Corporate Account Takeover & Information Security Awareness

Transcription

1 Crprate Accunt Takever & Infrmatin Security Awareness What is Crprate Accunt Takever? A fast grwing electrnic crime where thieves typically use sme frm f malware t btain lgin credentials t Crprate Online Banking accunts and fraudulently transfer funds frm the accunt(s). Malware, shrt fr malicius sftware, is sftware designed t infiltrate a cmputer system withut the wner's infrmed cnsent. Malware includes cmputer viruses, wrms, trjan hrses, spyware, dishnest adware, crime ware, mst rtkits, and ther malicius and unwanted sftware. Dmestic and Internatinal Wire Transfers, Business-t-Business ACH payments, Online Bill Pay, Electrnic payrll payments have all been used t cmmit this crime. Hw des it wrk? Criminals target victims by scams. Victim unknwingly installs sftware by clicking n a link r visiting an infected Internet site. Fraudsters begin mnitring the accunts when victims lg nt their Online Banking. Fraudsters cllect lgin credentials and wait fr the right time and then depending n yur cntrls they lgin after hurs r if yu are utilizing a tken they wait until yu enter yur cde and then they hijack the sessin and send yu a message that Online Banking is temprarily unavailable. Statistics Where des it cme frm? Malicius websites (including Scial Netwrking sites) P2P Dwnlads (e.g. LimeWire) Ads frm ppular web sites Web-brne infectins Accrding t researchers in the first quarter f 2011, 76% f web resurces used t spread malicius prgrams were fund in 5 cuntries wrldwide ~ United States, Russian Federatin, Netherlands, China, & Ukraine. Rgue Sftware/Scareware Frm f malware that deceives r misleads users int paying fr the fake r simulated remval f malware Has becme a grwing and serius security threat in desktp cmputing. Mainly relies n scial engineering in rder t defeat the security sftware. Mst have a Trjan Hrse cmpnent, which users are misled int installing: Brwser plug-in (typically tlbar). Image, screensaver r ZIP file attached t an . Multimedia cdec required t play a vide clip. Sftware shared n peer-t-peer netwrks A free nline malware scanning service

2 Phishing Criminally fraudulent prcess f attempting t acquire sensitive infrmatin (usernames, passwrds, credit card details) by masquerading as a trustwrthy entity in an electrnic cmmunicatin. Cmmnly used means: Scial web sites Auctin sites Online payment prcessrs IT administratrs Examples f Phishing:

3

4 Usage CAUTION! What may be relied upn tday as an indicatin that an is authentic may becme unreliable as electrnic crimes evlve. This is why it is imprtant t stay abreast f changing security trends. Usage Sme experts feel is the biggest security threat f all. The fastest, mst-effective methd f spreading malicius cde t the largest number f users. Als a large surce f wasted technlgy resurces. Examples f crprate waste: Electrnic Greeting Cards Chain Letters Jkes and graphics Spam and junk

5 What can we d t Prtect? Prvide Security Awareness Training fr Our Emplyees & Custmers Review ur Cntracts: Make sure that bth parties understand their rles & respnsibilities Make sure ur Custmers are Aware f Basic Online Security Standards Stay Infrmed Attend webinars/seminars & ther user grup meetings Develp a layered security apprach Layered Security Mnitring f IP Addresses Use Calendar File Frequencies, and Limits Dual Cntrl Prcessing f files n separate devices recmmended Fax r Out f Band Cnfirmatin What can Businesses d t Prtect? Educatin is Key Train yur emplyees Secure yur cmputer and netwrks Limit Administrative Rights -D nt allw emplyees t install any sftware withut receiving prir apprval. Install and Maintain Spam Filters Surf the Internet carefully Install & maintain real-time anti-virus & anti-spyware desktp firewall & malware detectin & remval sftware. Use these tls regularly t scan yur cmputer. Allw fr autmatic updates and scheduled scans. Install ruters and firewalls t prevent unauthrized access t yur cmputer r netwrk. Change the default passwrds n all netwrk devices. Install security updates t perating systems and all applicatins as they becme available. Blck Pp-Ups D nt pen attachments frm -Be n the alert fr suspicius s D nt use public Internet access pints Recncile Accunts Daily Nte any changes in the perfrmance f yur cmputer Dramatic lss f speed, cmputer lcks up, unexpected rebting, unusual ppups, etc. Make sure that yur emplyees knw hw and t whm t reprt suspicius activity t at yur Cmpany & the Bank Cntact the Bank if yu: >Suspect a Fraudulent Transactin >If yu are trying t prcess an Online Wire r ACH Batch & yu receive a maintenance page. >If yu receive an claiming t be frm the Bank and it is requesting persnal/cmpany infrmatin.