• coronavirus
• cyber risk
• cyberattack
• phishing
• report
• security awareness
• survey

Online consumers can do everything right and still become cyber victims. Learn about synthetic identity fraud and why “buyer beware” is not enough. Digital criminals are creating new and effective ways to con businesses and financial institutions by using synthetic identity fraud. They are having enough success that those in the know at McKinsey and Company are more than a little concerned:

“By our estimates, synthetic identity fraud is the fastest-growing type of financial crime in the United States, accounting for ten to fifteen percent of charge-offs in a typical unsecured lending portfolio.”

Laura Hoffner, current chief of staff at Concentric and former naval intelligence officer, is also concerned. “We’re seeing a huge increase in synthetic identity fraud — the process of combining real and fake personal information to create an identity and commit fraud,” Hoffner said during an email conversation. “It’s really growing, fueled by easy criminal access to corporate networks and Ransomware as a Service (RaaS) tools.”

Part of the problem, according to Hoffner, is the amount of personally identifiable information (PII) that has been compromised over the last 10 years. “Access to compromised networks is cheap, thanks to the availability of initial-access brokers and RaaS tools that can turn everyday petty crooks into full-blown cybercriminals in an afternoon,” Hoffner said. “This trend is most prevalent in the United States because of the emphasis on static PII to verify identity.”

…

What exactly is synthetic identity fraud?

Synthetic identity fraud melds factual information with fake information to create a unique identity that cybercriminals can exploit. An example of factual information commonly used by digital fraudsters would be Social Security numbers (SSNs) — especially SSNs of young children and deceased adults, due to a lack of activity and monitoring of those accounts. False information tends to include fake addresses, social media profiles or any required information to complete the targeted financial application. “Together, this creates an entirely new identity through which fraudulent and illicit activity can go unchecked,” Hoffner said.

…

What can be done to avoid synthetic identity fraud?

Sadly, synthetic identity fraud is difficult to detect and thus, hard to prevent. And as mentioned earlier, we consumers can do little to protect ourselves. Buyers have to rely on businesses and financial institutions to have sophisticated equipment to spot synthetic identity fraud.

…

Filed: https://www.techrepublic.com/topic/security/

More about cybersecurity:

Cyber insurance has been around since the 1990s and is viewed much differently since ransomware started growing and making headlines every day. Insurance companies used to employ cash-flow underwriting on cyber policies, meaning that they would take on a lot of polices just to pad their books of business with premiums. As a result, enterprises would often get blanket cyber coverage for a relatively good price – at least compared to today’s standards. Ransomware has largely struck fear in insurers, and they have reduced coverage significantly and are raising premiums. Some even consider excluding it altogether.vInsurers offering cyber coverage are asking more diligent questions about enterprise risk posture and adding more exclusions. This eliminates coverage for certain acts, property, types of damage or locations. Insurers are also trying hard to diversify their books of business so that a single ransomware attack to a third-party provider doesn’t drive catastrophic losses. Imagine being an insurance company that had many insureds with SolarWinds software during that attack. The financial loss of a catastrophic event can be so large that an insurer may be collecting premiums for 10 years only to have one attack wipe out all those profits.

On the insurance side, they will invest more in tools for underwriting cyber risk, portfolio management and high-end cybersecurity risk mitigation services to their insureds. One thing that could begin to materialize in 2022 is growing cyber insurance regulations to drive standardization. Any progress on this front should help enterprises better understand what’s expected of them in terms of communicating their cyber risk posture and also what they can expect in terms of cyber coverage.

…

NB How about an outside security/risk audit, not just once during underwriting?

Security researchers used a Bluetooth vulnerability to change negative results to positive. Security researchers found a vulnerability in a home test for COVID-19 that a bad actor could use to change test results from positive to negative or vice versa. F-Secure found that the Ellume COVID-19 Home Test could be manipulated via the Bluetooth device that analyzes a nasal sample and communicates the results to the app.

“F-Secure determined that by changing only the byte value representing the ‘status of the test’ in both STATUS and MEASUREMENT_CONTROL_DATA traffic, followed by calculating new CRC and checksum values, it was possible to alter the COVID test result before the Ellume app processes the data.”

…

Filed – https://www.techrepublic.com/topic/security/

We reviewed how transnational criminal organizations and terrorist groups traffic goods such as illegal drugs, engage in human trafficking, and launder money. We also looked at the information sharing used to help detect these activities. Responsibility for combating trafficking is spread across multiple federal agencies. Agencies collaborate via task forces that share information and resources with each other, the private sector, and foreign counterparts. The U.S. Treasury Department, for example, shares information with more than 160 international financial intelligence agencies.

…

Subject: These 6 tips will help you spot misinformation online
Source: Poynter via beSpacific
https://www.poynter.org/fact-checking/2021/these-6-tips-will-help-you-spot-misinformation-online/