Featured annually during October, and now in its 21st year, CIRMA observes Cybersecurity Awareness Month by highlighting the importance of staying safe online. We will share some of our most vital cybersecurity resources throughout October to help you and your employees understand and overcome existing and emerging cyber exposures. To kick things off, we will explore the topic of social engineering, what it is, and why it is so important.
Social engineering attacks are often highly profitable for cybercriminals and are one of the most common ways they exploit human instincts. Social engineering uses psychological manipulation instead of exploiting technical vulnerabilities and takes advantage of a victim’s instincts and emotions to obtain sensitive information. An attacker uses human interaction to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization’s network. Suppose an attacker cannot gather enough information from one source. In that case, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.
Pretexting, a social engineering tactic used in business email compromise (BEC) scams, remains the primary cause of cybersecurity incidents, with attackers targeting users through existing email threads in their relentless efforts to obtain sensitive data for their financial gain. BEC scams make up about 24% to 25% of money-driven attacks, with the typical transaction amounting to $50,000 annually (2023 Verizon Data Breach Investigations Report).
Cyber threat actors use various methods to infiltrate network systems and expose sensitive and vulnerable information. Phishing is the most common method of social engineering, where a hacker often convinces their victim to click a malicious link or software in an email. Baiting is another prevalent method of social engineering, referring to bad actors luring their victims into relinquishing sensitive information by tempting them with a valuable object or offer. For example, an attacker may send an email that may appear to be from a coworker, business partner, or financial institution that requests account information, often suggesting that there is a problem. When users respond with the requested information, attackers can use it to access the accounts. Attackers also use holidays, epidemics, and natural disasters to solicit personal information and use voice communication and text messages to deceive their victims.
Attackers use holidays, epidemics, and natural disasters to solicit personal information and use voice communication and text messages to deceive their victims.
Key findings in the 2024 Verizon Data Breach Investigations Report:
- 95% of cyber threat actors were motivated by financial gain
- 5% of cyber threat actors were inspired by espionage
- Techniques utilized to gain unauthorized access to an organization:
- 49% were carried out through pretexting
- 31% were carried out through phishing
Social engineering attacks are notoriously difficult to prevent, as they depend heavily on the human element. It takes one employee’s mistake to compromise a municipal network’s integrity, demonstrating the significance of training employees on cybersecurity awareness. Data security policies combined with cybersecurity awareness training can assist employees in understanding how to detect and respond to social engineering attacks.
Ensuring municipal and school board employees are aware of and adequately trained on cybersecurity best practices can help minimize the risk of a costly and disruptive data breach. Risk Management offers a Cyber Webinar Series through its exclusive CIRMA member Vector Solutions platform. This robust training and education tool features cybersecurity-related online training courses and webinars proven to educate employees and reduce costly and disruptive cyber exposures. Courses and webinars are available for employees to learn at their own pace, 24 hours a day, seven days a week.
If you haven’t taken advantage of the many benefits available through CIRMA’s exclusive online training and education platform, contact your local CIRMA Risk Management representative to get started today. There is no additional charge to CIRMA members for this service. Visit CIRMA’s Cyber Center for helpful information on preventing and managing cyber exposures. Contact your local CIRMA Risk Management representative to get started today.
Helpful Cyber Resources for CIRMA Members:
How to ensure you and your employees are protected.
Proper use of personal Protective Equipment (PPE) is crucial for accident prevention in the municipal workplace. From road maintenance crews to police officers managing traffic flows, employees in various municipal roles face a range of hazards daily. PPE plays a pivotal role in safeguarding your employees from potential risks, ensuring their well-being, and enabling them to perform their duties effectively.
According to the National Library of Medicine, about 40% of employees do not wear personal protective equipment (PPE) in the workplace, exposing themselves to a myriad of potential hazards, injuries, and, in extreme scenarios, fatalities. Public entities should implement and enforce a comprehensive PPE program to mitigate these risks. Raising awareness about the importance of PPE ensures your employees understand its importance, know how to select the appropriate gear for specific tasks, and are properly trained to utilize it.
Municipal employees engage in diverse tasks that expose them to different risks, from exposure to harmful chemicals to physical injuries. Public entity employees must wear PPE to safeguard themselves from workplace hazards such as physical injuries, chemical exposures, and biological contaminants. Serious workplace injuries and illnesses can result from exposure to chemical, radiological, physical, electrical, mechanical, and other hazards.
Training programs should cover the selection, maintenance, and proper use of PPE, and employees must receive proper training and monitoring to ensure the program’s effectiveness. PPE may include gloves, safety glasses, safety shoes, earplugs or earmuffs, hard hats, respirators, coveralls, vests, and full-body suits.
Personal protective equipment is covered by OSHA 29 CFR 1910.132, which requires that many categories of PPE must meet or be equivalent to the standards set by the American National Standards Institute (ANSI). This section outlines OSHA’s standard, detailing the general requirements for using and providing PPE to employers in the workplace and the importance of implementing a comprehensive PPE program.
Per OSHA requirements:
Protective equipment, including personal protective equipment for:
- Eyes,
- Face,
- Head, and extremities,
- Protective clothing,
- Respiratory devices, and
- Protective shields and barriers
… shall be:
- Provided,
- Used, and
- Maintained in a sanitary and reliable condition, wherever it is necessary by reason of hazards of processes or environment.
When employees feel safe and protected, they’re better able to focus on their tasks, leading to improved productivity and efficiency. Public entities that implement the required PPE training and protocol can help avoid accidents, mitigate costly claims, and keep their workforce safe.
Adhering to safety regulations isn’t just about ethical responsibility; it’s also a legal obligation. Municipalities are bound by laws and regulations mandating the provision of PPE to employees exposed to occupational hazards. Failure to comply can result in legal repercussions, including fines and lawsuits.
Beyond mere compliance with regulations, PPE is a critical component of fostering a safe, productive, and resilient workforce. By investing in quality PPE, enforcing its usage, and cultivating a culture of safety, municipalities not only fulfill their legal obligations but also demonstrate their commitment to employee welfare and public trust. Raising awareness about the importance of PPE ensures your employees understand its importance, know how to select the appropriate gear for specific tasks, and are properly trained to utilize it.
CIRMA offers a PPE training and education series through its exclusive CIRMA member Vector Solutions platform. This robust training and education tool features online training courses and webinars proven to educate employees and reduce workplace injuries and illnesses by wearing the appropriate protective equipment.
Has your municipality or local taken advantage of the many benefits available through CIRMA’s exclusive online training and education platform? Contact your local CIRMA Risk Management representative to get started today.
Bee Careful; Preventing Bee and Wasp Stings
Bee and wasp stings are a common summer nuisance that can turn deadly if the victim develops a severe allergic reaction (anaphylaxis). Public Health experts estimate that up to 3% of adults will have a severe systematic reaction to a wasp or bee sting. Anyone who works or recreates outdoors is at risk of being stung.
Helpful Tips to Avoid Being Stung
- Yellowjackets and wasps become aggressive when searching for food–keep garbage cans covered with tight-fitting lids and away from picnic and camping activity areas.
- Keep food covered
- Serve sweetened drinks in covered containers
- Check food and beverage before eating. Clear away food items after a meal immediately
- Eliminate water sources such as birdbaths and dripping faucets, which attract bees and wasps
- Wear proper foot protection. Require campers and students to wear shoes at all times.
- Remain calm and still when a wasp is in close proximity or lands on you
- Avoid wearing hairsprays, perfumes, colognes, suntan lotion, or brightly colored clothes outdoors
- Mow carefully–be observant ahead of the mower if there is a wasp nest on the lawn
Bee or wasp sting symptoms that warrant immediate medical attention include:
- Coughing or wheezing
- Problems breathing or swallowing, or having tightness in your throat
- Changes to your skin, such as breaking out into hives
- Feeling lightheaded or dizzy, or fainting
- Vomiting or diarrhea
Access CIRMA’s online portal for more important employee training and education on relevant seasonal topics.
In Connecticut, occupational exposure to tick-borne diseases is a recognized hazard. Outdoor workers must protect themselves in the spring, summer, and fall when ticks are most active.
School and Parks & Rec departments should be hyperaware of the danger to students and children participating in summer camp or other outdoor sports activities.
Those who are at particular risk include:
– Parks and recreation employees,
– Public works employees,
– Summer camp counselors,
– Animal control officers,
– Athletic coaches and teachers, and
– Police officers and firefighters
Ticks in Connecticut can carry a variety of disease-causing agents, including bacteria, protozoa, rickettsia, and the rare but fatal Powassan Virus.
Tick-Borne Diseases Identified in Connecticut:
– Lyme disease (Borrelia burgdorferi),
– Human granulocytic anaplasmosis (Anaplasma phagocytophilum),
– Babesiosis (Babesia microti),
– Ehrlichiosis(Ehrlichia chaffeensis),
– Rocky Mountain spotted fever (Rickettsia rickettsii),
– Powassan encephalitis(POWV), and
– Hard-tick relapsing fever (Borrelia miyamotoi).
While the number of human cases of these diseases in Connecticut remains low, the infection may have serious consequences. Without preventive measures in tick-infested areas, contracting a tick-borne illness in Connecticut, particularly Lyme disease, is entirely plausible.
All public sector employees required to work in tick-infested areas should know how to protect themselves and their coworkers from tick bites and the signs and symptoms of Tick-borne Disease. For information on workplace controls and Lyme Disease symptoms, download NIOSH Fast Facts. In addition, CONN-OSHA’s Safety and Health Consultation Program is available to help Connecticut employers with this initiative.
Read more about this issue in the CONN-OSHA quarterly.
Download CIRMA’s Tail Gate topic on Ticks and Lyme Disease.
Access CIRMA’s online portal for more important employee training and education tools and resources on relevant seasonal topics.
The home office has become a coveted commodity. Unfortunately, not all homes offer dedicated office spaces. Because of this, kitchen counters, dining tables, living rooms, or bedroom spaces are doubling as home offices.
CIRMA’s latest whitepaper, Creating a Home Work Environment That Works for You, identifies best practices for employees working from home who face the dilemma of creating a workstation that allows them to be productive and incorporate proper ergonomics. In this whitepaper, we share achievable and straightforward guidance to help you maximize comfort and reduce risks while working from home.
Adopting healthy behaviors outlined in this helpful resource and knowing what to look for when choosing the right space for you can improve your overall well-being and maximize productivity while working remotely.
Creating a home workspace does not require extraordinary upgrades to your home or even purchasing fancy office equipment. Setting up a workspace with basic ergonomic strategies in mind is beneficial in many ways, including promoting productivity and focus and helping to avoid discomfort and social isolation.
Helpful Resources for CIRMA Members:
Take me to the full whitepaper
Download CIRMA’s latest Workplace Safety Works Ergonomics poster