This section covers some technical aspects of security related to your email, computers and cloud services such as Dropbox and OneDrive.

Today nearly all security threats are driven by the motivation to obtain money by fraud. The threats are constantly evolving as fraudsters evolve their methods as older threats become less effective. Common threats are :

Ransomware
Phishing
Dark Web

Ransomware, although on the decline remains a common threat. Ransomware starts with an email that tricks the receiver into clicking a link and then it starts downloading and installing software onto the computer. The ransomware software then proceeds to encrypt files on that computer and any shared folders it can. Encryption effectively locks the files and makes them unusable without the password to unlock them. The software then posts a note on the computer demanding payment in Bitcoin to release the files.

More recently fraudsters have switched to even more lucrative deceptions involving tricking businesses or individuals to transfer money directly to the fraudsters bank accounts. In one recent example, hackers accessed a “Lucy’s” email account and then sent instructions to her solicitor to transfer $42,000 from Lucy’s Trust account. The solicitor followed the written instructions without confirming in person or on the phone. Lucy’s money was lost. In another example, “Peter”, a wholesale distributor received instructions to change the bank account payment details on a supplier invoice and paid $35,000. The email was from fraudsters pretending to be the supplier and the bank account details were the fraudsters not the supplier. This money is also lost.

These deceptions involve hackers obtaining email addresses and passwords. This is called phishing. It starts with an email which asks the receiver to click a link then enter their email address and password. The link directs the receiver to a web site which belongs to the hackers and they harvest passwords from there. Often compromised email accounts are used to send out these emails, so it may come from someone familiar such as a business acquaintance or colleague. This increases the chance of the fraud working because the receiver is likely to be less suspicious when clicking on the link.

Passwords which have been obtained through data breeches of major corporations can also be purchased by hackers on the Dark Web. That is why you should never reuse passwords across different services.

So how can a business remain protected against these threats? Here are our top five recommendations.

Become aware of potential fraud and look out for any suspicious emails. Anything slightly suspect should be confirmed by phoning the sender before taking any action. Never transfer money without confirming with the sender by phone even if the sender is known, because their account has probably been compromised
Activate two factor authentication (2FA) on all your email accounts and Dropbox. Microsoft and Google email services support 2FA. If fraudsters do obtain your passwords, they can’t access your account because they are blocked by the additional security check.
Ensure you backup all critical data and check it. In case your files are attacked by Ransomware the files can be recovered from the backup without paying the ransom.
Make sure your systems are kept up to date and you have good security software installed. Microsoft are ending support for Windows 7 in January 2020 so make sure you upgrade to Windows 10 before then.
Use strong passwords, a quality password tool to store passwords and never use the same password on different web sites.

There are also a range of additional security measures such as preventing pop and imap access to your email and setting up alerts for suspicious access to your email accounts. Talk to your IT provider about implementing these extra measures

This article is brought to you by Excelero IT solutions for any questions about the recommendations in the article please call John Braakhuis on 0433 00 4288.