A year after the Panama Papers, a massive leak of confidential information from the Bermuda law firm Appleby Group Services, dubbed the Paradise Papers, has shone another light on the use of offshore accounts, writes RUDI DICKS, Head of Cyber Security at BDO Cyber and Forensics Lab
A new set of data taken from an offshore law firm again threatens to expose the hidden wealth of individuals and show how corporations, hedge funds and others may have skirted taxes. A year after the Panama Papers, a massive leak of confidential information from the Bermuda law firm Appleby Group Services, dubbed the Paradise Papers, has shone another light on the use of offshore accounts.
1. What are your views / interpretation on / of the ‘Paradise Papers’ data leaks?
Appleby publicly stated that it was not the subject of a leak but of an illegal computer hack. Their systems were accessed by an intruder who deployed the tactics of a professional hacker and covered his/her tracks to the extent that the forensic investigation concluded that there was no definitive evidence that any data had left their systems. While the mechanics of the breach itself have yet to be revealed, this was clearly a targeted attack. Law firms are particularly susceptible to hacking as they house a treasure trove of sensitive data that, when compromised, can result in sometimes irrecoverable damage.
The paradise papers, like the panama papers is an excellent example of the reputational harm that attackers can cause, rather than financial. Here we saw many wealthy people shown to have offshore accounts in tax havens. Most of these transactions are perfectly legal but the implication is that these wealthy and often famous people are skirting their tax obligations. For the company that these documents were stolen from, this leak will most likely destroy the business.
This class of events demonstrates why law firms must protect their clients’ confidential information. No amount of cyber insurance, data backup strategies, nor business continuity planning can ever put this genie back in the bottle.
2. In your opinion, should we concentrate on the content aspect of these leaks or the security aspect?
For Appleby, the concern is with the content because their clients will be far less likely to conduct sensitive business with them in the future. By releasing the Paradise Papers, the aim of the International Consortium of Investigative Journalists (ICIJ) was to expose significant failures and weaknesses inside the offshore industry. As per ICIJ, “those stories and others they are pursuing serve the public interest by bringing accountability to the offshore industry, its users and operators. Other parts of the data are of a private nature and of no interest to the public. ICIJ will not release personal data en masse but will continue to mine the full data with its media partners.” The content released will certainly have far-reaching impacts for those affected.
For security specialists, the concern is with how this happened, and making sure we do everything possible to ensure that the same attack vectors cannot be used against our clients. This event, allegedly conducted by external hackers, could likely have been detected and mitigated. What ends in a business disrupting event often begins with the ‘click’ on a harmless looking link. Sometimes it involves complex social engineering, credential harvesting and clandestine operations inside the network to locate and slowly exfiltrate valuable data. Thus, considering heightened cyber risks, organisations have to make sure that they are taking reasonable steps to protect their clients’ confidential data. These include:
· Ensuring that software used is up-to-date and that available patches are implemented as soon as reasonably practical.
· Configuring Intrusion Prevention Systems and Firewalls policies to reject information gathering events
· Reviewing access controls regularly to ensure that they are up to date and that they restrict electronic data users to their necessary business functions.
· Utilising antivirus and malware detection software.
· Conducting periodic cybersecurity audits and penetration testing.
· Requiring multi-factor authentication for remote access into computer systems and for very sensitive internal access points.
· Requiring rotating complex passwords.
· Monitoring the activity of authorised users to detect any unauthorised file access, as well as, any large-scale downloading, copying or tampering with confidential information.
· Conducting regular cybersecurity awareness training together with phishing attacks.
3. With ‘Offshore Leaks’, ‘Panama Leaks’, ‘Paradise Papers’ – what should we be aware of / conclude?
We are living in an age of internet activism or hacktivism, which is the subversive use of computers and computer networks to promote a political agenda or a social change. With roots in hacker culture and hacker ethics, its ends are often related to the free speech, human rights, or freedom of information movements. Hacktivists seek to expose social injustice. The hack is a reminder that cybercrime is sometimes motivated by loftier aspirations than making money.
4. How come hackers can still obtain sensitive information when security conscious companies invest so much in safeguarding their data?
No matter how much a company invests in latest security technologies, the human factor remains the weakness link. The lack of effective cybersecurity training for all employees is the root cause of companies failing to keep their data safe. It is extremely pertinent to every organisation to protect its reputation, competitive advantage and operational stability against social engineering with effective company-wide security awareness. BDO’s cybersecurity education program sets employees up for success by instilling cutting edge knowledge and practical know-how into the workplace. Through integrated communication and hacker-led training, BDO helps organisation fight cybercrime strategically and beyond the scope of technology.
Kenya tool to help companies prepare for emergencies
After its team members survived last week’s Nairobi terror attack, Ushahidi decided to release a new preparedness tool for free, writes its CEO, NAT MANNING
On Tuesday I woke up a bit before 7am in Berkeley, California where I live. I made some coffee and went over to my computer to start my work day. I checked my Slack and the news and quickly found out that there was an ongoing terrorist attack at 14 Riverside Complex in Nairobi, Kenya. The Ushahidi office is in Nairobi and about a third of our team is based there (the rest of us are spread across 10 other countries).
As I read the news, my heart plummeted, and I immediately asked the question, “is everyone on my team okay?”
Five years ago Al-Shabaab committed a similar attack at the Westgate Mall. We spent several tense hours figuring out if any of our team had been in the mall, and verifying that everyone was safe. We found out that one of our team member’s family was caught up in the attack. Luckily they made it out.
At Ushahidi we make software for crisis response, including tools to map disasters and election violence, and yet we felt helpless in the face of this attack. In the days following the Westgate attack, our team huddled and thought about what we could build that would help our team — and other teams — if we found ourselves in a similar situation to this attack again. We identified that when we first learned of the attack, nearly everyone at Ushahidi had spent that first precious few hours trying to answer the basic questions, “Is everyone okay?”, and if not, “Who needs help?”
People had ad-hoc used multiple channels such as WhatsApp, called, emailed, or texted. We had done this for each person at Ushahidi (their job), in our families, and important people in our community. Our process was unorganised, inefficient, repetitive, and frustrating.
And from this problem we created TenFour, a check in tool that makes it easier for teams to reach one another during times of crisis. It is a simple application that lets people send a message to their team via SMS, Slack, Voice, email, and in-app, and get a response. It also works for educational institutions, companies with distributed staff, as well as part of neighbourhood networks like neighbourhood watches.
This week when I woke up to the news of the attack at Riverside, I immediately opened up the TenFour app.
Click here to read how Nat quickly confirmed the safety of his team.
Kia multi-collision airbags
The world’s first multi-collision airbag system has been unveiled by Hyundai Motor Group subsidiary KIA Motors, with the aim of improving airbag performance in multi-collision accidents.
Multi-collision accidents are those in which the primary impact is followed by collisions with secondary objects, such as other vehicles, trees, or electrical posts, which occur in three out of every 10 accidents. Current airbag systems do not offer secondary protection when the initial impact is insufficient to cause them to deploy.
However, the multi-collision airbag system allows airbags to deploy effectively upon a secondary impact, by calibrating the status of the vehicle and the occupants.
The new technology detects occupants’ positions in the cabin following an initial collision. When occupants are forced into unusual positions, the effectiveness of existing safety technology may be compromised. Multi-collision airbag systems are designed to deploy even faster when initial safety systems may not be effective, providing additional safety when drivers and passengers are most vulnerable. By recalibrating the collision intensity required for deployment, the airbag system responds more promptly during the secondary impact, thereby improving the safety of multi-collision vehicle occupants.
“By improving airbag performance in multi-collision scenarios, we expect to significantly improve the safety of our drivers and passengers,” said Taesoo Chi, head of the Hyundai Motor Group’s Chassis Technology Centre. “We will continue our research on more diverse crash situations as part of our commitment to producing even safer vehicles that protect occupants and prevent injuries.”
According to statistics by the National Automotive Sampling System Crashworthiness Data System (NASS-CDS), an office of the National Highway Traffic Safety Administration (NHTSA) in USA, about 30% of 56,000 vehicle accidents from 2000 to 2012 in the North American region involved multi-collisions. The leading type of multi-collision accidents involved cars crossing over the centre line (30.8%), followed by collisions caused by a sudden stop at highway tollgates (13.5%), highway median strip collisions (8.0%), and sideswiping and collision with trees and electric poles (4.0%).
These multi-collision scenarios were analysed in multilateral ways to improve airbag performance and precision in secondary collisions. Once commercialised, the system will be implemented in future new KIA vehicles.