Mark Pribish

Cybersecurity plan should address insider threats

By Mark Pribish
Vice President and ID Theft Practice Leader

Employees do it for money or to pay back a perceived wrong. Some workers commit this form of sabotage because they didn't get a raise or promotion, or to help a friend.

Reports consistently show that employee hacking and cyberbreaches - known as the "insider threat," are your biggest threat when it comes to data and ID theft.

It's three strikes out for a one-time MLB team and league employee. The Federal courts have focused on the activities of the St. Louis Cardinals baseball team as former Cardinals scouting boss Chris Correa has pleaded guilty to hacking of the Houston Astros' computer system.

According to the New York Daily News, "former St. Louis Cardinals scouting director Chris Correa pleaded guilty in Houston federal court to five counts of unauthorized access to the Astros' player data base, in a case that gave new meaning to baseball sign stealing."

This illegal breach happened because Correa was able to gain access into the Houston Astros' computer network by obtaining the password of an Astro's employee who had previously worked for the Cardinals. When the former Cardinal's employee left the St. Louis Cardinals, the employee had to turn over his Cardinals-owned laptop and password to Correa.

Do you want to guess what happened next? Correa was able to use the old password of his former employee to guess the new password of his competitor.

Does this sound like corporate espionage of an international, Fortune 500 company? Absolutely. Can it happen to any size organization including your small business? Absolutely.

The fact is that any business is at risk of acts of sabotage from current and former disgruntled employees and several recent headlines are examples of the problems facing employers.​But it gets worse. In the old days, disgruntled employees would "seek revenge" by stealing office supplies and bad-mouthing the boss.

Today, current and former employees are more likely to hack into your computer system to view and steal salary records, medical records, bank account information (e.g. for direct deposit purposes), driver's license information, credit card information, and Social Security Numbers.

Additional "at risk information" being targeted by the insider threat includes proprietary company information and trade secrets, vendor information (e.g. server credentials like what happened to Target), and even cyber terrorists sabotaging data and networks such as the Sony hacking event from a terrorist state like North Korea.

And just when you think things can't get any worse than the above, you find out about an unhappy employee working as part of a conspiracy with outside hackers to attack your company.

"Some of the most costly data breaches originate from malicious insiders," said John Iannarelli, a recognized expert on cybercrime and a former FBI special agent who now operates JGI Consulting Group.

Current and former employees intent on doing bad things typically have access to resources external which hackers generally don't have access, said Iannarelli.

Companies - especially small to medium business - have to balance giving employees access to information while monitoring for suspicious or abnormal behavior, said Iannarelli. This can be done with a written, annually reviewed information security and governance plan signed by each employee to establish policies to safeguard proprietary and sensitive information from both cyber and physical loss, recommended Iannarelli.

Minimize your risk of a malicious insider by implementing a strong information security and governance plan which includes monitoring employees.


To learn more about these threats and how to protect yourself and your family from Identity Theft, you can read my past newsletters at the Merchants Identity Theft Educational Website at www.idtheftedu.com.


Internet-Connected Cars: Scammers' Next Target

Scammers can even take advantage of your car. To find out more read this week's scam alert.

April 08, 2016

Is your car connected? Many cars can now connect to the Internet, enabling drivers to play music, use GPS, and access roadside assistance without their phone. Unfortunately, Internet connection comes with a potential drawback. It opens up your car to the risk of hacking, warns a new Federal Bureau of Investigation alert.

How the Scam Works:

You use the dashboard of your connected car to get GPS directions, connect through apps or stream music. But one recent study found that scammers can take advantage of security holes in the Wi-Fi connection to gain access to the car's computer. Once they get in, hackers can steal data or even take control of your vehicle.

Connected car hacking is more of a possibility than an existing issue. But as more people purchase connected cars, con artists are bound to find ways to use them for scams. This just happened with smartphones a few years ago, so the FBI wants consumers to be aware of the potential problem and to treat connected cars like other computer devices.

Tips to Keep Your Connected Car Secure:

  • Treat your car like a computer. Your connected car is a computer, so use the same common sense you would for keeping your laptop safe. Be especially cautious when allowing third-party devices to access your car's computer for reasons other than vehicle diagnostics and maintenance.
  • Respect recalls. If you receive a recall notice for an issue related to your car's computer system, treat it as seriously as you would a safety recall and get it taken care of right away. The notification will tell you how to get the problem fixed. Cyber recalls are regulated by the National Highway Traffic Safety Administration, and you can check for all recalls at recalls.gov/nhtsa.html
  • Keep your vehicle's software up-to-date. Manufacturers will do their best to patch security holes. System updates are annoying but vital for protecting your device. Always make sure you have the latest updates, "bug fixes," and security patches, but only download those officially provided by the manufacturer.
  • Don't make changes to vehicle software. Making unauthorized changes to the vehicle's software may introduce new vulnerabilities that could be exploited by scammers.
  • Lock your car. Just as you password-protect your smartphone and laptop, be sure to lock your car and know who has access to it.
  • If you suspect your connected car has been hacked... Contact the vehicle manufacturer or dealer. Provide them with a description of the problem so that they can work with you to resolve any potential cybersecurity concerns.

For More Information

Read the complete alert from the FBI's Internet Crime Complaint Center. The public service announcement contains tips to protect your car and additional resources.

To find out more about other scams, check out BBB Scam Stopper (bbb.org/scam). To report a scam, go to BBB Scam Tracker (bbb.org/scamtracker).

Courtesy of the Better Business Bureau - for more information visit http://www.bbb.org/phoenix/news-events/

If you believe your identity has been stolen, call 866.SMART68 today.