RiskXtraJune2019

x
RISKXtra
Professional Services: A New Breed
of Third Party Cyber Risk to Manage
In the UK, we are now
predominantly a
services-based
economy. That
realises a vast and
complex supply chain
of professional
services companies (ie
businesses that offer
not tangible goods,
but rather knowledgebased
skills that
cannot be sourced inhouse).
Azeem Aleem
observes the cyber
security implications
Professional services companies often have
privileged access to their clients’ IT
systems and store highly sensitive
customer and corporate data. That means they
represent a cyber security risk. A detailed NTT
Security poll conducted only last year found
that an overwhelming number (60%) of global
business decision-makers believe third parties
like these to be the weakest security link in
their organisation.
Fixing this problem will require a rigorous,
risk-based approach focused around security
Best Practice and achieving visibility, control
and continuous improvement.
Professional services are, in many ways, the
lifeblood of the UK’s economy. According to
PwC, firms that carry out auditing, advisory, tax
and similar account for 15% of the UK’s GDP,
14% of employment and 14% of exports. Even
that estimate is likely to be on the conservative
side. In fact, the sector covers a vast swathe of
businesses including law firms, architects,
accountants, advertising and marketing
agencies and many more.
Professional services can include virtually
anything that might be thought of as a
knowledge-based skill. As such, digital
infrastructure is vital to the smooth running of
these services, enabling seamless online
collaboration, reporting, analysis and auditing.
Yet where there’s data, people and money,
there’s always cyber risk. According to NTT
Security’s data, the business and professional
services sector became the most attacked in
the EMEA last year, accounting for just over
20% of all attacks. It was third globally,
comprising 10% of attacks.
Part of the problem stems from the sheer size
and complexity of modern digital supply chains.
Last year, one vendor reported that the average
US or UK company shares sensitive data with
over 580 third parties, with nearly 60% of them
having experienced a breach caused by one of
these firms. Three-quarters suggested they
thought such incidents were increasing.
Visibility appears to be a major challenge,
though. Over a fifth (22%) of respondents to
the study claimed they didn’t even know if they
had suffered a breach episode.
It also appears as if third party risk may still
not be receiving the Board-level attention it
deserves: only a third (37%) of respondents
claimed they have enough resources to manage
supplier relationships, while a similar number
rated their third party risk management
programme as being highly effective.
Supply chains under attack
Attackers are targeting professional services
firms with one of two goals in mind. They’re
either after sensitive client data stored by that
firm or are targeting the supplier in a kind of
‘stepping stone’ or ‘island hopping’ attack
focused on infiltrating the networks of its
customers. Half of all attacks analysed recently
by one vendor used ‘island hopping’ tactics.
Examples of both types of threat are
numerous. Law firms represent a particularly
attractive target given the large volumes of
sensitive information they hold on clients.
Perhaps the best example of the potential
risks involved comes from two infamous data
leaks at separate law firms dubbed ‘The
Panama Papers’ and ‘The Paradise Papers’.
These episodes exposed the offshore tax
avoidance plans of a large number of
businesses, celebrities and even world leaders,
destroying the trust these customers placed in
their legal advisors and putting one of the law
firms in question, Mossack Fonseca, out of
business altogether.
The threat posed to the legal sector is clearly
growing, as both financially motivated cyber
criminals and nation states look for valuable
data on M&A deals, patents and other sensitive
52