Michael J. Walls explains why cyber-security should be a priority for the year ahead.
Did you make a New Year’s resolution? I have to admit, I usually don’t bother. As cyber-criminals are utilising increasingly sophisticated techniques, however, digital business owners such as myself need to keep up-to-date with cybersecurity to prevent cyber-criminals hacking sensitive information or falling victim to fraud.
Thanks to the advances in cloud computing in recent years, companies and accountancy practices alike have increased their online operations. This comes with many risks and organisations should ensure that robust processes are in place to mitigate the associated risks.
There were numerous high-profile cyber-attacks in 2018 involving T-Mobile, Cathay Pacific and MyFitnessPal. These attacks resulted in users’ personal information, including credit card details in some cases, being obtained and exposed to the public.
To kick off 2019, I therefore decided to update readers of Accountancy Ireland on the latest cyber-criminal techniques and outline the steps you can take to mitigate the risks to your business.
Spear phishing and whaling
Chartered Accountants working in a finance function may have encountered an email that appears to be from an organisation’s executive or director requesting a payment. In fact, the email originated from a hacker impersonating the executive or director in question.
Hackers have also been spoofing email addresses of employees within organisations to target finance teams with change of bank details requests for payroll purposes. If overlooked, organisations could end up making payments for wages, goods or services to fraudulent bank accounts. So, what should you do?
Finance teams should have robust processes and controls in place for change requests relating to bank accounts, and particularly for requests received via email. The simplest and most effective process involves a follow-up call to the supplier or employee in question to verify the change.
Should your business fall victim to such a fraud and payment is made to a fraudulent bank account, you should contact your bank immediately to report the transaction and ensure that it is escalated to the bank’s fraud team. This is your best chance of getting the money back, as the bank may be able to freeze the payee’s account before the funds are withdrawn and moved offshore.
Credential stuffing
In this scenario, log-in credentials obtained from a previously compromised website will be used by hackers in a ‘brute force’ attempt to access a range of other sites or systems. Hackers will automate log-in attempts to various sites using the known log-in credentials and may gain access to your user accounts. If this is a business critical system, the hacker could hold your business to ransom.
So, what should you do? Businesses must ensure that strong password policies that require the use of a unique password for each site or system are in place. To check if your email address has been compromised in a data breach, visit this website:
https://haveibeenpwned.com. If your email address has been subject to a breach, you will see details of the site or sites where your data has been potentially exposed to hackers. If you haven’t already changed your log-in credentials for those sites, you should do so immediately or close the account if it is no longer in use.
Invoice fraud
Many organisations now send invoices via email but this trend has opened up a whole new field for hackers, who intercept emails containing invoices and change the bank details on the invoice. The invoice is then sent to the customer requesting payment to the new bank account.
Customers may then make a payment to the fraudulent account in the false belief that they are paying the invoice correctly. Once the payment has been made, hackers use a money mule (see below) to move the funds offshore.
So, what should you do? Ask your customers to verify ‘change of account’ requests by phone or in person, should they ever receive an invoice containing new bank details.
Money mules
Money mules is a term used to describe innocent victims who have been tricked (or possibly groomed over a long period of time) by fraudsters into laundering stolen or illegal money via their bank account. The money is deposited into the money mule’s account and they must then transfer the money to a foreign account via a financial services company. This is a critical issue for businesses as money mules may become the target of criminal investigation given the fact that they are laundering the proceeds of crime.
So, what should you do? As a Chartered Accountant, you should always be mindful of your reporting requirements subject to the relevant anti-money laundering legislation. You should also advise your clients and employees to keep their bank details private unless they are absolutely certain that the details are required for a legitimate purpose.
Remain sceptical
When it comes to operating a business online and keeping the cyber-criminals at bay, the important thing is to remain sceptical when it comes to emails requesting payment or changes to bank details. Always follow-up with a phone-call and ensure that your customers give you the same courtesy.
When it comes to log-in credentials, always have a strong unique password for each service or system you use, especially for business critical systems, and ensure that two-factor authentication is enabled wherever possible.
Top Five Cybersecurity Tips
- Passwords: It is important to ensure that you have a strong unique password for each online service or system you use. Password managers such as LastPass or 1Password can help generate strong unique passwords and store these in a password vault, so you don’t have to rely on your memory.
- Two-factor authentication: Nowadays, having a strong password isn’t sufficient to protect sensitive or confidential information, but combining a password with a token that generates a one-time code will provide an extra layer of security. Where a service offers two-factor authentication, this should be enabled. You can then use a SMS text message or Google Authenticator to complete your log-in verification.
- Lock desktop: Would you leave sensitive documents lying around in the open for anyone to read? Failing to lock the desktop of an unattended laptop or mobile device is a major risk, especially if the device contains sensitive client information. Get in the habit of locking your unattended devices if you want to avoid a potential GDPR breach. Lock the device, or pay the price.
- Mobile device security: Do you have client information on your mobile device? If so, you should ensure that you have a PIN with more than four digits and that you are able to wipe the device remotely in the event of loss or theft.
- Privacy screens: If you work in an open plan office with sensitive or client-confidential data, invest in privacy screens to ensure that the data remains confidential.
Michael J. Walls is the Founder and CEO of Dappr and the 2018 Young Chartered Star.