Type ‘cyber-crime’ into any search engine and you’ll get an array of pictures of shady-looking young men in hoodies, hunched over laptops in dark corners. Today, that stereotype couldn’t be further from the truth.
Cyber-attackers, who once acted in isolation, have evolved into organised, skillful, extremely agile profit-driven businesses that usually operate internationally to make it harder for national crime agencies to track them down. Increasingly, they use underground supply chains to develop, distribute and deploy customised malware to carry out attacks. New Grant Thornton research suggests the direct impact of cyber-crime is now costing companies more than $300 billion a year globally.
Financial gain is the main motive behind cyber-crime, but hackers are also launching attacks for a number of other reasons. Extra-marital affair website Ashley Madison was recently targeted by ‘hacktivists’ who disclosed clients' personal data, claiming their actions were driven by a moral imperative, while the systems of manufacturer Dyson have had their intellectual property stolen without any recourse from official authorities in the country where the theft occurred. A number of governments have even been accused of sponsoring attacks that target corporate intellectual property and industrial secrets as they seek to gain a competitive advantage in a globalised economy. Some companies fall victim to criminal organisations that are trying to launder stolen funds, while other attackers are simply on a ‘fishing’ expedition to see if anything of value or interest is out there. Dig for deeper motivating factors and a growing degree of political, economic, social and job polarisation across the world will rear its head.
Whatever the motive, cyber-crime is expected to grow, both in number and the level of sophistication, as the push towards globalisation, the blurring of business and country borders and the integration of technology systems converge to increase the risk of attacks.
Slow to respond
Governments’ response to cyber-crime has, on the whole, been slow and inadequate. Many Asian countries still don’t require mandatory reporting of data breaches, which could be why companies in the region are targeted around a third more than the global average – a figure reported by US security network company FireEye Inc. New Zealand is another country that doesn’t compel its companies to report cyber-attacks, although that may change as the government seeks to gain a greater slice of global business. In Ireland, the repercussions for cyber-criminals are limited. The local courts have convicted less than 10 people, with sentences totaling less than 10 years behind bars.
However, other countries are getting their act together. Launched in 2014, the UK’s National Cyber Security Programme sets out five technical controls that will protect firms against the majority of cyber-threats. Several household names have already gained Cyber Essentials accreditation by adopting these controls, including Vodafone, Barclays and GlaxoSmithKline. The US continues to indict and move forward with extradition of perpetrators of cyber crime around the world. The FBI is working proactively around the world to identify the cyber crime actors and track them down.
Singapore’s government is putting regulations in place to ensure that the city-state becomes a safer place in which to do business, while South Africa recently passed a Protection of Personal Information Act. Clauses dealing with the set-up of an Office of the Regulator are already in effect; remaining clauses will come into force once the regulator is fully functioning, which is expected to happen in 2017. The Cybercrimes and Cybersecurity Bill is also going through the South African parliament.
Clearly, governments and regulators need to play a much bigger part in identifying cyber-attacks as a business risk, as well as educating their people of the dangers. Government agencies need to improve their collaboration with each other, while rules across different jurisdictions need to be harmonised. That said, governments and regulators don’t have the resources or skills needed to fight cyber-criminals on their own – the private sector needs to play its part, too.
Failing to act
Failing to shore up your cyber-defences can, at best, be costly and, at worst, threaten the very survival of a company. The direct financial hit that a business takes doesn’t account for the long-term reputational damage and loss of trust that it suffers when its systems are breached. Operational damage can last for months; when US entertainment giant Sony was hacked in 2014, it couldn’t deliver audited financial statements at the beginning of 2015 because its systems were still down.
Lloyds of London insurer Aegis London, which underwrites cyber-insurance for a global client base, says attacks are becoming increasingly destructive and fully expects a business to fail in 2015 due to the financial consequences of a cyber-attack. Research by global reinsurer PartnerRe and Advisen, an insurance intelligence firm, found that between 2006 and 2013 there was a five-fold increase in cyber-insurance purchases. Current estimates suggest the global cyber-insurance market is worth more than $1 billion.
Despite these risks, our research found that a surprising 52% of firms are putting themselves in the firing line, with no comprehensive strategy in place to prevent cyber-crime. Lack of experience and awareness of the importance of cyber-security at board and senior management level is the main reason why it goes unaddressed, and companies often think they aren’t vulnerable to attack because they have “nothing worth stealing”.
In this tough economic climate, other priorities can also take over. The South African Institute of Risk Management puts cyber-crime at number six in its list of the top 10 risks facing South African companies by likelihood, but cyber-security should be in every organisation’s top five, if not top three, business risks. Unfortunately, too many organisations don’t appreciate this and are ill-prepared. Many fail to include cyber-risk in their enterprise risk management programmes; something that should be done as a matter of best practice.
Companies are more vulnerable to cyber-attacks than they might think; particularly those with large digital footprints that spread across their supply chains, including their outsourcing providers. Cyber-criminals are constantly looking for weaknesses in a company’s defences, such as an absence of mechanisms to monitor the robustness of an organisation’s IT infrastructure – the equivalent of having no security guards on your perimeter, if you like.
Defending yourself
There is no one-size-fits-all approach to cyber-security, but the strategies that work are built around three pillars: people, processes and technology. Organisations that get this right educate their people to be their first line of defence, building a culture of security awareness; they implement the right security processes; and they use technology to enforce those processes, where necessary.
What does that mean in practice? Cyber-security strategies are tailored to fit an organisation, taking account of regulatory demands within the given jurisdiction and focusing on what needs to be protected most rather than offering blanket coverage. Identifying priorities for protection starts with a risk assessment and gap analysis. Continual reassessment is important to ensure that the right areas of an organisation are always protected. Performance of the strategy needs to be consistently monitored for effectiveness, too.
The board, the CEO and heads of business need to take overall responsibility for the success of the strategy, rather than leaving it to the IT department, but everyone across the organisation should be aware of and understand the role that they have to play in making their firm cyber-secure. That’s achieved by cascading agreed policies down to all employees through awareness-raising and training programmes that help to make the cyber-threat relevant to each and every individual. This top-down communication should always be genuine; not a tick-box exercise.
Effective policies and strategies embed cyber-security within the business success metrics of an organisation. That contributes towards a culture in which everyone takes the issue seriously at all times and shares ownership. At that point, when cyber-security is not seen as a one-off project but part of ‘business as usual’, companies might be able to rest a little easier about the circling cyber-threats.