the stats compared to 2022 and before the pandemic.  Keep Listening.  Check out my website www.debrarrichardson.com if you need help implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data. Check out my new Vendor Process Training Center for 116+ hours of weekly live and on-demand training for the Vendor team. Links mentioned in the podcast + other helpful resources:    Federal Bureau of Investigation(FBI):  Internet Crime Report 2023 Federal Bureau of Investigation(FBI):  Internet Crime Complaint Center Vendor Process Training Center:  https://training.debrarrichardson.comDebra R Richardson LLC:  Free Live and On-Demand WebinarsVendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download (Get 25% Discount on the Global Vendor Registration Numbers)Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

This special 3-part series discusses the importance of fraud awareness, fraud protection, and how how to protect yourself, your business, your clients, and your vendors from fraud. Today's discussion focuses specifically on BUSINESS EMAIL COMPROMISE with guest Jeff Taylor, who has served as Senior Vice President, Head of Fraud Forensics & Commercial Payments Strategy for […] The post FRAUD PREVENTION SERIES: Business Email Compromise appeared first on Business RadioX ®.

This special 3-part series discusses the importance of fraud awareness, fraud protection, and how how to protect yourself, your business, your clients, and your vendors from fraud. Today's discussion focuses specifically on BUSINESS EMAIL COMPROMISE with guest Jeff Taylor, who has served as Senior Vice President, Head of Fraud Forensics & Commercial Payments Strategy for […] The post FRAUD PREVENTION SERIES: Business Email Compromise appeared first on Business RadioX ®.

This special 3-part series discusses the importance of fraud awareness, fraud protection, and how how to protect yourself, your business, your clients, and your vendors from fraud. Today's discussion focuses specifically on BUSINESS EMAIL COMPROMISE with guest Jeff Taylor, who has served as Senior Vice President, Head of Fraud Forensics & Commercial Payments Strategy for […] The post FRAUD PREVENTION SERIES: Business Email Compromise appeared first on Business RadioX ®.

In this episode I had a chance to have a candid conversation with Charles Henderson. Charles is a global managing partner at IBM and also happens to be the head of the X-Force team. IBM recently released the X-Force Threat Intelligence Index report for 2024.While the report is delves into many different areas of Threat Intelligence, we concentrated on several key areas focused primarily on artificial intelligence:Pronounced increase in Identity attacksUnderstanding how more 'business-like' malicious actors are becomingUpcoming universal AI attack surfaceHow much do you think this will get wors? For example, I reached out to a couple of CISOs from some prominent local companies and one of their worries was and I quote, "Longer term I think we will have to worry about attackers trying to attack and leverage AI technologies that are being utilized by organizations."50% is the expected market share threshold likely to trigger attacks against AI platforms.Evolution of malware delivery mechanisms. AI's part in Business Email Compromise. Another area of concern when I polled my CISO contacts was AI's ability to, and I quote again, "Easier to perfect grammar and templates for phishing and other social engineering attempts.". How do you think companies like IBM can start helping people combat these types of attacks?)Thoughts on OpenAI's Sora and its potential impact on securityEpisode Charity:The Corewell Health's involvement in the Blue Envelope Suicide Prevention Program. The School Blue Envelope Suicide Prevention Program trains middle and high school faculty and staff so that every school employee—from teachers to coaches and bus drivers—would know how to respond to a student who may express thoughts of suicide. The “Blue Envelope” protocol for crisis management was developed internally to quickly activate patient safety responses by communicating the code words "Blue Envelope."Every person within a physician's office became proficient in how to respond at a moment's notice to a patient who may have thoughts of suicide. Through previous grant and foundation dollars, this program has been able to successfully train over 8,500 middle, high, and elementary school personnel across 156 schools within 53 different school districts. This training has resulted in over 2,000 interventions for students in crisis.Episode Sponsor:This episode is sponsored by IBM, who recently celebrated their 100th birthday! IBM is a computer solution company based out of Armonk, New York.

Guest: Shawn Tuma, Co-Chair, Data Privacy & Cybersecurity Practice at Spencer Fane, LLP [@SpencerFane]On Linkedin | https://www.linkedin.com/in/shawnetuma/On Twitter | https://twitter.com/shawnetumaOn Instagram | https://www.threads.net/@shawnetuma____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsImperva | https://itspm.ag/imperva277117988Devo | https://itspm.ag/itspdvweb___________________________Episode NotesIn this episode of the Redefining CyberSecurity Podcast, host Sean Martin sits down with cybersecurity data privacy attorney, Shawn Tuma. They delve into a comprehensive discussion on cyber risk, cybersecurity incident response, and cyber insurance. During their discussion, Tuma shares a wealth of knowledge stemming from his deep involvement in thousands of cyber incident responses. He discusses the evolving cyber threat landscape, singling out business email compromises as now topping the list and how the evolution of threat actor tactics has exploited the human element in organizations.The conversation segues into the crucial role of insurance in incident response planning. Tuma goes into detail about the issues that organizations face with insurance, especially when they aren't familiar with the terms stipulated in their policies. He also emphasizes the importance of getting the insurance carrier involved early on and the necessity for businesses to have pre-approved incident response teams.The episode wraps up with Tuma's advice on building a robust incident response plan and how insurance plays a key part in the strategy.Key Insights Provided:Though cyber threats continue to evolve, business email compromises now top the list over ransomware attacks because threat actors are manipulating the human element in organizations.Insurance carriers play an indispensable role in incident response planning; it's crucial to get them involved early on and for businesses to have pre-approved incident response teams.In building a robust incident response plan, businesses must understand their risk, be familiar with the terms stipulated in their policies, and ensure the implementation of measures that limit their vulnerabilities.___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Guest: Shawn Tuma, Co-Chair, Data Privacy & Cybersecurity Practice at Spencer Fane, LLP [@SpencerFane]On Linkedin | https://www.linkedin.com/in/shawnetuma/On Twitter | https://twitter.com/shawnetumaOn Instagram | https://www.threads.net/@shawnetuma____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsImperva | https://itspm.ag/imperva277117988Devo | https://itspm.ag/itspdvweb___________________________Episode NotesIn this episode of the Redefining CyberSecurity Podcast, host Sean Martin sits down with cybersecurity data privacy attorney, Shawn Tuma. They delve into a comprehensive discussion on cyber risk, cybersecurity incident response, and cyber insurance. During their discussion, Tuma shares a wealth of knowledge stemming from his deep involvement in thousands of cyber incident responses. He discusses the evolving cyber threat landscape, singling out business email compromises as now topping the list and how the evolution of threat actor tactics has exploited the human element in organizations.The conversation segues into the crucial role of insurance in incident response planning. Tuma goes into detail about the issues that organizations face with insurance, especially when they aren't familiar with the terms stipulated in their policies. He also emphasizes the importance of getting the insurance carrier involved early on and the necessity for businesses to have pre-approved incident response teams.The episode wraps up with Tuma's advice on building a robust incident response plan and how insurance plays a key part in the strategy.Key Insights Provided:Though cyber threats continue to evolve, business email compromises now top the list over ransomware attacks because threat actors are manipulating the human element in organizations.Insurance carriers play an indispensable role in incident response planning; it's crucial to get them involved early on and for businesses to have pre-approved incident response teams.In building a robust incident response plan, businesses must understand their risk, be familiar with the terms stipulated in their policies, and ensure the implementation of measures that limit their vulnerabilities.___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Guests: Julie Haney, Computer scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology [@NISTcyber]On Linkedin | https://www.linkedin.com/in/julie-haney-037449119/On Twitter | https://x.com/jmhaney8?s=21&t=f6qJjVoRYdIJhkm3pOngHQJason Nurse, Reader in Cyber Security and Director of Science & Research, University of Kent [@UniKent] and CybSafe [@CybSafe]On Linkedin | https://www.linkedin.com/in/jasonrcnurseOn Twitter | https://twitter.com/jasonnurseOn Mastodon | https://infosec.exchange/@jasonnurse____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsImperva | https://itspm.ag/imperva277117988Devo | https://itspm.ag/itspdvweb___________________________Episode NotesIn this episode of the new (first!) episode of the Human-Centered Research Series on the Redefining CyberSecurity Podcast, host Sean Martin and co-host Julie Haney from the Human Centered Cybersecurity program at NIST, chat with Dr. Jason Nurse, a reader in cybersecurity at the University of Kent in the UK. The discussion revolves around the role of cyber insurance in organizational risk management.Jason elucidates cyber insurance's function as a residual risk mitigation tool when dealing with cyber attacks, helping businesses recover and connect with response teams. They discuss how cyber insurance can incentivize better security practices but highlight challenges related to assessing security postures across diverse businesses. While ransomware features heavily in discussions of cyber risks, Jason points out that insurers don't always encourage ransom payments. Julie raises the issue of accessibility of cyber insurance for small businesses and suggests insurers offer 'pre-breach services'.Sean, Julie, and Jason debate the role of human behavior in cyber risk, and how it affects organizations and insurance policies. They underscore the value of research in enhancing security practices and conclude by pondering ways to bridge the gap between academic research and practical implementation in cybersecurity.Key Questions Addressed:What is the role and impact of cyber insurance in organizational risk management?How does cyber insurance interact with a business's cybersecurity practices, and how could it incentivize better measures?How does human behavior factor into cyber risks and insurance policies, especially in the context of ransomware and small-medium enterprises?___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Guests: Julie Haney, Computer scientist and Human-Centered Cybersecurity Program Lead at National Institute of Standards and Technology [@NISTcyber]On Linkedin | https://www.linkedin.com/in/julie-haney-037449119/On Twitter | https://x.com/jmhaney8?s=21&t=f6qJjVoRYdIJhkm3pOngHQJason Nurse, Reader in Cyber Security and Director of Science & Research, University of Kent [@UniKent] and CybSafe [@CybSafe]On Linkedin | https://www.linkedin.com/in/jasonrcnurseOn Twitter | https://twitter.com/jasonnurseOn Mastodon | https://infosec.exchange/@jasonnurse____________________________Host: Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/sean-martin____________________________This Episode's SponsorsImperva | https://itspm.ag/imperva277117988Devo | https://itspm.ag/itspdvweb___________________________Episode NotesIn this episode of the new (first!) episode of the Human-Centered Research Series on the Redefining CyberSecurity Podcast, host Sean Martin and co-host Julie Haney from the Human Centered Cybersecurity program at NIST, chat with Dr. Jason Nurse, a reader in cybersecurity at the University of Kent in the UK. The discussion revolves around the role of cyber insurance in organizational risk management.Jason elucidates cyber insurance's function as a residual risk mitigation tool when dealing with cyber attacks, helping businesses recover and connect with response teams. They discuss how cyber insurance can incentivize better security practices but highlight challenges related to assessing security postures across diverse businesses. While ransomware features heavily in discussions of cyber risks, Jason points out that insurers don't always encourage ransom payments. Julie raises the issue of accessibility of cyber insurance for small businesses and suggests insurers offer 'pre-breach services'.Sean, Julie, and Jason debate the role of human behavior in cyber risk, and how it affects organizations and insurance policies. They underscore the value of research in enhancing security practices and conclude by pondering ways to bridge the gap between academic research and practical implementation in cybersecurity.Key Questions Addressed:What is the role and impact of cyber insurance in organizational risk management?How does cyber insurance interact with a business's cybersecurity practices, and how could it incentivize better measures?How does human behavior factor into cyber risks and insurance policies, especially in the context of ransomware and small-medium enterprises?___________________________Watch this and other videos on ITSPmagazine's YouTube ChannelRedefining CyberSecurity Podcast with Sean Martin, CISSP playlist:

Aaron Cole, an Oregon-based home buyer, fell victim to a business email compromise scam, resulting in the loss of $123,000. In this episode, he joins host Melissa O'Leary to discuss the incident as a whole, including exactly what happened, how it affected his family, whether any of the stolen funds have been returned, and more. • For more on cybersecurity, visit us at https://cybersecurityventures.com

For the last show of 2023, let's look back at the year and speculate about 2024. Richard flies solo to talk about what he's learned the past year and some thoughts about going forward into the next year. Economic concerns continue to play a significant role in sysadmin life – companies are holding back on spending but still expecting all the services. And new technologies like large language models look to play a significant role in our lives – if we choose to take advantage of them!Links:Large Language Models in Business with Ulrika HedlundGetting Ready for M365 Copilot with Karoliina KettukariPatching in 2023 with Sami LaihoResponding to a Ransomware Attack with Dana EppPlan for Windows 10 EOS with Windows 11, Windows 3655, and ESURecorded December 22, 2023

A social engineering scam where fraudsters spoof an email message from a trusted company officer that directs a staff member to transfer funds to an account controlled by the criminal. 

A social engineering scam where fraudsters spoof an email message from a trusted company officer that directs a staff member to transfer funds to an account controlled by the criminal.  Learn more about your ad choices. Visit megaphone.fm/adchoices

Maybe we have talked about this before? At any rate Business email compromise is a constant threat. We do Phishing simulations and other security awareness training to help our staff and clients make good choices, but we aren't always perfect. I sit down with Dan Gilligan with Integra MSP to hear his journey in dealing with this issue and the tools and training that have changed over the years to keep up with this evolving threat. --- Support this podcast: https://podcasters.spotify.com/pod/show/msp1337/support

Join host Adam Larson and expert guest AJ Coleman in Count Me In's latest episode. Get ready to dive into the world of internal control and fraud prevention.  AJ is an author and serves as Vice President, Fraud Manager at Byline Bank. He explores the importance of strong internal controls in detecting and preventing fraud, while sharing real-life examples of common types of fraud and how they're identified and dealt with. Don't miss out on this engaging and eye-opening conversation.Full Episode Transcript:Adam:            Welcome back to Count Me In. I'm your host, Adam Larson, and today we're diving deep into the world of fraud and internal control. Joining me is the incredible A. J. Coleman. He is an author, and serves as vice president and fraud manager at Byline Bank. Today, we'll be discussing the importance of strong internal controls, in detecting and preventing fraud, and how organizations can navigate through risks and vulnerabilities. A.J. will share some eye-opening examples of common fraud cases and explain how they are identified and dealt with. So if you want to learn more about the crucial role of internal control in combating fraud, you definitely don't want to miss this episode.  Well, A.J., I want to thank you so much for coming on the podcast. Really excited to talk about internal control, and fraud, and just all the different things you have to do in that world. And I know you're an expert in this field, and I thought that, maybe, you could start by giving some examples of how things like strong internal controls can help by detecting fraud. Since I know you see this every day. A.J.:                Well, great to be here and the opportunity to talk fraud is always rewarding. But, yes, internal controls are really the key, is to be able to identify where there are opportunities or gaps, for the fraudsters to expose an organization. And that's really where the first thing you have to look at is where are we exposed, and what risks that are out there. And from there, you then start crafting those internal controls.●       How do you want them set up? ●       What do you want people's roles to be?●       How should things be escalated?  And there's a lot that we can go into that aspect. But without internal controls, nobody understands what the proper steps are, and how do you get that message to the expert. And in terms of fraud, fraud happens every day, and it happens in places that we least expect it. It could be anything from a personal thing, where somebody steals your information unknowingly. All the way up to somebody depositing a fictitious check in the ATM deposit, knowing that it's fictitious. And without internal controls, how do we detect this? How do we maneuver through those processes to, actually, review these transactions? And, then, at the end, do we need to escalate this up through leadership? Does it need to have a certain suspicious activity report filing? And without those internal controls in place is a free fall. Adam:            That makes a lot of sense, and it begs the question, chicken versus egg, do you have strong internal controls unless you've experienced fraud? Or can you have good internal controls, if you've never experienced fraud? What comes first in some cases? A.J.:                Well, a lot of depends on the leaders, and the type of the organization and how they set up their infrastructure. Some organizations are very passive and they are reactive, in terms of waiting for things to happen. Other organizations are saying, "Well, you know what? We're going to be active in this. We're going to be proactive." And a lot of that has to do with that leadership quality. In my opinion, from a fraud expert, you always want to work on the preventive. Because you can always build something, and then do your own risk assessments to determine if there are gaps exposed. Then work together to figure out how to close up those gaps. Instead, of just leaving it open-ended and waiting for the fraud to happen. And a lot of times people just sit because it's easier to wait till something happen, rather than be proactive and build something. Adam:            Yes, that makes a lot of sense. Being proactive does seem like the better option, but it all comes down to leadership and those things. Maybe, we could circle back to what are some of the most common types of fraud that you see in your line of work, maybe, there are some examples. I know you can't name any names, but, maybe, there are some examples you can give and how it was identified and dealt with. A.J.:                Check fraud, is number one on the list. I mean, you would think that in today's world, that we would be doing more electronic payments. But there are just amount of checks that go out on a daily basis. And, sometimes, people just it's easier to write checks, it's easier to send them through the system. But I will tell you the post office is compromised. We are seeing a lot of checks intercepted by third party individuals. Whether it's the postal workers themselves or they're in a partnership, maybe, with the fraudster or they've been approached, and we read things on the news where postal workers are held at gunpoint, their keys are taken, for mailbox. And all these fraudsters are looking for is just checks, where they can either wash them or they can do a forged endorsement on the back hoping that nobody will notice that. Check fraud, is unfortunately not going away, and in the last two years I've seen a significant increase. And there are certain controls that you can put in place, not only for the banks, or the institutions, or the companies, but also for the customers themselves. Positive Pay is really important, where you can look to see if you can be protected and be notified, if there's a counterfeit check that gets presented. You can do a payee Positive Pay, that looks at the payee information to see if it's been washed.  Alternatively, go with the electronic. It's a lot easier on the cash flow, but you also don't have to worry about a paper copy. So check fraud is definitely number one. The other thing we're seeing a lot is what we call Business Email Compromise, BEC, as it's known. And what this is, is with fraudsters, they penetrate into an organization. Whether it's through a phishing attack or other metrics, and what they do is they clone the server once they're in the organization. And they operate as if they are an authoritative figure and emailing different groups, different business units.As well as, maybe, even the financial institution changing payment information or making requests for ACH or wires to go out. And what happens once the clone server is done, the primary customer or the vendor has no idea. And the fraudsters are the ones that are letting certain emails go through, intercepting other emails. So, a lot of times, these customers have no idea that they've been compromised, as well, as they just quickly change that information and say, "Hey, we need to pay this person X amount of dollars." But nobody questions a lot like "Why did this payment information suddenly change from our vendor? We've been sending this to this bank for the last five years, but now we're getting a payment request to send it to a different area." But we just hide behind emails all day long, instead of picking up a phone and calling. So, as a result, the fraudsters hedge on you not picking up that phone, and you're just trading emails, and you're going to just cycle through whatever the request is. And this goes from the customer, to the vendor, to the financial institution, all the way up. And this is where the second area, what we're seeing for fraud, is really significantly increased in recent years. And now with everybody remote, in many places, there are more interactions done on email as opposed to in person. Where somebody just doesn't get up from their desk and walk across to the accounting department, and say, "Hey, we've got a change here." And the accounting department looks at it and says, "Yes, this looks a little different." The third aspect is account takeovers. Where the fraudsters socially engineer themselves onto the victim, as to getting their credentials, in some cases logging in as their victim. In other cases, they'll socially engineer thinking the tech company that somebody has something wrong with their computer, and they will request remote access into the computer, and then do a lot of key logging to retrace some of the steps; passwords, websites. And many people, as we know, because it's hard to keep track of all the passwords, we use the same password for every website we can think of, and all they need is one. And they have sophisticated software to figure out what your passwords are and if they penetrate through. And, in many cases, a consumer is protected by their bank with the account takeovers. But in other cases they may not be, depending on how your financial institution controls, and procedures are designed and communicated. Very difficult to discover when you've been victimized. But a lot of people realize when they see money leaving the account that's not theirs. And I think today's generation, in my opinion, they don't do regular, bank reconciliations of their personal. They just look to see whatever balance they have in the account, and they just operate as they're, I think, that's another area that they hedge on. But the third aspect with account takeovers, is just be very careful. You talk to most places will never come out and ask you for your online credentials, which includes your password, giving out the multifactor authentication numbers. And many times there's a little disclaimer that these institutions share with them, "We will never ask you."But people freak out when it comes time to fraud, and they feel like there's something really wrong with the account. So I would say those are the top three. I mean, we can go through debit cards, credit cards. We can go through the human trafficking and all those other aspects. But I would say those are the top three, at least, that I see today, that are impacting most people. Adam:            Yes, that is in line, and I thought it was very surprising to hear that checks were still the top one. And that goes back to the importance of organizations, to utilizing new technologies like the e-checks and online types of payments that are definitely more secure. Do you think that if more people were to adopt those things that that would come down? Or do you think there are some people just stuck on using checks forever? A.J.:                I think it's mixed. There are organizations, and they're so used to writing checks and issuing checks, it's put in their procedures. And the bigger the organization to change procedures, there are a lot more people that need to be involved. Processes have to be vetted out and then approved, by the senior leadership. So, sometimes, these processes just stay the same for many years to come. But there are organizations that are, actually, taking steps to properly try to combat check fraud and the intercepting of checks, that they'll, actually, start moving towards that electronic model. Now, just because you move to the electronic, it doesn't, necessarily, make you less fraud prone. It just means that you may be susceptible in other areas like account takeover. Where somebody may try to socially engineer to get into the company account, so they can certainly send out bill pays and all that other payment, through their systems.  But, yes, checks, they're always here, people like to touch something. They like something that's tangible, they like giving something to somebody. I mean, if you think about back in the day, my grandparents used to love going to the bank. They got all dressed up, and they'd go to the bank and make whatever transactional activity that they're looking to do, and then they'd take it over to the post office, and they made a whole day of it because they like the tangible stuff. And I just think that, again, it goes where you believe, it's where you're comfortable with.  If you're comfortable writing checks, you're going to write checks. If you're going to take preventive measures by going on Positive Pay, doing a bank reconciliation. Really understanding your institution disclosures that are, probably, how to report incidences of fraud. Then you can have that safeguard measurement to say, "Okay, I'm comfortable writing checks." Others are going to go the electronic route and, again, same process that I just described. So a lot of it is just the comfort level, but it also goes back to the strong internal controls each organization has. To enable that the process is being followed, each time a transaction is made. Adam:            Yes, it makes a lot of sense. So no matter how big your business is because small business might not be able to afford to use some software company, and other ones may not be able to have the room or they don't want to move it. So having good internal controls is the most important thing, no matter how you make your payments. A.J.:                Yes, that's really critical, and reviewing those internal controls, I think, on an annual basis is important because fraud changes, business models change. And, again, I understand the pain points of having to go through, and then getting all the proper sign offs. But if you really want to protect yourself and strengthen the organization, those internal control are really the key for success. Adam:            Yes, so we can't talk about fraud without, possibly, at least, a little bit mentioning the fraud triangle—Pressure, opportunity, and rationalization. How does having a good understanding of that help prevent fraud? A.J.:                The fraud triangle, it's pretty straightforward, and to understand it you have to understand what each component represents. And a lot of times when there's fraud it, basically, is opportunity, "Is there an opportunity for somebody to commit this?" And it could be any type of fraud.  But what happens is there are certain aspects that people try to go through this type of fraud and say, "I have an opportunity. I do not like that company. I can steal money from them, and they'll never know." The opportunity is there for them to take, and in real way, they can do misappropriation of the funds, to try to conceal what they've done.  Now, the justification part, what I call the rationalization, it's really important because this is where they start thinking about, "Well, I'm justifying my action. You know what? My boss passed me up on a promotion. I missed out on some bonuses. You know what? I'm going to take some funds from the company because I'm owed that."  A lot of times, also, during the pandemic, when it first started, we would see people looting stores and creating havoc on the street. And I remember watching the news, one night, and they interviewed one of the looters, and she said, "You know what? I lost my job, I have no financial means. I have a baby. I can't afford diapers. I need to get diapers for my baby." And what they did is she rationalized her situation, as a means of justifying why she was looting.  Now, we can go into the whole ethics and talk about whether that's appropriate or not, but that's not for this discussion. Then, obviously, the motivation, the pressure, that comes through it. It's like, "What is the incentive for them to commit the fraud? What is the payoff?" And a lot of times people just say, "I'm just going to do it one time, no harm, no foul."  But, then, like other aspects, you do it one time, you're like, "Hey, that wasn't so bad, I didn't get caught." Or, "Maybe I'll just increase my next attempt, maybe, from $100 to $200 dollars, see who notices?" And, then, you know what happens is it becomes almost like a game of, "Who can catch me?" Because we all think as kids, we're untouchable when we're outside, at recess, running around playing tag, "Nobody can catch me," and you start taunting.  So the fraud triangle is really put into place, where it's just really just kind of think about from a fraud perspective. Like, why do people commit fraud?  What is their intention and why? What's the rationale behind it? How can they live with themselves after doing something because we have been taught, from young age, "Thou shalt not steal, honor thy neighbor." But the fraud triangles just put things in different perspective. Adam:            It really does, and, I think, it goes back to that gray area, the rationalization, because everybody has a reason for the things that they do. And, you're right, you have to go back to personal ethics and just business ethics because a lot of things aren't so black and white, especially, in today's world. And, so, it's very difficult. And, so, how do you encourage your employees to avoid these things, and to look out for the pressures and the opportunities? Because if you tell them too much about it, maybe, some people will get ideas and say, "Oh, that's a really good idea, I should try that." How do you find that balance when you're trying to educate? A.J.:                That's definitely spot on, that's something that I get concerned with. We build out some of these schemes and how we detect, and then we talk about how we can educate and train others. What information do we provide so it can't be used against us? Really, the first line of defense is hiring the right employees, that's part of where the internal control starts. If you hire the right employees, if you do their background checks. You set them up to manage expectations, understand what is acceptable, what is not acceptable, but also educate them on what they can tell others. We can never tell anybody, in our field, who are filing a suspicious activity reports. So that is instituted on day one, managing those expectations and reinforcing those ideas.  The other aspect we have is we create different materials, and this is how we're able to distinguish what is more proprietary, internally, for us, and what can be shared outside our walls. That if it were to be released, yes, it's informative, but it can't come back and somebody can leverage that against us.  Now, we're not going to be able to cover everything because it's just impossible. But, I think, it really starts with hiring the right people, doing ongoing training. Reinforcing some of these concepts that the organization has, and even, sometimes, putting it to a test and just having somebody call in and see if they can get information out that, maybe, necessarily, shouldn't be. And, again, use this as coaching opportunities. The last aspect of how you can also prevent it is, again, do an audit. Work backwards and say, "Okay, did we let anything slip? Is there something that's out there that maybe we couldn't disclose, that we should have, or vice versa?" And it's critical because you have to not only start somewhere, you got to end somewhere. And it's always good to re-evaluate the progress and then update.  A lot of times what we use are standard operating procedures to outline, what can be shared, what cannot be shared. And we also have separate guidelines that we call unwritten rule. Like, "We don't say this to this team, but we can say this to our team." And that's, again, where you set those expectations from day one. Adam:            Do you think the advent of great technology, that's coming down the road, do you think that will help with the ability to do the constant audit? Because when you were saying all those things about auditing and constantly checking. I'm thinking, "How do you progress, as an organization, if you're constantly monitoring auditing?" But do you think, in the advent of new technologies, will that help companies still be able to advance and become better. But also be able to still detect the fraud, as they're going along? A.J.:                Technology is great when it's leveraged properly. It solves one problem but, sometimes, opens the door for another problem. But I do think that having the right team that understands the technology, understand how it's set up, from the beginning, is really critical in that audit.  Because, a lot of times we're inheriting technology when we start a new job, and we really don't have a true understanding of how decisions were made, at the beginning of implementation. To allow something to go through that, necessarily, we would not want to go through. So the technology aspect, at any point, in what I call the lifeline of it, is you really have to understand what is the full functionality of it, that can help you with those audits. And where there are gaps, that's when you might have to do some manual audit reviews and use different parties from different areas to review it, so you have that proper checks and balance.  Technology is wonderful, it can really help improve efficiencies, point out, maybe, some areas that are exposed. And I think that's what we're moving more toward with AI technology, in the future, as they continue to craft it, and being able to use it appropriately. I'm a big fan of technology. It definitely beats, I would say, the manual process.  But I will say this, if you don't understand and have the basic knowledge of something, it's hard to really challenge that technology. And if I may give a great example. Back in school, accounting, we learned all about T-accounts and we learned about what the debits and what the credits are, and how do you move, and post certain things, and what are the implications behind it because we're physically using these T-accounts. Today, a lot of the accounting is done by software. Where people aren't having that same understanding of where the debits and the credits go. What happened? They're just doing a lot of memorization. They're looking to see, and where technology helps, yes, it helps audit some of those mistakes but, sometimes, it doesn't provide the rationalization as to why it's done certain ways. And when you're looking in fraud, you have to go back to the basics to really understand, "How did we get here?" It's like the root-cause analysis type; in how did we get here? How do we look, and craft, and prevent something from happening? But technology can only get us there on the back end. And that's where you have to be able to create and build something from scratch. Adam:            I think you've really highlighted something really important there. That no matter how far technology advances, it's still important, for us, to understand the basics and the foundation of how things work. Because we can't utilize that technology, properly, unless we understand how it's supposed to work. And that's something that is being talked about in accounting education. And it's really important, especially, with the rise of things like Chat GPT, and the generative AI type, elements. If you don't know how to ask the questions properly, you won't get the proper answers to be able to utilize the technology right, so that's a really great point. And just speaking of generative AI, how do you think elements like that will affect your profession, especially, when it comes to fraud? I'm sure you can use it for good, but I'm sure that other people can use it for bad, just as well. A.J.:                When it comes to fraud, it is definitely a confidence. It's also sort of a bragging right, who can do it better? Is the fraudster better than the catcher? What can they do differently to conceal their actions?  So with AI, I think, eventually, what's going to help is you're using the machine learning, you're using some of the digital imaging, that's out there. And they can look at certain checks, for example, and compare different check stocks between the customers. If one customer uses a certain check stock and, all of a sudden, they see a check that's presented with a different check stock. The system is capable of flagging and saying, "Hey, this doesn't look right, somebody needs to review it." They can also look and learn at the behaviors that customers use. Most people get regular standard paychecks, usually, on certain days of the week, perhaps certain times of the month. And what happens there, it can flag for anything that might be out of scope and look for different algorithms, that are out there, to help flag and detect incidents of fraud. In terms of account takeover, Business Email Compromise, it can almost register where payments have always gone, and then flag it for when there is sudden change of payment information. And, again, it's not designed to, basically, be all and stop everything. What AI can leverage is to help us with the notification. Where it informs us that something doesn't look right, "Here's what doesn't look right, somebody needs to go and look at it." Now, some people may argue, "Well, we just want them to automatically do that." And that's, again, where you have to really understand the behavioral aspects of people. You have to understand how systems work and set things up. And, today's, day and age, we're always looking for the faster, the better, and the ease of working on something.  But if you're in the fraud space, like myself, we like puzzles, we like challenges, but we look at things holistically. And that's really important because not only did one transaction may have triggered the fraud, but there may have been a whole series of other things. And that's where technology, like AI, can help leverage those changes and, at least, give us a jump start when they can look at, maybe, thousands of checks, instantaneously, and say, "Hey, here are five that doesn't quite meet the parameters that have been built." That's where, I think, there's going to be a tremendous amount of value. The downside, again, is that we become too reliant on it and not understand our true crowd, not understand the true behaviors behind something. Adam:            Yes, I really like that answer, and it's going to be a continuously evolving thing. And A.J., this has been a great conversation. It's hugely important to talk about fraud, and I just want to thank you so much for coming on the podcast, today. A.J.:                Great, thank you for having me. Announcer:    This has been Count Me In, IMA's podcast, providing you with the latest perspectives of thought leaders from the accounting and finance profession. If you like what you heard and you'd like to be counted in, for more relevant accounting and finance education, visit IMA's website at www.imanet.org.

Each week it seems I post about new victims of payment fraud caused by changing vendor banking information.  In this episode I share 20 tips that the Vendor Team can use to avoid business email compromise.    Keep Listening.  Check out my website www.debrarrichardson.com if you need help implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data. Check out my new Vendor Process Training Center for 149+ hours of weekly live and on-demand training for the Vendor team.  Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.   Links mentioned in the podcast + other helpful resources:    Watch Webinar Recording / Download Presentation PDF: How Vendor Teams Can Avoid Business Email Compromise in 2023Vendor Process Training Center:  New Scam AlertsVendor Process Training Center:  https://training.debrarrichardson.comDebra R Richardson LLC:  20 Tips in 20 Minutes WebinarsVendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download (Get 25% Discount on the Global Vendor Registration Numbers)Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

In this best of episode from December 2021, we revisit Business Email Compromise (BEC) scams. What are they, how to identify them, and why BEC scams have resulted in well over $3 billion in losses since 2016, more than any other type of fraud in the U.S. We also share our tips on how to […] The post Business Email Compromise Scams Revisited appeared first on Shared Security Podcast.

In this eye-opening episode, we dive into the intricate world of Business Email Compromise (BEC), a sophisticated cybercrime that preys on individuals and organizations. Join us as we uncover the tactics employed by scammers, from romance scam victims turned accomplices to the dark realm of gift card fraud and cryptocurrency conversion. We explore the psychological manipulation that drives scammers and the emotional strain inflicted on victims. Discover how collaborative initiatives, such as the BEC Working Group, are working to combat these scams, and learn practical steps to empower organizations against this pervasive threat. Join the conversation and become informed about BEC scams to create a safer digital landscape for all.Find Ronnie on LinkedIn: https://www.linkedin.com/in/ronnietokazowski/This podcast is hosted by Ayelet Biger-Levin who spent the last 15 years building technology to help financial institutions authenticate their customers and identify fraud. She believes that when it comes to scams, the story starts well before the transaction. She has created this podcast to talk about the human side of scams, and to learn from people who have decided to dedicate their lives to speaking up on behalf of scam victims and who take action to solve this problem. Be sure to follow her on LinkedIn and reach out to learn about her additional activities in this space. https://www.linkedin.com/in/ayelet-biger-levin/ Also check out https://scamranger.ai if you had received a message that you suspect is a scam

Dr 90210 finds himself in a sticky situation after his patients' plastic surgery photos AND more end up in the hands of hackers, emails to the US military end up in the wrong hands, and script kiddies salivate at the thought of Business Email Compromise powered by generative AI.All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by T-Minus Space Daily's Maria Varmazis.Warning: This podcast may contain nuts, adult themes, and rude language.Episode links:90210 plastic surgeon Dr Gary Motykie.Dr Gary Motykie videos - YouTube.More plastic surgery patients have their nude photos and information leaked - DataBreaches.net.Typo watch: 'Millions of emails' for US military sent to .ml addresses in error - The Register.Hundreds of thousands of US military e-mails wind up in Mali - Le Monde.Beware of WormGPT: AI Tool Enables Cyber Attacks and Impersonation Scams - IB Times.WormGPT: a generative AI tool to compromise business emails - CSO Online.WormGPT - The Generative AI Tool Cybercriminals Are Using to Launch BEC Attacks - SlashNext.“Who shat on the floor at my wedding?”Futurama - Wikipedia.Radiooooo.Smashing Security merchandise (t-shirts, mugs, stickers and stuff)Sponsored by:Kolide – Kolide ensures that if your device isn't secure it can't access your cloud apps. It's Device Trust for Okta. Watch the demo today!ClearVPN - Hide your IP address, browse without geo-restrictions, and stay private online with a 30 day free trial of its premium plan.SUPPORT THE SHOW:Tell your friends and colleagues about “Smashing Security”, and leave us a review on Apple Podcasts or Podchaser.Become a supporter via

In this week's Security Sprint, Dave and Jen talk about the following topics: BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces.  https://www.cisa.gov/news-events/alerts/2023/06/13/cisa-issues-bod-23-02-mitigating-risk-internet-exposed-management-interfaces Volt Typhoon https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a Hostile Event Arrests. Austria LGBTQ+ Parade Arrests. https://www.bbc.com/news/world-europe-65944514?at_link_type=web_link&at_medium=social&at_ptr_name=twitter&at_link_id=948A7BFE-0DDC-11EE-90F5-49B87E934D9D&at_campaign_type=owned&at_link_origin=BBCWorld&at_bbc_team=editorial&at_format=link&at_campaign=Social_Flow Synagogue Attack Arrest. https://www.foxnews.com/us/michigan-19-year-old-planned-synagogue-mass-shooting-fbi-claims MOVEit. https://www.cisa.gov/news-events/alerts/2023/06/15/progress-software-releases-security-advisory-moveit-transfer-vulnerability Millions of Oregon, Louisiana state IDs stolen in MOVEit breach https://www.bleepingcomputer.com/news/security/millions-of-oregon-louisiana-state-ids-stolen-in-moveit-breach/ Great recap: CVE-2023-34362: MOVEit Vulnerability Timeline of Events (Last updated at Fri, 16 Jun 2023 15:18:17 GMT) https://www.rapid7.com/blog/post/2023/06/14/etr-cve-2023-34362-moveit-vulnerability-timeline-of-events/ Friday - The Cybersecurity 202: The MOVEit ransomware reckoning has begun https://www.washingtonpost.com/politics/2023/06/16/moveit-ransomware-reckoning-has-begun/ MOVEit mayhem 3: “Disable HTTP and HTTPS traffic immediately” https://nakedsecurity.sophos.com/2023/06/15/moveit-mayhem-3-disable-http-and-https-traffic-immediately/https://www.helpnetsecurity.com/2023/06/19/cve-2023-35708/https://www.washingtonpost.com/technology/2023/06/16/moveit-ransomware-attack/ TE-SAT. European Union Terrorism Situation and Trend Report 2023 (TE-SAT) which provides the most comprehensive and up-to-date intelligence picture on terrorism in the European Union.    Quick Hits Verizon Data Breach investigations report comes out tomorrow   LockBit CSA ⁠https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a⁠  Baseboard Management Controller (BMC) ⁠https://media.defense.gov/2023/Jun/14/2003241405/-1/-1/0/CSI_HARDEN_BMCS.PDF⁠  Proofpoint's 2023 Human Factor Report ⁠https://www.proofpoint.com/us/blog/threat-insight/2023-human-factor-analyzes-evolving-threats-attack-chain⁠ A pretty good overview on Proofpoint's 2023 Human Factor Report: Cybercriminals return to business as usual in a post-pandemic world ⁠https://www.helpnetsecurity.com/2023/06/16/post-pandemic-threat-landscape/⁠  How a Shady Chinese Firm's Encryption Chips Got Inside the US Navy, NATO, and NASA Las Vegas police foil Stanley Cup terror threat hours before Golden Knights win PERSPECTIVE: The Rising Incel Terrorism Threat and the Broader Problem of Misogynistic Violence Why connected cars are the next frontier in cybersecurity New Food and AG-ISAO. Food Producers Band Together in Face of Cyber Threats CISA, FBI, and MS-ISAC Update Joint CSA on Progress Telerik Vulnerabilities.  Forrester: Ransomware, Business Email Compromise and AI Among Top Cybersecurity Threats in 2023 Real Estate Firm Hack Affects 319,500 Patients, Employees; Owner of Addiction Treatment Centers, Medical Offices and Hotels Hit by Ransomware GAO: Violent Extremism and Terrorism: Agencies Can Take Additional Steps to Counter Domestic Threats, GAO-23-106758 ‘More extreme, more violent': experts' warning over khaki-clad Patriot Front; Their button-up shirts and chinos have prompted mockery but experts say the far-right group is becoming increasingly violent

Hey, it's 5:05 on Friday, May 26th, 2023. From the Sourced Podcast Network in New York City, this is your host, Pokie Huang. Stories in today's episode come from Mark Miller in Albuquerque, New Mexico, Edwin Kwon in Sydney, Australia, Katy Craig in San Diego, California, Olimpiu Pop in Transylvania, Romania, Marcel Brown in St. Louis, Missouri.Let's get to it.150th Episode

On this week's Security Sprint Dave and Andy talked about the following topics: Cyber Signals (BEC) Shifting tactics fuel surge in business email compromise. On 19 May, Microsoft “released the fourth edition of Cyber Signals highlighting a surge in cybercriminal activity around business email compromise (BEC). Ransomware Cybersecurity experts confirm school security blueprints stolen in MPS ransomware attack. Russian National Charged with Ransomware Attacks Against Critical Infrastructure.  CISA and Partners Release BianLian Ransomware Cybersecurity Advisory. Ransomware Revenue Down As More Victims Refuse to Pay Ransomware comes back with a vengeance Philadelphia Inquirer hit by cyberattack causing significant disruption New RA Group ransomware targets U.S. orgs in double-extortion attacks. Ransomware group claims 2.5 terabytes of stolen data less than a month after emerging online Ransomware Roundup - Maori LokiLocker, a Ransomware Similar to BlackBit Being Distributed in Korea Ransomware corrupts data, so backups can be faster and cheaper than paying up MalasLocker Ransomware Targets Zimbra Servers, Demands Charity Donation  ScanSource says ransomware attack behind multi-day outages Are Ransomware Attacks Declining, or Has Reporting Worsened? Pride Month.  Orlando Digital Traffic Sign Blasts Vile Message to ‘Kill All Gays.'  Threats against the LGBTQIA+ community intensifying: Department of Homeland Security. Venue Security. BBC: El Salvador stadium crush leaves at least twelve dead NY Times: What to Know About the Houston Astroworld Tragedy NBC News: Gilroy Garlic Festival Mass Shooting Quick Hits: Computer in Russia breached Metro system amid security concerns, report says. 'Belligerent' passenger arrested after hitting flight attendant with intercom phone, Frontier Airlines says | CNN DOJ: Judge Imposes Eight Consecutive Life Sentences Plus 260 Years in Prison for ISIS-Inspired 2017 Murder of Eight Victims and Attempted Murder of 18 Others in NYC Truck Attack.  Congress looks to expand CISA's role, adding responsibilities for satellites and open source software. World likely to breach 1.5C climate threshold by 2027, scientists warn Burleson Man Who Idolized Mass Shooters Charged With Possessing Homemade Bomb: Feds New Mexico Shooter Was Wearing Bulletproof Vest, Carried Cryptic Note In His Pocket, Police Say At least 3 people killed, 2 cops injured in New Mexico shooting 3 dead, 6 injured in New Mexico shooting: Police Massachusetts Man Indicted for Acting as an Illegal Agent of the People's Republic of China Zoom executives knew about key elements of plan to censor Chinese activists Pentagon leak suspect Jack Teixeira warned about mishandling classified info, prosecutors say FBI misused surveillance tool on Jan. 6 suspects, BLM arrestees and others Homeland Security Uses AI Tool to Analyze Social Media of U.S. Citizens and Refugees; US Dept. of State: 2022 Report on International Religious Freedom Montana's TikTok ban: why has it happened and will it work?    

When prompted, ChatGPT gave me 5 types of business email compromise!  Four of the types, no problem – but one was one I hadn't thought about but is definitely fraudulent! If you want to hear the five types and how to combat each…. Keep listening. Check out my website www.debrarrichardson.com if you need help implementing authentication techniques, internal controls, and best practices to prevent fraudulent payments, regulatory fines or bad vendor data. Check out my new Vendor Process Training Center for 149+ hours of weekly live and on-demand training for the Vendor team.  Subscribe today to be entered in the subscriber-only monthly drawing to win a free Putting the AP in hAPpy Coffee Mug.  Links mentioned in the podcast:    Vendor Master File Tip of the Week:  Easy Precaution From the Secret Service to Protect Your EmailsVendor Master File Tip of the Week:  Don't Collect Vendor Banking From An InvoiceVendor Validation Reference List with Resources Links: www.debrarrichardson.com/vendor-validation-download (Get 25% Discount on the Global Vendor Registration Numbers)Vendor Master File Clean-Up:  https://www.debrarrichardson.com/cleanupYouTube Channel:  https://www.youtube.com/channel/UCqeoffeQu3pSXMV8fUIGNiw More Podcasts/Blogs/Webinars www.debrarrichardson.comMore ideas?  Email me at debra@debrarrichardson.com Music Credit:  www.purple-planet.com

In this episode I provide a post-mortem on a Business Email Compromise event to show the seemingly non-existent "Cyber Safety Review Board" how easy it can be.   I also discuss Twitter charging for SMS MFA use and how to still get MFA on Twitter with a simple phone app.  Give a listen, tell a friend. Email thoughts, comments, or suggestions to darren@thecyburguy.com or follow me at linkedin.com/in/darrenmott.  

Luna Moth's callback phishing offers an unpleasant and less familiar form of social engineering. New activity by China's Mustang Panda is reported. DEV0569 is using malvertising to distribute Royal ransomware. US indicts 10 in a business email compromise case. Developing a cyber auxiliary. Dave Bittner sits down with AJ Nash from ZeroFox to discuss holiday scams. Our own Rick Howard speaks with us about cloud security. And beware of Black Friday scams. For links to all of today's stories check out our CyberWire daily news briefing: https://thecyberwire.com/newsletters/daily-briefing/11/223 Selected reading. Threat Assessment: Luna Moth Callback Phishing Campaign (Unit 42)  DEV-0569 finds new ways to deliver Royal ransomware, various payloads (Microsoft Security)  Earth Preta Spear-Phishing Governments Worldwide (Trend Micro)  EXCLUSIVE: Rounding up a cyber posse for Ukraine (The Record by Recorded Future)  Tech for good: How the IT industry is helping Ukraine (Computing)  10 Charged in Business Email Compromise and Money Laundering Schemes Targeting Medicare, Medicaid, and Other Victims (US Department of Justice)  Black Friday and Cyber Monday risks. (CyberWire)