Australian CEO’s on Notice: A Hack can cost Your Job

Continuous Vulnerability Scanning can save your job

Last month FACC, a European supplier to Boeing and Airbus fired its CEO after he played an unwitting part in the loss of €41.9 million.

The sacking came after the company fired its CFO in January for the same event dubbed “the Fake President Incident”.

The fraud came about after an email, purportedly from the CEO was received by the accounts department requesting funds to be transferred to a supplier account. Beyond that, the details are a closed secret, but typically either the supplier is not real, or the supplier’s payment details are altered to divert funds to a fraudulent actor and pressure is applied to the accounts department to make a transaction.

It might seem unfair, but when millions are lost, heads usually roll.

What can you do to ensure you don’t suffer the same fate?

Rigid accounts process and the right culture

This kind of fraud is successful when it manages to convince employees to go outside normal operating procedure.  The correct checks and balances are bypassed and the subordinate employees, mindful of their jobs, don’t question the apparent orders from on high.

A culture that supports employees for asking questions and following written processes plus an accounts payable  process that must be followed every time will go a long way towards eliminating the risk of CEO fraud.

Integrate multi-factor authentication

Phising emails requsting users to validate their Active Directory security credentials are reset their password are not uncommon. To mitigate this an other similar threats, , then put a check in place with multi-factor authentication.  It could be something like a mobile phone soft token system or a simple spoken password that is only known to the CEO and the CFO.

Accept that you may be left stranded

Your company might not get stung for millions.  It might only be thousands.

Successful fraud actors are very competent researchers.  CEO’s who travel internationally are often used in a swindle known as “the Stranded Tourist”.  Here’s how it works:

Your accounts payable staff receive an email, purportedly from you, stating that you have been robbed, or that your cards don’t work and your mobile phone is lost and you can’t be reached via any normal channel as you were lucky enough to find someone who would let you use their internet to reach out but you have very little time.

Your staff are instructed to transfer several thousand to a money transfer location and advised that you’ll get back in touch with them after you’re back on your feet.

It’s simple to tell the accounts staff to never ever fall for this one.  The trade-off is that if you ever find yourself as a stranded tourist, you won’t get any help from the office!

All jokes aside, if you are at the centre of an incident where your credentials are faked and the people around you believe what the fake you is telling them, don’t be surprised if you lose your job.  Everyone has a role to play in securing the company

Build a culture where processes are set and followed and where employees are expected to question things outside of the norm and you’ll be well-served.  Combine it with excellent IT Security practices and you’ll be pretty resilient against attacks of all flavours.

James Walker