Social Engineering: The Art of Hacking Humansheadline

by Joe Dunn, Huntington T. Block Insurance

“Cybercrime is the greatest threat to every profession,
every industry, every company in the world.”¹
Ginni Rometty, IBM CEO

Opening the email, the accounting manager read:

Hi Tom! Becky and I are having a wonderful time here in France. Spent the day at the Louvre.
Incredibly inspiring! Say, I have a favor to ask of you. You are going to receive an email from a new foundation. Consider this your authorization to send them a wire transfer of $60,000. Please keep this confidential. I don’t want anyone knowing about this until I return. Appreciate the help! See you next week!

His computer pinged with a new email. It was from a foundation in Italy for emerging artists, with a link for the wire transfer. Conscious of the director’s request to keep the transfer confidential, without giving the matter another thought, the accounting manager sent the $60,000.

The museum just fell prey to one of the most common types of cybercrime today: social engineering.²

Social Engineering: AKA Fraudulent Impersonation

Roughly one-half of all email is spam, and 73% of all spam is malicious in nature.³ Well-educated individuals continue to click on links in phishing emails constantly. This is the #1 cyber threat facing all organizations today, and museums are no exception.

Anyone in your museum can click on an email link or visit a website believing it is legitimate and end up inserting a virus into your network that is able to log your key strokes. “You’ve just opened a door into your museum,” said Richard Mercado, the vice president of commercial insurance at Huntington T. Block.

The criminal monitors the museum’s email activity, getting to know your staff and operations. They use this information to impersonate a senior figure at the museum like the director. Then they send an email from the director telling your accounts payable person to wire money to the hacker’s account.

“They’re clever,” said Mercado. “They know who’s on vacation. Who’s likely to be out of communication. They’re very careful to tell your accounts payable person to keep the transfer quiet. If word of this type of theft leaks out, it’s a public relations nightmare.”

Additional Cybercrime Trends

Ransomware: The hacker uses a phishing scheme to insert a computer virus that encrypts all of the data in your network. Often there is no choice other than to pay a bitcoin ransom to get a decryption key to unlock your files. Criminals love bitcoins because they are virtually untraceable.
Artificial Intelligence: One of the concerning trends is that criminals are weaponizing artificial intelligence to automate attacks. They’re scanning the entire internet attacking organizations of all sizes. They’re not discriminating according to whether you’re big or small. Everyone is exposed.
Remote Desktop Protocol: It can be very helpful to have a trusted outside IT resource to log into your computer from anywhere to help resolve issues. Unfortunately, too often, a default or weak password is used. This often presents an open door to hackers, who use it to insert malware.

Cybercrime by the Numbers
Malware Insertion
92% of viruses are
delivered by email.⁵

Human Error
93% of successful cyberattacks are the result of a phishing scam.⁵

Ransomware Rise
Ransomware attacks have increased 15X in the past two years.¹

Awareness Training
Investing in training can reduce the risk of a breach by as much as 70%.⁴

Loss Control Tips

Phishing attacks have one thing in common. They need to be activated by someone who clicks, opens or executes them, usually because they are attracted by deceptive content. Museums can take some simple steps to help protect themselves:

DO NOT click on links in emails, even if it appears to come from a recognizable source like FedEx or UPS.
BLOCK delivery of email attachments that may contain malicious code, such as executable files (.exe, .src), system (.dll, .sys), script (.bat, .js, .vbs) and other files (.mht, .cmd).⁶
Always be on the alert. Was the email expected? Has this person ever emailed you from this email address before? Does something about the email smell fishy?
Verify the identity of the person asking for money via a phone call. If staff members are out of the country, have contact numbers on record for these individuals.
Institute controls such as counter-signatures on checks over a certain threshold like $5,000.
Create strong passwords and periodically change passwords.
If you access your servers remotely use an authentication program like Virtual Private Network (VPN) or require multi-factor authentication.
Routinely applying software patches to programs like Windows that contain security updates is basic and essential.
Make sure your data is backed up and stored in multiple locations, either offsite or in the cloud. If you backup to an external drive—afterwards disconnect the drive.
If you use a cloud service read the fine print in their service agreement. It should spell out their responsibilities in the event of a data breach to neutralize the threat, comply with breach notification laws and agree to indemnify you for any claims made as a result of a breach.
Don’t depend entirely on hardware of software solutions. Humans are the weakest link. Train your staff to be constantly vigilant.

Government Privacy Regulations

All 50 states now have data breach notification laws. Personal Data can consist of little more than a name and address. Fail to notify your patrons of a breach within your state’s prescribed time period, or fail to provide credit monitoring protection where required, and it can result in sizeable fines and penalties.

The privacy and security bar has been raised on organizations of all sizes. Many state laws now require you to demonstrate that you are taking action to prevent personal data from being hacked—like training employees, enacting policies and procedures, and utilizing information security technology.

Increasingly, having cyber insurance is considered a part of best practices. There are a few states that require certain organizations to have cyber insurance. This trend is expected to continue to spread across the U.S.

Cyber Insurance for Museums

“A common question we hear from museums,” said Richard Mercado, “is what happens if an artist’s digital art files are stolen, vandalized or destroyed?”⁷

Cyber insurance is not standardized across all carriers. This is a case where you have to do your due diligence, ask questions, and make sure you have coverage for data destruction/reconstruction and that the liability section of the policy provides coverage for data in your care, custody and control.

Be wary about adding a cyber endorsement to your property policy that offers minimal protection. Museums should consider a standalone policy that provides:

Cyber Liability: to defend against litigation from parties affected by a breach
First Party Benefits: covers the confidential data in your care and pays for such expenses as reconstruction, notification costs, credit monitoring, forensics and public relations
Third Party Benefits: covers damage to third parties’ networks and data should a cybercriminal access their systems through your system
Extortion Coverage: pays for ransomware claims
Regulatory Fines & Penalties: pays for fines accessed for noncompliance with data breach laws
Incident Response Team: provides a team of IT specialists that will help you restore your systems and ensure you meet the requirements of your state’s data breach law

“Everyone knows about cybercrime,” said Mercado. “Museums now realize they are like any organization. They are not immune. What happens if you are hacked? How do you protect yourself?” A good place to start is with a conversation with your insurance professional.

¹Morgan, Steve, “Top 5 cybersecurity facts, figures and statistics for 2018,” CSO, January 23, 2018.
²The story depicted is based on an actual cyberattack made against a museum insured through Huntington T. Block. The details have been blurred to protect the identity of our client.
³Spamlaws.com, Spam Statistics and Facts, 2018.
⁴Seals, Tara, “Phishing Remains Top Cyberattack Vector in 2017,” infosecurity, September 27, 2017.
⁵2018 Data Breach Investigations Report, Verizon, February 2018.
⁶”Social Engineering: how the human factor puts your company at risk,” Positive Technologies, April 9, 2018.
⁷Many fine art insurance policies exclude damage to digital artwork caused by cyberattacks. Talk to your insurance professionals to find out if your fine art insurance may provide coverage.
___________________________________________________

Joe Dunn is the President and CEO of Huntington T. Block Insurance Agency, Inc., the leading broker of fine art insurance. Among HTB clients are some of the most prestigious museums, universities, corporate and private collectors in the world. Joe has over 27 years’ experience in the insurance industry as a broker, underwriter and program designer. You can reach Joe at [email protected].

This article is provided for general informational purposes only and is not intended to provide individualized business, insurance or legal advice. You should discuss your individual circumstances thoroughly with your legal and other advisors before taking any action with regard to the subject matter of this article. Only the relevant insurance policy provides actual terms, coverages, amounts, conditions, and exclusions for an insured.