Guernsey regulated financial services firms - are you ready to evidence compliance with the new GFSC Cyber Rules? - Guernsey Press 04 September 2021

Time’s up. Are you ready to evidence compliance with the new GFSC Cyber Rules now in effect?

Guernsey Regulated Financial Services Firms, the deadline for compliance with the GFSC Cyber Rules is today!

Guernsey Regulated Financial Services Firms, the deadline for compliance with the GFSC Cyber Rules is today!

Will you be ready to explain your strategy and governance when the GFSC turn up for a regulatory visit?

The Cyber Rules compel Boards to take accountability for Cyber risks where previously it may have belonged to IT. Technology is only one piece of the puzzle, and often it is your people that present your weakest link.

We support our clients with an independent and proportionate gap analysis report that assesses risks and controls across people, operations and technology. This informs the strategy and governance that shows the GFSC what they want to see, reinforced by objective education and awareness for Boards and users.

We help our clients get the best performance from their IT Provider, to see and remediate the risks that cannot be revealed in a self-assessment either by the provider or the client.

Talk to the professionals today, with the experience and qualifications you can count on.

Contact us on contact@blackarrowcyber.com or call us on 711988

What is a Cyber 'Trigger Event' under the GFSC Rules - and what firms need to do to evidence they have taken appropriate steps

Priority action for all regulated firms in Guernsey: Microsoft announced that email servers are being attacked, and the GFSC rules require you to record how you have reviewed your cyber security controls to address this.

In an alarming announcement earlier this month, Microsoft alerted all customers across the world that their Exchange email servers may have been compromised by “state-sponsored [attackers] operating out of China”. Microsoft then announced that it continues to see the attacks growing by “multiple actors taking advantage of unpatched systems”.

The new GFSC Cyber Security Rules, which all regulated firms must comply with immediately, foresaw that sinister events such as these will increasingly occur. The Rules require Boards to review their controls if there is a “trigger event” which is defined as a “significant occurrence which would indicate that the licensee may be susceptible to a cyber security event” including “a vulnerability announcement issued by a software or hardware provider” and “international warnings of cyber security threats, vulnerabilities or incidents”.

Here, we share Black Arrow’s observations on how this ‘trigger event’ occurred, and how firms in Guernsey can demonstrate compliance with the GFSC Cyber Security Rules.

An attack on Microsoft Exchange email servers across the world

On 3rd March 2021 Microsoft released a statement indicating that their on-premises email server, Microsoft Exchange, was subject to several zero-day exploits of  “critical” vulnerabilities. A zero-day exploit is where an attacker uses a previously unknown weakness in computer systems for which there is no known mitigation such as a software security patch from the vendor. Microsoft stated that it wanted to “emphasize the critical nature of these vulnerabilities” which was evidenced in the way it gave comprehensive advice on what their customers should do.

Attackers will make the best use of the zero-day vulnerability until the software vendor, in this case Microsoft, creates and releases a fix. Although Microsoft has now released a corrective software patch, the troubling feature of this incident is that Microsoft says that just applying the patch “will not evict an adversary who has already compromised a server”. This means that cyber security teams in Guernsey need to investigate and implement controls that will identify and address activity by someone who is already in the firm’s network.

What the GFSC Rules require you to do

Microsoft strongly urged customers to “update on-premises systems immediately”, which include those of local IT providers, but it highlighted that “Exchange Online is not affected”. It also advised thoroughly investigating specific Indicators of Compromise that it listed, to identify whether the environment had been compromised through these vulnerabilities.

In addition, the GFSC Rules require regulated firms to review, and importantly to record, whether their approach to cyber security is still appropriate in the light of a ‘trigger event’ such as this. This goes to the heart of the Rules, which highlights that cyber security is never a one-time project but that firms must periodically review their controls across people, operations and technology, especially after the major alert this month.

To be effective, the review should be objective and impartial, and it should cover people, operations and technology. Cyber security is owned by the Board, and can never be handed to IT as a one-stop-shop to achieve compliance.

At Black Arrow, we work with clients to perform documented assurance for events like this as well as undertaking a gap analysis that identifies the priority areas of focus for organisations to achieve and demonstrate compliance with the GFSC Rules. The GFSC Rules were established following the thematic review conducted by one of our founding directors. Contact us to gain a better understanding of how the recent attacks affect your business, and what you can do to improve your protection in line with GFSC requirements.

Our latest piece in the Guernsey Press - The new GFSC Cyber Security Rules: What the GFSC demands of firms, and why leaving it all to your IT provider won't make you compliant

https://guernseypress.com/news/2021/02/19/the-new-gfsc-cyber-security-rules-what-the-gfsc-demands-of-you-and-why-you-cannot-simply-pass-it-to-it/

New Cyber Rules just released by the GFSC - and how Black Arrow can help you become compliant

Welcome to this week's Black Arrow Cyber Tip Tuesday, this week Tony is talking about the new cyber rules that the GFSC have just released and which are now in force for regulated financial services firms in the Bailiwick.

The GFSC have now released the new cyber rules and all regulated financial will need to be able to demonstrate compliance with these new regulations.

The regulations are built around compliance or adherence to the internationally recognised NIST cyber security framework and the five pillars contained therein, being identify, protect, detect, respond and recover.

We can assist any firm by producing a gap analysis against the NIST standard, and therefore the GFSC rules, to identify any areas of non-compliance or areas where firms will need to bolster their existing security arrangements.

Remember that cyber and information encompasses a lot more than just IT but is rather requires a holistic approach across people, operations and technology.

Leaving this solely to your IT team or IT provider likely won’t provide the coverage the GFSC now expects from firms.

Remember too taking a proactive approach should always be about preventing an attack or breach, many firms do not survive a significant cyber event, and for those that do recovery invariably costs a lot more than it would have cost to put appropriate controls in place to prevent the breach happening in the first place.

Boards are expected to show good governance over cyber and information security as they would be expected to do with any older and longer established risks.

It is clear from the new rules that the GFSC also agree that the responsibility for cyber and information security clearly sits with Boards, not IT.

Talk to us today to see how we can help you demonstrate compliance or become compliant with the new GFSC cyber rules.

The Board, not IT, is responsible for Cyber and Information Security

Welcome to this week's Black Arrow Cyber Tip Tuesday.

In our articles in Business Brief magazine and the Guernsey Press, we have consistently highlighted that the Board, not IT, is responsible for Cyber and Information Security.

The financial services regulators in the Channel Islands have also made that very clear.

The GFSC has warned that “Cyber and information security should be taken seriously by the Board and included along with more established risks within a firm’s overall strategy for risk management”. And the JFSC has told businesses that “As a registered person, the Codes of Practice require you to understand and manage risks, including cyber-security risks, which could affect your business or customers”.

There is no room for misunderstanding there.

So, if a cyber incident happened, the Regulator would say to each Director “show us the evidence that you had taken cyber and information security seriously. Show us that you had understood and managed your risks properly, just as we had warned you to do”. 

If you are a Director, including a Non-Executive Director, and you had to get that evidence ready for tomorrow morning, would you be able to?

To be clear, it would not be appropriate to say that you handed it over to IT and thought they had sorted it.

Our Black Arrow website contains videos and articles that help Directors understand the basics of cyber and information security.

It is really important that the Board should be an educated customer of cyber security providers, including any outsourced IT providers, to be able to scrutinise and challenge what they are being told. You don’t need to be an expert, but have a good understanding of the basics, and your independent trusted advisors can support you on the details.

Have a look at the information on our site or contact us to see how we can help you achieve what the regulators require of you.

Cyber Weekly Flash Briefing 25 September 2020: GFSC consult on new Cyber Rules; FinCEN leak exposes poor data security; Zerologon attacks detected; ransomware gang behind German hospital death

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

---

GFSC new Cyber Rules and Guidance out for consultation

The GFSC have put the Cyber Security Rules and Guidance Consultation Paper up on their website and consultation hub.

Why this matters:

The new rules and accompanying guidance came out of the 18 month thematic review which ended last year, which found that regulated financial service firms within the Bailiwick of Guernsey were not taking risks from cyber threats seriously enough and were lacking in appropriate protections and controls. These new rules seek to rectify this but many firms on the Island are going to have to do work to become compliant, especially around their ability to monitor for and detect unusual activity that could be indicative of a actual or attempted intrusion or breach.

The rules and guidance can be found here:

https://consultationhub.gfsc.gg/banking-and-insurance-supervision-and-policy/cyber-security-rules-and-guidance-consultation-pap/

---

Leaked FinCEN files expose poor data security

Leaked documents, dubbed the “FinCEN Files,” describe global money laundering of $2 trillion processed by many of the world’s biggest banks between 2000 and 2017. The reveal illuminates the struggle for the financial industry and government to provide ironclad data protection.

“This sensational and unprecedented leak clearly demonstrates a wide spectrum of data protection weaknesses in the governmental sector, affecting even the most developed Western countries,” Ilia Kolochenko, founder and CEO of  ImmuniWeb, said of the files.

“From a cybersecurity standpoint, we may expect a growing lack of trust to governmental agencies, which on one side have quasi-unlimited access to the most sensitive data of the largest organisations, while cannot duly safeguard this data on the other side,” he said.

The latest disclosure exposing apparently insufficient attempts by the public and private sectors to curb corruption came to light in a BuzzFeed News report which detailed more than 2,500 reported cases, including 2,100 Suspicious Activity Reports (SAR) filed by financial institutions with the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN).

JPMorgan Chase, Citigroup, Bank of America, Deutsche Bank, HSBC and Standard Chartered are among the financial institutions cited in the leaked files as processing dirty money around the world. The documents may have come from a whistleblower or insider at FinCEN. The International Consortium of Investigative Journalists (ICIJ), which represents 108 news organizations in 88 countries, is conducting a probe of the matter.

Why this matters:

Other similar investigative reports on similar wrongdoing focused single financial, tax or legal institutions, such as the 2017 Panama Papers emanating from clients of the law firm Mossack Fonseca. But the FinCEN docs reveal that a wide array of people from oligarchs and corrupt politicians to drug dealers and organised crime throughout the world know how to circumvent the system’s supposed checks and balances.

Read more: https://www.scmagazine.com/home/security-news/leaked-fincen-files-expose-poor-data-security/

---

Microsoft says it detected active attacks leveraging Zerologon vulnerability

Hackers are actively exploiting the Zerologon vulnerability in real-world attacks, Microsoft's security intelligence team said this week.

The attacks were expected to happen, according to security industry experts.

Multiple versions of weaponized proof-of-concept exploit code have been published online in freely downloadable form since details about the Zerologon vulnerability were revealed a week ago.

The first proof-of-concept exploit was published hours after the explanatory blog post, confirming initial analysis that the Zerologon bug is easy to exploit, even by low-skilled threat actors.

Why this matters:

Put simply the Zerologon bug is a vulnerability in Netlogon, the protocol used by Windows systems to authenticate against a Windows Server running as a domain controller. Exploiting the Zerologon bug can allow hackers to take over the domain controller, and inherently a company's internal network.

Zerologon was described by many as the most dangerous bug revealed this year. US federal agencies were given three days to patch domain controllers or disconnect them from federal networks.

As several security experts have recommended since Microsoft revealed the attacks, companies that have their domain controller exposed on the internet should take systems offline to patch them.

These internet-reachable servers are particularly vulnerable as attacks can be mounted directly, without the hacker first needing a foothold on internal systems.

Read more: https://www.zdnet.com/article/microsoft-says-it-detected-active-attacks-leveraging-zerologon-vulnerability/

---

Doppelpaymer ransomware crew fingered for attack on German hospital that caused death of a patient

The Doppelpaymer ransomware gang were behind the cyber-attack on a German hospital that led to one patient's death, according to local sources.

A German newspaper carried a report that Doppelpaymer's eponymous ransomware had been introduced to the University Hospital Düsseldorf's network through a vulnerable Citrix product.

That ransomware infection, activated last week, is said by local prosecutors to have led to the death of one patient who the hospital was unable to treat on arrival. She died in an ambulance while being transported to another medical facility with functioning systems.

Why this matters:

According to a report handed to the provincial government of North Rhine-Westphalia and seen by the German Press Association (DPA), the ransomware's loader had been lurking on the hospital's network since December 2019, the same month a patch was issued by Citrix for CVE-2019-19781 – the same vuln exploited to hit the hospital.

Whilst this is the first time a loss of life has been directly attributed to ransomware the threats are increasing all the time.

Vulnerabilities must be patched as soon as possible to stop known vulnerabilities from being used in attacks.

Read more: https://www.theregister.com/2020/09/23/doppelpaymer_german_hospital_ransomware/

---

“LokiBot,” the malware that steals your most sensitive data, is on the rise

Agencies in the US have reported seeing a big uptick in infections coming from LokiBot, an open source DIY malware package for Windows that’s openly sold or traded for free in underground forums. It steals passwords and cryptocurrency wallets, and it can also download and install new malware.

The increase was measured by an automated intrusion-detection system for collecting, correlating, analysing, and sharing computer security information.

US cyber agency CISA observed a notable increase in the use of LokiBot malware by malicious cyber actors since July 2020 according to an alert issued this week.

Why this matters:

While not quite as prevalent or noxious as the Emotet malware, LokiBot remains a serious and widespread menace. The infostealer spreads through a variety of methods, including malicious email attachments, exploitation of software vulnerabilities, and trojans sneaked into pirated or free apps. Its simple interface and reliable codebase make it attractive to a wide range of crooks, including those who are new to cybercrime and have few technical skills.

Read more: https://arstechnica.com/information-technology/2020/09/lokibot-the-malware-that-steals-your-most-sensitive-data-is-on-the-rise/

---

Ransomware is evolving, but the key to preventing attacks remains the same

Ransomware attacks are getting more aggressive according to a senior figure at Europe's law enforcement agency, but there are simple steps which organisations can follow to protect themselves – and their employees – from falling victim to attacks.

"Ransomware is one of the main threats," said the head of operations at Europol's European Cybercrime Centre (EC3). Europol supports the 27 EU member states in their fight against terrorism, cybercrime and other serious and organised forms of crime.

"Criminals behind ransomware attacks are adapting their attack vectors, they're more aggressive than in the past – they're not only encrypting the files, they're also exfiltrating data and making it available," he explained. "From a law enforcement perspective, we have been monitoring this evolution."

Why this matters:

This year has seen a rise in ransomware attacks where cyber criminals aren't just encrypting the networks of victims and demanding six-figure bitcoin payment to return the files, but they're also threatening to publish sensitive corporate information and other stolen data if the victim doesn't pay the ransom.

Read more: https://www.zdnet.com/article/ransomware-is-evolving-but-the-key-to-preventing-attacks-remains-the-same/

---

A look at the top threats inside malicious emails

Web-phishing targeting various online services almost doubled during the COVID-19 pandemic: it accounted for 46 percent of the total number of fake web pages, Group-IB reveals.

Ransomware, the headliner of the previous half-year, walked off stage: only 1 percent of emails analysed contained this kind of malware. Every third email, meanwhile, contained spyware, which is used by threat actors to steal payment data or other sensitive info to then put it on sale in the darknet or blackmail its owner.

Downloaders, intended for the installation of additional malware, and backdoors, granting cybercriminals remote access to victims’ computers, also made it to top-3. They are followed by banking Trojans, whose share in the total amount of malicious attachments showed growth for the first time in a while.

According to the data, in H1 2020 detected malicious emails were:

• 43 percent of the malicious mails had attachments with spyware or links leading to their downloading

• 17 percent contained downloaders

• 16 percent had backdoors

• 15 percent had banking trojans

• Ransomware, which in the second half of 2019 hid in every second malicious email, almost disappeared from the mailboxes in the first six months of this year with a share of less than 1 percent.

Why this matters:

These findings confirm adversaries’ growing interest in Big Game Hunting. Ransomware operators have switched from attacks en masse on individuals to corporate networks. Thus, when attacking large companies, instead of infecting the computer of a separate individual immediately after the compromise, attackers use the infected machine to move laterally in the network, escalate the privileges in the system and distribute ransomware on as many hosts as possible.

Read more: https://www.helpnetsecurity.com/2020/09/21/top-threats-inside-malicious-emails/

---

Credential Stuffing: the Culprit of Recent Attacks

A year ago, researchers found that 2.2 billion leaked records, known as Collection 1-5, were being passed around by hackers. This ‘mega leak’ included 1.2 billion unique email addresses and password combinations, 773 million unique email addresses and 21 million plaintext passwords. With this treasure trove, hackers can simply test email and password combinations on different sites, hoping that a user has reused one. This popular technique is known as credential stuffing and is the culprit of many recent data breaches.

There are only a few months left of 2020 but this year has seen its fair share of major data breaches including:

• Marriott International experienced another mega breach, when it was still recovering from the 2018 data breach that exposed approximately 339 million customer records

• Zoom became a new favourite for hackers due to the remote working mandated in many parts of the world - in early April  Zoom fell victim to a credential stuffing attack, which resulted in 500,000 of Zoom’s usernames and passwords being exposed on the Dark Web.

• GoDaddy, the world’s largest domain registrar confirmed in April that credentials of 28,000 of its customer web hosting accounts were compromised in a security incident back in October 2019.

• Nintendo - in March, users reported unauthorised logins to their accounts and charges for digital items without their permission. In June Nintendo advised that approximately 300,000 accounts were affected by the breach, resulting in the compromise of personal identifiable information such as email address, date of birth, country and gender.

Why this matters:

It has become evident that many of the recent data breaches were the result of credential stuffing attacks leveraging compromised passwords or passphrases. Credential stuffing attacks are automated hacks where stolen usernames and password combinations are thrown at the login process of various websites in an effort to break in. With billions of compromised credentials already circulating the Dark Web, credential stuffing attacks can be carried out with relative ease and with a 1-3% success rate.

When the account of an employee is compromised, hackers can gain access to sensitive data that organisation has collected, and sell it on the Dark Web. The stolen data, often including login credentials, can then be used to infiltrate other organisations’ systems which creates a never-ending cycle.

This is why the LinkedIn breach was blamed for several secondary compromises due to users recycling their exposed LinkedIn passwords on other sites.

Read more: https://www.infosecurity-magazine.com/blogs/credential-stuffing-recent-attacks/

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Regulatory Expectations around Cyber and Information Security - Cyber Tip Tuesday video for 11 August 2020

Welcome to this week's Black Arrow Cyber Tip Tuesday.

We have talked before about how the regulators like the Guernsey GFSC and the Jersey JFSC expect Boards to take Cyber and information security seriously by the Board just as they do with more established risks, and that Directors are required to understand and manage those risks.

So, how can a Board evidence this.

The clearest way is to schedule a regular review of a cyber security report at Board meetings. That report should contain a few sections with brief and focused content that is explained in terminology that all business leaders can understand. One of those sections is a dashboard with key indicators about the risks that the business faces, and the controls that are in place to mitigate those risks to match the organisation’s risk appetite.

We recommend that organisations structure their risks and controls based on one of the globally recognised frameworks, for example NIST or ISO 27001. In fact, the forthcoming regulations from the GFSC are based on the NIST framework. So, the dashboard would also be structured to match that same framework, to ensure everything this covered.

The Board members should be sufficiently knowledgeable about these topics to be able to question whether things are as good as the dashboard says they are, and whether the rating should be Amber instead of Green. Or, whether the RAG threshold is appropriate for their business. And that challenge in the Board room should be minuted for future reference.

You don’t need to be an expert, but you do need to have a good understanding of the basics, and your independent trusted advisors can support you on the details.

Contact us to see how we can help you achieve what the regulators require of you.

Black Arrow Cyber Tip Tuesday - Looking to 2020 and increased focus on cyber by the GFSC for all regulated financial service firms

Welcome to the final Cyber Tip Tuesday of the year, on this the last day of 2019.

As we look back over the last twelve months, the most significant thing, at least as far as regulated financial services firms in the Bailiwick are concerned, is that the GFSC is putting a lot more focus on, and changing the ways it is assessing, cyber risk - both in terms of operational risk and governance risk.

The Commission will be putting new regulations out to public consultation in the new year, but firms need to think about getting on the front foot and consider whether they are doing all they should be doing in relation to cyber security.

We know what the Commission will be looking for as we were directly involved in the thematic review that led to these new regulations, and provided direction for the regulations themselves and the changes to the way firms will be assessed as part of ongoing supervision.

Talk to us to see how we can help you to ensure that you have appropriate protections and controls in place and to help you meet the new regulations when they come into force.

Have a happy, safe and secure 2020