Cybercrime is becoming more prevalent and appears to be increasingly focused on the financial industry. Beverly Chandler investigates.
Cybercrime has been described by the US’s FBI as the biggest crime wave in modern history, says James Tedman, Managing Director, ACA Aponix (Europe), a cybersecurity risk advisory firm, focused on the investment management space.
The threat is incredibly serious – and growing, the FBI says, describing the collective impact of cybercrime as ‘staggering with billions of dollars lost every year repairing systems hit by attacks’.
The 2016 Cost of Data Breach Study from IBM and Ponemon Institute reveals that the average total cost of a data breach for the 383 companies participating in the research increased from USD3.79 to USD4 million, over the year, while the average cost paid for each lost or stolen record containing sensitive and confidential information increased from USD154 in 2015 to USD158 in this year’s study.
John Rogers, Principal, at consultants Booz Allen Hamilton says: “Cybersecurity is becoming more of a mainstream topic. It’s been a problem, especially for financial companies, for some time, but given the state sponsorship of the attacks and the heightened skill of organised crime units, it’s becoming more of a problem and will until we develop secure systems.”
Rogers’ firm does a lot of work in the intelligence community and, for him, cyber attacks make sense as a tactic for warfare in the future, or even currently.
“The amount of effort, time and resources in these attacks show it could not be done by a lone wolf,” he says, and others report cyber criminals are now operating from fully functional offices with tech support, desks and phones, just getting on with their business, just as any other firm – the difference is that they are often based in countries with no extradition treaties.
Glen Kopp, Partner, Bracewell LLP initially became involved in cybersecurity through his previous role as a Federal prosecutor working in white collar crime. “We got involved in cybersecurity because clients who had been victimised would call and ask us ‘what do we do, who do we call? The FBI or the Secret Service?”
Both the FBI and the Secret Service are committed to fighting the cybercrime battle, he says, but warns that financial firms are being targeted because the sophistication of the hackers is getting better. He says: “We went from concerns of loss of personal identification information, because that could be easily converted to a commodity on the black market and financial firms have that information, but the criminals also have access to money through spearphishing or ransomware.”
Tedman says: “The threat is more prevalent and the [financial] sector has become more of a target for the attackers. It used to be the case that investment managers flew under the radar because they were naturally secretive and there were bigger fish to go after such as investment banks, but actually most firms in this sector are resource constrained, they don’t have the budgets or specialist staff to build robust defences so can be an easy target.”
Marshall Terry is COO of USD150 million credit focused hedge fund Rotation Capital and says his firm is as concerned about cybersecurity as everyone should be.
“Most small to mid-sized hedge funds have less resource capacity for the development and support of their business and infrastructure, relative to the behemoth managers. The old model of building a big internal team and developing proprietary systems creates an uneconomic fixed cost structure for small and mid-sized managers. A co-sourcing model is equally effective from a business perspective and cost efficient for the smaller managers,” Terry says. “In the past, there has been some reluctance amongst firms to spend money on cybersecurity, however this has changed significantly over the past year as firms have become more aware of the potential operational, reputational and regulatory risks.”Terry adds: “Because the problem is multi-faceted and complex, we first drafted a data flow diagram to better help us understand the types and volume of data flowing in and out of our environment. When we were done with the exercise, we had a comprehensive understanding of the amount of data and number of entry and exit points our data travels. The next step in the process required us to classify the sensitivity of the data based on whether it was public or private. It is through this type of exercise that you gain a full understanding of where your higher risks sit and what you need to do to solve for them.
“If you go through this process, and map out your data flows and work on a risk assessment approach and do the training you still cannot guarantee that you are 100 per cent hacker proof, but you are better prepared to against the lower level of attack such as malware and phishing.”
And it’s staff that can pose a huge threat to financial firms. Tedman says: “Staff awareness is a major issue for every firm. We undertake training and phishing testing, crafting phishing campaigns based on what we have seen in real life and try to get the client to give up sensitive data through emails. Typically we will have a 40-50 per cent success rate through this method on the first pass. That’s a massive risk and demonstrates how easy it is to fall for. We then back it up with training.”
Specialist global executive search and interim management company Norrie Johnson Recruitment has recently conducted research that found that staff do indeed pose a significant risk to their employer’s cybersecurity.
NJR’s cybersecurity report shows that 23 per cent of employees use the same password for different work applications and 17 per cent write down their passwords; 16 per cent work while connected to public Wifi networks and 15 per cent access social media sites on their work PCs.
The firm writes that such bad habits and a lack of awareness about security mean that employees are inadvertently leaving companies’ cyber doors wide open to attack. Their research is supported by a report which incorporates the advice from fifteen experts in the field. One of the expert commentators, Tony Berning of OPSWAT summarises the issues facing financial firms. He writes: “Over the past few years, the financial industry has been moving towards more digitisation and greater accessibility, mostly due to the industry’s competitive nature. In retail banking, customers expect access to their accounts at all times, from any device that has access to the Internet.
“Banks are also offering more services than ever before, from digital deposits to money transfers, and any bank that does not offer these services will surely lose customers to competitors that do. Unfortunately, these new services provide an easy way for cyber criminals to attack financial institutions. Some of the threats affecting the financial industry have taken advantage of this digitisation trend by using multiple channels to extract funds that they have compromised. Similar forces are driving commercial banking towards increased automation and connectivity. With the majority of trades of equity, currency and commodities now done via electronic exchange, transaction speed can make or break a trade. Automated algorithms now execute trades so quickly that the physical distance trade orders travel (at the speed of light), to reach trading platforms significantly impacts profitability. This focus on speed has pushed more operations to become automated with less focus on human interaction. This combination of greater automation with more information being stored on interconnected networks means that financial institutions have more to lose if hit by a cyber attack.”
BAH’s Rogers says: “We help clients assess where their cybersecurity programmes are against their peers and we have 5,000 cybersecurity people with deep tech backgrounds who will uplift aspects of companies’ programmes.”
His observation is that cybersecurity has become more mainstream to the management of a company.
“I brief a lot of senior folks,” he says. “In the past two years a lot of the presentations I have been giving is to boards of directors whereas before it was to the security department within the companies. The questions I get at board level show they have researched the topic and know something about the topic. To help them defend themselves, a lot of the work has been focused around detection and then prevention. A lot of companies don’t know they have been hacked, so we help clients identify if they have been attacked. We work with a client to improve their reporting structure so they can find that needle in the haystack.”
Gerard Joyce, COO of CalQRisk agrees that many companies don’t know they have been hacked, citing a statistic that the average ‘dwell time’ – when hackers have been sitting quietly in the system – for banks is 98 days.
“There is no question in my mind that cyber security is getting more sophisticated, more stealthy and more scary,” Joyce says.
“I’d liken it to a burglar coming into your house and you have the baseball bat and you shout and they run out of the house but today’s cyber-criminal breaks into your network and hides and collects information as if it were like the burglar hiding in your cupboard and staying there for days and you didn’t even know.”
Rogers says: “Traditionally security issues were more in the compliance realm but now people are thinking about it from a risk perspective and risk managers are getting involved in this situation. You can have a reasonable risk reduction of cybersecurity risk through appropriate spending measures.”
But looking forward, Rogers is optimistic that the threat can be contained. “There is a lot of good work being done into the development of secure systems and what we will see is a lower level of attacks from unsophisticated adversaries. The script kiddies in their parents’ basement will stop. As the sophistication of the attacks increases, the number of people who can do them decreases.”
The IBM/Ponemon study found that the likelihood of a company having one or more data breach occurrences in the next 24 months stands at 26 per cent with organisations in Brazil and South Africa most likely to have a material data breach involving 10,000 or more records. In contrast, the report found that organisations in Germany and Australia are least likely to experience a material data breach.
The report unveiled seven megatrends. Firstly, the cost of a data breach has not fluctuated significantly; secondly, the biggest financial consequence to organisations that experienced a data breach is lost business; thirdly, most data breaches continue to be caused by criminal and malicious attacks; fourthly, organisations recognise that the longer it takes to detect and contain a data breach the more costly it becomes to resolve.
The fifth trend was that regulated industries, such as healthcare and financial services, have the most costly data breaches because of fines and the higher than average rate of lost business and customers; sixth, improvements in data governance programmes will reduce the cost of data breach and finally, seventh, investments in certain data loss prevention controls and activities such as encryption and endpoint security solutions are important for preventing data breaches.
On the regulatory front, the SEC, the FCA, the Bank of Ireland and other regulators are beginning to understand what cybercrime fighters are doing and the National Institute of Standards and Technology is beginning to be the common industry framework on which the processes are built.
The particular problems facing the funds industry is the number of other services firms they deal with. Tedman says: “We are concerned that there is a lot of dependency on service providers and there is a significant cyber security risk in that a lot of data is going back and forth and held by third parties. It’s important that firms have robust vendor management systems and monitoring.”
In conclusion, Bracewell’s Glen Kopp says: “I don’t think there’s an end in sight. It will be a long and continuing battle but the more we share information with each other the better it is. There is no competitive information advantage in hoarding information, the best thing is to share information so criminals don’t find the weak links, get fat on those and move to stronger links, fat with cash and attack those.”
