It Pays (in Ill-Gotten Gains) to be a Fraudster

If you've ever wondered why someone would go to the trouble of learning to become a ransomware fraudster, this fact may hold some answers for you: According to Trustwave, a standard ransomware campaign could earn an attacker a 1,425 percent return on investment (ROI). That's not a typo... one thousand, four hundred and twenty five percent!

The security company's report showed that with an investment of $5,900/month, these scammers can pull in as much as $90,000 in 30 short days... all with individual ransom demands of just $300 - $500.

Because people around the world and of all different walks of life value their time, most are happy to pay $300 - $500... even many U.S. police departments! And the fraudsters know this. They have intentionally set the dollar amount in this range to ensure its affordability. As well, they know that to make the investment worth the victim's time, it really has to work. (Kudos to my friend Sara Peters for writing the great articles referenced!)

Thanks also to my Facebook friend Debbie Mahler for pointing out the news of this ransomware ROI. Read my article from earlier this year to learn more about what to do if your computer is taken over by ransomeware. 

 

It's Convenient, But Worth It?

Many consumers are attracted to the convenience of cloud-based password keeper sites and apps. Using these services, however, may not be a good idea for many (something I discussed on a Great Day morning show appearance some time ago). That's because they are not immune from hacking, and when their systems are compromised, users' passwords - and the information protected by them - are vulnerable if they are not strongly secured.

That's precisely what happened in June with LastPass, a cloud-based password manager service that disclosed it had been the target of a hack. Although Wired reported the incident exposed users' email addresses, encrypted master passwords, and the reminder words and phrases the service asks users to create, LastPass says master passwords and encrypted user vaults were not exposed.  

What should you do if you use LastPass? First change your master password and set up the optional multifactor authentication LastPass offers. And, change your reminder words and phrases; if you don't, the crooks who have them may use them to get into your password vault. Be on the lookout for scammers who may pose as LastPass customer service agents. LastPass says "Never, ever disclose your master password or any confidential information, even to someone claiming to work for LastPass."  

If you want to use one of the many cloud-based password management services, do your homework first. Most importantly, make sure they have strong security controls in place. You can check magazines for reviews to help you determine this, and do online searches to see if the service you're considering has had a breach in the past 1-2 years.
 

I have a growing list of presentation and training events confirmed. Here are the public events where I will be next. Stop by and say hello if you'll be in the area.

July 13: I will be on Great Day at 7:20 a.m. CDT.

July 18: I will speak at the FBL Financial Group luncheon in Des Moines, Iowa.

November 9 - 11: I will deliver multiple sessions at the ISACA Euro CACS Conference in Copenhagen, Denmark