Risk & Business Magazine Miller Winter 2019 | Page 7

SOCIAL ENGINEERING
D
o you have ironclad
trust in your employees
that handle your most
sensitive financial
data? The sad fact is
that you may be forced to rethink
this. In today’s sophisticated world
of cybercrime, even the most
loyal employees can be duped into
unknowingly handing over critical
customer information or other
sensitive data. While hackers can
enter your computer systems through
a variety of ways—such as stolen
passwords or network infiltration—
some of their methods are even more
devious, particularly the new trend
toward what’s being called “social
engineering.”
In social engineering schemes,
hackers take advantage of human
weaknesses and temptations to get
employees to click on specific links,
allowing them to enter the user’s
network and wreak havoc on their
systems. They do this in a number
of ways, such as by sending emails
to employees with falsified sender
information and tricking them to link
through to “important information”
related to their jobs.
The idea of luring customers into
giving up their banking or personal
information to strangers has been
around for decades—most people
by now know to be wary of these
requests. But now, businesses as
well as consumers must be on
hyperalert against these criminals
who are constantly scheming to
access networks containing valuable
information, including everything
from top-secret military information
to confidential health records to
personal financial data.
Tricking someone into disclosing
sensitive information of their own
volition feeds off the human instinct
to trust and be helpful—particularly
in a work situation. Employees are
trained to be responsive on the job
and act respectful to customers and
vendors alike. Criminals exploit
this quality by using various forms
of communication, such as email, the
internet, the telephone, and even face-to-
face interactions to infiltrate and defraud
their targets. They may cultivate their
source on an ongoing basis, beginning
with information gathering, growing
into a relationship status, and then
diving into exploitation—all without the
victim’s awareness.
"IN SOCIAL
ENGINEERING
SCHEMES, HACKERS
TAKE ADVANTAGE OF
HUMAN WEAKNESSES
AND TEMPTATIONS
TO GET EMPLOYEES
TO CLICK ON SPECIFIC
LINKS, ALLOWING
THEM TO ENTER THE
USER’S NETWORK
AND WREAK HAVOC
ON THEIR SYSTEMS."
Here’s one example of how it works.
Say you are a controller at a private
corporation, responsible for making
regular payments to an overseas vendor
for supply that is later incorporated into
finished goods for sale in the United
States. After regularly working with this
vendor for some time, the controller
receives an email purportedly from that
same vendor describing an impending
move to a new bank. The controller
complies with the change request
and sends along payment to the new
institution. When the regular vendor
comes forward seeking payment some
time later, the buyer realizes a scam
has taken place and is out a large sum
of money. In this case, nobody hacked
into an account or used technology
to blindside someone without their
knowledge. The victim willingly gave
up identifying information and made
payment to the criminal.
Once businesses accept that it is
virtually impossible to guard against
these hackers, they need to take steps to
protect sensitive financial data. Training
should be an important component of
this effort, with formalized classes for
employees on when it’s OK to divulge
confidential information and to whom,
and when it is not. At the corporate
level, sensitive information should
be on a system different from the one
that widely used information is on,
and access should be restricted only to
key personnel. Employees should be
trained on what suspicious malware
links may look like, and companies can
even implement practice drills to assess
employees’ preparedness. In addition, IT
departments should force employees to
change their passwords frequently and
should be sure to implement software
updates as soon as they become available.
As wide-scale data breaches continue to
get reported—whether committed by
social engineering or more traditional
means of hacking—more businesses
are realizing the importance of a good
cybersecurity insurance policy. These
policies are designed to cover not just
large businesses whose hacks receive the
most press attention but any small or
medium-sized business that safeguards
sensitive customer, vendor, and employee
information.
Your insurance broker can help you
determine whether your business liability
policy can provide enough protection
in the event of a serious data breach or
whether a separate cybersecurity policy is
needed. These policies provide coverage
for a number of different risk factors,
including network infiltration, regulatory
breaches, data loss, business interruption,
and losses due to social engineering
schemes. While policies differ widely
with respect to their specific coverages
and premiums—premiums usually
depend in large part on revenues—talk
with your broker to understand what
coverage you need to protect yourself,
your staff, and your customers. +
7