RiskXtraJune2019

Cyber Security: Risk Mitigation for Professional Services
client information. A PwC report from 2017
claimed that 60% of law firms had reported an
information security incident over the previous
year (up from 42% in 2014). That same year,
the UK Solicitors Regulation Authority
estimated that circa £11 million had been lost
to cyber crime in the previous 12 months.
Sometimes, professional services firms are
their own worst enemy when it comes to risk
exposure. A 2018 report found over one million
corporate e-mail addresses belonging to staff
at the UK’s Top 500 law firms for sale on Dark
Web sites. Most were linked to a password,
offering cyber criminals a simple way in which
to crack open corporate accounts. It’s believed
employees had used these corporate
credentials to register accounts with consumer
sites like Facebook and LinkedIn, which were
subsequently breached.
Nation states join the fray
In the other type of attack, professional
services firms are targeted with a view to
compromising their clients. Operation Cloud
Hopper, uncovered in 2017, saw an attack
group (namely APT10) with links to the Chinese
state compromise managed service providers
(MSPs) on an “unprecedented” scale.
“Given the level of client network access
MSPs have once APT10 has gained access to a
MSP, it’s likely to be straightforward to exploit
this and move laterally to the networks of
potentially thousands of other victims,” noted
PwC. “In turn, this would provide access to a
larger amount of Intellectual Property (IP) and
sensitive data. APT10 has been observed to
exfiltrate stolen IP via the MSPs, hence evading
local network defences.”
Other techniques include ‘watering hole’
attacks, whereby the website of a professional
services firm is compromised in order to spread
malware to the computers of partner
organisations whose users are likely to visit it.
One vendor has even warned of a ‘reverse
business e-mail compromise’ attack in which
hackers compromise the mail server of a supply
chain organisation in order to spread fileless
malware to trusted partners.
The cyber risk from third party professional
services firms doesn’t just include data theft,
either. Below par security among suppliers
could also expose organisations to the threat of
ransomware. According to NTT Security’s
findings, business and professional services
firms experienced the second highest rate of
ransomware infection globally last year.
Given the scale of the threats confronting
organisations, it’s time to elevate third party
risk management to the level it deserves. The
“The cyber risk from third party professional services firms
doesn’t just include data theft, either. Below par security
among suppliers could also expose organisations to the
threat of ransomware”
National Cyber Security Centre has developed
some useful guidance setting out four key
principles which should inform any programme.
These are: understand the risks, establish
control, check your arrangements and then
work towards continuous improvement.
Understanding the risks means being clear
about what needs to be protected and why,
knowing who your suppliers are and being
aware of what – if any – security gaps they
have. Establishing control is all about
communicating minimum standards expected
of suppliers, building these considerations into
contracts and providing cyber security support
to suppliers where and when needed.
Assurance requirements – such as pen
testing and/or formal certifications – should
then be built into supply chain management.
Finally, it’s a case of encouraging a culture of
continuous improvement and mutual trust. This
will need to develop through time as supply
chains evolve and change over time.
Risk-based foundation
No organisation can expect to be completely
insulated from cyber risk, but this approach
seems to set a useful risk-based foundation
upon which to build. As for specific steps that
we would recommend, they should include first
conducting data auditing to understand what
needs to be protected and which suppliers
handle which high-risk data.
Best Practice security controls and processes
can include tighter access controls along the
lines of least privilege, enforced with risk-based
multi-factor authentication. Anti-malware
protection and threat detection are also a
‘must’ on endpoints, networks and servers, as
well as for e-mail and web gateways.
Regular patch management should be
another ‘given’, alongside continuous network
monitoring. Incident response and pen testing
plans must be run regularly to ensure IT teams
have an up-to-date view of their risk profile.
Modern techniques like threat hunting can also
provide a more proactive approach towards
security which will help in heading off any
attacks before they impact the organisation.
Finally, don’t forget the role of people in the
security environment. They’re often thought of
as the weakest link, but if properly trained they
can provide a welcome first line of defence.
Azeem Aleem: Vice-President
of Consulting at NTT Security
53
www.riskxtra.com>