Search

Brian Pennington

A blog about Cyber Security & Compliance

Category

Uncategorized

THE HISTORY AND FUTURE OF PASSWORDS – Infographic

history-and-future-of-passwords (2)

The Infographic is from Beyond Identity

 

11 Cyber Security Questions Every Small Business Should Ask

ICO: Warning to SMEs as firm hit by cyber attack fined £60,000

Small and medium sized businesses are being warned to take note as a company which suffered a cyber attack is fined £60,000 by the UK Information Commissioner’s Office.

An investigation by the ICO found Berkshire-based Boomerang Video Ltd failed to take basic steps to stop its website being attacked.

Sally Anne Poole, ICO enforcement manager, said:

“Regardless of your size, if you are a business that handles personal information then data protection laws apply to you.

“If a company is subject to a cyber attack and we find they haven’t taken steps to protect people’s personal information in line with the law, they could face a fine from the ICO. And under the new General Data Protection Legislation (GDPR) coming into force next year, those fines could be a lot higher.”

She added:

“Boomerang Video failed to take basic steps to protect its customers’ information from cyber attackers. Had it done so, it could have prevented this attack and protected the personal details of more than 26,000 of its customers.”

The video game rental firm’s website was subject to a cyber attack in 2014 in which 26,331 customer details could be accessed. The attacker used a common technique known as SQL injection to access the data.

The ICO’s investigation found:

  • Boomerang Video failed to carry out regular penetration testing on its website that should have detected errors
  • The firm failed to ensure the password for the account on the WordPress section of its website was sufficiently complex
  • Boomerang Video had some information stored unencrypted and that which was encrypted could be accessed because it failed to keep the decryption key secure
  • Encrypted cardholder details and CVV numbers were held on the web server for longer than necessary

Ms Poole said:

“For no good reason Boomerang Video appears to have overlooked the need to ensure it had robust measures in place to prevent this from happening.

“I hope businesses learn from today’s fine and check that they are doing all they can to look after the customer information in their care.”

Is the North West a hub for nuisance calls?

In the last few months it appears that the North West of England has become a hub of nuisance calls after three raids undertaken on behalf of the Information Commissioners Office.

The ICO executed two search warrants this week, one in Gatley, Greater Manchester, on Wednesday and the other in Wilmslow, Cheshire, on Thursday.

Computers and phones were seized during the searches as the ICO continues to investigate nuisance calls prompted by the theft of people’s details from car repair centres throughout the UK. The items will now be subject to forensic examination and investigation.

Mike Shaw, ICO Criminal Investigations Group Manager, said:

“This illegal trade has multiple negative effects – both on the car repair businesses targeted for their customer data and the subsequent nuisance calls made to customers. These can be extremely unsettling and distressing. 

“Our searches this week are the latest step in us tracking down the unscrupulous individuals involved in this industry. These people won’t get away with it – any person or business involved in the theft and illegal trade of personal data may find themselves subject to ICO action.”

ICO investigators are looking at how the data was stolen, who stole it and which companies have subsequently made calls to the public encouraging them to make compensation claims about to accidents they may have been involved in.

The ongoing investigation, named Operation Pelham, started in May 2016 and has so far involved:

December 2016. A business and two homes in Macclesfield and Heald Green were searched by ICO officers. The business was linked to the making of telephone calls to numbers originating from some of the car repair centres. Computers, telephones and documents were among items seized from the residential properties.

April 2017. Homes in Macclesfield and Droylsden.

Technological Change and Cyber Risk Overtake Regulation as Top Risks for Insurers

The global insurance industry’s ability to confront structural and technological changes is now the greatest risk it faces, according to a new survey of insurers and close observers of the sector.

The CSFI’s latest Insurance Banana Skins 2017 survey, conducted with support from PwC, surveyed 836 insurance practitioners and industry observers in 52 countries, to find out where they saw the greatest risks over the next 2-3 years.

Insurance Banana Skins 2017 
(2015 ranking in brackets)
1 Change management (6)
2 Cyber risk (4)
3 Technology (-)
4 Interest rates (3)
5 Investment performance (5)
6 Regulation (1)
7 Macro-economy (2)
8 Competition (-)
9 Human talent (15)
10 Guaranteed products (7)
11 Political interference (16)
12 Business practices (11)
13 Cost reduction (-)
14 Quality of management (12)
15 Quality of risk management (10)
16 Social change (20)
17 Reputation (18)
18 Product development (17)
19 Corporate governance (21)
20 Capital availability (22)
21 Complex instruments (25)
22 Brexit (-)

Change management is at the head of a cluster of operating risks which have jumped to the top of the rankings. The report raises concerns about the industry’s ability to address the formidable agenda of digitisation, new competition, consolidation and cost reduction it faces, especially because of rapidly emerging technologies which could transform insurance markets, such as driverless cars, the ‘internet of things’ and artificial intelligence.

Cyber risk follows close behind, with anxiety rising about attacks on insurers themselves as well as the costs of underwriting cyber-crime. Other major concerns include the adequacy of insurer’s internal technology systems and new competition, particularly from the ‘InsurTech’ sector.

The next cluster of high-ranking risks, interest rates, investment performance and macro-economic risk, shows that concern about economic instability remains high. Although respondents acknowledged signs of growth, confidence in the recovery is not strong for reasons as widely dispersed as the slowdown in China, the risk of Trump-era protectionism, and populism in Europe. The risk of political interference was seen to have risen sharply. However, Britain’s exit from the EU was seen to be a minimal source of risk for insurers, particularly those without operations in the UK.

Regulatory risk, which has topped the last three editions of this survey, has fallen out of the top five this year. This is largely because recent regulatory changes are settling in to business as usual (e.g. Solvency 2), though the cost and complication of regulation continue to be a concern.

The report shows that the industry’s ability to attract and retain human talent is a fast-rising concern, particularly to handle the digital challenge.  Conversely, an area of declining risk is the governance and management of insurance companies. These were seen as high-level risks during the financial crisis but have fallen sharply since, because of both initiatives from the industry itself and regulatory pressure.

Overall, the climate for insurers is becoming more challenging, according to respondents. The 2017 Banana Skins Index, which measures the level of anxiety in the industry, is at a record high, while the industry’s preparedness to handle these risks has fallen from 2015.

David Lascelles, survey editor, said: “For the first time in six editions of this survey, operating risks pose the greatest threat to insurers. Structural and technological changes to the industry could upend traditional business models. At the same time, insurers are grappling with a very difficult economic climate, which helps explain why anxiety is at an all-time high.”

Mark Train, PwC Global Insurance Risk Leader, comments: “Both the challenges and opportunities presented by change underline the vital importance of being clear about where you’re best able to add value, and then being ruthless in targeting investment and management time at these priorities. A key part of this ‘fit for growth’ strategy is differentiating the capabilities needed to fuel growth, ‘good costs’ targeted for investment, from low-performing business and inefficient operations, ‘bad costs’ targeted for overhaul or elimination.”

Will GDPR Change the World?

Rob Luke’s keynote speech ‘Will GDPR Change the World?’.

Introduction

Thank you.

Let me take a moment to thank TechUK for putting together this event and for offering me the platform to speak with you this morning.

Our Commissioner, Elizabeth Denham, has been clear that the ICO’s vision – of increasing data trust and confidence among the UK public – can only be achieved by working in partnership with the private, public and third sectors.

An important part of that is developing key relationships with representative or umbrella organisations as multipliers and amplifiers for our engagement with different constituencies. Helping us reach new or hard-to-reach audiences.

Our strong relationship with Tech UK is a great example of that partnership approach.

We appreciate the role you play in bringing together representatives from across the sector and your ongoing constructive dialogue with us around issues of importance to your members and the sector as a whole.

I’m glad to have the opportunity to continue that dialogue this morning.

Will GDPR change the world?

Will the General Data Protection Regulation change the world?

Wow, what a question. On the face of it, even the most ardent data protection advocate would struggle to make a case that a blandly titled piece of European legislation deserves that billing.

So despite my professional obligation to emphasise the importance of data protection in the digital age, I am not going to make the argument for the world revolving around GDPR.

What I will try to do is highlight some of the opportunities and challenges GDPR brings for organisations.

Ultimately, of course, GDPR is an indicator of change as much as it is an instigator. And no sector is more relevant to that rapidly changing landscape than yours.

GDPR is part of the response to the challenge of upholding information rights in the digital age. Of protecting the rights and interests of the individual in the context of an explosion in the quantity and use of data and in an environment of extremely rapid technological change.

So I feel it is particularly relevant to mark One Year To Go in dialogue with the tech sector in particular.

I should be clear early on that this is not a speech about Brexit or an exploration of the UK’s possible post-Brexit data protection framework.

In a pre-election period, and with the need to adhere to the guidance on purdah, I hope you will understand that I am not in a position to speculate about the post-Brexit environment, nor indeed to comment on proposals in political party manifestos.

I apologise in advance if there are questions, or elements of the panel discussion, where I am limited by the caution that purdah requires.

What we can safely say however, is that one way or another, GDPR is going to be an important part of the global data protection landscape over the years ahead, with great relevance to UK organisations, the public and their data.

Fit for the digital age

The moment at which GDPR takes effect in the UK on 25 May 2018 will of course mark a change. In delivering legislation fit for the digital age GDPR confers new rights and responsibilities and organisations need to be working now to prepare for them.

I assume that this audience has a familiarity with the core features of GDPR and the key requirements it places on organisations. I hope you have already deployed our ’12 steps to take now’ guidance and our ‘Overview to GDPR’ and that you are drawing on our wider resources.

One consistent feature of our outreach with organisations is a high demand for granular guidance – often people will say to us: “tell us what we need to do”.

We are working at pace to produce detailed guidance, both at national level but also European level guidance produced by the Article 29 EU Working Party to which we are making a major contribution.

I will flag up some particular pieces of guidance in a minute, and the pipeline of guidance will continue to flow.

But I urge you not to wait, nor to take a reactive approach to your GDPR preparations, motivated solely by a mindset of compliance or risk management.

Those organisations which thrive under GDPR will be those who recognise that the key feature of GDPR is to put the individual at the heart of data protection law.

Thinking first about how people want their data handled and then using those principles to underpin how you go about preparing for GDPR means you won’t go far wrong.

Transparency and accountability

It can be boiled down to two words: “transparency” and “accountability”.

Being clear with individuals how their personal data is being used.

And placing the highest standards of data protection at the heart of how you do business.

An issue for the boardroom

That means this is an issue for board level, whatever the size of your business.

Not least because under GDPR the regulator wields a bigger stick. For the most serious violations of the law, the ICO will have the power to fine companies up to twenty million Euros or four per cent of a company’s total annual worldwide turnover for the preceding year.

And as we’ve seen in well-publicised examples the cost to business of poor practice in this area goes above and beyond any fine we can impose. Losing your consumers’ trust could be terminal for your reputation and for your organisation.

We would all prefer a win-win outcome. A model where organisations take an approach to data protection which earns the trust of consumers in a more systematic way. And where that trust translates into competitive advantage for those who lead the charge.

Nowhere does that feel more relevant than for your sector.

GDPR and the tech sector

The UK tech industry is at the forefront of our vibrant digital economy, changing how we live our lives and offering huge potential for positive change and wide social benefit.

Data is the fuel that powers that economy and tech companies are involved at every level.

GDPR is a response to this evolving landscape, building on previous legislation but bringing a 21st century approach and delivering stronger rights in response to the heightened risks.

The right of an individual to be informed about use of their data; their right to access their information and move that information around; the right of rectification and erasure of data where appropriate; the right to remove consent; and the right to enable automated decisions to be challenged.

Good practice tools that the ICO has championed for a long time – such as privacy impact assessments and ensuring privacy by design – are now legally required in certain circumstances.

The ICO covers privacy impact assessments in its existing Privacy by Design guidance and the European Article 29 Working Party has also issued draft guidelines.

Being transparent and providing accessible information to individuals about how you will use their personal data is another key element of the new law and our privacy notices code of practice is GDPR-ready.

Increased responsibilities for data processors are another feature. Data processors, companies using personal data on behalf of others, will have specific legal obligations to maintain records of personal data and processing activities.

Data breach reporting will also change under the GDPR. You’ll be obliged to notify the ICO, within 72 hours, of a breach where it is likely to result in a risk to the rights and freedoms of individuals.

The widespread availability of personal data on the internet and advances in technology, coupled with the capabilities of big data analytics mean that profiling is becoming a much wider issue.

People have legitimate concerns about surveillance, discrimination and the use of their data without consent.

Data protection can be challenging in a big data context and some types of big data analytics, such as profiling, can be intrusive.

We explore many of these issues in detail in our recently updated paper on big data, artificial intelligence, machine learning and data protection.

We’ve also recently published a consultation paper on profiling under GDPR to which TechUK has responded. We’ll be using this to feed into the European Article 29 Working Party guidelines.

Harnessing the benefits of big data, AI and machine learning, as it relates to healthcare for example, will be sustained by upholding the key data protection principles and safeguards set out in GDPR.

Whilst the means by which personal data is processed are changing, the underlying issues remain the same. Are people being treated fairly? Are decisions accurate and free from bias? Is there a legal basis for the processing? These will remain key questions for us as a regulator under GDPR as they have been under the DPA.

The GDPR is a principles based law well equipped to take on the challenges of 21st century technology.

It aims to be flexible – protecting individuals from harm while enabling you to innovate and develop services that consumers and businesses want.

Data analytics

As data becomes the fuel powering the modern economy, so it becomes a key element of many of the debates in modern society.

Take the announcement last week by Elizabeth Denham of her opening of a formal investigation into the use of data analytics for political purposes.

Given the big data revolution I have mentioned it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes. The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing.

This is a complex and rapidly evolving area of activity and the level of awareness among the public about how data analytics works, and how their personal data is collected, shared and used through such tools, is low.

What is clear is that these tools have a significant potential impact on individuals’ privacy. It is important that there is greater and genuine transparency about the use of such techniques to ensure that people have control over their own data and the law is upheld.

We will provide an update on that investigation later in the year.

Rising to the challenge

I’ve talked about some of the challenges and opportunities GDPR brings for organisations. Likewise it is a moment for us at the ICO to reflect on how we do our work.

Clearly there are practical aspects such as preparing for a higher volume of activity given enhanced breach notification requirements.

But we are thinking more widely than that.

One example, again with particular relevance for the tech sector, is how we might be able to engage more deeply with companies as they seek to implement privacy by design.

How we can contribute to a “safe space” where companies can test their ideas. How we can better recognise the circular rather than linear nature of the design process.

Separate but related we need to become more comfortable about recognising good practice and drawing on exemplars.

We should be able to find ways to give credit where credit is due without that translating into a free pass for an individual organisation or practice. GDPR explicitly foresees wider use of tools such as codes of conduct and certification schemes, which potentially have an important role to play.

To deliver on the above and more broadly we also need to build our own tech know-how and capability. We are working on a new Technology Strategy which will outline our means of adapting to rapid technological change as it impacts information rights.

We are also committed to exploring innovative and technologically agile ways of protecting privacy.

And of course we need to exercise global reach and influence. Effective protection of the UK public’s personal information becomes increasingly complex as data flows across borders.

The ICO will continue to develop and deepen effective relationships with our international partners, reacting to changes in the global regulatory environment.

These goals among others feature in our new Information Rights Strategic Plan, being launched today by Elizabeth Denham, which sets out the ICO’s plan for the coming four years.

The tech sector will be a priority for our engagement as we look to seize these opportunities set out in the strategy.

Conclusion

With 12 months to go until GDPR takes effect in the UK, I hope I have offered a brief insight into some of the implications and impacts of GDPR on UK businesses.

I hope I have also signposted key actions you should be taking and key tools on which you can draw to rise to the challenge.

GDPR brings big changes, important changes. But GDPR is an evolution of the existing rules, not a revolution.

And as I said at the outset it is also a mirror of the changes in the practices and environment it seeks to regulate.

It is not GDPR which is pushing data protection up the public, political and media agenda. It is the changing nature of the world in which we live, and the ubiquity of data, which is causing society to reflect on the consequences for our personal information and for privacy itself.

You are at the heart of that change. Your response to the challenges and opportunities of GDPR will set a marker for other sectors.

You have a major stake in the enterprise of increasing data trust and confidence among the UK public. By putting the individual in genuine control of their own data you can help achieve that goal, delivering benefits for your consumers, your business and society as a whole.

Thank you.

ICO statement on recent cyber attacks on the NHS

The ICO has released the following statement concerning the recent cyber attacks on the NHS:

“All organisations are required under the Data Protection Act to keep people’s personal data safe and secure.

“Following the news on Friday afternoon that many organisations had been the subject of a cyber attack, the ICO made contact with both NHS Digital and the National Cyber Security Centre (NCSC).

“Our enquiries will continue this week and we note that NHS England have said they have no evidence that patient data has been accessed.

“Any appropriate next steps for the ICO will decided once these initial enquiries are complete.

“The ICO has published a useful blog on how to prevent ransomware attacks.”

VMware Infographic – Are you ready to tackle the security risks facing your business

Cyber-screening: Putting security on the M&A agenda

This is a contributed piece by Brian Pennington, regional sales director, EMEA for Coalfire

From financial institutions such as Tesco Bank to tenured technology giants like Yahoo, it seems that no one is impervious to the mounting sophistications of cyber attacks. And in the case of the latter, these attacks pose more of a threat than just the compromising of user data. As a result, businesses need to seriously think about the hidden issues that a cyber-security breach can cause to a merger and acquisition (M&A) deal.

2016 was a big year for cybersecurity. From discussions pertaining to foreign infiltration in the US election to some of the largest scale cyber attacks ever witnessed, questions around the global state of cybersecurity dominated the media. As a result, there are increasing needs, demands and pressures for purchasing companies in M&A deals to calculate and identify cybersecurity weaknesses and breaches in the companies they intend to buy.

With so many moving parts involved in a large scale M&A; it is easy to overlook the cyber security element. With contracts, staffing, and a lot of legal frameworks to be worked through, cyber security can quickly fall down the list of priorities. This though can be a big flaw, as once a data breach is found – even if it took place years before an acquisition was even planned – the purchasing company can be held responsible and consequently suffer the penalties and charges that come from this.

These ticking time bombs can then go off, wiping millions or even billions off the value of an acquisition. For those that have spent time engineering the deal, it can turn a career defining moment into a nightmare. Having completed the deal, the people that should have been held accountable can, in fact, head off into the sunset, without needing to worry about what might happen next.

 

The modern-day M&A                                                                                                                                          

One recent example of how a good deal can turn sour very quickly can be seen in Verizon’s deal to buy Yahoo. Having agreed to buy Yahoo for $4.8 billion, Verizon soon found out that all was not what it may have seemed as two large, successful and separate cyber attacks were announced to the public. With one billion accounts having been compromised in the largest of the attacks, Yahoo now has the unenviable title of suffering the largest cyber-attack ever recorded. Following this news, it was widely reported that Verizon may seek to have $1 billion removed from the sale price for Yahoo.

With large hacks such as these making headline news across the global, PR and marketing teams at Yahoo will be springing into action to save as much of the company’s reputation as possible. Having established itself as a world-renowned, and recognised internet brand, Yahoo is in serious danger of becoming synonymous with cyber hacks and data breaches.

 

The price you pay

Brand reputations are not the only area that can take a blow following a cyber-attack. The financial impact of a data breach can easily spiral into large sums of money, with some estimates placing the average cost to a company at  $221 per stolen record in the US. If this applied to the smallest of Yahoo’s reported attacks the total would still be over $100 billion or close to the market capital of MasterCard! To make matters even worse, a company’s share price often nosedives after a breach, with the likes of TalkTalk taking a hit of 20% off its share price in the months after its widely broadcast cyber-attack. It is quite clear that forgoing cybersecurity checks can cost businesses billions financially and make a once priceless brand name, completely worthless.

So how can businesses empower and protect themselves from a cyber-attack when considering a potential M&A? Well there are three steps that can help protect the investment:

  • Audit potential breaches: Carrying out a risk audit of potential breaches, assessing both the societal and financial factors that might increase the likelihood of becoming a cyber-target will help M&A analysts calculate whether the eventual acquisition is cost effective.
  • Regulatory industry standards: Companies within certain industries are obliged to maintain a secure environment that will mitigate risk of cyber-attacks and protect user data. For instance, Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information do so in a secure fashion. Ensuring that potential purchases are compliant with these standards is essential in M&A deals.
  • Seek expert help: Cyber security systems are complex and require in-depth knowledge and understanding of how to navigate them safely and effectively; without compromising existing structures. It is therefore highly recommended that M&A analysts enlist the help of cybersecurity consultants to advise them on the suitability of a potential purchase.

 

Cyberpolitics and societal security                                                                                                                   

As cyber criminals and their crimes become ever more complex and dangerous, it is in the best interests of the purchasing company during an M&A to calculate and identify cyber security weaknesses and breaches in the business they intend to buy. Furthermore, brands need to start planning earlier in the M&A process to carry out a full cyber security due diligence investigation and report to assess the dangers of a hack. Carrying out a full cyber risk assessment as part of an M&A not only lessens the financial impact on a deal but also ensures that a business’s reputation remains intact too.

Next time you are planning an M&A it is vital to get the experts in to ensure there are no hidden surprises from large cyber attacks. Working with cybersecurity experts to assist the M&A department could truly be the difference between disaster and prosperity in years to come.

Originally published by IDG Connect here.

Blog at WordPress.com.

Up ↑

%d bloggers like this: