1. City of London 1 Understanding Cybercrime Risk 21 April 2016 Chris Keesing

2. City of London 2 Today we will be exploring: What is Cybercrime/ Cybersecurity? What are the risks/impacts? Why the anti-fraud team? Member & Chief Officer engagement Working with Audit and IT/Information security teams What you can do?

3. City of London 3 What is Cybercrime/ Cybersecurity? Cybercrime Can be defined as criminal activities carried out by means of computers or the Internet. Cybersecurity Can be defined as protecting yourself, your organisation and your customers in todays interconnected world through People, Process and Technology.

4. City of London 4 What do these two have in common?

5. City of London 5

6. 6 Motivations Behind Cyber Attacks

7. City of London 7 Distribution of Cyber Attacks

8. City of London 8 Types of Cybercrime PBX/dial-through fraud Phishing Ransomware - ‘Locky’ Hacking Denial of service attacks – DoS DDoS Social engineering Insider risk

9. City of London 9 What is PBX/dial-through fraud? PBX (Private Branch Exchanges) are systems which enable organisations improved communication PBX/dial-through fraud occurs when hackers target PBX’s from the outside and use them to make a high volume of calls to premium rate or overseas numbers. Since the end of June 2013 there have been nearly 500 Action Fraud reports relating to this - costing victims over £6m.

10. City of London 10 What is Phishing? It’s a con ! Using email or websites with malicious code in links or attachments that can install malware into your system. Often very convincing emails. Or telephone calls from IT service desk asking for passwords or to click on a link or attachment. Examples in everyday life are banking scams.

11. City of London 11 What is ‘Locky’ Ransomware “Locky” is the nickname of a new strain of ransomware, so-called because it renames all your important files so that they have the extension.locky. It doesn’t just rename your files, it scrambles them first. Only the crooks have the decryption key which can be brought from the crooks over the dark web using bitcoin (BTC). Prices seen vary from BTC 0.5 to BTC 1.00 (BTC is short for “bitcoin,” where one bitcoin is currently worth about £295).

12. City of London 12 What is Hacking? A hacker is someone who seeks and exploits weaknesses in a computer system or computer network. Hackers may be motivated by a multitude of reasons - profit, protest, challenge, enjoyment, identify weaknesses. There are different types of hackers: - White Hat Hacker - Black Hat Hacker - Grey Hat Hacker

13. City of London 13 What are Denial of Service attacks? Also known as Dos or DDos attacks. Exploit emails, information access requests and network timings to interrupt or shutdown an entire IT system - for example sending multiple emails or flooding a website with useless traffic so the system can no longer cope. Aim is to cause disruption to legitimate business or to expose vulnerabilities.

14. City of London 14

15. City of London 15

16. City of London 16 What is social engineering? A social engineer runs what used to be called a "con game." Many social engineering exploits simply rely on people's willingness to be helpful and they are therefore tricked into breaking normal security procedures. For example, the attacker might pretend to be a co-worker who has some kind of urgent problem that requires access to additional network resources.

17. City of London 17 What is insider risk? The person sitting next to you…. Often regarded as the highest risk for data loss. Sensitive information is lost when someone makes a genuine mistake such as sending an email with a confidential attachment to the wrong addressee. Motivation can be financial, personal or political. Stolen data can be used for fraudulent purposes and criminal gain when in the wrong hands.

18. City of London 18 Why Target Your Organisation? Information ! What information does your organisation hold – People/Process/Planning etc. Does it understand what information it holds – why is it interesting? Where is the data held, are there weaknesses in where the data is held? What could the data your organisation holds be used for in the wrong hands? What would be the consequences of a data loss to your organisation – reputation/financial? Why would people want to attack your organisation?

19. City of London 19 Why the anti-fraud team? Why not? Good understanding of fraud and risk. Uniquely placed within the organisation to raise the profile of cyber risk, with good access to Chief Officers, Senior Managers and Committee. Deal with Information and data on a daily basis. Understand how sensitive data should be handled. Strong working relationships with Audit colleagues in most cases.

20. City of London 20 What did we do? Included cyber fraud risk within proactive anti-fraud plan – reported to and agreed at A&RM Committee. Worked with IT Senior Auditor. Engaged with IT Information & IT Security colleagues. High-level review of the City’s cyber security position. Information Security Policy and Procedure. Information Security training – Responsible for Information.

21. City of London 21 What did we do? Reviewed penetration test outcome and action plans – internal and external vulnerabilities and communicated the findings and resulting actions to Members. Considered PSN accreditation and resultant network security requirements. Considered the programme of Internal Audit activity to review measures in place to mitigate cyber security risks. Benchmarking against the CESG 10 steps to cyber security.

22. City of London 22 What did we do? Reviewed best practice and ISO 27001 guidance against the City’s cyber security response. Engaged with IT Information Security colleagues in establishing a cyber security roadmap across the organisation and attend and contribute to regular review and progress meetings. Ensured cyber security and cyber fraud risks are appropriately considered as part of our Corporate Risk Management response. Reported findings to Finance Director and A&RM Committee.

23. City of London 23

24. City of London 24 Cyber Security – Next Steps Change Programme will include… Information Asset Ownership Group set- up to look at People, Places and Process. Group will seek to understand what information we hold across all Departments. Cyber Security activity to report to Strategic Resource Management Group, made up of senior officers who will oversee cyber security roadmap progression.

25. City of London 25 Cyber Security – Next Steps Series of Information awareness workshops – cyber focused and aimed at key risk areas, including…. -Members -Procurement -Grants -Finance -Children and Family Services -Housing and Benefits. Aim to appoint a Cyber Security Champion who will drive through the change agenda in this area.

26. City of London 26 What can you do…..? Establish what work is being done to understand cyber security risks within your organisation. Consider the cyber security risks that your organisation may face. Consider whether your organisation has been affected by cyber security breaches in the past and the affect it has had.

27. City of London 27 What can you do…..? Discuss with your IT Auditors, Information Security Teams and IT Teams. Consider including cyber security as part of your proactive fraud planning. Raise awareness of cyber security risk with senior management and those charged with governance.

28. City of London 28