GDPR compliance a major concern for business leaders, claims new survey

BY Fraser Tennant

Increasing regulatory pressures such as the forthcoming EU General Data Protection Regulation (GDPR) are a major concern for business leaders, according to an EY survey published this week.

According to the third biennial EY Global Forensic Data Analytics Survey – ‘How can you disrupt risk in an era of digital transformation?’ – which examined the responses of 745 executives from 19 countries, 78 percent of respondents expressed increasing concern about data protection and data privacy compliance issues, specifically the GDPR.

Indeed, with less than four months to go until the GDPR comes into force on 25 May 2018, only 33 percent of survey respondents said they have a plan in place to comply with the EU legislation. Moreover, while the average response of respondents in Europe was more positive, with 60 percent indicating they have a GDPR compliance plan in place, the survey notes that much work remains to be done in other markets, including Africa and the Middle East (27 percent), the Americas (13 percent) and Asia-Pacific (12 percent).

“The pace of regulatory change continues to accelerate and the introduction of data protection and data privacy laws, such as GDPR, are major compliance challenges for global organisations,” said Andrew Gordon, EY global fraud investigation & dispute services leader. “But businesses that adopt forensic data analytics (FDA) technologies can achieve significant advantages, benefiting from more effective risk management and increased business transparency across all of their operations.”

The survey also found that 42 percent of businesses believe that data protection and data privacy regulations have a significant impact on the design or use of FDA. EY’s examination further revealed that 13 percent of respondents indicated that they currently use FDA to achieve GDPR compliance, with more than half (52 percent) of the respondents indicating that they are currently in the process of analysing exactly which FDA tools they would use to assist them with achieving compliance.

Overall, survey respondents stated that increased adoption of, and spending on, advanced FDA technologies, needs to be matched with greater investment in skilled resources.

Mr Gordon concluded: “While it is encouraging to see that investment in advanced FDA is increasing, companies need to hire the right talent and invest in core skills such as domain knowledge and data analytics in order to be successful in managing their risk profile.”

Report: How can you disrupt risk in an era of digital transformation? – Global Forensic Data Analytics Survey 2018

Confidence down as cyber threat grows

BY Richard Summerfield

Cyber threats are evolving all the time, and while cyber criminals become more sophisticated and better equipped, it is the responsibility of companies to ensure that they are well prepared for any attacks. Yet, according to a new report from Alert Logic, many organisations lack confidence that their systems can withstand an assault.

The ‘Threat Monitoring, Detection and Response Report’ notes that companies are increasingly under attack from ransomware and phishing, and frequently experience data losses (these are the three biggest concerns for companies). Yet many cyber security executives in the UK are unconvinced that their company’s overall security posture is adequate.

Just 42 percent of the 400 executives surveyed indicated that they were moderately confident about their company’s ability to repel an attack. Thirty-two percent of executives felt that their company was more likely to experience a cyber breach in the next 12 months, compared to a year ago. Twenty-nine percent believed a breach was less likely, 22 percent did not expect the threat to change and 17 percent were unsure.

Many companies expressed concern about their ability to resist attacks. Primarily, executives believed that a lack of budget (51 percent), a lack of skilled personnel (49 percent) and lack of security awareness (49 percent) were the most significant obstacles facing security teams and the biggest barriers companies face when trying to defend themselves from attack.

Insiders are another growing concern for respondents. Fifty-four percent of those surveyed perceived a growth in these threats over the past year. Indeed, inadvertent insider breaches were cited as the biggest internal threats companies faced (61 percent). Insufficient user training contributed considerably, with 57 percent of respondents claiming that improving training would help overcome internal threats.

Yet despite the increased profile of cyber threats in the media, many cyber security executives do not expect to see their budgets increase substantially. Only 32 percent expect to get more, while 9 percent expect to receive less and 54 percent anticipate the same level.

A number of organisations are utilising threat intelligence platforms to respond to attackers.  Forty-seven percent of respondents reported that they were deploying open-source threat intelligence. Thirty-seven percent claimed that they uses a range of commercial vendors. Forty-nine percent claimed that the use of threat intelligence platforms had a positive impact on reducing data breaches.

Report: Threat Monitoring, Detection and Response Report

Countering complacency key to defeating cyber criminals

BY Richard Summerfield

Despite an increase in the number of cyber attacks and data breaches over the last 12 months, including a number of high profile cyber events, there has been a decline in how seriously C-suite executives view cyber risk, according to a report from Zurich and Advisen Ltd.

In ‘The Seventh Annual Survey on the Current State of and Trends in Information Security and Cyber Risk Management’, 60 percent of the risk professionals surveyed said executive management view cyber risk as a significant threat to their organisation. However, this is down significantly from the 85 percent recorded in 2016.

The eroding of the importance of cyber security issues among senior management is a worrying trend, particularly in light of the number of cyber incidents recorded over the last 12 months, as well as the volume and value of the data stolen.

According to the report, only 53 percent of respondents knew of any changes to their companies’ cyber security systems in response to the high-profile attacks that took place in early 2017. Furthermore, growth in the purchase of cyber insurance has gone stagnant after a steady six-year increase from 35 percent to 65 percent.

“These findings may indicate that businesses are not up to speed on the magnitude of impact that business interruption losses are beginning to have on businesses,” said Erica Davis, head of Specialty E&O for Zurich North America. “Businesses must adopt a mindset of resilience that extends beyond the four walls of their organization. As cyber security breaches persist, it is more critical than ever to engage in an ongoing, comprehensive review of all business partner relationships including how those vendors and business partners approach their own exposures and controls and how the vendors’ supplier approach fits into their overall resilience plan.”

A total of 315 respondents, across a spectrum of businesses of all sizes, contributed to the report. Fifty-six percent of respondent were from companies with revenue of $1bn or less.

Report: The seventh annual survey on the current state of and trends in information security and cyber risk management

Cyber criminals increasingly deploying sophisticated malware as attack tools, warns report

BY Fraser Tennant

Cyber criminals across the globe are increasingly deploying sophisticated malware such as adware and ransomware to attack companies, warns a new report by Check Point Software Technologies Ltd.

In ‘Global Cyber Attack Trends 2017’, Check Point notes that the global cyber landscape in 2017 appears to have picked up where 2016 left off, with cyber threats emerging on a monthly basis that are increasingly sophisticated, featuring new capabilities and distribution methods.

Among the key trends identified in the report are: (i) nation-state cyber weapons are now in the hands of criminals; (ii) the line between adware and malware is fading, and mobile adware botnets are on the rise; (iii) macro-based downloaders continue to evolve; (iv) a new wave of mobile bankers has arrived on Google Play undetected to infect users; and (v) threat actors are continuing to sell new malware-as-a-service though several platforms, increasing the risk of data breaches.

Also highlighted in the report are today’s most prevalent examples of global malware and ransomware and the regions of the world which attackers target most often.

Acccording to the report: “2017 is shedding light on a new trend – simple, yet highly effective malware families are causing rapid destruction globally. The samples are distributed by unknown threat actors, yet wield high-end attack tools and techniques developed by elite nation-state actors. In addition, massive theft operations, such as the infamous Shadow Brokers leak of tools allegedly developed by the US National Security Agency (NSA), have led to some of the world’s most sophisticated malware ending up in the hands of unskilled attackers.”

Also analysed is the impact of the WannaCry and NotPetya ransomware which has affected public infrastructure as well as medical facilities around the world, with the report noting that many of these attacks could have been blocked had the proper security measures been in place.

“Even with WannaCry and NotPetya making global headlines, most organisations continue to rely on a strategy of detection and response after an attack has occurred as their primary means of defence,” continues the report. “Unfortunately, 99 percent of organisations still have not put in place the fundamental cyber security technologies available to prevent these types of attacks.”

To keep ahead of cyber threats, the report advises companies to stay alert and concludes: “To provide organisations with the best level of protection, security experts must be attuned to the ever-changing landscape and the latest threats and attack methods to keep their security posture at the highest standard.”

Report: Global Cyber Attack Trends 2017

Shortfall in private cyber defences

BY Richard Summerfield

Given the increasing sophistication of cyber criminals and the potential risks faced by companies that fall victim to attack, cyber security has become a hot topic in recent years. According to a new report from the President’s National Infrastructure Advisory Council (NIAC), however, cyber defences in the US are not currently fit for purpose.

The report, 'Securing Cyber Assets: Addressing Urgent Cyber Threats to Critical Infrastructure', was based on reviewing hundreds of previous studies plus interviews with 38 cyber experts, who were mostly in the financial services and electricity sectors.

The NIAC, which was created in the aftermath of the 11 September 2001 attacks in the US, is charged with the task of advising the Department of Homeland Security on the security of US critical infrastructure against any form of attack, be it physical or cyber based. It believes that cyber security provisions in the US are currently experiencing a pre-9/11 moment. According to the report, if more is not done to protect the country’s critical infrastructure, such as the financial system or electric grids in the US, both the government and private industries run the risk of missing a “narrow and fleeting window of opportunity before a watershed, 9/11-level cyber attack".

The report notes: “Cyber is the sole arena where private companies are the front line of defence in a nation-state attack on US infrastructure. When a cyber attack can deliver the same damage or consequences as a kinetic attack, it requires national leadership and close coordination of our collective resources, capabilities, and authorities."

The NIAC has proposed 11 specific recommendations to shore up the country’s cyber security defences. Chief among these is establishing specific network paths designated for the most critical networks, which would include dark fibre networks for critical control system traffic and reserved spectrum for backup communications during emergencies. The NIAC also recommended private organisations and government bodies improve their threat information sharing. In addition, the government should provide incentives for any hardware upgrades performed, as well as establish a centre of excellence which will showcase best-in-class tools across the industry and provide a test bed environment for companies to test and evaluate new software, among others.

“We believe the US government and private sector collectively have the tremendous cyber capabilities and resources needed to defend critical private systems from aggressive cyber attacks – provided they are properly organized, harnessed, and focused. Today, we’re falling short”, the report suggests.

Report: Securing Cyber Assets: Addressing Urgent Cyber Threats to Critical Infrastructure