CONTENTS

politics first | Special Section: Cyber Crime
ADVERTORIAL
98
Interpol and the Nigerian police were delighted this July when
they arrested “Mike” – his full details were not published – who
is suspected of being the mastermind of a $60 million operation
running online scams and frauds across the world from his base in
the southern Nigerian city of Port Harcourt.
“Mike” and his gang had reportedly been hacking into and
hijacking the email systems of small businesses and using these
fake fronts to defraud individuals and other businesses out of
money; in one case as much as $15 million.
Sadly, even with Mike potentially out of the picture, cyber crime
is still big business, in the UK and elsewhere. Whereas traditional
crime rates have been falling across Western Europe for two
decades, cybercrime has expanded exponentially.
The Office for National Statistics believes there were almost six
million computer misuse and fraud offences in England and Wales in the
year to the end of March 2016, of which 3.8 million were fraud offences -
suggesting cyber-fraud is the most common type of crime.
The Culture, Media and Sport Select Committee, of which I am a
member, looked into the issue following the TalkTalk hack.
TalkTalk, one of our country’s leading telecoms and internet
providers, was the victim of a hack in October 2015, in which
around 160,000 customers’ personal and banking details were
stolen, potentially to be passed on to allow criminals to access bank
accounts or to pose as the victims and use their data elsewhere
online. TalkTalk has insufficient protection for its computer and data
systems and these were too easily defeated by the hackers.
There is also a further tricky conflict to resolve: TalkTalk was itself the
victim of a crime. But it is also responsible for the safe keeping of a huge
amount of personal data for its customers. Where does the balance lie
between treating individuals or organisations as victims, and making
them share some of the blame when an attack is successful? Metropolitan
Police Commissioner Sir Bernard Hogan-Howe started such a debate
this March when he suggested that customers should not be refunded
by banks if they fail to protect themselves from cybercrime. Perhaps that
should go for companies, too, who do not keep their security up-to-date?
Certainly in the case of TalkTalk, we proposed a duty to undertake
an annual audit of cyber security with a named individual – a board
director – taking the responsibility to sign that audit off in the annual
report and accounts.
Christian
Matheson,
a member of the Culture,
Media and Sport Select
Committee and Labour MP
for City of Chester
Cyber crime: the new and potent
criminal battleground
It was also clear to our committee that TalkTalk was not alone in
suffering cyber attacks. Other telecoms providers regularly have to fend
off unwanted approaches. In another inquiry, into broadband provision
in the UK, my committee was concerned at how uneasily the industry
sat together. Yet whereas vigorous commercial competition must remain
at the heart of the industry, surely in terms of security, collaboration
between providers must be promoted? I would expect telecoms providers
– and banks, and utilities and other businesses holding large amounts of
personal financial data – to share best practice with each other on how to
defend against cyber attacks. In terms of security, the competition is not
the other providers, but the criminals.
There is one other complicating factor for government to consider.
I sat on the bill committee for the Investigatory Powers Bill, which
brings in the new requirement for internet and telecoms service providers
to retain all users’ data and web browsing habits for a year.
The stipulation is to help in urgent investigations into serious crimes,
such as the disappearance of a child. But it does rather offer a plump
target to hackers and thieves and puts yet further obligations on the
internet companies to ensure that the data is held securely. And whereas
big firms like BT or Virgin may have the capacity and capability to secure
the huge amounts of data the new law will require, will smaller firms – or,
indeed, new entrants to the market – be able to cope competitively?
Indeed, the threat may not even come from external hackers. We
know that newspapers have not been averse in the past to hacking
into mobile phone voicemails or email accounts. How easy would
it be, presented with the possibility of accessing a year’s worth of
a celebrity’s internet browsing history, to pass a couple of grand in
a brown envelope to a low grade technician at an internet provider,
and have them access that internet data and download it on to a USB
memory stick for a month’s worth of stories for the paper?
As more and more of our lives are lived online, so more and more
of us will become vulnerable to online criminals. And as the ONS sadly
pointed out, online crime is replacing traditional criminal activity and is
growing apace. Cyber space is the new criminal battleground.
LEARNING ABOUT CYBER SECURITY
FROM CHEESE…
So, another Politics First issue and here we go with
another abstract article about, yes, you’ve guessed it,
cheese. Why? Because I love cheese. Any cheese.
In any form. From any country. It can be toasted, on
crackers, with salad, with chutney or just on its own. But
this article isn’t about all cheeses, we’re going to look at
one in particular - Swiss cheese.
Why? Well, you’ve obviously spotted from the title that,
at some point, we’re going to make the link between
cheese and cyber security so Swiss cheese gives us a
good starting point.
When we think of swiss cheese, we’ve been brought up
to know that Swiss cheese has holes in it. Pockets of air
created from carbon dioxide released by little bacteria
make the holes as the cheese ripens. Clearly, there’s
more to it than that but you get the gist of it.
Anyway, we all know that these holes are placed randomly
throughout the cheese and none of them line up. That
means that nothing can pass directly through these holes.
This is where we can make the link to cyber security.
Good cyber security in an organisation is like a good
Swiss cheese. Yes, there are some holes but there are
layers of policy, procedure and technology that stop these
holes lining up.
However, when something goes wrong, something
manages to slip through that’s just like all the holes in our
cheese lining up.
Lets put it in to context. Think of Organisation A.
Normally, they’re a good Swiss cheese and all their
holes are recognised but they don’t line up through their
defensive layers. Except we’re going to look at a curious
set of circumstances.
Imagine for one moment that its the school holidays
and several of the accounts staff are on holiday. Then
imagine that, for whatever reason, the skeleton cover
staff falls ill and can’t come into work. These are normal
circumstances that could hit any business.
So, in order to cover the absences, email is delegated
out to someone who’s merely “steadying the ship” until
normal service can be resumed.
Enter the bad guy.
As everyone likes to do these days, we’ll tell our email
client to automatically respond to whoever emails us and
tell them that we’re on holiday and, in our absence, who
to contact. As the bad guy does his reconnaissance, he
discovers that many are on holiday and we’ve also got one
who is off sick. The bad guy knows that he’s got someone
covering several jobs.
So, he takes a punt. Pretending to be the CEO he starts
up a dialogue with the “ship steadier” and builds some
rapport. Said “ship steadier” is extremely busy but will
always make time for the big boss - so the conversation
blossoms and information is exchanged, resulting in an
instruction to pay £25000 into a bank account. As its the
CEO who has asked and the “ship steadier” is unfamiliar
but keen to impress, the instruction is carried out and a
pat on the back from the CEO results in a job well done.
All the holes in the cheese have been lined up by clever
manipulation and a healthy bit of luck. When the mistake
is discovered, its too late. Funds have been extracted
from bank accounts and Organisation A now becomes
just another victim.
This might sound far-fetched but it happens on a regular
basis. Some organisations see this as just “the norm”.
Some organisations can’t recover from the loss. We’ve
got to become more savvy and the lead needs to come
from the top. Its time to fight back.
Stuart Green is MD of SJG Digital, a Cyber
Security Specialist servicing the UK from its
base in Lincolnshire.
SJG Digital can be contacted on
01673 898001,
www.sjgdigital.com or safer@sjgdigital.com