ILMA Compoundings – November 2018 - 38

information. ILMA members might
have an employee on the shop floor
who is working on blending or packaging lubricants, and as a part of his
or her duties has access to a firewalled
portion of the company network. In
this example, the employee is at a low
risk of falling prey to a phishing attack
and leaking information.
At the other end of the company
ladder, senior-level managers, board
members and executive-level employees
who might have direct access to all
databases in the company are at a
higher risk of leaking information
based on the nature of their work and
level of access.
"There are levels of seriousness, too,"
said Leiter. "If someone inadvertently
clicks on one of these phishing scams
and it infects the company system,
that's one thing. Meanwhile, if I've
got somebody who is bribing my
employee, or paying him or her to
steal things like our formulas to sell to
someone else, that's theft in the traditional sense and typically has much
more severe legal consequences."
If a situation is serious enough, law
enforcement is likely to get involved.
"I'm aware of an incident with a
client - not an ILMA member - where

information was stolen that included
employees' payroll demographics and
bank account information. In this
case, and similar cases, the incident
was reported to the FBI," said Leiter.
"I've seen situations where employees had to be taken off the email
system for a period of time [because of
liability concerns]."

Defending Against
Phishing Attacks
Step I
While the first line of defense against
phishing attacks and other cybersecurity breaches is a technological
one - firewalls, spam filters, etc. - it
takes a number of other measures to
protect a company from risk. It is
not safe to assume that your system is
100 percent foolproof simply because
you've invested a lot on cybersecurity
protection.
That's not to say that common-sense
digital security measures aren't important. Approved-sender arrangements
and cloud storage are just two examples. "I've lost track of the number of
ILMA members that I'll send an email
to, and they'll send me something
that requires me to be an approved

sender ... otherwise the email would
be blocked by a firewall," Leiter said.
ILMA member Gold Eagle Co., for
example, utilizes one of these approvedsender services called Opt-Inbox by
Sendio. It automatically replies to any
emails sent to those using the service,
asking the original sender to reply
and verify that he or she is, in fact, a
trusted emailer and the message is not a
phishing email.
Some ILMA members have been
known to only accept very small file
sizes attached to emails as a limitation
that makes it harder for phishing
emails to send attachments. Others
use cloud-based file-sharing services
such as Dropbox, Egnyte and OneDrive instead of attaching documents
to emails; this practice allows recipients to decide when and if they'd like
to download an attachment.

Step II
Cybersecurity starts with a company's
leadership. If it's important to the top
brass, it will be important companywide. Employers ought to be asking
themselves: What are this business's
sensitive systems? Most often, those
include human resources, finances,
formulas, customer relationship

Here is an example of an email sent to an individual attempting to reach someone using the approved-sender service Opt-Inbox by Sendio. The email asks the original sender to
verify that he or she is the original sender of the email, something that an automated phishing scam could not do.

NOVEMBER 2018

| COMPOUNDINGS | ILMA.ORG

http://www.ILMA.ORG

ILMA Compoundings – November 2018

Table of Contents for the Digital Edition of ILMA Compoundings – November 2018