safety Archives | Risk Strategies | Joyce Insurance Group

5 years ago · by Joyce Insurance · Comments Off

Protecting Your Business From Social Engineering

Fraud and social engineering claims filed by policyholders have dramatically increased since the start of the COVID-19 pandemic. *Reported losses ranged from $25,000 to $1.3 million per event, with threat actors exploiting COVID-19 and changes in organizations’ operating procedures.

Please be aware that email is not a secure medium, and one should never rely upon financial instructions sent via email without additional verification. We highlight below some of the criminal tools, tactics, procedures (TTPs) we see in use, and our recommendations for keeping your organization safe:

Invoice manipulation: criminal actors are sending phishing emails with malicious links and files to trick individuals into providing credentials to their business email accounts. Once an email account is compromised criminals search for and doctor any discovered invoices with fraudulent wire instructions. They then use the compromised account (or a look-alike domain) to send the manipulated invoices to third parties claiming that, due to COVID-19, check payments are no longer being accepted and that all payments should be made to the new (fraudulent) account. Depending on whether an organization is on the giving or receiving end, it can suffer a 1st party loss of any funds transferred or liability to 3rd parties who are socially engineered into wiring funds as a result of an organization’s security failure.
Look-alike Domains: related to the above, criminal actors commonly register domain names that appear similar to an organization’s or its partners’ domain names. For example, instead of receiving an email from your vendor’s real address (e.g., finance@coalitioninc.com), the hacker sends it from finance@coalitionninc.com. Did you spot the difference? Very often, these emails contain intimate knowledge of company procedures by virtue of their access to a compromised email account. While it can be easier to spot typos in an organization’s own domain, it can be very difficult to do so for vendors and partners, and all can be potential vectors of compromise.
Domain Spoofing: criminals are preying on organizations that have failed to set up SPF email security, allowing them to send emails from an organizations’ actual domain (i.e. email spoofing). While many mail clients are set up to detect this, many are not, allowing an attacker to impersonate anyone in an organization without ever compromising an account.

In order to avoid these common attacks, we recommend that you:

Never rely on wiring instructions sent via email or in attachments. Whenever receiving a new instruction or a request to change an existing one, be sure to use a dual-control method to confirm the instruction (e.g., if you received it via email, make a phone call to a known good phone number to verify).
Always verify with your bank that the name of the organization you are transferring funds to matches the name associated with the account number provided to you (if it’s fraudulent, it often won’t).
Always use 2-factor authentication. That way, if someone in your organization is ever tricked into disclosing their credentials, the hacker will be missing the 2nd factor to gain account access.
Configure SPF and DMARC records to avoid email address spoofing — there is no cost to do so.
Consider using an anti-phishing solution, or configuring your email client to notify you when you are receiving an email from outside of your organization.

Just about any organization that uses technology to do business faces cyber risk. And as technology becomes more complex and sophisticated, so do the threats we face — which is why every business and organization needs to be prepared with both an effective cybersecurity plan, and a cyber liability insurance policy to manage and mitigate cyber risk. Take Your Free Cyber Liability Risk Assessment here.

Request A Complimentary Cyber Liability Risk Consultation

Source: Coalition

5 years ago · by Joyce Insurance · Comments Off

COVID-19: Phased-In Process for Restarting Construction Projects

In conjunction with the State of Pennsylvania COVID-19 Phased-In Process for Restarting Construction Projects and the Health and Safety Standards of the OSHA Act including the OSHA General Duty Clause Section 5 (a) Construction Companies/Contractors should follow these measures to protect its Employees, General Contractors, Sub-contractors, Associated Job-site Companies, and Personnel, Inspectors, Vendors, Qualified Interested Persons and the General Public.

Good hygiene and infection control practices must be implemented

Face Covering: In light of new data about how COVID-19 spreads, along with evidence of widespread COVID-19 illness in communities across the country, CDC recommends that people wear a cloth face covering to cover their nose and mouth in work and community settings. This is to protect people around you if you are infected but do not have symptoms.

Mandated frequent and thorough hand washing, including by providing workers, customers, and worksite visitors with a place to wash their hands. If soap and running water are not immediately available, provide alcohol-based hand rubs containing at least 60% alcohol
Mandating workers to stay home if they are sick
Mandated respiratory etiquette, including covering coughs and sneezes. Avoid touching your face
Maintain a spacing of at least six (6) feet where feasible and possible with the job at hand
Mandating workers not use other workers’ phones, desks, offices, or other work tools and equipment, when possible
Mandating regular housekeeping practices, including routine cleaning and disinfecting of surfaces, equipment, and other elements of the work environment.
- When choosing cleaning chemicals, consult information on Environmental Protection Agency (EPA)-approved disinfectant labels with claims against emerging viral pathogens. Products with EPA-approved emerging viral pathogens claims are expected to be effective against COVID-19 based on data for harder to kill viruses. Follow the manufacturer’s instructions for use of all cleaning and disinfection products e.g., concentration, application method and contact time, PPE.

Procedures for Prompt Identification and Isolation of a Person or Persons who have Signs and/or Symptoms of COVID-19 must be implemented

Prompt identification and isolation of potentially infectious individuals is a critical step in protecting workers, customers, visitors, and others at a worksite
Employees are strongly advised to self-monitor for signs and symptoms of COVID-19 if they suspect possible exposure or symptoms regarding themselves or others
Move potentially infectious people to a location away from workers, customers, and other visitors immediately
Although most worksites do not have specific isolation rooms, designated areas with closable doors may serve as isolation rooms until potentially sick people can be removed from the worksite
Take steps to limit the spread of the respiratory secretions of a person who may have COVID-19. Provide a face mask, if feasible and available, and ask the person to wear it, if tolerated.
- Note: A face mask (also called a surgical mask, procedure mask, or other similar terms) used for a sick person should not be confused with PPE for a worker; the mask acts to contain potentially infectious respiratory secretions at the source (i.e., the person’s nose and mouth)
Isolation of persons suspected of having COVID-19 virus to prevent further transmission at worksites using either permanent (e.g., wall/different room) or temporary barrier (e.g., plastic sheeting)
Restrict the number of personnel entering isolation areas until and beyond the time that qualified medical personnel has controlled and administered the situation. Proper and immediate disinfection must be completed following the incident by competent personnel utilizing proper PPE and disinfectant

Administrative Controls

Sick workers must stay at home and contact your Primary Care Physician or other Medical Provider
Minimize contact among workers, general contractors, sub-contractors, inspectors, vendors, and other qualified interested persons by replacing face-to-face meetings with virtual communications and implementing telework if feasible
We are discontinuing nonessential travel to locations with ongoing COVID-19 outbreaks. Regularly check CDC travel warning levels at www.cdc.gov/coronavirus/2019-ncov/travelers

Safe Work Practices

Safe work practices are types of administrative controls that include procedures for safe and proper work used to reduce the duration, frequency, or intensity of exposure to a hazard. We will implement safe work practices for COVID-19 to include:
Providing resources and a work environment that promotes personal hygiene. For example, provide tissues, no-touch trash cans, hand soap, alcohol-based hand rubs containing at least 60 percent alcohol, disinfectants, and disposable towels for workers to clean their work surfaces.
Requiring regular hand washing or using alcohol-based hand rubs. Workers should always wash hands when they are visibly soiled and after removing any PPE.
Post handwashing signs in restrooms and in other conspicuous places

Construction Project COVID-19

Safety Guidelines of Minimum Requirements

As the Commonwealth responds to the COVID-19 outbreak, the following information represents the minimum requirements for active construction projects
The Contractors shall each designate a representative on the project to administer each employer’s COVID-19 safety guidelines
- The Contractor is responsible for conveying the guidelines to all material suppliers and subcontractors

Personal Responsibilities

It is critical that employees NOT report to work while they are experiencing illness symptoms such as fever, cough, or shortness of breath
Employees should seek medical attention if they have or develop symptoms:
- Fever
- Cough
- Shortness of breath or difficulty breathing
- Chills
- Repeated shaking with chills
- Muscle pain
- Headache
- Sore throat
- New loss of taste or smell

Employees that develop emergency warning signs for COVID-19 should get medical attention immediately

See the following warning signs- (Emergency warning signs include*)

Trouble breathing
Persistent pain or pressure in the chest
New confusion or inability to arouse
Bluish lips or face
*This list is not all inclusive. Please consult your medical provider for any other symptoms that are severe or concerning.
Refer to COVID-19 Hygiene and Cleaning Best Practices for personal hygiene, cleaning (project office and job site), for COVID-19 best practices.