Type ‘cyber-crime’ into any search engine and you’ll get an array of pictures of shady-looking young men in hoodies, hunched over laptops in dark corners. Today, that stereotype couldn’t be further from the truth.
Cyber-attackers, who once acted in isolation, have evolved into organised, skillful, extremely agile profit-driven businesses that usually operate internationally to make it harder for national crime agencies to track them down. Increasingly, they use underground supply chains to develop, distribute and deploy customised malware to carry out attacks. New Grant Thornton research suggests the direct impact of cyber-crime is now costing companies more than $300 billion a year globally.
Financial gain is the primary motive for cyber-crime, but hackers also attack for other reasons. Hacktivists targeted Ashley Madison, exposing clients' data under a claimed moral imperative. Dyson faced intellectual property theft, with no action from authorities where it occurred. Some governments are accused of sponsoring attacks on corporate secrets for competitive advantage. Criminal organizations launder stolen funds, while others launch exploratory attacks seeking valuable data. Deeper motivations often reveal growing political, economic, social, and job polarization worldwide, highlighting the complex and varied drivers behind cyber-attacks in today’s interconnected economy.
Whatever the motive, cyber-crime is expected to grow, both in number and the level of sophistication, as the push towards globalisation, the blurring of business and country borders and the integration of technology systems converge to increase the risk of attacks.
Governments’ response to cyber-crime has often been slow and insufficient. Many Asian countries lack mandatory reporting of data breaches, potentially explaining why companies there are targeted about a third more than the global average, according to FireEye Inc. New Zealand also doesn’t require companies to report cyber-attacks, though this may change as it aims for more global business. In Ireland, consequences for cyber-criminals are minimal; fewer than 10 convictions have occurred, with combined sentences totaling less than 10 years. These gaps in enforcement highlight the global disparity in addressing the growing threat of cyber-crime.
However, other countries are getting their act together. Launched in 2014, the UK’s National Cyber Security Programme sets out five technical controls that will protect firms against the majority of cyber-threats. Several household names have already gained Cyber Essentials accreditation by adopting these controls, including Vodafone, Barclays and GlaxoSmithKline. The US continues to indict and move forward with extradition of perpetrators of cyber crime around the world. The FBI is working proactively around the world to identify the cyber crime actors and track them down.
Singapore’s government is putting regulations in place to ensure that the city-state becomes a safer place in which to do business, while South Africa recently passed a Protection of Personal Information Act. Clauses dealing with the set-up of an Office of the Regulator are already in effect; remaining clauses will come into force once the regulator is fully functioning, which is expected to happen in 2017. The Cybercrimes and Cybersecurity Bill is also going through the South African parliament.
Clearly, governments and regulators need to play a much bigger part in identifying cyber-attacks as a business risk, as well as educating their people of the dangers. Government agencies need to improve their collaboration with each other, while rules across different jurisdictions need to be harmonised. That said, governments and regulators don’t have the resources or skills needed to fight cyber-criminals on their own – the private sector needs to play its part, too.
Failing to shore up your cyber-defences can, at best, be costly and, at worst, threaten the very survival of a company. The direct financial hit that a business takes doesn’t account for the long-term reputational damage and loss of trust that it suffers when its systems are breached. Operational damage can last for months; when US entertainment giant Sony was hacked in 2014, it couldn’t deliver audited financial statements at the beginning of 2015 because its systems were still down.
Lloyds of London insurer Aegis London, which underwrites cyber-insurance for a global client base, says attacks are becoming increasingly destructive and fully expects a business to fail in 2015 due to the financial consequences of a cyber-attack. Research by global reinsurer PartnerRe and Advisen, an insurance intelligence firm, found that between 2006 and 2013 there was a five-fold increase in cyber-insurance purchases. Current estimates suggest the global cyber-insurance market is worth more than $1 billion.
Despite these risks, our research found that a surprising 52% of firms are putting themselves in the firing line, with no comprehensive strategy in place to prevent cyber-crime. Lack of experience and awareness of the importance of cyber-security at board and senior management level is the main reason why it goes unaddressed, and companies often think they aren’t vulnerable to attack because they have “nothing worth stealing”.
In this tough economic climate, other priorities can also take over. The South African Institute of Risk Management puts cyber-crime at number six in its list of the top 10 risks facing South African companies by likelihood, but cyber-security should be in every organisation’s top five, if not top three, business risks. Unfortunately, too many organisations don’t appreciate this and are ill-prepared. Many fail to include cyber-risk in their enterprise risk management programmes; something that should be done as a matter of best practice.
Companies are more vulnerable to cyber-attacks than they might think; particularly those with large digital footprints that spread across their supply chains, including their outsourcing providers. Cyber-criminals are constantly looking for weaknesses in a company’s defences, such as an absence of mechanisms to monitor the robustness of an organisation’s IT infrastructure – the equivalent of having no security guards on your perimeter, if you like.
There is no one-size-fits-all approach to cyber-security, but the strategies that work are built around three pillars: people, processes and technology. Organisations that get this right educate their people to be their first line of defence, building a culture of security awareness; they implement the right security processes; and they use technology to enforce those processes, where necessary.
What does that mean in practice? Cyber-security strategies are tailored to fit an organisation, taking account of regulatory demands within the given jurisdiction and focusing on what needs to be protected most rather than offering blanket coverage. Identifying priorities for protection starts with a risk assessment and gap analysis. Continual reassessment is important to ensure that the right areas of an organisation are always protected. Performance of the strategy needs to be consistently monitored for effectiveness, too.
The board, the CEO and heads of business need to take overall responsibility for the success of the strategy, rather than leaving it to the IT department, but everyone across the organisation should be aware of and understand the role that they have to play in making their firm cyber-secure. That’s achieved by cascading agreed policies down to all employees through awareness-raising and training programmes that help to make the cyber-threat relevant to each and every individual. This top-down communication should always be genuine; not a tick-box exercise.
Effective policies and strategies embed cyber-security within the business success metrics of an organisation. That contributes towards a culture in which everyone takes the issue seriously at all times and shares ownership. At that point, when cyber-security is not seen as a one-off project but part of ‘business as usual’, companies might be able to rest a little easier about the circling cyber-threats.