The facts and the results of forensic investigations across the cyber domain are telling a significant story. The question remains, will CxO's take the time to digest and think about what is happening within their Enterprise Risk ecosystem? Operational Risk Management (ORM) has four key dimensions:
Each of these dimensions must be looked upon in a holistic and interdependent manner, realizing that they are all indeed interconnected. One may impact another or managing risk in some but not others could bring the entire enterprise to it's knees. This is understood.
You are no doubt utilizing a myriad of strategies to deter, detect, defend and document the Operational Risks within your specific industry and associated with the adversaries and regulations pertinent to your business. So why is this still the state-of-play?
Cybercrime analysis needs to go deeper. As an example, it would be interesting to discover what percent of cyber fraud victims in 2013 currently run a Microsoft-based operating system on their computer? No doubt the highest, due to the vast installed base of Microsoft-based PC's over the years.
Executive Management of companies with over 1000 employees who do not perceive the risk of cybercrime on the rise, may have other more pressing issues. Labor, raw materials, weather, or other factors that may be impacting their business. It makes some sense.
Over the next decade, the tide will turn on the motivation to pursue petty cybercrime and fraud. Not because the laws and enforcement are more effective. Not necessarily because the fraud opportunity becomes too difficult because of the effectiveness of new technology. Not even because the Microsoft Operating System installed base, dwindles to a minority percentage. Why?
It is because the best cyber Transnational Organized Crime (TOC) organizations will become allies with nation states or even terrorist non-state actors. They will be paid much more handsomely and they may not even have to disclose their true identities. The stakes and the fortunes to be made in TOC are rising. The cyber domain is now a race for superiority. The best of these skills and knowledge will come from the "dark side" to start, and at a high premium. So what are you to do, if you are the CxO of a top Global 500 organization?
Pray longer. Allocate a treasure chest to invest in your long digital war ahead. Hedge the risk...
- People
- Processes
- Systems
- External Events
Each of these dimensions must be looked upon in a holistic and interdependent manner, realizing that they are all indeed interconnected. One may impact another or managing risk in some but not others could bring the entire enterprise to it's knees. This is understood.
You are no doubt utilizing a myriad of strategies to deter, detect, defend and document the Operational Risks within your specific industry and associated with the adversaries and regulations pertinent to your business. So why is this still the state-of-play?
Companies are beginning to change how they think about cybersecurity – viewing it as a business issue, not just an IT issue. Forty-four percent of U.S. organizations that experienced fraud in the past 24 months suffered from cybercrime; and 44 percent of all U.S. respondents indicated they thought it was likely their organization would suffer from cybercrime within the next 24 months.
So for the other 71%, the perception of the risks of cybercrime has increased. Again, what are the business details of these respondents? What would be interesting is to ask the question: How many U.S. citizens have been issued a new credit or debit card last year due to fraudulent charges? Perhaps the 29% are the unbanked population of the U.S. who are not issued cards because they do not participate in the formal banking system? Unlikely.Seventy-one percent of U.S. respondents indicated their perception of the risks of cybercrime increased over the past 24 months, rising 10 percent from 2011. U.S. respondents' perception of the risks of cybercrime exceeded the global average by 23 percent. Despite having more to lose, U.S. respondents were generally less aware of the cost of cybercrime: 42 percent of U.S. respondents were unaware of cybercrime's cost to their organizations, compared to 33 percent of global respondents.Didier Lavion, PwC principal and lead author of the U.S. report, said, "U.S. corporations need to better leverage and implement the computational and analytical power of cybersecurity technologies to help combat the increasing global presence of cybercrime." --Source: PwC's Global Economic Crime Survey 2014
The reason that the state-of-play remains in turmoil, is the inverse of what the survey is reporting. 29% of U.S. respondents have no perception that the risks of cybercrime has increased over the past 24 months. The 29% who do not perceive this, must be in an industry group that is either not connected to the Internet, does not use mobile devices or are using paper and pencils to run their business.
Cybercrime analysis needs to go deeper. As an example, it would be interesting to discover what percent of cyber fraud victims in 2013 currently run a Microsoft-based operating system on their computer? No doubt the highest, due to the vast installed base of Microsoft-based PC's over the years.
Executive Management of companies with over 1000 employees who do not perceive the risk of cybercrime on the rise, may have other more pressing issues. Labor, raw materials, weather, or other factors that may be impacting their business. It makes some sense.
Over the next decade, the tide will turn on the motivation to pursue petty cybercrime and fraud. Not because the laws and enforcement are more effective. Not necessarily because the fraud opportunity becomes too difficult because of the effectiveness of new technology. Not even because the Microsoft Operating System installed base, dwindles to a minority percentage. Why?
It is because the best cyber Transnational Organized Crime (TOC) organizations will become allies with nation states or even terrorist non-state actors. They will be paid much more handsomely and they may not even have to disclose their true identities. The stakes and the fortunes to be made in TOC are rising. The cyber domain is now a race for superiority. The best of these skills and knowledge will come from the "dark side" to start, and at a high premium. So what are you to do, if you are the CxO of a top Global 500 organization?
Pray longer. Allocate a treasure chest to invest in your long digital war ahead. Hedge the risk...
New threat actor: Spanish-speaking attackers targeting government institutions, energy, oil & gas companies and other high-profile victims via cross-platform malware toolkit
Today Kaspersky Lab’s security research team announced the discovery of “The Mask” (aka Careto), an advanced Spanish-language speaking threat actor that has been involved in global cyber-espionage operations since at least 2007. What makes The Mask special is the complexity of the toolset used by the attackers. This includes an extremely sophisticated malware, a rootkit, a bootkit, Mac OS X and Linux versions and possibly versions for Android and iOS (iPad/iPhone).
The primary targets are government institutions, diplomatic offices and embassies, energy, oil and gas companies, research organizations and activists. Victims of this targeted attack have been found in 31 countries around the world – from the Middle East and Europe to Africa and the Americas. The main objective of the attackers is to gather sensitive data from the infected systems. Several reasons make us believe this could be a nation-state sponsored campaign.
