The letters posted here illustrate  attempts at ADVANCE FEE FRAUD. The sender claims to be a bureaucrat, banker or royal toadies, who wants to cut you, and only you, in on the financial deal of a lifetime.

In plain English, the writer claims to be in a position to skim public accounts or in other ways move vast amounts of cash into your hands. Hint: There is no money to be moved except yours. Palms must be greased, with your money. A few K here, a few K there eventually you get wise, and retire to lick your wounds.

Other versions of the scam play on your sense of charity, your loneliness, or your naivete  . Orphan, cancer patient, dead bank customer, phony job offer, overpayment with a cashier’s check, different names or countries… same scam. You may be shown pictures of “money”. Same scam.

Setting aside the scammers’ willingness to take your last penny, the letters are funny. Read them out loud at parties and see. The 125 letters below introduce the literary genre of the Lads from Lagos.

Why “Lagos” ? Most such e-mails come from West Africa, chiefly Nigeria, or Nigerian expatriates  There are of course scam artists elsewhere. But these guys are special. Some people write them back just to waste their time. This is the art of scam baiting. Welcome to the Scamology. Most readers say “what an obvious scam!”. Some say “I was almost fooled till I saw this site.”A handful say “couldn’t mine be ‘real’?”

Three basic security concepts important to information on the internet are confidentiality, integrity, and availability. Concepts relating to the people who use that information are authentication, authorization, and nonrepudiation.

When information is read or copied by someone not authorized to do so, the result is known as loss of confidentiality. For some types of information, confidentiality is a very important attribute. Examples include research data, medical and insurance records, new product specifications, and corporate investment strategies. In some locations, there may be a legal obligation to protect the privacy of individuals. This is particularly true for banks and loan companies; debt collectors; businesses that extend credit to their customers or issue credit cards; hospitals, doctors’ offices, and medical testing laboratories; individuals or agencies that offer services such as psychological counseling or drug treatment; and agencies that collect taxes.

Information can be corrupted when it is available on an insecure network. When information is modified in unexpected ways, the result is known as loss of integrity. This means that unauthorized changes are made to information, whether by human error or intentional tampering. Integrity is particularly important for critical safety and financial data used for activities such as  electronic funds transfers, air traffic control, and financial
accounting.

Information can be erased or become inaccessible, resulting in loss of availability. This means that people who are authorized to get information cannot get what they need. Availability is often the most important attribute in service-oriented businesses that depend on information (for example, airline schedules and online inventory systems).

Availability of the network itself is important to anyone whose business or education relies on a network connection. When users cannot access the network or specific services provided on the network, they experience a denial of service.

To make information available to those who need it and who can be trusted with it, organizations use authentication and authorization. Authentication is proving that a user is the person he or she claims to be. That proof may involve something the user knows (such as a password), something the user has (such as a “smartcard”), or something about the user that proves the person’s identity (such as a fingerprint). Authorization is the act of determining whether a particular user (or computer system) has the right to carry out a certain activity, such as reading a file or running a program.

Authentication and authorization go hand in hand. Users must be authenticated before carrying out the activity they are authorized to perform. Security is strong when the means of authentication cannot later be refuted—the user cannot later deny that he or she performed the activity. This is known as nonrepudiation.

These concepts of information security also apply to the term information security; that is, internet users want to be assured that

• They can trust the information they use
• The information they are responsible for will be shared only in the manner that they expect
• The information will be available when they need it
• The systems they use will process information in a timely and trustworthy manner

In addition, information assurance extends to systems of all kinds, including large-scale distributed systems, control systems, and embedded systems, and it encompasses systems with hardware, software, and human components. The technologies of information assurance address system intrusions and compromises to information.

FOR EMPLOYEES

• Make your passwords complex. Use a combination of numbers, symbols, and letters (uppercase and lowercase).
• Change your passwords regularly (every 45 to 90 days).
• Do NOT give any of your user names, passwords, or other computer/website access codes to anyone.
• Do NOT open e-mails or attachments from strangers.
• Do NOT install or connect any personal software or hardware to your organization’s network or hardware without permission from your IT department.
• Make electronic and physical back-ups or copies of all your most important work.
• Report all suspicious or unusual problems with your computer to your IT department.

FOR MANAGEMENT & IT DEPARTMENT

• Implement Defense-in-Depth: a layered defense strategy that includes technical, organizational, and operational controls.
• Establish clear policies and procedures for employee use of your organization’s information technologies.
• Implement Technical Defenses: firewalls, intrusion detection systems, and Internet content filtering.
• Update your anti-virus software daily.
• Regularly download vendor security “patches” for all of your software.
• Change the manufacturer’s default passwords on all of your software.
• Monitor, log, and analyze successful and attempted intrusions to your systems and networks.