Safeguarding your firm from a cyber attack

The cyber threat is real and pervasive. This is not hype, or reminiscent of the concerns in the run-up to Y2K; instead governments around the world are taking the threat of cyber attack to wealth creation as an existential issue.

In the UK, for example, the National Defence and Security Strategy has defined cyber attack as a ‘tier one’ threat to national security alongside major terrorist attack. Further, right across the world, at a time when many nations’ public finances are in a parlous state, additional funds are being spent to bolster cyber defences of critical national infrastructure.

This seriousness is underlined by the 3 May amendment to the UK’s Computer Misuse Act 1990 that introduces new life sentences for serious computer-related crime.

Industrial scale

Part of the challenge is that cyber threat is as much about the sophistication of the institutionalisation and industrial scale it operates on as the technology that underpins it. Here, we bump into one of the critical issues: the population as a whole has little real understanding or exposure to the institutionalised nature of the criminality.

Practices are becoming increasingly sophisticated. For example, legitimate service level contracts with call centre providers where the operators endeavour to provide a good level of service to their clients, who can be organised criminals. Or criminal co-ordinators (‘botmasters’) who utilise big data analytics to maximise the monetisation of their criminal activities as well as using these tools to report monthly to their institutional investors who, like any other investor, are looking for managed returns on their (criminal) investments.

This criminality is not isolated, individual, or uncoordinated; it is collective, sophisticated, and highly organised.

Law firms are high-value targets for organised criminals, nation states, hacktivists, and lower-level criminality: they are aggregators of high-value market and commercially sensitive information, and provide ready access to cash through client settlement accounts.

Consider the payment system for small law firms.There is usually a straightforward, partner-controlled governance regime for release of payments once the BACS or other payment system is loaded up. The payment is detailed by the cash clerical team and distributed in settlement.

In 2014, there was a systematic scam that saw spoof emails (‘spear phishing’ emails) sent to partners and other relevant staff involved in cash transactions that purported to be from a firm’s bank and informed the firm of a call centre support service to use if they were having problems with their payments. This was then accompanied by a slightly technical exploitation of the Heartbleed vulnerability, which affects the underlying security handshake for the encrypted part of a transaction.

Together, this allows criminals to interfere with the payment, gets the firm to speak with a legitimate call centre seeking to provide a legitimate service, provides alternative payment details, and leads to the misdirection of the settlement payments. This is a systematic campaign of attack and there are variations on
the theme.

Organised criminals have targeted firms who specialise in mergers and acquisitions and other commercially or market-sensitive transactions. Essentially, the criminals become insider traders and then use the insight gained to place trade transactions across the world’s electronic exchanges, manipulating the market in a way that is very difficult to detect. Once detected, of course, there is the possibility of the regulatory community considering the duty of care and compliance of the firm in protecting market sensitive information. SJ

Peter Armstrong is executive director and head of cyber at Willis FINEX Global