A number of recent events have provided a reminder of the importance of security in our computing lives. Instead of elaborating in one long blog post, I will break these out into smaller, individual discussions. Top of mind for me today is the recent trend of cyber theft – costing businesses, schools, and other organizations tens to hundreds of thousands of dollars.
The general approach is for the attackers to use a keystroke logging program, typically placed on a computer system through a virus or malware, to steal the credentials that the organization uses to manage its bank accounts online. A common method for placing these spies is through email promoting “too good to be true” offers like an unexpected refund/rebate or generous money making opportunity. Once in place, these rogue programs may go undetected by your antivirus protection software. Once the thieves have gathered the necessary bank credentials, they can then access them online to make outbound transfers to their network of accounts. The money movement does not stop there, as the funds will be moved again and eventually land overseas.
So what can we do to help protect ourselves? Unfortunately, in today’s wired world, we cannot insulate ourselves completely. However, we can reduce our risks by implementing the following precautions:
- Email: Always be mindful that not all email is good email. Only open email from trusted sources. And even then, if the message seems suspicious, treat it as such or check with the sender to verify before opening.
- Antivirus: In addition to having antivirus protection software installed and running on your computers, make sure that they are being updated with the latest virus signatures. Outdated signatures leave you at risk from new and evolving threats. If a computer does happen to become infected, consider seriously the risk/benefit of reinstalling the operating system and applications, instead of just removing the virus. The upfront inconvenience may reduce or eliminate future frustrations.
- Bank Accounts: Stay vigilant in monitoring your banking activity. In the several instances that I am aware of personally, the organization spotted the fraudulent activity itself. Early detection will help limit the potential loss and increase the chance of recovering those funds. In fact, failure to identify and dispute unauthorized activity on a commercial account within a couple of business days greatly reduces the likelihood of retrieving any of the money that was transferred.
- Dedicated Terminal: To maximize protection from unwanted access, dedicate a computer for online banking and then limit it to only that activity. Do not do any other web browsing or email from that workstation. When you are done with your banking, turn it off until you need to access your account again.
The Internet provides us with many benefits, but it also leaves us open to unfriendly human interference if we are not careful. So use common sense as you surf and email. If you have questions or concerns about the safety of your network and computers, work with your IT professional to review your environment and implement any necessary changes.
If you want to read more about this trend in cyber theft, check the following posts from Brian Krebs’ blog:
Let’s be safe out there …