Cybercrime: Don’t be a Victim

As a cyber-security expert, I know how fragile a company’s finances can be when left unprotected. Over the past few months, I’ve been involved in an international task force dealing with a specific cyber- crime that should be of major concern to all EO members: bank wire and automated clearing house (ACh) fraud. In fact, some of you have already fallen victim to this offense, including one member whose company was defrauded to the tune of more than uS$300,000.

The particular cyber-crime I’m referencing involves wire transfers and ACh processes— basically, the network that allows funds to move between banks. The criminals I speak of are international financial terrorists who prey on uneducated business owners. By spreading some very sophisticated and difficult-to-detect software, and taking advantage of the third-party clearing processes, these terrorists stole directly from small businesses to the tune of uS$100 million last year … and that was just one criminal gang!

It’s an epidemic, it’s global in scope, and I want to make sure that no other EO members join the ranks of these victims. The initial weakness occurs when someone in your organization gets a carefully crafted e-mail addressed to a senior executive (perhaps you), which triggers a reaction. I have received e-mails like these claiming to be from the local Better Business Bureau, mentioning a negative report or something of that sort. I’ve also received disguised e-mails that are addressed to me, some of which came from our bank (our actual bank); they mention the names of my CFO and controller, referring to a significant chargeback. Spooky.

Believe it or not, these criminals do their homework. I’m not talking about the broadly spread, fake bank e-mails you receive daily. These cyber-terrorists actually research your Web site, search for executive’s names, look at your press release page, identify events and refer to them in their messaging. A surprising number of executives click on the attachments or links … and the damage is done. The compromised system looks for other local machines, and because your system is behind your corporate firewall, which is now of no value, it attempts to exploit them through well-known vulnerabilities.

Eventually, the criminals end up infecting the controller’s or accountant’s computer. Once that occurs, they monitor traffic, log connections to your bank and capture your log-in credentials. At that point, you’re done for. Just before your bank’s closing time, the criminals log in to your account and set up a series of wire transfers.

By the time you get to work the next morning, your account is empty. Now you’re left struggling to figure out what happened, and how to get your funds back. Sometimes you catch a lucky break, but more often than not you lose everything.

To defend your company’s assets, here are some immediate actions you can take while you develop a more sustainable, long-term plan:

• Separate banking tasks. Buy a cheap laptop and dedicate it to banking alone. Don’t use it for e-mail, and never browse the internet. Log on to your bank, do your banking, log off, disconnect it from the internet and power it off.

• Establish secure confirmations. Ask your bank to implement a positive mechanism, which ensures that unless a wire transfer is pre-notified to them, they must call you for voice confirmation. In the US, this is known as “positive pay.”

• Safeguard the internet. Establish strict rules for employees regarding their use of the internet. Show them some of the real-world stories about cyber-terrorism and how it can affect their employment.

• Keep your information safe. Internet hygiene goes a long way in keeping your information safe. Keep anti-virus programs and patches up to date, and never click on attachments or links in e-mails you don’t absolutely trust.

Keeping your finances in check and your company’s important information under lock and key isn’t as hard as it seems. A few simple steps like those listed above can go a long way in ensuring you never experience the heartbreak of bankruptcy as a result of online vulnerabilities. In the end, the best way to stave off cyber- terrorism is to be armed with the right information and put in place processes that keep you and your company safe.

Rodney is a serial entrepreneur who has founded and sold a number of prominent companies, most notably Genuity, one of the largest internet service providers. He is also a leading global authority on cyber-terrorism. Rodney is currently the senior vice president and senior technologist at Neustar, a telecommunications provider. E-mail him at [email protected].