Tim Ring

October 30, 2014: Our plummeting faith in new technology was starkly illustrated last year by the Russian secret service. In the wake of whistleblower Edward Snowden’s revelations of mass electronic spying by the Americans, the Kremlin agency tasked with protecting Russia’s top officials resorted to buying 20 Triumph Adler manual typewriters to use instead of email, and so guarantee their communications stayed secure.

In the ‘civilian’ world, the same lack of trust has prompted many consumers to question whether they should follow the growing trend of online and mobile banking, or stick to old-school bricks-and-mortar banks and hard cash payments instead?

With tales of exotic-sounding banking malware families like Zeus and Carberp being used by often (ironically) Russian cyber criminals to steal the electronic account details of millions of people worldwide, it’s a valid concern.

The problem with banking via the internet, and now mobile devices, and soon social networking sites like Facebook and Twitter, is that it opens up a bigger and bigger ‘attack surface’ for cyber criminals to target. And crucially, the newer the technology, the less people understand its inner workings and can be certain it is safe and secure.

So what are the benefits and pitfalls of online and mobile banking?

Financial security expert Pierluigi Paganini is worried. “Many banks and financial institutions have a great interest in providing services to customers through mobile and also social networking. But there are a lot of problems that could be linked to the use of these platforms,” he explained.

Paganini, founder of the respected ‘Security Affairs’ cyber security blog and chief information security officer at Bit4Id, says the main problem is not the inherent insecurity of these devices – it’s the way people use them.

Take someone who transacts with their bank via their smartphone or tablet: “If you install defence mechanisms such as anti-virus, if you always visit legitimate websites, if you don’t click or respond to unsolicited emails – if people follow some basic best practices, I am quite confident that they can be secure,” Paganini said. “But in reality, this is what never happens.”

He outlines the Dos and Don’ts: don’t use open WiFi networks (criminals can take control of the transaction); don’t open unsolicited emails purporting to come from your bank (it’s a phishing attack that will infect your device with malware); do use the latest (most secure) version of your Android mobile operating system and banking app; and do install anti-virus and other security software.

But even with these precautions, there’s still no guarantee: no technology is 100% safe. For example, banks typically offer seemingly uncrackable ‘two-factor authentication’ on every mobile transaction. This means that as well as your user name and password, you are sent an SMS with a one-time secure code for that transfer.

But because many banking apps don’t properly manage the security ‘certificates’ that the bank’s computer and your device send each other to prove their identity, malware can mount a ‘man-in-the-middle’ attack to intrude on the exchange, pretend to be the bank, send you a fake code and then siphon off your cash without you realising.

In the face of all that, you might think Paganini would side with those who resist the move to online and mobile. But he doesn’t.

For one thing, electronic banking offers obvious benefits: you can access all your bank’s services, all the time, wherever you are. And physical banking isn’t safe – you might get robbed; and physical credit and debit cards get lost or stolen.

Paganini argues that by using online and mobile technology, you avoid these dangers. “I would suggest to people to move to mobile banking, there are a lot of advantages. Under specific conditions we have a good level of security. It just means the user must be educated to avoid risky behaviour.”

As for the banks, they point out that the move to online, mobile and social networking banking is not directly their doing. “This is not a bank-led revolution, it’s consumer-led,” said Rob Watts of the British Bankers’ Association, who oversaw the BBA’s ‘The Way We Bank Now’ study project. “Banks have been genuinely astonished by just how quickly consumers are doing this.

“Of course it’s not for everyone, but a lot of people are finding it’s easy, it’s fast, it’s convenient, they can bank whenever and wherever they want. They don’t have to take time out to go to the branch.”

Globally, banks are adopting a growing range of innovative technology-based services, Watts said: Kenyan banks pioneered mobile payments made to your contacts list via SMS texts; some US banks offer cheque imaging technology which means you don’t have to take a cheque to the branch, you can email a photo instead; and UK banks are making specialist advisers available via Skype.

It may be a case of: if you can’t beat these benefits, you better join in. Just cut out the risky behaviour – a big ask maybe, but at least online you can’t get mugged.

Also read:

There is no escaping the cyber threat

Home Depot’s payment system breached

The post Should you trust mobile banking? appeared first on International Finance.

Suparna Goswami Bhattacharya

October 17, 2014: When someone mentions “CFO”, the first thing to hit the mind is – a guy managing finance in a company.

However, with time, the role of the CFO has evolved. Today if you mention about the ‘managing finance’ bit to any CFO worth his salt, he will probably laugh out loud.

Once focused on cost containment, accounting and compliance, the position has evolved into that of a true business partner – someone who delivers insights and provides decision-making support.

Today, companies expect CFOs to have the ability to manage volatility, navigate complexity among other things. In fact, a recent Accenture report* — The CFO as Architect of Business Value: Delivering Growth and Managing Complexity — states that the expanded role has resulted in their growing influence, especially as a result of their involvement in growth-related and business transformation activities.

“The role has evolved over time internally because of the increasing importance of financial data and insights and externally as a voice of the company to various stakeholders,” said Christian Campagna, lead managing director, Accenture Finance & Enterprise Strategy Group.

And the biggest drivers of this change in the scope of the role of the CFO are the global financial crisis of 2008, wherein the CFO emerged as a trusted partner to the CEO and other member of the C-Suite.

The role of the CFO at present has clearly expanded. The Accenture study calls it ‘Value Architect’. Here the CFO acts as the guardian of the economic value agenda for the company and provides guidance for key decisions made across the enterprise. “Now the CFO has the responsibility to drive profitability and growth while managing constant volatility, complexity, globalisation and emerging technology. The CFO is arguably one of the most powerful executives after the CEO,” says Campagna.

“This view that the CFO is the owner of cost control, and someone else in the business is the owner of revenue growth, is not the case,” says Margherita Della Valle of Vodafone. “The CFO has a role to play across the whole of the P&L and the balance sheet. It is essential that the CFO convinces the CEO that finance has a role to play on more than just costs.”

Thanks to the expanded role, the CFO now often finds himself in middle of a wide range of internal and external stakeholders, including other members of the C-suite, the rest of the management team, the board of directors, investors, regulators and analysts. Each has their own demands, and the number of stakeholders continues to expand.

Mike McClellan, CFO, North America at Sanofi, believes that bureaucracy should not mushroom in a company in order for things to run smoothly. “The CFO’s role is to really make sure that we’re not allowing processes to become too complex. We’re really trying to keep things effective and efficient, not only from a cost perspective but also from a way of doing business,” remarks McClellan.

Industries embracing change in role of CFOs

Research by various firms shows that the role of CFO is expanding. “The role is expanding but the focus may vary from industry to industry in order to address industry-specific challenges,” says Campagna. For instance, a CFO in financial services must focus more on regulations and cost control while a CFO at a consumer goods company may be more concerned with managing complexity.

In fact, in most industries CFOs are putting a special emphasis on digital. Hugh Morris, finance expert and vice-president of business development banking at GENPACT LLC in his statement earlier, had said that technology continues to change the way business gets done.

“CFOs need an understanding of emerging technology, but also where things are headed. They must remain agile enough to change course as technology changes and be committed to governance as a way of ensuring that the organisation uses the technology as efficiently as possible,” he said

David Rowland, CFO, Accenture believes that technology is central to finance strategy and agenda. “Organisations can’t have optimal efficiency and effectiveness without focusing on enabling technologies. In today’s world, where there’s an abundance of data, it’s particularly important that organisations raise their game in managing, analysing and presenting data in a way that yields the greatest value for the business.”

*The Accenture 2014 High Performance Finance Study was based primarily on an online quantitative survey conducted between January and April 2014 among 617 finance executives.

The post CFOs looking after more than just finance appeared first on International Finance.

Tim Ring

Aug 4, 2014: The fear of economic cyber espionage is now so great that companies rate cyber security as one of the top three global business risks, according to Lloyd’s of London, along with high taxation and loss of customers.

The worst-case scenario is that your business could, without you knowing it, be targeted by a rogue nation-state that infiltrates your corporate computers, siphons off your IP and confidential data on a massive scale, and passes it on to competitors. And one country’s name stands out above all others in this nightmare scenario: China.

In the last quarter alone, security researchers have disclosed cyber attacks from China against international shipping, logistics and manufacturing companies, US and European satellite, aerospace and communications companies, Japanese and European telecoms companies, and specific targets like Boeing and Lockheed Martin.

But the precise scale and nature of the threat became most clear on May 19 when, in an unprecedented move, five officers from the Chinese People’s Liberation Army (PLA) were indicted by a US court on 31 charges of hacking, economic espionage and stealing trade secrets, dating back to 2006.

The victims were American companies across a number of industries, and the beneficiaries were all state-owned Chinese enterprises. The accusations – vehemently denied by China – help to explain how, and why, businesses are targeted:

* In 2010, Sun Kailiang, an officer in Unit 61398 of the Third Department of the PLA, hacked US power plant manufacturer Westinghouse to steal technical and design specifications for power plant pipes and related products. At the time, Westinghouse was building four plants in China and negotiating terms of the construction with a Chinese state-owned enterprise (SOE), including technology transfers.

* In 2008, Sun Kailiang sent a “spear-phishing” email (a plausible fake message containing hidden ‘malware’) to US aluminium producer Alcoa that resulted in thousands of email messages and attachments being siphoned from Alcoa’s computers, including internal discussions concerning its partnership with a Chinese SOE.

* In 2012, another Chinese army officer, Wen Xinyu, stole thousands of computer files from US solar energy supplier SolarWorld, the charges say. The theft happened just as the US Commerce Department ruled that Chinese solar product manufacturers had ‘dumped’ products into US markets at prices below fair value. The stolen data included cashflow, costs and production line data, and privileged attorney-client communications relating to ongoing trade litigation. “Such information would have enabled a Chinese competitor to target SolarWorld’s business operations aggressively from a variety of angles,” say the charges.

China not alone

The evidence shows that businesses are being deliberately targeted by government hackers in search of specific types of IP and data, to gain commercial advantage and sometimes improve their negotiating position.

But is the threat limited to China? The answer is: no.

While every developed country spies on other nations, the US insists that (unlike China) it draws the line at infiltrating foreign firms and passing what it finds to its own companies.

Yet in claiming this moral high ground, White House spokeswoman, Caitlin M Hayden, revealed that it is not just China who fail to reciprocate: “We do not give intelligence we collect to US companies to enhance their international competitiveness or increase their bottom line. Many countries cannot say the same,” she told the New York Times in March.

Paul Simmonds, founder of the international Jericho Forum, which aims to improve companies’ information security, agrees: “As much as we like to name and shame China, everyone is involved. Every major power is doing it to some extent,” he said.

Simmonds believes even the US may be culpable, pointing to a recent report by Glenn Greenwald, a journalist close to whistleblower Edward Snowden, which revealed that America’s NSA intelligence agency routinely planted ‘spyware’ in internet routers and servers before they were shipped to international customers – potentially allowing the US to hack industrial companies across the globe.

But Dmitri Alperovitch, co-founder and CTO of CrowdStrike, a US cyber security firm which specialises in tracking advanced attacks, is adamant the threat is limited to China and a few other nation-state attackers – who, unlike China, tend to target specific industry sectors.

Alperovitch singles out Russia (attacking primarily energy firms, oil & gas, nuclear), India (financial and legal firms), Iran (so far reconnaissance-only attacks on energy companies) and even France who have “traditionally not shied away from economic espionage; we have seen some activity in the aerospace sector from French actors”.

He also points out there is a dramatically different scale of threat between China and the rest. Attacks from China since 2005 have numbered in the tens of thousands, he said. From other countries – dozens.

“China is not the only player but they are by far the largest,” he said. “It’s literally orders of magnitude difference.”

Chinese hackers have hit a wide range of industries, he says, including energy, manufacturing, high-tech, environmental sciences, solar power, nuclear energy, finance (primarily M&A banking divisions of financial institutions); as well as law firms who hold confidential data on clients spanning many industries and typically have “very little security so they are the soft underbelly”.

Jen Weedon, principal threat intelligence analyst at Mandiant, another well-known pursuer of state cyber criminals, agrees with Alperovitch’s take: “In terms of economic espionage, China is vastly ahead of everybody else in the quantity of their activity,” she says.

Weedon also tops up the list of industries being hacked: “We’re seeing more and more utilities, energy companies and pharmaceutical/healthcare companies targeted. We’re also seeing financial companies get targeted not for financial theft but for information related to their business processes – information that might allow other people doing trading platforms and things like that to replicate business processes.”

Out of patience

In the face of this persistent Chinese cyber threat to business, America has abandoned tact and quiet diplomacy. Along with the ‘naming and shaming’ court indictments in May, both President Obama and US Secretary of State John Kerry have raised the issue publicly. On a July 9-11 visit to China, Kerry spoke of the country’s cyber attacks having a “chilling effect” on business innovation and investment.

Despite that, there is little optimism that China, and others, will moderate their activity.

There is “absolutely no sign” of change, Alperovitch said. “It’s no longer the art of war with China, it’s the art of denial. So far they have issued blanket statements saying China does not hack in the face of overwhelming evidence to the contrary. The Chinese have just rejected all accusations and basically tried to shut down discussions.”

Weedon agrees: “There’s been no appreciable difference in activity from China since the indictments and these dialogues that we’ve noticed. Maybe in the long term it might start to shift, but because this activity is so institutionalised it’s not easy just to stop on a dime.”

So with little prospect of change, what can companies do to protect themselves?

Instead of simply installing swathes of security hardware and software, Alperovitch suggests businesses need to use ‘threat intelligence’ (detailed knowledge of attackers, their likely targets and methods).

“In this day and age you can’t just defend yourself against everything and everyone. You need intelligence on who they are, how they operate, what information do they want,” he says.

“That’s probably the biggest shift in mindset that we’re seeing – the use of intelligence to look out for specific attackers who are likely to go after you, based on your business and based on the intellectual property that you’re going to have.”

Paul Simmonds puts less faith in current security approaches. “What we’re doing at the moment is horribly broken. Basically your systems are wide open,” he says. “But you can do one thing right now: you have to start encrypting your data. Then if someone accesses your data, guess what, it’s totally useless to them because it’s encrypted.

“That’s a do-it-today. For me that’s better than any magic thing sitting there sniffing my traffic, trying to detect strange packets coming in from China.”

But Jen Weedon only partially backs this advice: “If you are out and about and have disks or devices that are mobile or removable, then you should encrypt the files on it is as it adds that extra layer of security,” she says.

“But having a business encrypt all of the information on all of its servers in its environment may not be a feasible solution. Encrypting all these files can lead to your business being affected (for example, by complicating nimble communications or operations) which could outweigh the overall boost to security for many businesses. Ultimately it is a risk/reward calculus that each business must do for itself.”

Currently then, there are few glimmers of hope for companies who, armed with inadequate security shields, stand against what remains a powerful and apparently unrelenting economic cyber espionage threat.

The post There is no escaping the cyber threat appeared first on International Finance.