A year after the Panama Papers, a massive leak of confidential information from the Bermuda law firm Appleby Group Services, dubbed the Paradise Papers, has shone another light on the use of offshore accounts, writes RUDI DICKS, Head of Cyber Security at BDO Cyber and Forensics Lab
A new set of data taken from an offshore law firm again threatens to expose the hidden wealth of individuals and show how corporations, hedge funds and others may have skirted taxes. A year after the Panama Papers, a massive leak of confidential information from the Bermuda law firm Appleby Group Services, dubbed the Paradise Papers, has shone another light on the use of offshore accounts.
1. What are your views / interpretation on / of the ‘Paradise Papers’ data leaks?
Appleby publicly stated that it was not the subject of a leak but of an illegal computer hack. Their systems were accessed by an intruder who deployed the tactics of a professional hacker and covered his/her tracks to the extent that the forensic investigation concluded that there was no definitive evidence that any data had left their systems. While the mechanics of the breach itself have yet to be revealed, this was clearly a targeted attack. Law firms are particularly susceptible to hacking as they house a treasure trove of sensitive data that, when compromised, can result in sometimes irrecoverable damage.
The paradise papers, like the panama papers is an excellent example of the reputational harm that attackers can cause, rather than financial. Here we saw many wealthy people shown to have offshore accounts in tax havens. Most of these transactions are perfectly legal but the implication is that these wealthy and often famous people are skirting their tax obligations. For the company that these documents were stolen from, this leak will most likely destroy the business.
This class of events demonstrates why law firms must protect their clients’ confidential information. No amount of cyber insurance, data backup strategies, nor business continuity planning can ever put this genie back in the bottle.
2. In your opinion, should we concentrate on the content aspect of these leaks or the security aspect?
For Appleby, the concern is with the content because their clients will be far less likely to conduct sensitive business with them in the future. By releasing the Paradise Papers, the aim of the International Consortium of Investigative Journalists (ICIJ) was to expose significant failures and weaknesses inside the offshore industry. As per ICIJ, “those stories and others they are pursuing serve the public interest by bringing accountability to the offshore industry, its users and operators. Other parts of the data are of a private nature and of no interest to the public. ICIJ will not release personal data en masse but will continue to mine the full data with its media partners.” The content released will certainly have far-reaching impacts for those affected.
For security specialists, the concern is with how this happened, and making sure we do everything possible to ensure that the same attack vectors cannot be used against our clients. This event, allegedly conducted by external hackers, could likely have been detected and mitigated. What ends in a business disrupting event often begins with the ‘click’ on a harmless looking link. Sometimes it involves complex social engineering, credential harvesting and clandestine operations inside the network to locate and slowly exfiltrate valuable data. Thus, considering heightened cyber risks, organisations have to make sure that they are taking reasonable steps to protect their clients’ confidential data. These include:
· Ensuring that software used is up-to-date and that available patches are implemented as soon as reasonably practical.
· Configuring Intrusion Prevention Systems and Firewalls policies to reject information gathering events
· Reviewing access controls regularly to ensure that they are up to date and that they restrict electronic data users to their necessary business functions.
· Utilising antivirus and malware detection software.
· Conducting periodic cybersecurity audits and penetration testing.
· Requiring multi-factor authentication for remote access into computer systems and for very sensitive internal access points.
· Requiring rotating complex passwords.
· Monitoring the activity of authorised users to detect any unauthorised file access, as well as, any large-scale downloading, copying or tampering with confidential information.
· Conducting regular cybersecurity awareness training together with phishing attacks.
3. With ‘Offshore Leaks’, ‘Panama Leaks’, ‘Paradise Papers’ – what should we be aware of / conclude?
We are living in an age of internet activism or hacktivism, which is the subversive use of computers and computer networks to promote a political agenda or a social change. With roots in hacker culture and hacker ethics, its ends are often related to the free speech, human rights, or freedom of information movements. Hacktivists seek to expose social injustice. The hack is a reminder that cybercrime is sometimes motivated by loftier aspirations than making money.
4. How come hackers can still obtain sensitive information when security conscious companies invest so much in safeguarding their data?
No matter how much a company invests in latest security technologies, the human factor remains the weakness link. The lack of effective cybersecurity training for all employees is the root cause of companies failing to keep their data safe. It is extremely pertinent to every organisation to protect its reputation, competitive advantage and operational stability against social engineering with effective company-wide security awareness. BDO’s cybersecurity education program sets employees up for success by instilling cutting edge knowledge and practical know-how into the workplace. Through integrated communication and hacker-led training, BDO helps organisation fight cybercrime strategically and beyond the scope of technology.
Mobile is the new branch
Standard Bank has launched an account for mobile devices that gives back 500MB of data a month
Standard Bank has introducd a R4.95p/m bank account called MyMo that customers can open on their mobile devices, loaded with data and airtime offerings and other benefits such as virtual and Gold physical card.
MyMo account holders will also enjoy the convenience of a cheque account through a Visa and Mastercard gold card. Once the account is open, users can choose to either receive R50 in airtime or 500MB of data a month, if their card is swiped more than four times a month. A further megabyte of data is loaded on the account for every R20 spent.
“MyMo is an account for everyone, whether you just landed your first job or have been around the block. With no documentation required it only takes a few minutes to open the account,” says Funeka Montjane, Chief Executive for Personal and Business Banking, South Africa, at Standard Bank Group. “For just R4.95 a month customer will be able to enjoy free swipes and ATM withdrawals at only R6.50 for amounts under R 1 000.
“Mobile is the new branch. This account is about bringing the mobile branch into customers hands, it is about convenience and security while banking.”
She says mobile offers low cost transactional banking which integrates people and businesses into the new connected economy, making mobile the new branch ecosystem that will drive and connect Africa’s growth. Physical connections to the economy are rapidly changing to digital where banks have to move from being financial institutions to service organisations.
“In the past people congregated in communities and eventually cities to maximise the advantages of connectivity. Today a simple hand-held device has the potential to open infinite doors, transforming individuals’ access to opportunities, regardless of where they are, and like never before in history.
“Historically, a bank account represented access to economic citizenship. Today, having a simple device enabling digital access to a modern banking platform is a passport to global connectivity and vast human development potential.”
The bank says it is using technology, and mobile phones in particular, to deliver low-cost transactional channels accessible to all our customers. The evolution in mobile can be seen in transaction options like cash back at the retail checkout till rather than the ATM, free digital banking rather than using a branch, and the ability to transact using digital wallets, even without a bank account.
“Developing comprehensive connected ecosystems requires a mind-set change from Africa’s banks,” says Montjane. “Banks will evolve away from traditional financial service organisations, into service ecosystems enabling broad universal access to almost everything like enhanced purchasing experiences of vehicles and homes, online procurement of goods and services and lifestyle elements like rewards and travel.
“These connectivity drivers will also act to future-proof evolving connectivity ecosystem by allowing us to offer untold future services while deriving income from as yet unrealised revenue streams,.
From a customer perspective, the kind of ecosystems of knowledge, access and, ultimately, connectivity that banks will come to provide will radically transform the share of life that almost all individuals will be able to access.”
Two-thirds of SA staff hide social media from bosses
With 90% of people in employment going online several times a day, it can be hard for most workers to keep their private and work-life separate during the working day (and beyond). The recently published Global Privacy Report from Kaspersky Lab reveals that 64% of South African consumers choose to hide social media activity from their boss. This secretive stance at work also extends to their colleagues, with 60% of South Africans also preferring not to reveal online activities to their co-workers.
Globally, the average employee spends an astonishing 13 years and two months at work during their lifetime. Interestingly though, not all this time is directly related to solving work tasks or earning a promotion: almost two thirds (64%) of consumers admit visiting non-work-related websites every day from their desk.
Not surprisingly, 35% of South African employees are against their employer knowing which websites they visit. However, more interestingly, 60% of South African are even against their colleagues knowing about their online activities. This probably means that colleagues constitute an even greater threat to future perspectives of an office slouch or maybe the relationships with colleagues are more informal and therefore, more valuable.
On the contrary, social media activity appears to be a less private domain for many and therefore, more suitable for sharing with colleagues but not the boss. This is probably because workers fear harming the public image of a company or interest in decreased staff productivity motivates companies to monitor employees’ social networks and make career changing decisions based on that. Such policies have led to 64% of South Africans saying that they don’t want to reveal their social media activities to their boss and 53% even don’t want to disclose this information to their colleagues.
A further 29% are against showing the content of their messages and emails to their employer. In addition, 3% even said that their career was irrevocably damaged as a consequence of their personal information being leaked. Thus, people are worried about how to build a favourable internal reputation and how not to destroy existing workplace relationships.
“As going online is an integral part of our life nowadays, lines continue to blur between our digital existence at work and at home. And that’s neither good nor bad. That’s how we live in the digital age. Just keep remembering that as an employee you need to be increasingly cautious of what exactly you post on social media feeds or what websites you prefer using at work. One misconceived action on the internet could have an irrevocable long-term impact on even the most ambitious worker’s ability to climb the career ladder of their choice in the future,” comments Marina Titova, Head of Consumer Product Marketing at Kaspersky Lab.
To ensure workers don’t fall prey of the internet threats at a work, there are some core guidelines to adhere to in the digital age:
- Don’t post anything that could be considered defamatory, obscene, proprietary or libellous. If in doubt, don’t post.
- Be aware that system administrators may at least, in theory, be informed about your web browsing patterns.
- Don’t harass, threaten, discriminate or disparage against any colleague, partner, competitor or customer. Neither on social networks or in messages, emails, nor by any other means.
- Don’t post photographs of other employees, customers, vendors, suppliers or company products without prior written permission.
- Start using Kaspersky Password Manager to ensure your social media and other personal accounts are not at risk of unauthorised access by someone else in an office. Install a reliable security solution such as Kaspersky Security Cloud to protect your personal devices.