2nd Annual PorzioCS Safety, Security & Investigations Symposium

WELCOME TO THE 2 ND ANNUAL

SAFETY, SECURITY, & INVESTIGATIONS SYMPOSIUM

CREATING A CULTURE OF SECURITY IN YOUR ORGANIZATION Kevin Craig, MAS, CPP, CPM Vice President Safety, Security & Investigations Porzio Compliance Services John Marley Security Consultant Porzio Compliance Services

PRESENTERS

Kevin Craig, MAS, CPP, CPM Vice President Safety, Security & Investigations Porzio Compliance Services KCraig@porziocs.com

John Marley Security Consultant Porzio Compliance Services JMarley@porziocs.com

THE CURRENT STATE OF SECURITY

UNITED STATES SECRET SERVICENATIONAL THREAT ASSESSMENT CENTER(NTAC) In 2023, the United States Secret Service National Threat Assessment Center (USSS NTAC) released a study of mass attacks in public spaces 2016-2020. The study provided an overview of the timing, locations, targets, motives, weapons, and other factors to identify patterns for preventing future attacks.

While many commonalities were identified, the reality is that acts of targeted violence impact communities of all sizes. While the attacks occurred at schools, houses of worship, public events, and open spaces, the most common location identified was businesses.

A strong organizational culture of security can help reduce risk and build confidence and resilience.

BENEFITS OF STRONG SECURITY CULTURE

BENEFITS OF A STRONG SECURITY CULTURE FOR THE ORGANIZATION

FOR THE INDIVIDUAL

• Reduced risk

• Positive work environment

• Fewer incidents

• Reduced anxiety

• Better productivity

• Clear roles and responsibilities

• Positive employee relationships

• Instill confidence through preparedness

• Reduced interpersonal conflicts • Compliance with standards

• Enhance personal security awareness

BUILDING A CULTURE OF SECURITY Process • Establish commitment of organizational leadership • Develop comprehensive security policies • Identify risks and vulnerabilities • Promote shared security responsibilities • Familiarize staff with policies • Provide training on awareness and emergency responses • Provide opportunities to practice (Drills/Exercises) • Implement security measures and technology to enhance security.

MAINTAINING THE CULTURE

MAINTAINING THE CULTURE

• Reinforce good security habits • Periodically review and monitor security strategies • Get feedback and adjust as needed

FINAL TIPS & TAKEAWAYS

• No organization is immune • View security strategies holistically • Carefully explore new strategies and technology • Periodically assess risk and vulnerability • Strive for continuous improvement and keep plans and procedures current

THANK YOU…QUESTIONS?

CASE STUDIES IN DATA PROTECTION AND CYBER SECURITY Fred R. Brunetti Principal Porzio, Bromberg & Newman, P.C. Brian Clarke Cybersecurity Manager Porzio, Bromberg & Newman, P.C.

PRESENTERS

Fred R. Brunetti Principal Porzio, Bromberg & Newman, P.C. ARBrunetti@pbnlaw.com

Brian Clarke Cybersecurity Manager Porzio, Bromberg & Newman, P.C. bcclarke@pbnlaw.com

AGENDA Introduction Invoice Fraud AI-enabled Security Screening Powerschool Breach Sloppy Data Governance Final Tips & Takeaways

15

INVOICE FRAUD

INVOICE FRAUD BY THE NUMBERS • $55.5 billion in exposed losses have been attributed to BEC scams globally.

• Nearly 40% of organizations experienced at least one vendor email compromise (VEC) attack each month in 2023, up 50% from the previous year.

• Large organizations (50,000+ employees) face a near 100% weekly probability of experiencing at least one BEC attack. Even small organizations (<1,000 employees) have a 70% weekly probability.

• The average cost of a successful BEC attack is over $125,000, with some incidents resulting in multi-million dollar loss.

HOW DO THEY GET TO YOU? • Spoof or compromise legitimate email accounts to send fraudulent invoices or payment requests.

• Modify real invoices by intercepting email communications and altering payment details.

• Use lookalike domains with subtle changes to evade detection.

• Exploit business workflows, such as forwarding messages between executives and finance teams, to make scams appear legitimate.

OVERCOMING NERVOUSNESS Confidence-building strategies

AI-POWERED SECURITY SCREENINGS

AI-powered Evolv Express scanners promised: • Detection of ALL weapons • No false triggering by harmless items • Outperformed metal detectors Sold to 800+ schools (K-12) and other venues detectors

• Repeated failed detection incidents (stabbing) • High false alarm rates (even after adjustments) • Necessitated additional staffing & manual screening

AI-POWERED SECURITY SCREENINGS

AI-related claims must be scrutinized Business side:

Security side:

 Evaluate vendor AI claims rigorously

 AI claims must be evidencebased

 Operational tradeoffs

 Risk assess in your realworld circumstances (not just via product specification)

 Contractual exit strategy

POWERSCHOOL BREACH PowerSchool is a cloud-based K-12 software provider serving over 60 million students and 18,000 customers worldwide, offering enrollment, communication, attendance, staff management, learning, analytics, and finance solutions.

In December, the company announced that hackers had gained unauthorized access to its customer support portal, named PowerSource. This portal included a remote maintenance tool that allowed the threat actor to connect to customers' databases and steal sensitive information, including full names, physical addresses, contact information, Social Security numbers (SSNs), medical data, and grades.

POWERSCHOOL BREACH

The breach impacted 6,505 school districts in the US, Canada, and other countries, with 62,488,628 students and 9,506,624 teachers having their data stolen.

POWERSCHOOL BREACH

POWERSCHOOL BREACH

WHAT HAPPENED? Attack Vector and Initial Access •The breach began with attackers obtaining and using compromised administrative credentials to access PowerSchool’s customer support portal, known as PowerSource.

•The compromised credential was tied to a maintenance account, which provided broad and deep access to many PowerSchool customers’ data.

•The PowerSource portal included a remote maintenance tool that allowed PowerSchool engineers-and, in this case, the attackers-to connect to customer databases and extract sensitive information

WHAT HAPPENED? Security Weaknesses •The PowerSource system did not have multifactor authentication (MFA) enabled, a standard security measure that could have prevented unauthorized access even if credentials were compromised.

•There were also reports that the PowerSource system lacked encryption for sensitive data, further increasing the risk of exposure

WHAT ARE SCHOOL DISTRICTS DOING? In the wake of the PowerSchool data breach, school districts are taking a multi-layered approach to strengthen their cybersecurity posture and protect sensitive student and staff data. The following measures are being prioritized:

WHAT ARE SCHOOL DISTRICTS DOING? 1. Disabling Remote Maintenance and Reviewing Access 2. Resetting Passwords and Tightening Access Controls 3. Implementing Multi-Factor Authentication (MFA) 4. Enhancing Cybersecurity Awareness and Training 5. Leveraging Federal Guidance and InformationSharing 6. Notifying Affected Individuals and Providing Support 7. Collaborating with Vendors and Auditing ThirdParty Security

SLOPPY DATA GOVERNANCE = BREACH

 Two cyberattacks in 2020 and 2021 exposed personal data of 165,000 New Yorkers  Breach #1: flawed consumer quoting web functionality; no resulting consumer notification; no resulting system wide audits  Breach #2: capitalized on uncured Breach #1  Automated bot attacks and much-delayed detection  Even after Allstate acquired National General, it did not properly notify regulators and consumers; did not perform security audits or assessments

SLOPPY DATA GOVERNANCE = BREACH

Know your website and its functions Business side:

Security side:

 Enable the evaluation and auditing of vendors (and potential asset) security functionality and safeguards

 Public-facing tools should never expose sensitive personal data (w/o strict encryption and necessity)

 Know your breach notification rights

 Perform practical audits and address gaps  Breach detection and response programs must be real time

FINAL TIPS & TAKEAWAYS

QUESTIONS?

E L E M E N T S O F I N V E S T I G AT I O N : I N T E RV I E W S , E V I D E N C E , & INTELLIGENCE K e vi n C r a i g , M AS , C P P, C P M Vi c e P r e s i d e n t S a f e t y, S e c u r i t y & I n v e s t i g a t i o n s Daniel Coleman C h i e f E x e c u t i v e O ff i c e r, Creative Solutions Investigative Services Rachel Kronenfeld Product Manager & Private Detective

PRESENTERS

Daniel Coleman Chief Executive Officer Creative Solutions Investigative Services

Kevin Craig, MAS, CPP, CPM Vice President, Safety, Security, & Investigations Porzio Compliance Services

Rachel Kronenfeld Product Manager & Private Detective

SCOPING THE INVESTIGATION

INVESTIGATION SCOPING CONSIDERATIONS Considerations • Complexity and severity of the investigation • Conflicts of interest - Who is involved?

• Internal, civil, or criminal?

• Timeline and urgency • Regulatory/Compliance • Compliance with standards • Internal capacity vs. outside investigator

CONDUCTING EFFECTIVE INTERVIEWS

CONDUCTING EFFECTIVE INTERVIEWS Interview Process • Review available background information/complaints • Identify relevant witnesses • Plan your interview strategy • Schedule interviews for precision, accuracy, and efficiency • Remote or in-person?

• Ask targeted and open-ended questions • Document and summarize information • Emphasize confidentiality

IDENTIFYING, GATHERING, AND PRESERVING EVIDENCE

EVIDENCE Evidence is vital to supporting conclusions and findings. It can come in many forms and is often critical in validating or nullifying information derived during interviews.

Evidence can be: • Digital/computer • Photographs • Video/audio recordings • Text/email • Documents/records

EVIDENCE

Gathering evidence sometimes requires specialized skills, training, and equipment.

Covert static cameras, physical surveillance, digital forensics are often used to gather evidence. Evidence must also be carefully collected and preserved.

Analysis of evidence may also require the expertise of a professional investigator.

INTELLIGENCE INVESTIGATIONS AND OPEN-SOURCE INTELLIGENCE (OSINT)

INTELLIGENCE INVESTIGATIONS Intelligence investigations can be used as standalone investigations or information gathering as part of a comprehensive investigation to support interviews and evidence-based services. Intelligence investigations often include: •

People searches

•

Identity/address verification

•

Social Media

•

Public Records

•

Asset Searches

•

Dark/Deep Web

•

Open-Source Intelligence (OSINT)

INTELLIGENCE INVESTIGATIONS Intelligence investigations can also be used proactively to mitigate risk and threats. Proactive investigative intelligence tools include • Deep/Dark Web Monitoring • Social Media Monitoring • Threat and Risk Detection • Information Removal • Online Risk Assessment • Identity Theft Protection

FINAL TIPS & TAKEAWAYS

• Plan investigation strategies to focus scope • Identify conflicts and gauge internal capacity • Gather, preserve, and document evidence • Use intelligence tools to enhance investigations and mitigate risk • Document investigation activities • Detail conclusions and findings supported by the investigation activities in investigation reports

THANK YOU…QUESTIONS?

A S K T H E E X P E RT S PA N E L James Carifi Director of Security, Mount Olive Public Schools Jonathan Miller, M.Sc Director of Security and Emergency Management, Mountainside Medical Center Ad r i e n n e R o b e r t i e l l o Interim Autism Program Coordinator and Specialized Health Care Educator, Children’s Specialized Hospital Stan Valles Founder & CEO, Unique Security Group Dr. John Ward Deputy Commissioner of Training and Development, NYC Department of Corrections Robert M. Schechter, JD Chief Business Officer, Porzio Compliance Servces

PRESENTERS

James Carifi Director of Security Mount Olive Public Schools

Jonathan Miller, M.Sc Director of Security and Emergency Management Mountainside Medical Center

Adrienne Robertiello Interim Autism Program Coordinator and Specialized Health Care Educator Children’s Specialized Hospital

PRESENTERS

Stan Valles Founder & CEO Unique Security Group

Dr. John Ward Deputy Commissioner of Training and Development NYC Department of Corrections

Robert M. Schechter, JD Chief Business Officer Porzio Compliance Services RSchechter@porziocs.com

QUESTIONS?

KEYNOTE ADDRESS Sheriff James Gannon Morris County Sheriff’s Department

THANK YOU FOR JOINING US

Scan the QR Code to access additional resources and upcoming events!