OR 9 – Cyberthreats and Information Security Risks

In annual surveys, operational risk practitioners have placed cyber, technology, data protection and information security risks among their top worries for about a decade. Cyber risk is only one slice of the problem, though. A mailbox can be compromised from outside, a staff member can pick the wrong autofill address and send a confidential file to a stranger, or an unhappy employee can pass data out on purpose. Each has a different cause, so each needs a different control.

The people responsible for a data theft may sit inside the firm, outside it, or in a grey zone between the two, such as suppliers and other third parties who have legitimate access. Sometimes insiders and outsiders collude. A 2017 McAfee study on data exfiltration found that 43% of data leaks were started by insiders, about half of them unintentionally. So roughly 21.5% of all leaks came from insiders who meant no harm, a strong argument for controls aimed at everyday behavior.

Paper matters too. An audit report forgotten in a train carriage, or a security review left in the printer tray, is as much an incident as a stolen database.

The four-quadrant typology

A typology from Ariane Chapelle’s work crosses two questions. Is the cause internal (including on-site contractors and consultants) or external (including third parties)? And is the data stolen or deliberately corrupted, or is it lost, corrupted by accident or disclosed without intent? Eleven incident types fill the four cells.

Source: adapted from Chapelle (2018). The medium shown for items 3 to 5 is an interpretation.

Any industry can be attacked, but finance is especially exposed because of the value of the transactions it handles. In November 2017 the Paradise Papers leak took 1.4 terabytes of private records from Appleby, a Bermuda-based offshore law firm and tax adviser whose clients include most major banks. The files went to the newspaper Süddeutsche Zeitung and then to the International Consortium of Investigative Journalists, and the offshore holdings of thousands of prominent people, firms, politicians and even countries became public, with heavy reputational damage. It is the second largest data hack on record after the Panama Papers; Appleby still operated in 2022.

At Equifax, a major credit-scoring firm, an outside intruder used a known but unpatched vulnerability in 2017 to expose the data of 147 million US customers. Within a week of the announcement the firm lost about $5bn of its $15.5 bn market capitalization. The case is examined later.

Malicious insiders and cryptocurrency thefts

Leaks caused by corrupt or disgruntled staff sit closer to internal fraud than to cyberattack, yet they still fall under information security. In July 2017 an employee of a UK insurer copied names, birth dates and contact details of 500,000 customers and offered them for sale on the dark web. The regulator was told, the employee was dismissed and legal action followed; the cost was a £175,000 fine and closer supervision, with little press coverage. In the United States, ProPublica reported the tax rates paid by very wealthy Americans such as Jeff Bezos, Bill Gates and Warren Buffett over 2013 to 2018, probably from an IRS employee leak, though the origin was never firmly established.

Young and largely unregulated cryptocurrency platforms are a fresh target. A private key unlocks the value of a crypto transfer, so stealing one is stealing the funds.

BXH offered a $ 1 million reward for help recovering the funds. The COVID-19 pandemic also reshaped the threat landscape: remote working, faster digitalization, disrupted supply chains, QR codes and heavier social media traffic opened new routes of attack in every sector.

Cybersecurity frameworks give security managers a structured way to reduce cyberthreats and benchmark against good market practice, and regulation often makes them close to mandatory. Three standards dominate: the NIST framework for critical infrastructure cybersecurity (NIST CSF), the CIS Critical Security Controls from the Center for Internet Security, and ISO/IEC 27001 and 27002.

The National Institute of Standards and Technology, part of the US Department of Commerce, built its voluntary framework to help businesses of any size understand, manage and reduce cyber risk. It was first aimed at critical infrastructure such as power plants and dams, but many financial institutions now use it. It guides firms in analysing threats and vulnerabilities, judging their effects and responding with tailored measures, and in recovering afterwards through root-cause analysis and lessons learned.

Its core, five cyber defense functions, mirrors the identify, assess, mitigate and monitor logic of an operational risk framework.

For a financial firm, implementation starts with an asset inventory of what needs protecting, followed by the detection, response and recovery steps.

A coalition of volunteer experts created the CIS framework in the late 2000s to protect companies against cyberthreats. It consists of key controls, kept current by specialists from many fields and ranked by priority so that the most common attacks on systems and networks are tackled first. Many legal, regulatory and policy frameworks map to it and cite it. Version 8 contains 18 CIS Critical Security Controls and is free to download. This version was revised to reflect cloud computing, virtualization, mobile working, outsourcing, home working and changing attacker tactics. Each of the 18 controls is a theme that breaks down into 10 or so specific controls.

Source: Center for Internet Security, CIS Controls version 8 (www.cisecurity.org/controls). The grouping by purpose is an original arrangement for study.

Because the CIS guidance is detailed, it suits firms that are building or reviewing their cybersecurity measures. It can also run alongside other compliance standards such as NIST, or support a firm on its way to a cybersecurity certification such as ISO 27001.

ISO/IEC 27001 and the ISMS

The internationally recognized cybersecurity standard is ISO/IEC 27001: 2013. It sets out how a firm should organise information security risk management: governance, policies, support, communication and awareness, operational planning and control, risk assessment and risk treatment, and finally the role of audit and of management review. Unlike CIS, ISO does not give firms implementable instructions as such. It works as an evaluation grid for firms seeking certification.

To be considered, a firm must run an Information Security Management System (ISMS) that manages its information security risks systematically by identifying threats and vulnerabilities. It must also design and put in place comprehensive and effective controls against the risks found, and then keep improving through an ongoing risk management process. To become certified as ISO 27001-compliant, the firm has to show the auditor that it follows the Plan-Do-Check-Act (PDCA) cycle.

Good protection of information comes from technical safeguards and sensible human behavior working together. Information has three dimensions to protect, usually called the CIA triad: confidentiality, integrity and availability. Confidentiality and integrity belong to information security proper, whereas availability concerns business continuity and system uptime and is now treated as part of operational resilience.

Behavioral controls deal with how people handle information and with their capacity for error. Examples are awareness campaigns, prudence and conduct rules, online training, password management, supervision and sanctions. Because people sit behind every quadrant of the typology, these controls work against all information security risks, not only cyberattacks.

Technical controls cover the systems themselves and come in three kinds. Preventive controls (system architecture, access rights, firewalls, encryption, passwords and patching) mainly face outward against external threats. Detective controls raise an early alarm when data starts to leak, whoever starts it. One example is a data loss prevention and detection (DLPD) tool, which watches how confidential data is accessed and moved so that unauthorized disclosure or misuse can be spotted. Another is a honeypot, a decoy system that sets a virtual trap to attract attackers. Mitigating controls keep redundant copies and back-ups offline so that an attack cannot reach them.

The last column is an added classification for study.

Risk appetite and information sensitivity

How many controls a firm runs, and how strict they are, depends on its risk appetite and on consistent choices. Every firm says it has zero tolerance for security breaches, yet firms differ widely in the governance, discipline and technical investment they actually commit. Security costs time, money and effort, and it slows people down, so the reduction in risk has to be weighed against cost, convenience and speed. Classifying information by sensitivity lets the firm concentrate protection where it matters most rather than spreading it evenly.

Information security is a heavily controlled activity, so monitoring concentrates on two things: whether the controls are working, and whether anything is drifting away from normal, such as a change in exposure, in network traffic or in how staff behave. For cyberattacks and access breaches, almost all technical monitoring is done by the IT department as the first line of defense. Many firms keep a separate information security department, usually in the second line of defense, because protecting information involves more than repelling attacks. That department designs, maintains and monitors the full set of behavioral and technical controls, and every deviation or failure in those controls becomes a KRI.

Most of these are leading signals: an overdue patch or an understaffed team is not yet a breach, but each widens the window for one.

Equifax, a leading US credit reporting agency, holds credit files on more than a hundred million consumers and firms that lenders, insurers, employers and landlords use daily.

On March 10, 2017, attackers got in by exploiting a weakness in Apache Struts, the software behind Equifax’s online dispute portal. From that portal they moved quickly into other parts of the network, and for months they went unnoticed while they queried several databases and copied names, addresses, birth dates, social security numbers and credit card accounts.

A healthy cyber environment would probably have stopped this, and the warning signs were visible. In 2015 an internal audit found a backlog of 8,500 unpatched vulnerabilities from a badly broken patch management process, while the Chief Security Officer (CSO) was still drafting the firm’s first policy for it. A year before the main breach, in May of 2016, hackers had hit the W-2 Express website and leaked 430,000 records of personal data. By 2017 most of these weaknesses remained.

Five weaknesses behind the breach

The patch for Apache Struts came out on March 7, three days before the attack, and an alert reached Equifax on March 8, after which its Global Threats and Vulnerability Management (GTVM) team circulated it to 400 employees. NIST had rated the flaw 10, the highest criticality score possible under the Common Vulnerability Scoring System (CVSS). Yet the patch was never applied, and a review against market standards found five weaknesses.

When Equifax finally spoke on September 7, 2017, it said that the personal data of 143 million customers had been exposed, a figure later raised to 147 million. The firm was blamed for this delay and lack of openness as much as for the breach, since good crisis communication after a large operational risk event aims to limit reputational damage, and it was not applied.

The deeper lesson is that large operational losses rarely have one cause. They grow in weak operating environments where several things fail together: governance and procedures are deficient, communication breaks down, and alerts and actions are not prioritized. Equifax’s cybersecurity environment fitted that description at the time. No single missed patch explains the loss; the missing inventory, the unenforced policy, the broken distribution list and the blind spot in traffic monitoring each removed a layer of defense.

The fallout

The consequences reached every part of the firm. The share price fell, several US federal authorities opened investigations, fines and lawsuits followed, and the CEO, CSO and CIO resigned. The settlement agreed in July of 2019 reached up to $700 million of fines and compensation, $300 million of it for the people whose data was exposed. Each affected consumer could choose cash of up to $125, or else free credit monitoring from Equifax, Experian and TransUnion, the three largest credit bureaus. Equifax then overhauled its IT security system and management.