Cybercrime and cyber security tops business worries for 2016

By Cyber SecurityNo Comments

Cybercrime and cyber security tops business worries for 2016.

Cybercrime and Cyber security tops business worries for 2016This year, cybersecurity will be the main issue worrying global business, firms say, and it will become more critically important as the internet of things takes off and our world becomes ever more mobile and connected.

Lawyers, accountants, digital agencies, research analysts, telecoms and tech firms all gave the BBC’s Technology of Business their views on what the key tech trends were likely to be in 2016.

Here’s a summary of the Top 10 tech trends affecting business in 2016 that emerged:

  1. Cybercrime and a renewed emphasis on cybersecurity
  2. The internet of things and the development of the hyper connected world
  3. Real time data analytics, not intuition, driving business decisions
  4. New data protection laws forcing firms to rethink compliance strategies
  5. Artificial intelligence and robotics replacing repetitive tasks
  6. Smartphones becoming the primary tool for almost everything
  7. More business applications for virtual and augmented reality tech
  8. Increased personalised and in-store location-based marketing
  9. Drones to be allowed to make deliveries and perform other public tasks
  10. Established businesses to face increased competition from start-ups

Allowing customers’ data to be stolen by hackers is not good for business, firms are finally realising. It damages corporate reputations and erodes the public’s “comfort with sharing their data”, says Rashmi Knowles of cybersecurity company RSA.

But the worrying news is that breaches are inevitable, warns Geoff Smith of Experis, while a shortage of skilled cybersecurity professionals is likely to push up the costs of beefing up defences and dealing with attacks.

On top of this, new European data protection laws coming into effect in 2018 will see a “dramatic increase in fines” for data breaches, says James Mullock of law firm Bird and Bird, forcing firms to reassess their compliance procedures this year. Dedicated Data Protection Officers reporting to the board would be “a sensible measure”, he says.

Ransomware is opening up new income for cybercriminals.

Several security experts are forecasting an increase in ransomware attacks, whereby criminals hack into your system, encrypt your data and then demand a ransom before they decrypt it.

“The ransomware arms race will come to the fore in 2016,” says Hitesh Sheth, chief executive of Vectra Networks. “The threat will take on a new, larger role by concentrating attacks on enterprises, holding critical assets hostage in return for even bigger money.”

Other experts warn that the growth of mobile payments systems will offer new opportunities for hackers, while others think criminals will increasingly target employees, suppliers and contractors as a way of infiltrating corporate systems.

Gadgets and objects wirelessly transmitting sensor data to each other and central computers will accelerate in 2016, many believe, leading to a host of new applications – and a host of new cybersecurity threats.

Internet of Things (IOT) cybersecurity concerns will also loom large in 2016.

This new world of “connected everything”, says Tudor Aw, head of technology sector at consultancy KPMG, “should finally see real momentum in 2016”, from connected cars recording driver behaviour data for insurance purposes, to smart watches and other wearables delivering health data and even initial diagnoses.

And all the data that these connected things generate will be stored, analysed and translated into practical insights using real-time analytics, enabling companies to “move beyond just quickly responding to changing customer needs, to actually anticipating those changes,” says Andy Lawson, managing director at Salesforce UK.

But many warn that greater connectivity means more points of entry for hackers constantly on the look out for weak points in any network.

BBC suffers widespread website and iPlayer outages

By Cyber SecurityNo Comments

UK broadcaster apologised as its internet services are taken down by ‘technical issues’ affecting its website, apps and streaming video and radio services.

UK broadcaster apologised as its internet services are taken down by ‘technical issues’ affecting its website, apps and streaming video and radio servicesThe BBC website returning an 500 error page with intermittent outages across its entire bbc.co.uk domain and internet services.

The BBC is currently suffering an intermittent internet services outage that has taken down its website, the BBC iPlayer and all other digital services provided by the bbc.co.uk domain.

Users started complaining about the iPlayer and website issues at in the early hours of this morning, with web service down detector indicating major issues from around 7am. The website is currently showing 500 error pages, with some parts of it intermittently loading and others completely offline.

The BBC’s radio and television broadcasts are unaffected but many of the broadcaster’s digital services are offline.

The BBC’s press office simply called it a “technical issue”. The cause of the outage is not currently known.

The BBC is in the process of migrating more and more of its traditional services to its website, including BBC3, which will become online only from February.

The last major outage of the BBC’s web services was in 2011 when the broadcaster’s bbc.co.uk domain went offline for an hour due to technical problems.

Later in 2012 the BBC revealed that it had suffered from cyber attacks, which took its Farsi language service in London and its telephone and email services offline.

Security of UK ISPs failing users

By Cyber SecurityNo Comments

The security of the UK’s biggest ISPs needs “major improvement”, according to one expert.

The security of the UK's biggest ISPs needs improvementSecurity consultant Paul Moore examined the publicly available information of the UK’s six biggest ISPs. He said he found plenty of bugs that could be exploited by hackers.

But he said most ISPs had been in contact with him and had worked to tighten security once told of the issues.

The audit of TalkTalk, Sky, BT, Plusnet, EE and Virgin Media was kicked off in the wake of the TalkTalk hack, which saw the personal details of 157,000 of its customers exposed and more than 15,600 bank account number and sort codes were stolen.

Similar problems to those encountered by TalkTalk could have been experienced by any of the major ISPs, Mr Moore believes.

The audit found a variety of problems, including passwords stored in plain text, exposed code that would allow hackers to inject their own code on to ISPs’ websites and, potentially load malware on to them, and issues with encryption certificates that meant Mr Moore could apply for them from the certificate authority and pose as the webmaster for a set of ISP-owned websites.

Mr Moore said he was impressed by most of the ISPs’s responses when he raised the issues with them.

“Ordinarily they would not be so open and honest with me but, after what happened at TalkTalk, they have been stepping in quickly,” said Mr Moore.

“On one occasion I notified BT and PlusNet about a bug at 14:00 and they kept people back until 22:00 to fix it.”

But, he added, TalkTalk was yet to contact him. TalkTalk did supply a statement saying it had “integrated Paul Moore’s comments into an ongoing programme of work”.

“We constantly run vulnerability checks using industry-standard third party tools. The vulnerability exploited by the hackers was not picked up by this testing, and if it had been, we would clearly have acted on that information straightaway to secure our system,” it added.

Prof Alan Woodward, a security expert at Surrey University, said he was shocked by the findings.

“TalkTalk still has problems and others have not dissimilar ones,” he said. “I find it very surprising that after the TalkTalk hack, they the six ISPs still appear not to be attending to the basics.

He added: “ISPs are the single biggest handlers of our personal data and I would expect them to get this right.”

Web spying proposals may be costly

By Cyber SecurityNo Comments

MPs are investigating what it will cost ISPs to meet government proposals to log online Britons.

MPs are investigating what it will cost ISPs to meet government proposals to log online BritonsThe House of Commons Science and Technology committee is looking at whether gathering data on online citizens is even financially feasible.

It also wants to look into the potential impact that logging browsing will have on how people use the web.

The consultation comes as questions mount over the money the government will set aside to support monitoring.

The draft Investigatory Powers Bill (IP Bill) was unveiled as it attempts to update the way the state, police and spies gather data to fight crime, terrorism and other threats.

One of the most contentious aspects of the IP Bill obliges ISPs to record information about the services, websites and data every UK citizen uses. These “Internet Connection Records” would hold a year’s worth of data.

The Science and Technology committee has said it wants to look more deeply into this and its potential cost.

In a notice announcing the inquiry, the Committee said it wanted to find out if it was possible for ISPs to meet the IP Bill’s requirements. The text of the Bill asks ISPs to log where people go but not what they do when on a site or using a service.

MPs also want to find out how easy it is for ISPs to separate data about a visit to a site from what happens once people log in, because more stringent rules govern who can discover what people do on a site as opposed to the sites they use.

The Committee will also look at how much it might cost the providers to do this.

The government has said it will provide £175 million to ISPs over 10 years to pay for data to be gathered and stored.

Adrian Kennard, head of UK ISP Andrews and Arnold, said it was not clear whether that was enough because the government had not specified what exactly it wanted recorded.

Added to this will be the “big issue” of how to meet the need to separate data about the sites people visit from what they do, he said.

ISPs watch the flows of data across their networks to help manage traffic, he said, but they typically only sample these streams because they deal with such massive quantities of information every day.

Added to this, he said, was the question of how to log which device was being used for which visit.

Microsoft builds UK cloud data centres

By Cyber SecurityNo Comments

Microsoft is building two cloud data centres in the UK next year.

Microsoft is building two cloud data centres in the UK next yearThe move will allow the company to bid for cloud computing contracts involving sensitive government data, which it was restricted from providing before.

Consumers should also benefit from faster running apps.

The announcement, made by Microsoft chief executive Satya Nadella in London, follows a similar declaration by Amazon last week.

The two companies vie to provide online storage and data crunching tools via their respective platforms Microsoft Azure and Amazon Web Services.

The companies’ latest efforts should address highly regulated organisations’ privacy concerns.

In a related development, the firm has also announced plans to offer its Azure and Office 365 cloud services from two German data centres controlled by a third-party, a subsidiary of Deutsche Telekom.

“Microsoft will not be able to access this data without the permission of customers or the data trustee, and if permission is granted by the data trustee, will only do so under its supervision,” it said.

The move will make it even harder for overseas authorities to gain access to the files.

Microsoft is currently engaged in a legal battle with the US Department of Justice, which is trying to make it hand over emails stored on a server in Ireland – the tech firm says the government is trying to exceed its authority.

Mr Nadella announced the plan to open a data centre near London and another in elsewhere in the UK – whose location has yet to be named – in 2016.

They will bring the company’s tally of regional data centres to 26.

He added Microsoft had also just completed the expansion of existing facilities in Ireland and the Netherlands.

“It really marks a huge milestone and a commitment on our part to make sure that we build the most hyperscale public cloud that operates around the world with more regions than anyone else,” he told the Future Decoded conference.

Scott Guthrie, Microsoft’s cloud enterprise group chief, added that the move would address privacy watchdogs’ concerns about “data sovereignty”.

Amazon has also committed itself to multiple UK data centres, but has not said how many at this stage. It will make the UK its 15th regional base.

Although that is fewer than Microsoft’s, the company is currently the global leader in this field in terms of market share.

Announcing its move, Amazon said an added benefit of having a local data centre was that the public would experience less lag when using net-based services.

Amazon’s other EU-based data centres are in Ireland and Germany.

Although outsourcing computing work to one of the big tech companies offers the potential for savings – as they do not have to build and maintain their own equipment – there are also risks involved.

A fault with Azure knocked many third-party websites offline last year, and Amazon has experienced glitches of its own. However, major faults taking clients’ services offline are a relatively rare occurrence.

New EU data laws threaten huge fines

By Cyber SecurityNo Comments

Companies could face fines of up to 4% of their global annual turnover under new European rules on data protection.

Companies could face fines of up to 4% of their global annual turnover under new European rules on data protection
The European Union has approved significant changes to data laws, aimed at putting individuals back in charge of their information.

It is the biggest shake up to privacy regulation for 20 years, according to experts. The changes would make privacy “a board-level issue”, one lawyer said.

Peter Church, a technology lawyer at Linklaters, said it would make businesses “start taking these issues a lot more seriously”.

US technology companies already have problems with European regulators, with both Google and Facebook facing big fines – Facebook over its use of cookies and Google over its privacy policy.

Although this new law will not come into force until 2018, the changes meant the tech giants would have to “pay more attention to what regulators are saying”, said Mr Church.

The new draft policy, in discussion since 2012, will need to be ratified by the European Parliament next year.

Other changes include:

  • Firms will have to report serious data breaches to regulators within 72 hours
  • Consumers’ right to be forgotten will be extended beyond search engines to all aspects of their web history – so, for example, a user could request to have his or her Facebook profile removed
  • Consumers have the right to transfer their data from one company to another – so, for example, a user could request all data relating to shopping purchases be sent to them so they can transfer their preferences to a rival supermarket
  • Companies that handle significant amounts of data will have to employ a data protection officer

Jan Philipp Albrech, chief negotiator, said of deal: “This would be a major step forward for consumer protection and competition and ensure Europe has data protection rules that are fit for purpose in the digital age.”

 “The scale and breadth of the EU’s changes to privacy rules will deliver unprecedented challenges for business and every entity that holds of uses European personal data both inside and outside the EU.”

“Most companies will be shocked at the scale of the new rules and the work that needs to be done before the laws take effect in two years – it is not much time for the magnitude of the internal changes that will be required.”

Facebook’s data tracking issues in trouble

By Cyber SecurityNo Comments

Facebook is in trouble from the Belgian privacy commission-  which is cross that it tracks internet users who are not members of the social network.

Facebook is in trouble from the Belgian privacy commission- which is cross that it tracks internet users who are not members of the social network
A court has ruled that it is unacceptable that every time someone clicks a “like” button on a website, their browsing activity is collected, regardless of whether they are Facebook users or not.

The controversy centres around a cookie – a simple text file which can track a number of user activities – which Facebook has used for the last few years.

Researchers found that even non-members who visited any page that fell under the facebook.com domain would have what Facebook calls its datr cookie – which has a two-year lifespan – installed on their browser.

They conducted a series of tests including one where they did a Google search for the term “facebook data policy”. It led them to the Facebook data policy page which placed the datr cookie on their browser.

They then visited a Belgian website related to prostate cancer treatment which includes a Facebook like button and found that the datr cookie was sent to Facebook.

There was no formal Facebook privacy notice regarding any cookie being stored.

It’s tracking functionality has led the Belgian court to, rather dramatically, give Facebook 48 hours to stop using it or face a fine of £176,000 per day.

Investigators were drawn to the details of how Facebook’s cookies worked when the social network rolled out new terms and conditions in January, authorising it to track its users across websites and devices, use profile pictures for both commercial and non-commercial purposes and collect information about its users’ locations.

Users could agree to the changes or they could leave Facebook.

One of the things that the Belgian privacy commission did in response to the changes was commission a report from the Universities of Leuven and Brussels.

It concluded that tracking non-users was in breach of EU law.

Its findings were handed to the Belgian authorities who, after initial talks with Facebook failed to reach agreement, decided to take the case to court.

The judge agreed with the Belgian privacy commissioner, ruling that the information collected by the social network was personal data “which Facebook can only use if the internet user expressly gives their consent”.

Advertising revenue is Facebook’s biggest source of income, jumping 45% this year, with mobile ad sales accounting for 78% of that. Being able to track web browsing habits, even anonymised ones, allows it to better target that advertising.

Privacy campaigners are very clear though about what they want from Facebook.

They argue that Facebook needs to be more explicit about what it is tracking and offer users the right to opt in to such tracking rather than having to search through the site to find ways to opt out.

And a court in Austria is now considering whether it will bring action against Facebook for violating privacy laws in its country.

The battle between privacy campaigners and the big tech firms is far from finished.

TalkTalk hack to cost up to £35 million

By Cyber SecurityNo Comments

The cyber attack on TalkTalk could cost it up to £35 million the company has said.

TalkTalk hack to cost up to £35 millionFollowing the hack- which divulged some users’ financial details, all customers of the telecoms group will be offered a free upgrade.

Chief executive Dido Harding said that despite the hack, TalkTalk was “well positioned to deliver strong and sustainable long-term growth”.

The firm expects still full year results to be in line with market expectations.

TalkTalk shares had jumped more than 13% by the close of trade on Thursday- but were still down more than 20% compared with their pre-hack value.

Speaking to the BBC, Ms Harding said: “The estimated one-off costs are between £30 million and £35 million – that’s covering the response to the incident, the incremental calls into our call centres, obviously the additional IT and technology costs, and then the fact that over the last three weeks until yesterday our online sales sites have been down, so there will be lost revenue as a result.”

She added that in recognition of the uncertainty that this had caused customers, they would be offered an upgrade.

A spokesperson said the type of upgrade offered would depend on the kind of package customers already had. For example, customers with TV packages might be offered a sports channel that they did not already have.

Customers who were financially affected directly will be free to leave TalkTalk without financial penalty. They would have to be able to show they had lost money as a result of the hack.

Customers who wish to leave for a different reason – for example, if they feel their data is not secure – would still have to pay a contract termination fee.

However Talk Talk’s offer to it’s customers is very limited

Some of TalkTalk’s millions of customers might have been angry enough to try to terminate their contracts when the telecommunications company first revealed details of a major data security breach last month.

But, with contracts for mobile, fixed line, broadband and television services of up to two years (always worth looking at those few lines at the bottom of the paperwork) customers found they couldn’t leave TalkTalk without incurring hefty costs.

When Dido Harding, the chief executive, first announced that customers would only be able to leave if they could show a “direct impact” on their bank account – a pretty high bar – investors heaved a sigh of relief and TalkTalk’s share price bounced up.

More than 15,600 bank account numbers and sort codes were stolen. Four people have been arrested and bailed in connection with the hack.

Ms Harding told the BBC that it was “too early to tell” what the longer term impact of the breach would be on the business.

Heartbleed attacks US banks

By Cyber SecurityNo Comments

US banks have been the victim of hacking and attacked by the heartbleed cybervirus.

US banks have been the victim of hacking and attacked by the heartbleed cybervirus
In April 2014 the cybersecurity world was shocked by the discovery of Heartbleed- the name given to a vulnerability found in one of the systems we use to securely communicate over the internet.

In this hack – which investigators are calling the largest theft of consumer data from financial institutions ever – the Heartbleed bug was exploited to gain access to “Victim 2”, an as-yet unnamed financial firm headquartered in Boston.

But it’s just one angle to this enormous attack.

The real damage appears to have been done with some social engineering, executed in a way that shows just how difficult it is to defend against determined cybercriminals.

According to investigators, hackers gained access to various networks belonging to JP Morgan and six other financial institutions, scraping personal data they would then use to manipulate stock prices.

The three indicted men – Israelis Gery Shalon and Ziv Orenstein and American Joshua Samuel Aaron – were conducting “security fraud on steroids”, prosecutors say.

Another man, Anthony Murgio, was charged over running an illicit operation trading virtual currency Bitcoin.
Targeted mail

This is how prosecutors say Heartbleed functioned.

The hacking technique often involved using legitimate accounts belonging to Joshua Aaron.

Using this legitimate access, as if Mr Aaron was a normal customer, paved the way for the hackers to gain access to networks and systems containing reams of data about other customers – people who were investing in stocks.

Over the course of several years, they stole personal data on more than 100 million people. The hackers didn’t access bank details. They didn’t need nor want them.

Investigators said the hackers used the personal details to send out information to bosses’ email addresses, promoting certain stocks that hackers had bought cheaply. The price would rise, and the hackers would then sell off their now very valuable shares.

It’s a technique known as “pump and dump”.

The hackers were said to be using a remote server in Egypt to access the network of “Victim 3” – a financial services firm based in Omaha, Nebraska.

The remote server, which covered the accused’s real location, was used to log in to Mr Aaron’s account with Victim 3.

When info-security staff at the firm noticed the odd sign-in location, it locked Mr Aaron’s account. Good security practice.

But, according to the court papers: “Aaron called Victim 3 and, upon being notified that his account had been locked and asked by a customer service representative whether Aaron had been traveling in Egypt in March 2014, Aaron lied to the representative, and claimed that he had been in Egypt.

“In truth and in fact, and as Aaron well knew, Aaron had not been in Egypt and was merely attempting to convince Victim 3 to allow Aaron and his co-conspirators to access Aaron’s account online in furtherance of their efforts to hack into Victim 3.”

For banks – indeed any big company online – there’s a constant balance between making a system as secure as possible, but not locking it down so much that its frustrating for normal customers to use.

But that’s not all these men are accused of doing. According to the court papers, the men were involved in a myriad range of online crime.

As well as the stock manipulation, and running a Bitcoin trading platform to help launder the cash, the men were said to be running illegal online casinos, selling fake antivirus software and – that age old internet scam – offering the purchase of pharmaceuticals.

All of this added up to an alleged haul of £75 million which they kept in bank accounts in Switzerland.