SECURE IT - January 2025

A monthly Information Security publication for the WPI community.

This month's focus is COMPROMISED VENDORS. It's when an organization's vendors or business partners are attacked in a way that exposes their customers' sensitive data. This may also be referred to as a third-party data breach. The graphic  below shows an example of a compromised vendor.

Industry experts estimate that about 60 percent of all data breaches happen via third-party vendors.

In this issue: 

• Compromised Vendors
• Business Email Compromise
• Vendor Security at WPI
• Massachusetts Cybersecurity Crime Statistics
• Learning with Laughter
• From Our CISTO: Caller ID Spoofing
• Where to Find Information Security?  At a Webinar!
• Meet an Information Security Student Worker!
  
• Featured Videos & In the News
• Diversity in Cybersecurity
• Coming Next Month...

At a former workplace of mine, a scammer impersonated the email address of one of our business partners. They sent a deceptive email requesting a payment to be transferred to an out-of-state bank account. Thankfully, the recipient bank detected the unusual activity—a substantial payment being sent to a newly established account—and placed a hold on the funds. Due to the bank's proactive measures, we managed to retrieve our funds.

Compromised Vendors

Vendors who have a large number of customers are an attractive target for cybercriminals. If they can successfully impersonate a vendor, then they can persuade multiple organizations to pay them or provide sensitive information.

This infographic compares third-party breaches in 2022 and 2023.

Most notable is how the 2023 breaches in the education sector led to an average of 14.1 victims per breach. This is due to a vulnerability in the MOVEit file transfer system, which compromised the National Student Clearinghouse. That single event cascaded into breaches at 890 schools. 

Black Kite’s annual Third-Party Breach Report examines the impact of third-party cyber breaches.

Business Email Compromise

Business Email Compromise (BEC) is a type of invoice scam.

Given that over $65 million dollars was lost in Massachusetts  in 2023 due to BEC, make sure you address communications from your suppliers at times when you can give them your undivided attention. Does something seem off? Compare the current communication to previous ones. If you think it's a Business Email Compromise scheme, then contact phishing@wpi.edu.

Vendor Security at WPI

Processes in Procurement and Information Security, and diligence by all community members helps protect WPI!

Procurement

Procurement reviews new supplier requests and their accompanying documentation. There is a list of preferred suppliers available on the Procurement website. The details for each supplier and their relationship with WPI is updated and managed by Procurement. All new suppliers that are created in Workday automatically run through the Sanctioned Supplier Screening, which will create a Workday inbox item for the Procurement team to review potential matches, or simply approve if there are no matches found. A sanctions list is a compilation of individuals, companies, or countries that are restricted or penalized by governments or international bodies. There are different types of sanctions, such as economic sanctions, international sanctions, embargo, and diplomatic sanctions.

In addition, Workday uses an integration to screen suppliers against the Office of the Inspector General’s List of Excluded Individuals/Entities from U.S. federally funded health programs, for reasons such as Medicare or Medicaid fraud. The Workday screening results are reviewed in tandem with the Sanction screening on new suppliers.

Information Technology

Our Data Governance and Management model includes Information Security Review of any new technologies being considered for purchase or implementation at WPI. Details about the review and a link to the Project Intake Form where it all begins are at: 

Access to systems and data is vetted; vendors requiring access have their own accounts which require multi-factor authentication. 

WPI Community

Security also depends upon community members carefully inspecting invoices, reviewing PCard purchases, and handling WPI data securely. As a WPI partner to vendors and system contacts, you may be alerted if they experience a security breach. If you are notified of an external cybersecurity issue, please immediately forward details to WPI's Chief Information Security & Technology Officer at CISO@WPI.edu.

Cybersecurity Crimes in Massachusetts in 2023

This small excerpt from the FBI's Internet Crime Complaint Center (IC3) Annual Reports for Massachusetts shows BEC at the top of the list for both number of victims impacted and amount of money lost. 

People over 60 accounted for about 25% of the cybercrime victims in Massachusetts, while those under 20 were about 4% of the victims. The other 71% were working age people between ages 20 - 59. A significant number of people at WPI are in that age range. 

Learning with Laughter