Businesses warned to take action on Data Protection Day

By Cyber SecurityNo Comments

This year Data Protection Day is warning businesses to do more to protect personal data.

This year Data Protection Day is warning businesses to do more to protect personal dataData Protection Day is an international holiday that occurs every January 28. The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the United States, Canada, and 47 European countries.

Global businesses are re-evaluating their data privacy programmes this year as new privacy regulations targeted at businesses start to gather.

The European General Data Protection Regulation (GDPR), which is expected to come into force in 2018, provides for fines of up to 4% of annual global revenue or €20 million- whichever is greater for failing to safeguard data of EU citizens and residents.

However, despite the introduction of this legislation, many enterprises are still not doing enough to protect consumer data, according to security and privacy industry experts.

“Data privacy day is a great opportunity for organisations to re-evaluate their privacy programme,” said Tim Erlin, director of IT risk and security strategy for security firm Tripwire. “Privacy is often treated as part of larger security initiatives. While this approach addresses some key privacy issues, others may not get the attention they deserve.”

According to Erlin, the top five data privacy mistakes businesses make are:

  • Failure to keep only essential consumer data
  • Failure to encrypt customer data
  • Failure to secure access to data at all times
  • Failure to patch known vulnerabilities
  • Failure to monitor and control simple misconfigurations

Many organisations keep a lot of customer data in case they need it, he said, but it can easily become a major target for cyber attackers, and may not receive the same level of protection as business critical data.

The EU’s data protection rules will impact every entity that holds or uses European personal data both inside and outside of Europe.

More than two thirds of global companies expect EU data protection laws to dramatically increase costs of doing business in Europe.

Erlin said companies need to establish internal processes to keep data encrypted. “Leaving customer data unencrypted makes it much easier for attackers to grab.”

And while encrypting customer data is important, it must be decrypted for use in an application at some point, with attackers trying to compromise those applications so they can get to that data, Erlin warned.

Successful attacks are more likely to exploit vulnerabilities that are several years old if that gets them access to high value data. Patching systems isn’t glamorous but it’s essential to protecting data.

More than one of the security breaches that have been in the headlines recently has been the result of a misconfigured database or server, said Erlin. “If you’re not monitoring server configurations for change, you have a blind spot in your security that attackers can exploit.”

The UK’s Information Commissioner’s Office (ICO) has also highlighted the potentially devastating effect of reputational damage as a result of a personal data breach.

And it is not only the new privacy legislation in Europe and the US that is a factor. Lawrence Munro, European director at security firm Trustwave for Europe and Asia-Pacific, said the mounting number of breaches involving consumers’ financial and private data means that people are increasingly aware that their information is at risk, and much less willing to forgive businesses that betray their trust.

Munro said security professionals see “Password1” as the most common password year after year. “Such abysmal security presents an open door to hackers. Likewise, phishing scams over email and phone continue to trick droves of workers,” he said.

According to Munro, security in many organisations continues to be seen as a “box to be ticked” as cheaply as possible rather than an essential operation necessary for survival.

“Practices such as regular intensive network testing using real experts rather than occasional automated scans are crucial if businesses are to avoid the reputational and financial fallout of a breach this year,” he said.

Phishing cyber fraud up 21% reports police fraud unit

By Cyber SecurityNo Comments

Cyber fraud linked to social engineering phishing attacks has increased by 21% in a year according to the City of London Police’s National Fraud Intelligence Bureau (NFIB).

Cyber fraud linked to social engineering phishing attacks has increased by 21% in a year according to the City of London Police’s National Fraud Intelligence Bureau (NFIB)Social engineering phishing is a non technical method of intrusion used by cyber criminals that relies heavily on human interaction and often involves tricking people into breaking normal security procedures.

Typically, the aim is to trick people into malware laden email attachments or to divulge sensitive information that can be used to steal information and credentials to commit fraud.

The harvesting of account and login information is known as phishing and can happen through fake emails, phone calls, texts or social media posts.

Phishing attacks frequently involve piecing together information from various sources- such as social media and intercepted correspondence, to appear convincing and trustworthy.

The most common themes for contacting potential victims are an update to BT account details, an iTunes invoice and a tax refund.

Others themes include Tesco vouchers, Apple ID, accident injury claim, invoices, suspended bank and credit card accounts, and Sky services upgrades.

According to the government backed GetSafeOnline campaign, cyber criminals have become increasingly sophisticated in their attacks, with more than 95,500 phishing scams reported in the 12 months up to October 2015.

Research by GetSafeOnline reveals that 26% of victims of online crime have been scammed by these types of social engineering emails or phone calls.

According to the research, 29% of reported phishing emails contained a potentially malicious link that could infect a victim’s computer with malware, 17% requested a reply and 15% requested personal information.

The research notes that although the number of emails with malicious links is decreasing, requests for money transfers are on the rise.

In response to these findings, GetSafeOnline has launched an advertising campaign to warn of the dangers of social engineering, in partnership with Barclays, NatWest, Royal Bank of Scotland, Lloyds, Halifax, Bank of Scotland, City of London Police, anti-fraud organisation Cifas and Financial Fraud Action UK (FFAUK).

Phishing attacks are the most popular causes of data breaches in the enterprise. Phishing attacks on mobile devices are increasing as adoption of internet connected mobile devices and services grows.

Tony Neate, chief executive of GetSafeOnline, said social engineering is becoming ever more targeted and personal.

“What is worrying, however, is the complex nature of these scams and how they tap perfectly into feelings that make us panic,” he said. “If you get an email purporting to come from someone we trust, such as our bank, about something that is emotive to us all, like money, and then demand that we act urgently, it’s almost like the perfect storm.”

The newly launched advertising campaign aims to encourage people to think twice before they act and not to let panic override common sense.

The campaign highlights the importance of having strong passwords or pass codes to secure devices, and ensuring that all software and apps are up to date.

Research shows that email is the most popular channel for phishing, accounting for 77% of all reported incidents, followed by phone calls, making up 12% of incidents.

Risk of cyber attack underestmated by countries WEF warns

By Cyber SecurityNo Comments

Most of the world’s economies are underestimating the potential risk of cyber attacks on businesses and their economies- the World Economic Forum (WEF) warns.

Most of the world’s economies are underestimating the potential risk of cyber attacks on businesses and their economies WEF warnsA major study by the WEF reveals that, with the exception of the US, most countries have underplayed the risks of cyber attacks on their economic well being.

The warning comes as business leaders, politicians, and academic and non-government organisations prepare for the Davos summit on 20-23 January 2016 to discuss the “fourth industrial revolution” and the global impact of new technologies.

Businesses of all sizes have been affected by complex cyber attacks, and have suffered economic, legal and reputational damage, the WEF’s Global Risks Report 2016 revealed.

Studies show that cyber crime cost the global economy £445 billion in 2014. The costs will be much higher if economic espionage and state sponsored hacking are taken into account.

However, only eight economies have concluded that cyber attack is a risk of the highest concern: Estonia, Germany, Japan, Malaysia, the Netherlands, Singapore, Switzerland and the US.

The findings reveal a lack of appreciation of the effect of cyber crime in the rest of the world, said John Drzik, chairman of the Global Risk Centre at Marsh & McLennan, and one of the contributors to the risk report.

According to Drzik, US companies are more aware of cyber risks because legal requirements to report security breaches have focused the minds of company leaders. As a result, 90% of the world’s cyber insurance is taken out in the US.

“I think there is going to be similar regulation outside the US and that is going to trigger the growth of the insurance market and bring more attention in the corporate sphere,” he said.

The report warns that the threat of sophisticated government sponsored espionage exceeds the ability of companies to defend themselves.

Over the past year, the number and impact of cyber attacks has increased. Hackers are turning their attention to industrial control systems, placing power plants, transportation and other infrastructure at risk.

“There was the recent cyber attack in the Ukraine on a power plant and an industrial control system. There were earlier attacks in Germany on manufacturing systems and there are unreported attacks as well,” he said.

Although terrorist groups have not yet resorted to cyber warfare, this may change in the future. “You have certainly seen organised crime – a different form of terrorism – participating in this sphere,” said Drzik.

Hacking attacks, which have led to loss of confidential information, have cost companies millions of dollars – but companies have lost far more through damage to their reputation.

“If your customer base starts to worry about you being unreliable and being unable to protect confidential data, they may go to a different company – the reputational amplifier can be enormous,” said Drzik.

Some companies have invested in sophisticated technology to monitor and detect security breaches. However, said Drzik, companies realise they cannot prevent every attack and will spend more resources to mitigate and managing the effects of an attack.

“We are not only in a cyber arms race between countries, but between the security community and the hackers. If you are on the defence, you are trying to get ahead of the offence, but it’s going to go back and forth and it’s not going to go away,” said Drzik.

Cybercrime and cyber security tops business worries for 2016

By Cyber SecurityNo Comments

Cybercrime and cyber security tops business worries for 2016.

Cybercrime and Cyber security tops business worries for 2016This year, cybersecurity will be the main issue worrying global business, firms say, and it will become more critically important as the internet of things takes off and our world becomes ever more mobile and connected.

Lawyers, accountants, digital agencies, research analysts, telecoms and tech firms all gave the BBC’s Technology of Business their views on what the key tech trends were likely to be in 2016.

Here’s a summary of the Top 10 tech trends affecting business in 2016 that emerged:

  1. Cybercrime and a renewed emphasis on cybersecurity
  2. The internet of things and the development of the hyper connected world
  3. Real time data analytics, not intuition, driving business decisions
  4. New data protection laws forcing firms to rethink compliance strategies
  5. Artificial intelligence and robotics replacing repetitive tasks
  6. Smartphones becoming the primary tool for almost everything
  7. More business applications for virtual and augmented reality tech
  8. Increased personalised and in-store location-based marketing
  9. Drones to be allowed to make deliveries and perform other public tasks
  10. Established businesses to face increased competition from start-ups

Allowing customers’ data to be stolen by hackers is not good for business, firms are finally realising. It damages corporate reputations and erodes the public’s “comfort with sharing their data”, says Rashmi Knowles of cybersecurity company RSA.

But the worrying news is that breaches are inevitable, warns Geoff Smith of Experis, while a shortage of skilled cybersecurity professionals is likely to push up the costs of beefing up defences and dealing with attacks.

On top of this, new European data protection laws coming into effect in 2018 will see a “dramatic increase in fines” for data breaches, says James Mullock of law firm Bird and Bird, forcing firms to reassess their compliance procedures this year. Dedicated Data Protection Officers reporting to the board would be “a sensible measure”, he says.

Ransomware is opening up new income for cybercriminals.

Several security experts are forecasting an increase in ransomware attacks, whereby criminals hack into your system, encrypt your data and then demand a ransom before they decrypt it.

“The ransomware arms race will come to the fore in 2016,” says Hitesh Sheth, chief executive of Vectra Networks. “The threat will take on a new, larger role by concentrating attacks on enterprises, holding critical assets hostage in return for even bigger money.”

Other experts warn that the growth of mobile payments systems will offer new opportunities for hackers, while others think criminals will increasingly target employees, suppliers and contractors as a way of infiltrating corporate systems.

Gadgets and objects wirelessly transmitting sensor data to each other and central computers will accelerate in 2016, many believe, leading to a host of new applications – and a host of new cybersecurity threats.

Internet of Things (IOT) cybersecurity concerns will also loom large in 2016.

This new world of “connected everything”, says Tudor Aw, head of technology sector at consultancy KPMG, “should finally see real momentum in 2016”, from connected cars recording driver behaviour data for insurance purposes, to smart watches and other wearables delivering health data and even initial diagnoses.

And all the data that these connected things generate will be stored, analysed and translated into practical insights using real-time analytics, enabling companies to “move beyond just quickly responding to changing customer needs, to actually anticipating those changes,” says Andy Lawson, managing director at Salesforce UK.

But many warn that greater connectivity means more points of entry for hackers constantly on the look out for weak points in any network.