Hi Seth, could you just tell us a little bit about Stroz Friedberg and your role there as UK executive managing director?
We're living in a digital world, where organisations are facing a rapidly changing risk landscape. Stroz Friedberg works with large corporates, law firms and government agencies to understand, manage and counter such risks. For example, we are called in to support some of the most high profile criminal cases in the UK and were tasked by Google to report on the issues around the development of Street View, following widespread privacy concerns.
As executive managing director, I am responsible for the company's London and Hong Kong offices, and the delivery of several services: digital forensics, cyber crime and incident response, security science, forensic accounting, compliance, due diligence, data disclosure and analytics. We have a further nine offices in the United States.
Before joining Stroz Friedberg, I was an assistant US attorney. This offered an excellent opportunity to see some of the digital threats first-hand, as my primary role was to conduct and supervise investigations and prosecutions of computer-related crime – such as intrusions, computer and internet fraud, identity theft and other abuses – involving the theft and use of information over computer networks.
Cyber crime has been in the news quite a lot recently, with attacks from hacking and military groups occurring more and more. Why do you think it's now that cyber crime has become so 'popular'?
Cyber risks are growing exponentially and attacks are getting more sophisticated. The fragmented nature of such risks, from opportunistic criminals at one end of the spectrum to nation states at the other, means organisations are forced to engage in a game of cat and mouse, where the adversaries change with increasing regularity.
We are seeing actual examples of cyber warfare, where high-value targets, such as banks, law firms and corporates are key targets. In this scenario, the West is particularly vulnerable, due to its reliance on technology.
Are cyber criminals getting better or is it our defences getting worse?
Adversaries are becoming increasingly sophisticated and even the best computer security can be breached. Business leaders are increasingly concerned about cyber crime and their organisations' ability to combat and recover from an attack. The commitment to tackling such threats must come from the top. There must be a clear focus on the corporate governance and the development of a culture of vigilance.
The weakest link in computer security is the individual user and they may not realise how easy it is to be fooled into being that weak link. For example, phishing emails are becoming increasingly elaborate and are now successfully used to obtain trade secrets, commercially sensitive information and intellectual property.
Stroz Friedberg recently found that data breaches remain largely hidden – why is this, and is it about time for some data breach notification laws?
There are two key reasons for the low disclosure of data breaches. First, organisations are generally not required to report a breach in the UK as a result they have little incentive to do so. Second, fiscal belt-tightening has made some organisations reluctant to commit budgets to thoroughly investigate a breach.
This could well be short sighted, as turning a blind eye could leave systems open to future attacks.
It is a question of securing the right balance between identifying who has been affected, against the need to report as swiftly as possible. As most data breaches have their own unique characteristics, it may not be immediately clear what data may have been affected.
Without mandatory reporting incentives in place, businesses are unlikely to proactively investigate or report a breach. Such complacency makes it a whole lot easier for cyber criminals to continue to operate and target other companies. A move to introduce a reporting regime must take these issues into account. However, timescales must be realistic, due to the difficulties of establishing the true extent of a breach within a matter of a few hours.
Your recent legal benchmarker survey found some 31% of law firms have been a victim of a cyber crime – how do you explain those figures?
It's due to a combination of increasingly sophisticated attacks and a potential treasure trove of valuable client commercial information and intellectual property – it means law firms are particularly attractive target to hackers. To underline the significance of this threat, the FBI has taken steps to brief US law firms on the heightened risk of cyber attacks and hacking.
UK law firms are not immune to this threat. The cyber crime benchmarker report showed that the legal sector has a higher proportion of victims of crime than any other sector (31%), with financial services a distant second (22%). It also revealed that the legal sector is less inclined to support mandatory reporting of data breaches.
The failure of law firms to tackle online security is leaving clients increasingly vulnerable to attacks. Clients will increasingly be looking to their legal advisers for leadership and reassurance that steps are being taken to reduce such risks. The reported decision by Bank of America Merrill Lynch to audit the cyber security policies of outside law firms is only the beginning of the heightened scrutiny facing such organisations.
What about smaller companies – should they be concerned about cyber crime?
Any business that handles customer credit cards and data is at risk. Businesses must conduct regular threat assessments and security audits to determine vulnerabilities. They must also create contingency plans to address and minimise the consequences of a breach in case, despite their best efforts, one were to occur.
Though robust security is not cheap, it is nowhere near as expensive as dealing with a security breach.
Finally, the Bank of England released their Systemic Risk Survey results – anything in there surprise or concern you?
The emergence of cyber risks as a key operational challenge finally confirms what has long been a concern among industry experts. While there is a high level of awareness and focus on tackling such issues, the recent $45m MasterCard prepaid ATM fraud has shown that cyber crime remains a very real threat. The case reinforces the difficulty facing banks in safeguarding systems.
We are likely to see more incidents in the future, as criminals abandon traditional bank heists in favour of cyber attacks that are more profitable and less risky.
The perception of cyber crime as low risk and high reward means the sector remains highly attractive to criminals. Its international nature will require a focused response from the industry, which will need not just a technology solution, but one of policy and technology.
Seth Berman is executive managing director of Stroz Friedberg – follow the company on Twitter @strozfriedberg
Get more articles like this sent direct to your inbox by signing up for free membership to the Guardian Media Network – this content is brought to you by Guardian Professional.
