Untitled

Governments have made cyber security a cornerstone of their policies. Regulators are desperately trying to implement various rules and regulations in order to keep our key infrastructure protected in a world where just about everything is now plugged into the www. Even tooth brushes and TVs are now connected – and providing unprotected routes into our most secret data.

Various agencies are tasked with the job of making sure that our concatenated world is secure. Some are not tasked but stick their ore in anyway. Over in the US, for example, almost 50 government departments are running many initiatives intended to keep our data safe. It is inevitable that amongst such complexity, like the systems which all these organisations attempt to police, holes in the coverage are missed or new ones created.

Regulators are kept awake at night worrying about financial companies. These are the axles around which are complicated 21st Century lives rotate. If the banks go, we’re all in deep doodoo. The banks are  twixt the rock and the hard place. Customers demand ever more convenient methods of getting at their assets. The banks run just to stand still. Developers, who frequently know nothing about security, develop. Security becomes more complex. Holes are missed and new ones created. Most of them are subsequently seen. Some of them are not. Meanwhile, the criminals work diligently away to find vulnerabilities and, once they do, ways to exploit them. Technology advances, holes are left behind – perhaps they have been overlooked, maybe they have been forgotten about. Holes equal vulnerabilities. Vulnerabilties are the hackers’ bread and butter. Lined up to assist them are millions of little people who unknowingly do daft things on their computers on a daily basis. Often, the hard bit for the hacker is finding the vulnerability and creating the exploit which may take months to construct. The easier job, frequently, is to gather the data he needs to execute it. There are criminal gangs who make a healthy living selling huge quantities of personal data to hackers so that they can target and socially engineer hundreds, thousands or millions of victims for an exploit. Take it from me, a mega-breach is coming.

Criminal hackers are always going to be more agile than the monoliths against which they operate. The recent Ebay/Paypal incident in Australia is a good case in point. An ethical hacker reported a vulnerability and described how it could be exploited to the companies and was, apparently, fobbed off. The companies then, apparently, did nothing with his report. Three months later, the vulnerability was still there. Apparently, nothing had been done. Our experience tells us that the word apparently can probably be removed. The chances are that large corporate inefficiency led to poor housekeeping. Hubris may also have been present.

The problem for all institutions is that they face millions of attacks on a daily basis. Under such sustained and incessant attacks, things will inevitably give. Only one has to get through. Imagine, if you will, a bank which is breached. The customer can’t identify the attack and the bank cannot either. To both everything seems ticketyboo. Eventually, the attacks will come to light when a customer notifies the bank that he is short some cash – this could be weeks if the hacker is careful and the customer does not diligently check his account frequently. It might take customers a long time to notice that tiny amounts – a couple of £’s or $’s here, a couple more there – are bleeding from their accounts. Worse, are there any other victims? How to identify them? What to do? How to stop it once the exploit has been identified? Clever, devious and dedicated hackers will eventually outwit the defences arrayed against them, if only because those defences are so complex that there are bound to be some gaping holes in them.

But it is not just our financial institutions which are being targeted. Hackers are sniffing around all manner of other targets; hospitals, sewerage systems, traffic lights, oil terminals, airports, etc. Some of these systems are woefully unprotected and relatively easy to disrupt or even destroy. Most are vulnerable to malicious attacks. Just think, if the Iranian’s can take control of a US drone and land it, and if the Chinese can hack into Israel’s Iron Dome missile defences, it is highly likely that the banks will be a relative cakewalk for competent hackers.

Regulators are straining every sinew in the Sisyphean task of ensuring our institutions and key infrastructure are protected and safe. But the nature of government and their agencies is that they are conservative, clunky and, often, hugely inefficient. Hiring good staff is becoming a huge problem, simply because the demand for skills is so much higher than the supply. To make matters worse, governments usually don’t pay that well so business gets the cream. That means that it is very easy for everyone to end up with decidedly suboptimal defences where assurance is given when it most definitely should not be.

So What? So a lot actually. For lack of alternative options and the shortage of hands at the pump, there is, now, far too much reliance on automated defences. When the machine goes wrong and no-one is watching except another machine, the results can be carnage. There are too many systems which use out of date software and hardware. Many systems are poorly patched. Hackers can see this during a virtual drive-past. They don’t have to go anywhere near systems. End-point security is a nightmare akin to cutting the head off of a Hydra. If there is one thing you can guarantee, it is the multitude of bad things that individuals will do to undermine good security. Entering through a third party’s portal makes life even easier. Unusual activity sniffing software doesn’t, can’t, spot everything. Denial of vulnerability, often after assurances from the in-house (or third party vendor) help, is standard fare. Denial is frequently automatic – and is often a lie. Post Steinhafel, the head shed, the ‘C Suite’, is looking straight down the barrel of personal responsibility gun. Permission to quiver bottom lip Sir?

Bronzeye Group is a Business Risk Management company. We have a wide array of programs which help our clients to stay out of harm’s way and at the head of the ‘threat curve’. Please call us to investigate how we can assist you in ensuring your information assurance.

It’s a buyer’s market out there

Peter Nisbet, Director, Risk Management Services, Utilyx

As regulators prepare to probe concerns over lack of competition in the domestic energy market, they don’t need to look too far to see what healthy rivalry looks like in action.

The emergence of a number of new business energy suppliers is leading to some aggressive elbowing for market share. These smaller suppliers are keen to build scale rapidly and are taking an innovative approach to encourage customers to switch. Concerned that they are seeing their position in the market eroded, the Big 6 are fighting back.

Of course, this is all good news for buyers at a time when those on flexible contracts in particular are also in a strong position to capitalise on downward pressure on longer-term energy prices due to factors including the freezing of the carbon tax and increasing LNG supply. We are already seeing the evidence of increased competition through the many retendering exercises we have carried out for flexible energy contract clients in recent months.

A portfolio which might have attracted four bids when it was first offered a couple of years ago may now get twice as many. Suppliers are also offering incentives to try and secure business. The most obvious room for manoeuvre is on management fees and we are seeing very low charges currently being offered. In one case, we helped a client secure a saving of more than 50% off the fee they had been paying with the same supplier previously.

It’s not just on management fees where the benefits of increased competition are being seen. Discounts such as reduced cost levy-exempt energy – often much more valuable than even the supplier margin - are being offered. More favourable contract terms such as longer payment periods and wider volume tolerances are also on the table. In the current market the benefits should outweigh the costs involved with retendering but it is important to choose a consultancy carefully to get the most out of the process.

The strength of relationships a broker has with suppliers for example is crucial.  The more influential the broker, the better terms they are likely to be able to get. In many cases, the real value from using a broker comes from their ability to negotiate with suppliers to get them to go that bit further from their initial offer to secure your business. In an increasingly sophisticated market, an in-depth understanding of how different suppliers price, what charges are subject to change and the likely long term trends is also critical.

The talk of the moment is the ever rising ‘cyber threat’. Received wisdom is that the majority of the threat to our intellectual property (IP) comes from without. That is, of course, correct. Consequently, much of our focus relating to the protection of our ‘Crown Jewels’ is on blocking and defeating those who seek to break into our systems to steal our most important secrets. But a report in ExecSecurity magazine yesterday is a timely reminder that we must not drop our guard in other directions too.

Cargill, a major global player in the commodities markets, has taken out an injunction against one of its former executives who, the company alleges, copied hundreds of highly confidential and proprietary files before resigning and taking up employment with one of Cargill’s major competitors. The gentleman concerned had been with Cargill for 20 years.

This sort of threat is not, of course, new. The value of IP can be enormous, stratospherically enormous. Lose it and it could be the end of the company. The ability of employees to remove huge amounts of data easily is a major threat to any organisation which has something worth stealing – which is all of us. The causes and motives for such activity are myriad. Accident and external espionage are frequently the cause of loss of IP. Disaffection can create a pernicious situation where an employee remains at the company whilst regularly passing important intelligence to competitors or criminals. But the most likely motivator for theft of IP is, surprise surprise, money. Competitors are always trying to poach top staff; those with juicy client lists and proven relationships. What is in their heads is dangerous enough. The ability to walk out of the door with, potentially, millions of customer details, price lists, product details, commercial plans and much more is why many companies will escort out of the building any senior or well placed employee who is let go. Even then, you can’t guarantee that he hasn’t seen it coming and prepared for the day. It is even more difficult to guard against someone who plans their exit carefully and with the intent of taking as much with him as his memory sticks will carry. Equally, it is very easy for employees to zip up, encrypt and send out information to wherever the choose. In order to cover the tracks. it doesn’t usually require too much subterfuge to do it from a colleague’s computer either.

Most companies will have in place unusual activity sniffing software which will note when an employee downloads lots of data onto removable media. But machines and software cannot mitigate everything and a wiley thief can easily circumvent many of the defences which might be deployed to protect important information. So you need to be on the lookout for other signs that someone is up to mischief. That means that people need to talk with each other.

The damage which can be caused from IP theft can be devastating. The simple combination of a client list, what they buy and what they pay is a potentially massive loss which could turn into a catastrophy if those clients are subsequently lost to competitors. But imagine if you have spent gezillions on developing a new this or that on which the future of the company is pinned and all of the data walks out of the door in someone’s pocket?

It is crucial that all aspects of your enterprise’s defences are actively involved at all times in working together to defend your IP. Everyone. All of the time. Whatever processes you have in place muct be actively policed. HR, information assurance (IT & cyber), physical security, legal and the data owners must all play a proactive role in defending secrets. If you are not actively working together you will, no question, lose data. Once it has gone, it is an altogether more difficult task to prevent further dispersion and consequential damage to the company’s health and welfare. It’s all very well pursuing someone after they have gone, but if the information went with them, you had better be good at herding cats. The only people who are going to get fat in this scenario are the lawyers. I know that many may feel that this is all common sense and, of course you are doing it. I’m prepared to bet a pound to a pinch that many of you are not, even if you think you are.

Bronzeye Group specialises in Business Risk Management. Please contact us to discuss how we can help you to ensure that your enterprise’s security at all levels stays at the head of the threat curve. Until you do,

New York’s State Department of Financial Services says that although banks are working hard to combat cyber crime, they are struggling to keep up with the pace of change. Rapid changes being forced on them from the competitive pressure to adopt new technologies into their product offerings puts pressure on managements to respond and this pressure is transferred through to staff who are already fully committed defending the current estate. The speed of technological change is testing institutions ability to protect themselves in the face of increasingly sophisticated attacks. The report notes that frequency and sophistication of attacks are growing and that smaller banks, credit unions and vendors are increasingly being targeted. Perps range from foreign nations through to organised criminals and hacktavists. A black market for stolen data means that hackers are not only interested in stealing money from the banks.

Regulators are pressuring banks and other financial firms by upping their oversight. Virtually all regulators are now embarking on a rolling regime intended to test cyber security defences. The regulators are looking particularly at network security, access controls, incident response and third-party vendor management. Crisis management/disaster recovery planning is slowly moving toward the top of the priority list for most institutions as C officers are increasingly held personally responsible for breaches. This will force banks to concentrate on their security systems and, hopefully, start looking at the problems in a more efficient and effective way.

Cyber Security at the banks tends to be heavily IT focused. That is not good. Changes are occurring slowly. This is because, like virtually all corporations, bank managements and boards tend to be full of conservative characters. All this technical stuff sounds fascinating and sexy, but what does it all mean!? They want to use new systems to improve their bottom line, but they don’t really want to change the way they are doing things. They see new IT systems as enhancements to what they do, rather than changing the way that things are done. They usually have limited knowledge of the systems upon which they rely to drive their businesses. To further complicate their problems, the ever more complex array of offerings created by technological advancement creates the need to use outside suppliers and providers. This creates further weaknesses as those thire-party systems are plugged in, thereby creating vulnerabilities. Because third-party vendor systems are seldom controlled by the prime user, any vulnerability at the third-party becomes an unknown and unmeasured vulnerability at the corporation employing that vendor (think Target = $500m loss and 33% drop in stock price).

Most corporations, whether large or small, use a mix of organic and outsourced IT management (only just over 10% rely on entirely outsourced support for their cyber security). Interestingly, whilst all of the institutions covered by the report conduct Penetration Testing (PenTest), almost 80% only do so annually (oh dear!). The rest conduct their tests more frequently but only 4% conduct monthly PenTests. PenTesting is a spot check so it looks like the banks are just using these tests as a ‘check in the box’ activity. Many will restrict PenTest frequency for cost reasons – for these, you might say that paying bonuses are more important than ensuring security!

We question whether the regulators have the ability or capability to conduct all this checking and to understand the data it will garner in the process. Given that there aren’t enough cyber practitioners around just to feed commerce’s need to run and protect their own systems, we wonder whether there will be enough left for the regulators to use. Then there is the ability of commerce and industry (and in particular the banks) to pay more than the regulators for the skills they need. Surely we will end up with regulators which have inferior skills to their charges. That would mean that we have banks which could hide bad things. Given their previous behaviour, can we trust them not to do that? That is very much a suboptimal situation – but that’s another story.

Bronzeye Group has a comprehensive set of programs to help our clients identify, fix and mitigate their cyber vulnerabilities to get ahead of cyber criminals and stay there. Please contact us for advice and assistance.

New York’s State Department of Financial Services says that although banks are working hard to combat cyber crime, they are struggling to keep up with the pace of change. Rapid changes being forced on them from the competitive pressure to adopt new technologies into their product offerings puts pressure on managements to respond and this pressure is transferred through to staff who are already fully committed defending the current estate. The speed of technological change is testing institutions ability to protect themselves in the face of increasingly sophisticated attacks. The report notes that frequency and sophistication of attacks are growing and that smaller banks, credit unions and vendors are increasingly being targeted. Perps range from foreign nations through to organised criminals and hacktavists. A black market for stolen data means that hackers are not only interested in stealing money from the banks.

Regulators are pressuring banks and other financial firms by upping their oversight. Virtually all regulators are now embarking on a rolling regime intended to test cyber security defences. The regulators are looking particularly at network security, access controls, incident response and third-party vendor management. Crisis management/disaster recovery planning is slowly moving toward the top of the priority list for most institutions as C officers are increasingly held personally responsible for breaches. This will force banks to concentrate on their security systems and, hopefully, start looking at the problems in a more efficient and effective way.

Cyber Security at the banks tends to be heavily IT focused. That is not good. Changes are occurring slowly. This is because, like virtually all corporations, bank managements and boards tend to be full of conservative characters. All this technical stuff sounds fascinating and sexy, but what does it all mean!? They want to use new systems to improve their bottom line, but they don’t really want to change the way they are doing things. They see new IT systems as enhancements to what they do, rather than changing the way that things are done. They usually have limited knowledge of the systems upon which they rely to drive their businesses. To further complicate their problems, the ever more complex array of offerings created by technological advancement creates the need to use outside suppliers and providers. This creates further weaknesses as those thire-party systems are plugged in, thereby creating vulnerabilities. Because third-party vendor systems are seldom controlled by the prime user, any vulnerability at the third-party becomes an unknown and unmeasured vulnerability at the corporation employing that vendor (think Target = $500m loss and 33% drop in stock price).

Most corporations, whether large or small, use a mix of organic and outsourced IT management (only just over 10% rely on entirely outsourced support for their cyber security). Interestingly, whilst all of the institutions covered by the report conduct Penetration Testing (PenTest), almost 80% only do so annually (oh dear!). The rest conduct their tests more frequently but only 4% conduct monthly PenTests. PenTesting is a spot check so it looks like the banks are just using these tests as a ‘check in the box’ activity. Many will restrict PenTest frequency for cost reasons – for these, you might say that paying bonuses are more important than ensuring security!

We question whether the regulators have the ability or capability to conduct all this checking and to understand the data it will garner in the process. Given that there aren’t enough cyber practitioners around just to feed commerce’s need to run and protect their own systems, we wonder whether there will be enough left for the regulators to use. Then there is the ability of commerce and industry (and in particular the banks) to pay more than the regulators for the skills they need. Surely we will end up with regulators which have inferior skills to their charges. That would mean that we have banks which could hide bad things. Given their previous behaviour, can we trust them not to do that? That is very much a suboptimal situation – but that’s another story.

Bronzeye Group has a comprehensive set of programs to help our clients identify, fix and mitigate their cyber vulnerabilities to get ahead of cyber criminals and stay there. Please contact us for advice and assistance.

Multinationals have always had a bit of a balancing act to perform in China. Several years ago Rio Tinto went through a particularly tough period where the Chinese authorities seemed to be all over it. Several of its employees were arrested and charged with corruption. One was accused of stealing state secrets which the Chinese said were intended to give the company an edge in its price negotiations in iron ore pricing. Senior Glaxo employees have recently been accused of corruption. Now the former head of JP Morgan’s China unit has been arrested in Hong Kong by the territory’s anti-corruption unit, the ICAC. He has been released on bail but is forbidden from leaving Hong Kong. Investigations are ongoing, the authorities say.

It is often hard to know where a real crime has been committed or where someone has upset some official looking for his payout. China is notorious for its corruption which, at least until recently, reached all the way to the top. We have certainly heard some monstrous horror stories about the scale of lawlessness with fairly blatant involvement, or at least exaggerated apathy which tends to indicate involvement, of local officials. The government has lately been on an anti-corruption drive and several high profile officials have ended up on the wrong end of the law. The Communist Party appears to be conducting a two-pronged approach in its anti-corruption drive; putting pressure on companies and moving against officials who have been daft enough to become the story.

The FBI’s move against officers of PLA Unit 61398 opens a potential new minefield for foreign companies who would like to do business in and with The Middle Kingdom. China, to put is mildly, is highly miffed by the accusation and has been throwing around counter-claims and accusations of hypocrisy. If past form is anything to go by, they will continue to stomp around for some time yet. They really, really don’t like criticism. It’s a ‘face’ thing and anyone who doesn’t understand how important ‘face’ is for the Chinese, they shouldn’t be going anywhere near the place, let alone trying to do business there.

Google warns its staff who have cause to visit China that it is a ‘restricted country’ and that accessing some of the company’s systems from the country could be illegal. Others are choosing not to do business in or with China, preferring to base themselves in Taiwan, Korea or even Indonesia. The German company Infineon says that it is subject to thousands of attempted data attacks daily from China, according to Bloomberg. But so much of our technology hardware is now fabricated in China that for some companies, not being there is not an option. That puts foreign firms slap bang in the firing line between a US government trying to put its foot down and a Chinese government which will become more intransigent the longer they have to wait for a grovelling apology from the US. They probably won’t conduct a mass retaliation but, as one observer put it, they are likely to “kill the chicken to scare the monkey” – pour encourage les autres. The only way this is likely to end is for the US to back down and back off.

For some time, companies who sought to do business in China had to think very carefully about how they would protect their Intellectual Property (IP) and their other commercial secrets. They apparently face persistent attacks but most accept this as part of the price of being there. The true scale of this activity isn’t really known because most companies just don’t report it. Those multinationals already in China don’t need telling that looking after your cyber security is one of the most important things to be done. A lot of companies outside know that too. If nothing else, this case highlights the need for everyone else to get with the program. The cyber threat from hacking puts us all in a situation where walls literally have ears. There is no company which doesn’t have something worth stealing. The hacking which so many companies face on a daily basis can be amateurish and unsophisticated. But it can also be highly competent – conducted by people who really know their craft. The attack can be brazen with hackers even changing main passwords so that they can come and go freely to suck out vast amounts of data until the victim eventually regains control of his own system to turn it off. Other times, it can be sophisticated and highly covert with the intention of long-term exploitation. Don’t forget too, China only does about 75% of the hacking. Russia is responsible for about 20% and Israel and France, et al, are active too.

Bronzeye Group has a comprehensive set of programs to assist our clients in ensuring that your systems are as safe as they possibly can be.

So, following yesterday’s news that the FBI has filed formal charges against 5 officers belonging to Unit 61398 of the PLA, China has accused the US of attacking 1.2 million Chinese computers to steal trade secrets and conduct fraud against government, institutions, enterprises, universities and major communication networks. The US ambassador, Max Baucus, who has only been in post for a couple of months, was hauled in by the Chinese Assistant Foreign Minister this morning and given a dressing down about the matter which has caused “serious harm” between the two nations.

A Chinese Foreign Ministry spokesman said that the charges against the five are “fabricated” and have been laid in pursuit of ulterior motives. “China is a victim of severe US cyber theft, wiretapping and surveillance activities”, he added. China’s internet security agency, the National Computer Network Emergency Response Technical Team Co-ordination Centre (CNCERT) said that trojan horse networks and botnets in the US had been used to directly take control of the 1.2 million Chinese computers during the two months to May 19th.

China has also suspended the work of a special China/US working group which had been set up to look at ways of easing tensions between the two countries following previous accusations of cyber naughtiness. China said that it had stood the working group down because of US “insincerity”.  The Chinese have said that if the US does not withdraw the charges against the five officers, it will retaliate. It isn’t clear what form any retaliation might take but if China starts naming US personnel as hacking into its space, life could become complicated for those accused. China doesn’t have the international reach that the US does but anyone fingered by the Chinese would have to be very cautious about travelling overseas, for example.

The Chinese have a long history of throwing their teddy bear into the corner when they are unhappy with perceived insults. The country has made an art form of international sulking and bloody mindedness. Recently, the UK upset China when the British Prime Minister met with the Dalai Lama. The consequences of that meeting was a lot of lost business for British firms. As a calculated insult, much of that business was given to French companies instead.

Most of the noise around the cyber espionage case is for internal consumption. The Chinese are keen to paint the US as hypocrites applying double standards. With the Snowden case still very much alive and given that the internet in China is heavily censored it is likely that the Chinese will win that fight. The matter may even be seen as a bit of a windfall by Beijing which has been grown increasingly aggressive recently as China seeks to become the regional power. Many countries in Asia look to the US for protection against Chinese expansionism. Lately China has been aggressively pursuing territorial claims in the South and East China Seas, sometimes within what is internationally recognised as the maritime borders of other countries hundreds of kilometres from the Chinese mainland. For example, China has laid claim to the entire South China Sea. This territorial aggression, which is not new but has built up over the last twenty years or so, is primarily driven by China’s hunger for oil. China’s Defence Minister said recently that there would be no compromise or concessions over its territorial claims. Vietnam, Malaysia, Brunei, Indonesia, Taiwan, the Philippines and Japan have all been on the receiving end of this aggression. The United Nations has declared that territorial waters may only extend to 200 nautical miles (just over 370km) – in 2011 Chinese naval forces damaged vessels conducting seismic exploration for oil off of Vietnam and over 1,000km from the Chinese mainland and there have more recently been spats over uninhabited archipelagos off of Vietnam, Japan and Taiwan which have included the deployment of US air and naval assets.

The net result of all of this action may be that China responds even more aggressively and that cyber attacks on US targets (military and civilian) may be increased, just to prove a point. This may include an increase in activity against US allies too. Relations between the US and China have worsened lately in any case as China is discomforted by the fact that the US has focused more on Asia as it has pulled back from the Middle East. Raised tensions between the US and China on top of the recent posturing from both as a result of China’s territorial claims means that the chances of a physical clash are rising. This is not likely to result in a deliberate clash of military forces, but in such circumstances, accidents can happen.

In a move which is sure to kick off a diplomatic bunfight between the US and China, the FBI has formerly accused five members of a specialist unit within the People’s Liberation Army (PLA) Third Department of corporate espionage. The five are all members of Unit 61398, a specialist cyber unit which operates out of a tower block in Shanghai. They are accused of hacking into 141 computers across 20 industries and of stealing hundreds of terabytes of secret corporate data in the process.

The FBI has issued ‘Wanted’ posters for each of the five (Gu Chunhui, Huang Zhenyu, Sun Kailiang, Wang Dong and Wen Xinyu) complete with photographs. The accusations cover crimes over the period 2006 – 2014. Their targets were, inter alia, Westinghouse Electric, US subsidiaries of Solarworld AG., US Steel Corp, Allegheny Technologies, United Steel, Paper and Rubber Manufacturing, Alcoa and the Allied Industrial and Service Workers International Union.

Specific cases were given to demonstrate the reach of the accused. For example, SolarWorld, a maker of solar panels and accessories, was targeted to gather information on its pricing strategy at a time when it was rapidly losing market share to Chinese competitors. At Westinghouse, the hackers stole secret designs for plant component whilst the company was negotiating a deal with a Chinese state-owned firm to build nuclear power plants. Particular interest was given to steel manufacturers because this is such an important sector of Chinese industry.

The charges allege that the range of trade secrets and other sensitive business information stolen is sufficiently significant to demand an aggressive response. Well, they have certainly done that! Don’t expect China, which has already come back with the sophisticated response that the charges are “made up”, to take this lying down. They tend to get a bit miffed in these sorts of things.

The charges are largely symbolic as there is zero chance that China would hand the five over. It has to be said too that whilst China is most definitely prima inter pares when it comes to state sponsored commercial espionage, they are not the only ones. Russia, Israel and France are very active in hoovering up commercial information which is then subsequently passed on to their own industrial players.

This story is likely to have fairly far reaching consequences.

Over one million adults each and every day become the victim of cyber crime. That is 14 every second. Sobering isn't it.

The favored attack route for the criminals is via laptops and smartphones, mainly because of the heavy use of, often unsecured, Wifi with these devices. About 60% of attacks are made by hackers who are just doing it for the thrill of the challenge (hacktivism) and 40% are conducted by hackers who set out to conduct cybercrime.

Almost half of adults using the internet suffered some form of cyber crime last year; just over 80% of these were the victims of hackers. Seven out of 10 attacks involve the use of malware, unwittingly downloaded from the internet with some free software or music.

The number crunchers assess that this collectively costs us all about $114bn and rising. But that number is a guess although, if anything, it is an likely to be a significant underestimate because the numbers don’t include, for example, most of the losses incurred as a result of identity theft, hacked bank accounts or cyber creditcard fraud. In any case, many businesses and individuals often don’t report crimes either because they are embarrassed about the loss, don’t know how to report it or just don’t think it is worth the trouble. To be fair, if you have ever tried to report such a crime, you will understand the reticence; reporting cybercrime in many jurisdictions is like playing a surreal game of ‘apathetic pass the parcel’ where each of the agencies who one might think should be interested isn’t. Victims just get shoved around until they get bored and give up. Been there, done it, very unimpressed! But we do understand the problems.

Another interesting statistic is that the theft of intellectual property is estimated to cost in the region of three quarters of a million jobs each year. Given that these thefts are often from small start-ups, that is an awful lot of little companies which die every year simply because they have not protected their crown jewells.

I can feel that you are probably flagging now so to finish, let’s try a few last numbers to catch your attention. In one survey of almost 8,000 businesses, 5,200 had been victim of at least one cyber crime – almost 4,700 of them had suffered more than one. Almost 1,000 (11%) had suffered cybertheft. About 2,500 suffered other security incidents. Most didn’t report these attacks to any law enforcement agency.

Bronzeye Group has a comprehensive program to protect our clients from such crime. Prophylaxis is always better than cure. It is usually more affordable than many realise. Blissful ignorance is no longer an option for any sane business to pursue.

One of Microsoft’s finest technicians was on a firing range one day. He was given some instruction, a rifle, and bullets. He fired several shots at the target. The report came from the target area that all of his rounds had completely missed the target.

He looked at his rifle, and then at the target. He looked at the rifle again, and then at the target again. He put his finger over the end of the rifle barrel and squeezed the trigger with his other hand. The end of his finger was blown off, whereupon he yelled toward the target area, “It’s leaving here just fine, the trouble must be at your end!”

Small or Medium Enterprises (SME’s) are a favourite target of hackers, according to PwC. In one study, over 60% of companies which suffered data breaches were SMEs. Small companies – those with 50 or fewer employees – typically end up losing between $107,000 – $190,000. A data breach at a medium sized company of, say, 250 employees, typically costs between $990,00 – $1.9 million.

Although improvements are being seen, many companies just don’t know how to prevent data breaches. Once a breach has occurred, the costs quickly mount. Just investigating a breach can take several months and cost several thousand dollars. On top of the financial cost there is, more often than not, a reputational hit too.

Prevention is always better than treatment.

Call Bronzeye for advice and help.

Information Assurance (IA) is not only the responsibility of your company IT department. It is the responsibility of everyone – especially the Executive Officers and the Board. A massive data breach could begin with a tiny mistake made by a cleaner or a security guard. Don’t just think IT.

Law enforcement agencies struggle to keep up with cybercrime. Financial regulators are having sleepless nights worrying that financial companies are not ready for the threat and are failing to apply enough emphasis to their counter-cybercrime procedures which means that many are ill-prepared to withstand the attacks which many face on a daily basis. Just about every regulator in every jurisdiction is in the process of preparing a mass audit of company cyber resilience preparation and disaster planning. It’s like William the Conqueror has sent out his men to compile a modern day Domesday census. Let’s hope that they are not really like them – in 1086, if villagers upset William’s census takers, retribution was often instant and savage. Then again…..

Most companies are aware that there is a threat. Many are cognisant of just how high it is. But, amazingly, many aren’t. Often, they don’t know because they haven’t asked – because they don’t want to know. They think that if they cloak themselves in a blissful, wilfull,  ignorance, Damocles won’t notice them when he comes a’ visiting. Then, they believe, they will step forward, the hero, to cast out those who had allowed the company to arrive at its current predicament and then lead the company to a brighter, more pleasant place. The computer says “No!” Unfortunately, regulators, increasingly law enforcement and, most certainly, shareholders will be looking at Boards and company executives and will expect them to, as the Victorians so quaintly put it, do ‘The Right Thing’.

As we blogged a few days ago, Gregg Steinhafel took six months, but he eventually went to feed the virtual fishes. You might think that this was because he didn’t have the wit to appoint a CISO. You might be right. But, unfortunately for those remaining in executive posts, he has now set a precedent which will likely be seen as the benchmark for future similar occurrences – and you can be certain that future similar occurrences are coming as sure as night follows day. Target was warned time and again that its back door was open. It’s CEO chose to adopt a stance of wilful technological ignorance. Losses directly due to the data breach were probably in the region of half a billion dollars. The company’s stock fell almost 30%. The markets and shareholders will never forgive that.

According to Symantec, data breaches cost corporations over $113 billion dollars last year. The cost of cybercrime to global business is climbing exponentially. Some companies which get hit never recover, in which case the company officers can expect to go down with the ship. Most corporations will survive but many will spend some time in rehab. Executives cannot afford to be in charge when their company gets whacked because they did not prepare and defend themselves properly. Rehab is when the tainted will go. RIP Mr Steinhafel. Make sure you don’t join him.

Act as if it were impossible and you will fail.

We offer a comprehensive programme which will help you to stay with and ahead of the threat curve. Call us.

Symantec and PwC recently held a cyber security round table in London at which they discussed the current state of play for companies trying to protect their data in our increasingly connected world. I was pleased to see that Bronzeye’s Mindyereye blog has been accurate and timely on the issues they highlighted. Here are a few points which were discussed:

Every company has something worth stealing. Sure, it’s usually the “megabreaches” which hit the headlines (see Bronzeye’s recent blog on Target’s CEO plank walk).  But small businesses are at risk too and, for lots of reasons, probably less capable of bouncing back after the event. That said, PwC’s Richard Horne thinks that companies become more vulnerable the larger they grow because their increased size inevitably brings increased complexity and, usually, bigger data pools. Larger companies are also more likely to be more financially robust and more likely than SME’s to tick the boxes on the corporate resilience planning check sheet. SME’s will often assume that they aren’t a target because they are too small to be noticed. In that, they are wrong.

It is not just about technology. Software only does what it is told told to do by its developer and its user. But there’s no accounting for what people (the ‘wetware’) might do and, when they have done it, what they might do to recover. Nor is it all to do with a company’s size. It’s about culture and education too. Boardroom complacency is a danger for all companies. Unless the board pushes and executives get the message, IT can very easily just fall into the ‘cost centre’ box. There are plenty of big companies where IT/cyber is seldom on the agenda but for some reason the problem is more frequently magnified in small companies.

It is crucial that, whatever the size of the company, the board contains members who are computer savvy so that they have the IT skills to hold the executive to account. Hmmmm, for most boards. I’d bet good money that eyes would glaze over at most board meetings at the mention of IT security. Start any board meeting with, “cyber security is the security of data in transit and at rest”, and you might need a defibrillator on standby. For some reason, these problems and omissions are frequently more prevalent at smaller companies – perhaps because board members are more likely to be multi-hatted and therefore busier.

As we have frequently blogged, perhaps the biggest threat to anyone’s IT network emanates from third party vendors. But what about the varmit customers – the most pernicious form of wetware – infected with bugs, worms and all other manner of other malware too. Many of them are just walking incubators of every bug there is out there. If they interact with your system they will provide excellent pathways. If you don’t control their computer – and you don’t – your risk has grown exponentially. If the customer is the other side of a border, with different regulations and laws, the complexity of your problem climbs further yet. A breach might be the customers fault but his regulator might blame you for not stopping the customer from doing (or not doing) whatever they did (or didn’t do).

Whenever a breach occurs, it is crucial that communication and transparency are to the fore. Unfortunately, wetware being what they are, the first instinct will often be to hide the problem. In some jurisdictions it is a stand-alone offence not to notify data-breaches. But we know (I mean really know) that some don’t, even when a breach is very severe. This is sure to turn a problem into a predicament. Richard Anderson of the Institute of Risk Management says that standard approach should be: apologise, communicate, rectify and continue to communicate. That sounds like very good advice to us. Unfortunately, there are a few out there who claim this type of service standard but in reality ignore it completely, usually to the benefit of their bottom line and the detriment of the customer.

Anderson also says that as more security devices are embedded in systems, the more risks people will take. Management don’t like people who say no and businesses do often need to take risks to grow – this is particularly the case with financial firms. So we have to learn to manage the risks. Part of the battle is to stay up with the threat curve, encourage communication and respond to potential vulnerabilities in a timely fashion.

Call us on that.

VACANCY FOR CHIEF INFORMATION SECURITY OFFICER (CISO)

Volunteers needed for special mission. It’s a suicide mission but the pay is good.

 Gregg Steinhafel, the CEO, er sorry, ex CEO of Target, the US retailer which recently suffered a massive data loss has walked the plank. Almost six months after the company lost seventy million customer records and forty million payment cards to hackers due to lax cyber security Mr Steinhafel, a 35 year veteran with the company, has become the sacrifice to the markets. The CIO had been thrown to the wolves in March but that clearly wasn’t enough blood. The CEO’s departure sets a precedent which should send shivers down the spine of many CEOs. Delegated responsibility is fine but don’t rely on it for protection if you try to double hat someone or fail to appoint a key role when the proverbial hits the fan. Ignorance is no longer an option. If the cap fits, put it on.

The opinion of many observers is that the CEO had to go because he had failed to put in place a dedicated CISO. One might argue that the board should have been on top of this oversight too, so there may still be a risk that others might follow too. The CISO would usually be the victim to be thrown to the wolves after a data-loss debacle. In these days of litigious shareholders and other stakeholders, you never know where the blame game will end. Certainly, as a result of the data loss, the company is facing a long and expensive perdition which ultimately might cost it $1 billion or more. And shareholders will be very unhappy about that – maybe for years.

Bronzeye knows of several large organisations which have suffered successful hacking attacks and may not be aware of it. It is amazing how little some companies know about their own cyber security. Blissful ignorance is no longer a safe place to be. Companies will increasingly need to be far more proactive in their own protection. They certainly need to keep on top of their security vendors because, ultimately, their own shareholders will hold them and not the vendors to account when things go wrong.

Bronzeye has been highlighting for some time that perhaps the biggest threat to any company’s cyber security, apart from good old hubris, comes from its third-party vendors. A chain is only as strong as its weakest link and every hacker knows that the weakest point is almost always on a boundary. That’s where the holes are. That’s where some tiny little flaw will be missed by the friendlies but spotted by the baddies. Most companies may not (yet) exert close surveillance of their vendors’ IT security. Now they will have no choice. This could cause mayhem. It will certainly add massive complexity to an already complex task. Many companies will have several vendors, some hundreds. All a pathway. Where there are pathways, there are potential vulnerabilities. As Heartbleed has proven, a vulnerability can lurk in plain sight and still not be spotted by the millions of eyes that see it. Companies may try to outsource the responsibility, or have the vendor self-certify its own security. One big data loss will test whether such a defence is accepted by the market, or in the case of financial firms the regulators. I suspect not.

Cyber-security is all too often seen as a cost centre.  Well the cost of responding to Steinhafel’s unprecedented departure is going to be enormous and we all know how much executives and boards hate spending money on nonsense like IT security. But there is nothing like self preservation to concentrate the mind. So, at least until the dust is settled, you will probably see a period where IT managers are told to spend whatever is necessary to secure the perimeter. It is always cheaper, in the end, to pay to do things properly rather than pay to repair the damage. And if you don’t pay for prophylaxis and catch a bug or two, the cure may kill the company, especially if its disaster recovery plan lets it down too.

It might be worth picking up a few shares in a plank manufacturer next time you are talking with your stockbroker. There might be a pick up in demand.

For a fresh approach to your cyber problems, talk to us.

Industrial Control Systems (ICS) control, monitor and alarm a wide variety of operating systems around the world. Their purpose is to bring control into one central point, supposedly making maintenance of whatever systems the ICS brings together more focused and effective.

Most of the system designers who built these systems knew little about security. Most ICS were never designed to be used on the internet and many are tied into old OS’ which cannot be changed. Some, for example Windows98 or XP, are now way out of date or will be soon. Many of these ICS’ have never been air-gapped and, consequently, are plugged straight into the internet. Even where an air-gap was installed, this will usually only mean that another pathway has been created and, as many of us know, when you create a pathway, you create another potential vulnerability. Sometimes many more vulnerabilities.

For lots of reasons most ICS’ require the constant flow of data to the central control point. Disruption of this dataflow can result in catastrophic failure and breakdown. An ICS which deals with the control of traffic lights in a major city, falling over during the rush hour, would be bad enough. Imagine a system which runs a major airport or which controls the national power distribution or even one which looks after several oil refineries. Imagine the kerfuffle if one of these went off line for several hours or even days – or is taken out completely. The consequences do not bear thinking about.

Many of these facilities still grapple with locking down their cyber security. Many remain vulnerable because their systems are rickety, not up to date or even out of date – often made worse by out of date thinking. The bean counters don’t want to spend money and the professionals who should warn of the dangers, do not have the power or position – or backbone – to make enough noise. Worse, some will just shrug their shoulders and accept the status quo. The approach is frequently to patch and hope for the best. Now new cloud based solutions seem to be the answer which will resolve our issues. But they often don’t. Frequently they just create more pathways, more vulnerabilities. But we can be deceived into believing that everything is now ticketyboo when the truth is that the underlying systems  are still shot through with security holes. Consequently, things are worse – much worse. Your vulnerabilities may have increased exponentially and, like ‘Heartbleed’, those vulnerabilities may be harder to see and even harder to find. And, you can be certain, someone will eventually find them. You’d just better hope that it is a good person!

Some ‘experts’ will tell you that the latest gizmo will be the answer to all of your prayers. “Spend gezillions on this and your cyber security will be assured”, they will say. Fact is, this isn’t the answer and you won’t be safe. To be safe, you need to understand EXACTLY what your vulnerability is NOW, then resolve to fix it NOW. There is no such thing as absolute security of any kind. But you need to close the holes you can, mitigate those you can’t and resolve to stay ahead of the threat curve from that moment on. Then you might well find that the answers will be simple, affordable and much more secure than the advice that you have been suffering. Even when this is not so and you need to put some cash out, at least you will know exactly where you are starting from and will then be in a position to make an informed judgement on next steps. The guessing game will have ended.

For an alternative approach, call Bronzeye.

According to a study conducted by the insurer Willis Group, sixty percent of US retailers describe their risk of cyber crime as “significant”, “serious” or “critical”. But, would you believe, almost ten percent do not feel that they are at risk at all – or, at least it would seem, they believe that if they ignore the threat, the nasty monster won’t get them. The data for the study was garnered from filings which retailers have to submit to the SEC.

Retailers perceive the top three cyber risks as; privacy/loss of data (74%), reputational risk (66%) and cyber liability (61%). Interestingly, less than 10% of companies are worried about the cyber risk they face from third party vendors’ systems. Willis describes this as surprising. We would describe it as gobsmackingly low – and wrong – but I’d put good money on a bet that you would find this attitude replicated across the entire business spectrum. If it is ‘below stairs’ it is psychologically much easier to deny or ignore. The problem is much less likely to be seen and recognised and, in our experience, third party vendors frequently carry the highest cyber risk. Given that retailers place heavy reliance on third-party technology partners, malicious or criminal hackers will often seek vulnerabilities to exploit through third-party vendors’ systems. Boundaries, real or virtual, will always offer weaker defences and therefore more opportunities to those who seek to breach them.

Half of retailers use technical safeguards as their primary defence against cyber attack and 17% admit to having insufficient stop-loss resources in place. Only 10% have taken out insurance against cyber exposure. As Pete Seeger said, “When will they ever learn”!

Every company, no matter how small, has something worth stealing. Fixing the fence is not always as expensive or time consuming as you might think and it will always be more affordable than coming back from a crisis caused by a cyber incursion. Don’t be one of the 17%. Call us. In the meantime….

Cyber security, like any security, is made up of layers – defence in depth, they call it in the military. It is not a single lock or set of bars or a fence. It is a combination of some or all of these. Any security has to be constantly reviewed and updated. This is the same whether you are talking about physical security or cyber security, or any other type of security for that matter. To get it right it is expensive in time and cash and the worst thing is that it is never finished.

Securing data costs money and inevitably requires the user to swap convenience for safety. Every decision you take regarding your data security, like everything else, is a compromise between risk and reward. You accept that you will live with some risk in order not to have to adopt frustrating usage restrictions – but, the quandary is where to draw that line. This is all made worse because we default assume that the web designers and software engineers who devise our systems are infallible. Surely, we assume, they have spotted all the bugs and ironed them out. Surely, we assume, the system is delivered to the user in a ready-to-go state. Firewalls are already installed, anti-malware is embedded. Excellent. Good to go. Nothing more to do!

Well to disabuse you of that view, Heartbleed was, according to what I have read, an oversight. An omission on the part of the software writer who wrote the programme. And that omission opened up a big fat door in cyberspace as wide as a black hole about to eat its lunch. Any system potentially has an infinite amount of exploits embedded within it. It just happens that this developer picked about the biggest biggy he could when making a mistake. And that goes to prove that it doesn’t matter how big the brains are or how many $gezillions you spend on developing it, you cannot know, you cannot be certain, that there isn’t a hole or two lurking there waiting to be found by someone. Well, here’s a thing; your run-of-the-mill (and most of them are exactly that) software developer knows no more about security than the next man (or woman). He (or she) is focused on making the software do something. Spotting the holes and vulnerabilities is likely as far beyond their capability as it is for me to hop into a 747 and fly it after only reading the instruction manual.

Our problem is further exacerbated because we do tend to do foolish things – like the cyber equivalent of fitting top of the range expensive locks onto glass doors. Your software can be as gucci as you like but if someone can work a way around it, that security has as much use as a chocolate teapot. Passwords are often the biggest vulnerability because they are relatively easy to guess and exploit. We could mitigate that vulnerability with two-stage authentication, but most people try to avoid that because it is just such a bind.

Vendors, misinform us. They deploy the fear factor – delivered in gobbledygook – at the first opportunity in order to sell ineffective security systems. Their snakeoil salespitch is that everything must be locked down and secure and whatever it costs is worth the inconvenience. Smart presentations dazzle the consumer with irrelevant detail and no-one ever asks the most important questions. Their tables will clearly demonstrate the cost/benefit analysis of their various gadgets and gizmos but it is near impossible to cost realistically and equally impossible to realise that the benefit is non-existent.

The fact is, cyber security, like all other forms of security, is a constantly moving beast. Nothing is ever absolute and things are never fully secure. It is not a solid, fixed state. Absolute security is a Holy Grail. What is secure today may not be tomorrow – or even in a couple of hours from now. And this for no other reason than someone did something or didn’t. Or maybe someone left something open, or didn’t. Or maybe, someone found out that if you do this and then do this and follow it with that, it springs open.

People are human. Even experts are human – lots are not even experts really. Some of them have more than their fair share of hubris and arrogance too. An expert who isn’t an expert and is full of hubris and arrogance can be a very bad mixture indeed – and there’s a few of them about, aren’t there?  And when they make a mistake they are more likely to hide it than own up – and that can open up a whole new can of worms. However, it is unlikely (though entirely possible I suppose) that such a mistake might open up virtually the whole internet for a couple of years. It makes your heart bleed, doesn’t it.