Re: Danger from recent BEC attacks

["Boyd, Daniel" <dboyd () BERRY EDU>]

For those who have a mature IR procedure in place for these types of incidents, can you share your full process, either 
here or offline? This is the first instance we’ve had of this and having only been in this position since July 1, I 
don’t want to miss anything in our response.

Thanks,

Dan


Daniel H. Boyd (94C)
Director of Information Security
Office for Information Technology
Information Security Advisory Group Chair
Berry College
Phone: 706-236-1750
Fax:     706-238-5824

There are two rules to follow with your account passwords:
1. NEVER SHARE YOUR PASSWORDS WITH ANYONE (EVEN OIT!!!!)
2. If unsure, consult rule #1



From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU> On Behalf Of Steven Alexander
Sent: Wednesday, October 03, 2018 7:09 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Danger from recent BEC attacks

We’ve seen the same scam.  They phish credentials, set up email filters, and change direct deposit.  I’ve talked to 
another college who ran into the same thing.

Steven Alexander
Director of IT Security
Kern Community College District

From: The EDUCAUSE Security Community Group Listserv <SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV 
EDUCAUSE EDU>> On Behalf Of Curt Kappenman
Sent: Wednesday, October 3, 2018 12:38 PM
To: SECURITY () LISTSERV EDUCAUSE EDU<mailto:SECURITY () LISTSERV EDUCAUSE EDU>
Subject: [SECURITY] Danger from recent BEC attacks

All,
   I am sending this out as a notice of an issue related to some recent BEC campaigns focused on our institution.  The 
malicious actors seem to be after user credentials so that they can spoof the user to make changes to their direct 
deposit information and highjack payroll.  We have had a few user fall prey to these attacks and the malicious actors 
inserted email rules so the user would not see the traffic and they then corresponded with the business office to 
change direct deposit info.  All of this traffic appeared to be the user because it transpired on their institutional 
email address.
  This was caught when the user inquired about missed deposits.  Just giving everyone a heads up if this is happening 
on your campus.

Curt Kappenman
Security Compliance Officer / Systems Technician

[cid:image002.png@01CE928D.7FDE1D30]<http://www.andersonuniversity.edu/it.aspx>
316 Boulevard, Anderson, SC 29621
Phone: (864) 231-2850
Help Desk: (864) 231-2457
ckappenman () andersonuniversity edu<mailto:ckappenman () andersonuniversity edu>
www.andersonuniversity.edu<http://www.andersonuniversity.edu/>

Note: This message contains information which may be confidential and privileged. Unless you are the addressee (or 
authorized to receive for the addressee), you may not use, copy or disclose to anyone this message or any information 
contained in this message. If you have received this message in error, please advise the sender by replying to 
ckappenman () andersonuniversity edu<mailto:ckappenman () andersonuniversity edu>, and delete the message. Thank you 
for your cooperation in this matter.