Downloaded 13 times
![PERSONAL DATA PROTECTION
• Specific regulation relating to personal data
• Currently Data Protection Act 1998
• General Data Protection Regulation in force 2018
• Both contain obligations to have appropriate security measures
“…the controller [and the processor] shall implement appropriate technical
and organisational measures to ensure a level of security appropriate to the
risk…”
• Stronger obligations for sensitive personal data
• Stronger notification requirements in GDPR](https://image.slidesharecdn.com/cybersecurityandtheimpactonyourbusiness-170209084213/75/Cyber-Security-and-the-Impact-on-your-Business-25-2048.jpg)
More Related Content
Similar to Cyber Security and the Impact on your Business
Cyber Security and the Impact on your Business
- 1. WELCOME TO: CYBER SECURITYANDTHE IMPACT ON YOUR BUSINESS HOW DO YOU CURRENTLY BACK UP YOUR DATA? ADD YOUR RESPONSE AT WWW.SLI.DO JOIN USING THIS CODE: #5660
- 2. WHO WE ARE "Ourmission is to make IT simple. Enabling our customers to succeed by delivering information technology services better than anyone else."
- 3. CYBER SCAMS What werethe most prevalent cyber scams of 2016? How much damage did they cause?
- 4. Common frauds &scams in today’s digital marketplace • Phishing • Vishing • Invoice Redirection • Bogus Boss • Overpayment Fraud
- 5. PHISHING Bogus emails whichappear authentic and from legitimate sources • High volume • Fake links, websites, attachments Tips to protect • Antivirus, Trusteer Rapport, spam filters and firewalls • Https:// • Do not respond • Do not click links • Forward suspect emails to: phishing@natwest.com
- 6. VISHING Voice + Phishing= Vishing • Social engineering • Information jigsaws Tips to protect • Question who is calling • Decline to provide personal information • Do not rely on Caller ID • Do not transfer money
- 7. INVOICE REDIRECTION Specifically aimedat businesses They research your business • Suppliers’ details • Payment profile They attempt to issue a revised payment location controlled by fraudsters. Tips to protect • May begin with post going missing • Validate any requests • Dual-authorise changes • Systems, processes and checks
- 8.
- 9. BOGUS BOSS • Emailor text reportedly from your ‘boss’ • Requests an urgent transfer of funds due to a situation or in a light- hearted conversation • Fakes/spoofs internal email appearances Tips to protect • Question the request • Validate the request • Speak to the person
- 10. OVERPAYMENT FRAUD • Customeradvises they have ‘mistakenly’ overpaid your bill e.g. £40,000 instead of £4,000 • Requests you keep the amount and return the difference • Original payment subsequently bounces Tips to protect • Typically new clients • Do usual background and reference checks • Think about how you would treat a cheque • Strange type of payment - validate
- 11. REMEMBER • Do notshare user accounts • Install Trusteer Rapport software • Have up to date antivirus • Never give out your pin/password Useful contacts Email: phishing@natwest.com NatWest Fraud: 0345 300 3986 Actionfraud: 0300 123 2040
- 12. CRYPTOLOCKER A type ofRansomware that stealthily encrypts all your files and deletes the originals, before demanding payment to reinstate your documents and data. Typically delivered via email or an insecure internet-enabled computer. In 2016, 54% of UK businesses were hit by some form of Ransomware attack
- 13. CRYPTOLOCKER HOW RANSOMWARE CANIMPACT YOUR BUSINESS IF YOU GET IT RIGHT… Hotel in Belfast Employees: ~500 Type of Backup: untested, internally managed What happened: AAG brought in when Cryptolocker hit for the 3rd time in 2 weeks Response: Engineer deployed within 4 hours Recovery time: <48 hours for all systems; no downtime to booking or critical systems Cost to business: £negligible IF YOU GET IT WRONG… Company in Rotherham Employees: 149 Type of Backup: untested, externally managed What happened: Cryptolocker got onto their network via an infected email Recovery time: 14 days for critical systems Last viable Backup: May 2016 (lost five months’ worth of data) Cost to business: £35,000 lost revenue
- 14. WHY SHOULD IBACK UP? • 6.2 million cyber attacks on UK businesses took place in 2015 • 33% of attacks were caused by an employee • 3,200% - the increase in attack infrastructure used by cybercriminals in 2016 • 80% of CIOs and IT Directors surveyed had experienced a cyber attack • 37% lost revenue • 20% had to halt operations* *540 individuals surveyed by Malwarebytes, 2016
- 15. WHY SHOULD IBACK UP? The typical cost to SMEs of a cyber attack (PWC IOC Report, 2015) 70% 70% of businesses who suffer a major data loss fail within one year (PWC IOC Report, 2015) 75% 75% of businesses fail to successfully execute an untested Disaster Recovery plan (PWC IOC Report, 2015) £75k - £311k
- 16. HOW SHOULD IBACK UP? How do you back up? Let’s have a look at the results Popular + unreliable Less popular + more reliable Becoming popular + most reliable Optical Drive Disk-to-Disk Site-to-Site Backup Tapes Cloud USB Hard Drive Site-to-Site + Cloud How often do you test your Backup method?
- 17. HOW SHOULD IBACK UP? Cloud vs. Site-to-Site vs. Disk The recommended Backup method is always down to your business needs. Typically, Cloud and/or Site-to-Site Backup gives the best value and peace of mind Capacity Security Reliability Cloud Unlimited Very secure 99.99% uptime Site-to-Site Flexible Secure More reliable Disk/USB Hard Drive Limited Easily corruptible Less reliable Tape Limited Easily corruptible Unreliable
- 18. COST OF SECURINGYOUR DATA ANNUAL MONTHLY REVENUE (21 WORKING DAYS) £1 MILLION £82,677 £3 MILLION £248,031 £5 MILLION £413,385 £10 MILLION £826,770 CLOUD COST (DATA-DEPENDENT) £150 £250 £350 £500 % OF TURNOVER 0.007% 0.001% 0.0008% 0.0006% ANNUAL COST OF 12 DAYS’ LOST BUSINESS £1 MILLION £47,244 £3 MILLION £141,732 £5 MILLION £236,220 £10 MILLION £472,440 *based on 254 working days per year
- 19. BACKUP & DISASTERRECOVERY Backup refers to the copying and archiving of computer data so it may be used to restore the original after a data loss event. Backup is different to Disaster Recovery: • Backup is simply making one or more copies of your data in case the original is lost or damaged • Disaster Recovery is restoring that data in the instance that the original is lost or damaged.
- 20. Backup, Disaster Recovery andCyber Security LEGAL ISSUES
- 21. INTRODUCTION • Shulmans LLP •One of the fastest growing Commercial law firms in the UK • Providing a national service from a cost effective base in Leeds • Experienced team with a focus on compliance, risk management, technology and good business practice • Risk and Regulation • Strategy and Risk Management • Business Process Advice • Crisis Management and Regulator Response mlumley@shulmans.co.uk hgoldthorpe@shulmans.co.uk
- 22. CHANGING LANDSCAPE • Increasinglyconnected world • Obsolete or vulnerable technology • Increasingly complex attacks • Rise of the Super-Regulator • ICO • National Cyber Security Centre (or similar) • HSE • Sector-specific regulation e.g. Financial Services
- 23. RISK What risks arewe trying to avoid? • Injury • Financial Loss • Reputational Damage • IP & Confidential Information Loss • Regulatory Intervention/fines • Liability to third parties • Interference with operation/production • Maintaining services/data availability
- 24. REGULATION • Any interruptionto business could expose you to claims e.g. that you are unable to carry out contracted services • ALWAYS good business sense to protect against this risk • In some sectors there are also specific obligations to put security in place: • Personal Data • Cyber Security Directive • Financial Services • Payment card information
- 25. PERSONAL DATA PROTECTION •Specific regulation relating to personal data • Currently Data Protection Act 1998 • General Data Protection Regulation in force 2018 • Both contain obligations to have appropriate security measures “…the controller [and the processor] shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk…” • Stronger obligations for sensitive personal data • Stronger notification requirements in GDPR
- 26. CYBER SECURITY DIRECTIVE •Will take effect in UK by May 2018 • Impacts on operators of essential services and digital service providers • Online marketplace, online search engine, cloud computing service • NOT hardware manufacturers/software developers/micro or small enterprises • Security requirements “appropriate and proportionate organisational risk management measures including measures to prevent and minimise the impact of incidents that affect security of networks and information systems” • Incident notification • Will require • Risk management systems • Reporting processes • Enforcement - fines?
- 27. INCIDENT RESPONSE • Legalobligations don’t just cover putting technical protection in place • Also cover how you respond to an incident – containment, recovery, notification • Disasters do happen – need to plan ahead • Legal priorities • Regulatory notification obligations • Contractual notification obligations • Potential liability to third parties • Are you able to pursue the perpetrator (especially for employee fraud) or recover money/IP/assets? • Legal privilege • Plan ahead so you can act fast!
- 28. DIRECTORS’ LIABILITY • s61DPA • Directors’ duties • Regulatory obligations • ICO may request undertakings from directors
- 29. CASE STUDY: EMPLOYMENTFRAUD • Apparently loyal employees • Handed in notice, off sick • No apparent warning signs • But… • Copied emails to home address • Used FTP File transfer software to transfer large files – difficult to detect • Software, designs, clients, suppliers and pricing all copied • Loss? • What did we do?
- 30. WHAT NEXT? • I’mtoo busy! • Schedule time to review risks and strategy • Understand your risk profile • Formulate an action plan • Fit into your “business year” • Who needs to be involved? • Board, key managers, staff, consultants, key suppliers • Lawyers and specialist consultants
- 31. OUR SOLUTION • DataProtect Workshop with AAG and Shulmans • A planned, time & cost controlled solution • Intro to other key business participants - high level summary of law and approach to risk assessment • Scoping questionnaire • Workshop: • legal and technical • individual business needs • Board, management & operational • Outputs – technical requirements, risk analysis & risk register, business knowledge, policies, procedures, training materials. • Outputs - data protection policies, customer document and online policies, business continuity policy update, disaster recovery, cyber Incident response & cyber risk training. Delivered in physical and digital formats • Outputs - high level summary for board, compliance protection & insurers/brokers • Layered approach to information, role specific (board, management and operational) • Annual review and access to ongoing technical and legal support. • Available dates
- 32. SUMMARY • If yourbusiness is important to you, it is worth protecting it with a Backup & Disaster Recovery strategy that you can have confidence in • Educate your staff of the latest cyber scams and types of Ransomware attacks • Test your current Backup • Review your Disaster Recovery plan • Implement a responsibilities chart • Book your Data Protect Workshop with AAG and Shulmans sales@aagsystems.co.uk www.linkedin.com/company/aagsystems 0114 399 0995
Editor's Notes
- #5 Fraud is huge! Over 50% of all crimes reported in the latest ONS survey are fraud related – this includes traditional fraud Cyber fraud continues to rise – at least the bits that get reported (the only part that can be measured) Cybercrime –is Estimated to cost the UK economy up to £27bn per annum https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/60943/the-cost-of-cyber-crime-full-report.pdf £21Bn of which is attributed to UK businesses We will look at some of the common types of fraud we are seeing occurring within our marketplace today. I will give you a brief insight into the process of the fraud along with some tips and considerations to help you protect against these
- #6 Everyone who has an email account will have experienced this approach! Emails that look like they are from a known brand but are fake containing fake links etc Can feed into fake websites Tips to prevent Anti Virus – use a known brand, keep it up to date Trustee Rapport – industry recognised software used across multiple organisation including natwest to validate websites you access Spam Filters – many ISP and email providers run spam filters to filter out mass mailings Https:// - look out for the S to show a site is secure, links to Trusteer Rapport Software Don’t respond – most email, like calls, are anticipated from known sources. How would you act to a cold call? Don’t click links Phising@ natwest.com – most larger companies reserve this for such incidents to tackle on a collated basis.
- #7 Advanced form of phishing which also uses contact via phone. 2 Main avenues Social Engineering – portraying to be Bank, police or reputable organisation often on the pretence of helping you. Request pin numbers, bank transfers, passwords test transfers. Information Jigsaw – multiple small attempts to collate data item such as address, account number, key contacts. Fraudsters then pull these together in order to make an impersonation fraud attempt such as CHAPS, cash withdrawals, change of bank details . Tips to prevent Question who is calling – don’t assume they are a known person if they provide simple details such as names/address when calling Decline personal information – no authority or bank staff will ever get aggressive if you refuse to provide information. Simply tell them you will contact the organisation by a known number. Use a different number, maybe different phone to call back (fraudsters often leave the line open for your return call – wait 5 minutes) Caller ID – these can be imitated to the extend they can manipulate the name rather than number appearing Never make impromptu transfers Banks will never ask for your pin and password in full
- #8 First two can occur personally, this is aimed at business Aimed at businesses of all sizes – large business due to breakdown in communication between teams, small business as they are perceived to be easier to persuade (may have a smaller/part time finance function) Fraudsters build a picture of your payments - suppliers names, current details, typically amounts, frequency Then look to instigate a typical redirection – advice by email, phone, letter Client innocently make payment to new location which is swiftly transferred through multiple accounts, overseas etc. Tips to protect Missing post – to obtain copy invoices and understand your payment patterns Validate all changes of address – we do as a bank! Call the company, speak to a known contact. Dual authorisation to change payment details
- #9 Who knows this firm? Trades on the NYSE Computer networking – tech savvy? TO $650M+ 500+ employees Aug 6th 2015 – market update included a disclosure of $39.1m bogus boss fraud – being $46.7M of which just $8m recovered (http://fortune.com/2015/08/10/ubiquiti-networks-email-scam-40-million/) No insurance cover.
- #10 “Boss” commonly MD to FD however it could be the other way round, or FC to MD Emails or texts used – emails often spoofed to look like a company email Tips to protect Question if you have received such instructions before Validate email/text is genuine - check the email/phone number received from speak to the person, they are likely to be known to you.
- #11 Undertake business with new client – may seek pro-forma payment, upfront. Client pays but then highlights an error in keying. Decimal point in the wrong place, too many zeros. Looks to rectify by you sending the balancing amount back- this ia separate unique transaction Original payment is then removed from bank account in clearing cycle. Net loss = 36k in this example. Tips to protect New clients – most long standing client relationship will be aware this will bring such relationship to an end! May make 2 or 3 small transaction perfectly fine to build a level of trust Background checks– those who insure your debts will do this as a matter of process, those who don’t may not. Think back to the days of bounced cheques if someone game you a cheque, when would you release your goods? Payment type – typically deposit a chq or draft over the counter, or make a foreign payment. Was this how the deal was arranged/discussed? Call the bank to validate payment and confirm it is cleared funds.
- #12 Banks, including NatWest, currently carry the cost of fraud when clients are not negligent What is negligent? Sharing bankline/online banking log-in (internal fraud) Not having trusteer rapport software installed, Not having UTD antivirus Disclosing (writing down!) pins and passwords Falling out of scope of cover would be when you have set up and made your own payment following a fraud – this is a separate transaction authorised by you. Don’t underestimate fraudsters – they may use small parts of each of the above types of fraud to construct a more complex attempt. Banks are working behind the scenes to protect you! Profiling, screening, systems and checks. According to a recent BBC article banks prevent £6 in £10 of fraud attempts in the first half of 2016 [handover] most of the above types of fraud exploits basic human behaviour traits in the increasing busy lives we lead. The following part of this seminar will focus on a form of fraud which exploits technical loopholes Lisa from AAG systems will now explain this in more detail…..
- #22 Brief introduction to who we are and what we do.
- #23 This is an issue which is growing in importance. Part of it is the technology side of it – the more connected we are the more risks there are. But also regulators have started to pay attention so there is increasing focus on this. Regulators like the ICO are starting to get more powers, and cyber security specific initiatives are being set up. Sector specific regulators like the FCA are paying more attention too. You might question why the HSE is on there. Simple answer – as more and more things get connected to the internet (internet of things), the risks increase. If you have safety critical equipment which is controlled via your networks a cyber attack could impact on this.
- #24 Some of these risks are risks that you want to guard against from a commercial point of view anyway, but could all have legal consequences – e.g. if you can’t maintain services what is your contractual liability to clients? If client data has been accessed as part of the incident is there a potential claim against you for this? Is there a risk of a PI claim if someone gets injured? On the flip side, if you have suffered financial loss, reputational damage or a loss of confidential information do you have any routes to recover these or to take action against the party responsible? And finally, are there any regulatory consequences? Fines aren’t just for big companies like Talk Talk. The ICO has issued fines against a nursing home (£15,000) and a historical society (£500) when personal data was held on an unencrypted laptop which was then stolen. Stolen unencrypted laptops are a recurring theme in ICO enforcement action.
- #25 I’ve mentioned regulators a couple of times, and want to give a flavour of what this covers. Not all IT systems are subject to regulatory obligations but the scope of regulation is increasing. The big one is personal data – currently the DPA but to be replaced by the GDPR. There’s also a new cyber security directive and I’ll look at both of these shortly. There is a lot of regulation around financial services and it’s important to remember that even if you’re not directly regulated by the FCA, if you provide services into the sector your clients may want to flow specific obligations through to you. The FCA requires them to put strong contracts in place. They may also want you to pick up the tab if they get fined as a result of your breach. There are also specific requirements if you hold payment card information.
- #26 Personal data is data about living individuals. It’s subject to specific rules, and these are even stronger for sensitive personal data which includes things like health information. The DPA is nearly 20 years old and is being replaced next year by the GDPR. This is European law but will happen regardless of Brexit. They cover much more than just security, but 2 important points to note in the context of this seminar are first that both of them require you to put appropriate security measures in place for all personal data. If you fail to do this you could face enforcement action or fines. Secondly, under GDPR there are notification requirements where there is a security breach. At the moment notification of a breach is voluntary although there is ICO guidance as to when you should and shouldn’t notify. Under GDPR notification requirements are much stronger and some notifications will be mandatory. With relatively short timescales it’s helpful to understand in advance what you need to do because in the immediate aftermath of a breach there will be lots going on and you don’t want to overlook this.
- #27 The cyber security directive catches two main groups of businesses. Operators of essential services will be listed, so it will be fairly easy to know whether this applies to you. This covers things like infrastructure and utilities but also financial services. Also includes some health care businesses like hospitals and GP surgeries. Digital service providers are subject to slightly less stringent requirements. This covers specific types of online service, but not all IT related services. It also doesn’t cover the smallest businesses. Again, the two key points are the requirement to put appropriate security in place, and the requirement to notify incidents. Risk management systems and reporting processes will be important to help you do this. Again there are likely to be fines if you don’t comply.
- #28 I’ve talked a bit about regulatory notification obligations, but there are other legal issues to think about in the event of an incident. It’s always useful to understand what these are in advance so that you can prioritise what you do in the immediate aftermath. As well as regulatory notifications you may have contracts (particularly if you deal with FCA registered clients) which require you to notify those customers. These sometimes kick in even if the customer wasn’t directly affected. If you have potential liability to a third party, maybe for non-provision of a service, you may want to take steps to manage that liability including thinking about what you will say to the customer. You may want to look into your options to pursue the perpetrator. This is a big issue for employee fraud, and again you need to act quickly to do this. Mark will look at a case study on this. Finally, one advantage of using lawyers as part of your incident management is that advice you are given benefits from legal privilege meaning that you would not necessarily have to disclose it to a regulator investigating the incident.
- #29 My last slide is a quick note on personal liability for directors. Most of what I’ve covered is liability for the company rather than the individuals, but there are routes to bring actions directly against directors. Under the DPA criminal proceedings can be brought against a director where an offence is committed with the consent, connivance or neglect of a senior officer of the company. It’s rare but there have been a couple of prosecutions. There is also the possibility of an action by the company against the director for breach of directors duties e.g. that the director has not exercised reasonable care, skill and diligence or has not promoted the success of the company. Different regulatory regimes also put specific obligations on individuals. In a DP context the ICO can request undertakings from directors and if these are not complied with the director could face liability. Hand over
- #30 Mark
- #31 Mark
- #32 Mark