Transcription
MINNEAPOLIS/ST. PAUL BUSINESS JOURNALEFXPOERELC&C YB E RSPONSORED BYSEF R A U DU R T YITATSB18
19SEPTEMBER 18, 2015MODERATORMOLLY EICHTEN LARKIN HOFFMANMolly Eichten is an attorney in Larkin Hoffman’s intellectual property, technology and Internetdepartment. Because she worked in the IT field prior to law school, she has substantial realworld experience solving technology issues and managing complex implementations ofenterprise-wide software applications and corporate infrastructure projects. As an attorney,she has represented clients in negotiating complex IT technology agreements for credit cardtokenization, co-location, hosting and network services, all of which included significantcybersecurity considerations. She has experience drafting website terms of use, privacy andDigital Millennium Copyright Act policies. Some of her representative IT matters include draftingand negotiating agreements for a national online retailer in its acquisition and transition to adifferent co-location and network services provider, and representing a nationally recognizedhospital in its acquisition of hardware and software for technology-integrated operating rooms.For information on future Table ofExperts, please contact KathyRobideau at 612-288-2134 orkrobideau@bizjournals.com.MANUFACTURING (SOLD OUT)Publication date: 10/16PANELISTSDAVE WASSON HAYS COMPANIESDave Wasson is the Professional and Cyber Liability Practice Leader at Hays Companies. Hespecializes in identifying and assessing cyber insurance exposures and provides solutions tohelp Hays’ clients effectively mitigate their risk. Wasson brings significant experience to the Haysteam as he has managed the Technology and Privacy practice in the Midwest region for HiscoxUSA, a Syndicate of Lloyd’s of London. During his time, Wasson also successfully designed,implemented and managed their small and middle-market Cyber Liability program. In addition,Wasson served as an Underwriter in the Management and Professional Division of PhiladelphiaInsurance Companies where he underwrote multiple product lines, including Cyber Liability,Professional Liability, and Management Liability. Dave holds a B.S. in Business Administrationwith a concentration in Finance from Saint Louis University and frequently speaks at cybersecurity conferences and seminars across the country.BRIAN ISLE UNIVERSITY OF MINNESOTA TECHNOLOGYLEADERSHIP INSTITUTEBrian Isle is a senior fellow at Adventium Labs and a senior fellow at University of MinnesotaTechnology Leadership Institute. He is co-founder and former CEO of Adventium. He alsoteaches courses at TLI in information assurance and risk assessment. He supported the multiyearU.S. Department of Energy-funded NESCOR program to improve the cybersecurity readiness ofthe next-generation power grid. He held roles on several security-related research programs,including a U.S. Department of Defense program focused on vulnerability assessment for forceprotection and a Department of Homeland Security program to apply advanced cyber protectiontechnology to control systems for critical infrastructure. Isle is on a number of boards, includingthe Minnesota chapter of the FBI-sponsored InfraGard.CHRIS JEFFREY BAKER TILLYChris Jeffrey is a partner and Midwest leader of the risk and internal audit consulting group atBaker Tilly. He is part of a practice that provides industry-specialized services to organizationswithin the manufacturing, higher education, public sector, real estate, government contracting,financial services, professional services, and energy and utilities industries. His areas ofexperience include internal audit, risk assessment, financial and operational risk management,Sarbanes-Oxley compliance, fraud investigation, technology risk consulting, and organizationalgovernance. He is the lead client service partner on numerous engagements and specializesin complex global organizations. He has published several articles and has spoken numeroustimes on the topics of internal audit, internal controls and compliance.SUCCESSION PLANNINGPublication date: 10/23AGRICULTURE BUSINESSPublication date: 10/30HEALTH CARE (SOLD OUT)Publication date: 11/13EDUCATIONPublication date: 12/4NONPROFITSPublication date: 12/18FRANCHISINGPublication date: 12/25Master of Science in Security TechnologiesGain the skills to prevent, protect and respond to today’s security demands witha Master of Science in Security Technologies from the University of MinnesotaTechnological Leadership Institute.Next info sessions:Tuesday, September 22, 5:30-7:00 p.m.Monday, October 19, 5:30-7:00 p.m.TO SIGN UP VISIT TLI.UMN.EDU OR CALL 612.624.8826
20MINNEAPOLIS/ST. PAUL BUSINESS JOURNALBY ELIZABETH MILLARDContributing writerThe Minneapolis/St. Paul Business Journal held a panel discussion recently, featuring three expert panelists to explore topics about fraud and cybersecurity.Panelists included Dave Wasson, cyber liability practice leader at Hays Companies; Chris Jeffrey, partner of risk advisory services at Baker Tilly; and BrianIsle, senior fellow, Technological Leadership Institute at the University of Minnesota.Molly Eichten, a shareholder at Larkin Hoffman, served as moderator.Eichten: Let’s start with discussing themost common types of fraud schemesand how these schemes are beingperpetrated within the world of thecybercriminal.Jeffrey: One of the most common fraudschemes that we see is anything where thecompany actually cuts a check. This canhappen in areas like payroll and accountspayable. Related to cybersecurity, oneof the schemes that we’ve been hearingabout are incidents similar to a “phishing”scheme where someone is reaching out toan executive and asking for a fake paymentto be made.Wasson: We have seen a significantnumber of phishing schemes. A majorcause often relates back to an organization’s inter nal controls that are periph-eral to cyber security. For example, anorganization would ideally stop a phishing email before it comes in. But if it doesget through, an employee may simply notnotice small changes in the email addressand it may fool them into acting at thesenders direction. In a situation like this,callback procedures to verify the identity of the sender behind the email communication could have easily stopped thescheme.Isle: The Verizon Breach Report did atargeted selection of phishing emails andthey found that 23 percent of the people opened them, and of those, 11 percent clicked on the attachments. The firstresponse was within 22 seconds.Jeffrey: We’ve also seen that executivesare not immune from opening phishingemails. In some cases, they’re more apt toopen them than other levels within thecompany.Wasson: Yes, in some instances youmight have a controller that requests anorder to transfer money and nobody wantsto question the chief financial officer. Theywill see that email come in and send themoney, because they think it is comingfrom the chief financial officer.Isle: But it turns out the email isn’t fromthe CFO. It’s really easy to fake an emailfrom somebody. The bad guys get the credentials and pretend to be someone else.Jeffrey: In these cases, the hackers aresimply monitoring email traffic and looking at everything to get a sense of how theCFO, or another executive, might communicate with employees, so they can dupli-Risk you can manage.Results you can measure.That’s the Hays Difference.700 Risk Management Advisors 35 Offices Across the Countrywww.hayscompanies.comcate an executive’s request.Isle: What I advise is that you shouldassume that every email you send is beinglooked at by multiple people. Every text,every attachment, is being watched. Ifyou send a contract to your favorite client over email, assume that seven otherpeople have read it. And some of them arelooking to steal money from you.Eichten: What are the most commonways that fraud schemes are uncovered?Jeffrey: The Association of CertifiedFraud Examiners, which is the primaryindustry association around fraud prevention and detection, reports that employee tips are the most common way fraudis detected. Their most recent Report tothe Nations in 2014 found that of all the
21SEPTEMBER 18, 2015fraud schemes that were reported on, 42percent were uncovered through employee tips. The second most common waythat fraud was uncovered was throughmanagement review (16 percent) and thethird was via internal audit (14 percent). Ithink those are important statistics whenit comes to cybersecurity, given the needto train employees. It’s important to teachpeople what to do in the event of a phishing attack. Another important point is thatcompanies should have a fraud or ethicshotline in place. As a best practice, thesehotline numbers should be available notonly to employees, but also to customersand vendors.Wasson: Even before you get to the fraudhotline, we see more and more companieslooking to underwrite their controls andpractices.Isle: Just because we have noncyberpeople here, please describe what wemean by “controls.”Wasson: Depends on the situation.One of the major issues is how companiesprotect their data, particularly on mobiledevices like cell phones and laptops. Ifan employee has a laptop and is travelingwith it, the company should make sure thedata is encrypted or utilize data-loss prevention software.Jeffrey: And everybody forgets that alaptop is still a mobile device.Wasson: Right, and it can be a tickingtime bomb of data. Laptops have lots ofstor age, and people have poor controls.For instance, they stick them in overheads, or leave them at the table at a coffee shop. But the oth er issue is updatingpatches. Sometimes you are in the mid-dle of something and you do not want torestart your comput er right then. But it’simportant that you get those updated. Alsoimportant is role-based access control, sonot everyone can see everything. That is away to stop inter nal fraud. You just wantto have a system of checks and balances.Isle: So, control could be any means ormethod of preventing unwanted exfiltration of physical assets or information. ForIT folks, a control is something they canimplement to measure the security statusof a certain asset, like a server or network.All of these controls are important.Wasson: We are starting to see morecompanies focus on that for employeetraining. They might have monthly or justrandomly selected training for employees,because they realize they purchase moresecurity and money only goes so far, andyou only get a certain level of security.From that point, the only way to increasesecurity is to train people to recognizethreats.Isle: The leading organizations in ITbuild security into the culture of the organization. When they have a staff meeting,they talk about where they’re at in termsof cyberattacks. The people who get it havesecurity at the top of their minds. Theyknow they’ll get attacked, they acceptthat, so they think about how they’llrespond. The really advanced companieshave moved to that point. Not only havethey increased the prevention part, but thereaction part is much stronger.Eichten: We’ve been talking aboutcompanies and fraud schemes, but arethere certain steps that individuals canNANCY KUEHNFrom left: Dave Wasson, Hays Companies;Molly Eichten, Larkin Hoffman; BrianIsle, University of Minnesota TechnologyLeadership Institute; Chris Jeffrey, Baker Tilly
22MINNEAPOLIS/ST. PAUL BUSINESS JOURNAL“Security is an ongoing process thatyou have to continuously monitor.”- Dave Wasson, Hays CompaniesNANCY KUEHNtake to reduce the risk of fraud?Jeffrey: For an individual, I think it’sjust about using some common sense. Iwouldn’t go into my bank account on mymobile device, for example. I would savethat for my home computer, where I knowI have more controls. I wouldn’t use a network I don’t know. I’m always amazed atthe number of people I see on a planechecking their bank accounts using thein-flight connection.Isle: In terms of other actions for individuals, if you haven’t changed your homewireless router in the past five years, stopon the way home and get a new router and configure it with best encryption.Because if it’s over five years old, the operating system is most likely vulnerable andunpatched. Second, I personally never doany financial transactions on a mobiledevice because I assume that 100 percent of the activity on the phone is beingwatched. Use your desktop, make sure it’spatched, keep your patches up to date,make sure you’re running modern antivirus and spam filter. Also, keep yourselfinformed about phishing schemes. If youget an email that starts out with someonein Syria who has 10 million to get out ofthe country, just delete it.Wasson: I am not so much againstmobile banking because if you look at anymajor credit card brand, they put your lia bility at zero. There’s less recovery if usinga debit card, though. I travel a lot, and I geta new credit card every six to nine months.I’ll watch my transactions and many timeswhat you’ll see is that someone will putthrough a transaction for a dime. Just tosee if you flag it. And if you don’t, criminals will swing for the fences.Jeffrey: That brings up a good point.I check all my accounts, every day. Thatincludes brokerage, credit cards, and bankaccounts. I look through the transactionsvery carefully. And I’m looking for thosereally small transactions.Wasson: Exactly. If you know your balance, you might not notice 15 cents beinggone, but you’ll see it on the transactions.You can’t let yourself be entirely hobbledby anxiety about security threats, though.You just need to know how to addressthem if they do happen, because, mostlikely, it will happen to you at some point.Eichten: One thing we’ve been hearingabout more lately is attacks on healthcare organizations and insurancecompanies. What do criminals do withhealth records?Wasson: Very often we’ll see that someone will take a large amount of records,batch them up and sell them. That mightresult in health care fraud. A criminaldoesn’t have health insurance, but theycommit identity theft and go get prescriptions or treatment. It’s the same as usinga credit card and pretending to be thatperson.Jeffrey: They can also use all the otherinformation in those records, in a varietyof ways. Those records have Social Security numbers, addresses, names — and that’sall usable.Isle: If I have that information, I canuse it to get a bank loan or pull new creditcards. I can defraud insurance companies.There are all kinds of ways to monetize thatinformation. The big change over the pastfive years is that criminals have really figured out how to monetize the theft of stolen information. There’s been a big jumpin sophistication. One aspect to keep inmind is that for 99.9 percent of the 2014breaches, the bad guys exploited knownvulnerabilities that have had patches available for more than a year. They’re usingvulnerabilities that everybody knowsabout. If you have your system up-to-date,it will slow them down. At this point wedon’t know how good the bad guys really are, but a well-maintained system willdefinitely make it harder for them.Eichten: What are the biggestmisconceptions when it comes to fraudand cybersecurity?Wasson: A lot of companies believethey will be indemnified. We get a lot ofcompanies that say, “So-and-so is goingto indemnify us.” But they don’t look atwhether the company has the money to doit. We see a lot of times that the insurancerequirements in the contract don’t makesense. We might see that whoever wrotethe contract took all the technology termsthey know, put them into a contract, andsaid we want 10 million for this. So, we’vebeen working with companies because Idon’t have great confidence that when itcomes down to it, they’ll get indemnity.Many of these contracts have incrediblelimitations on liability, and you’re probably not going to get much more than feespaid for the past 90 days.Jeffrey: At the end of the day, it’s still agood idea that you’re putting those agreements into place with third-party providers. You’ve got to understand what kind ofsecurity they have in place, if you’re transmitting your data to them.Wasson: I agree. We tell our clients toget the best requirements in place andobtain proper insurance coverage, but itis important to understand it is still yourdata and you are ultimately responsi ble forits safekeeping.Eichten: That brings up a good pointabout providers. In the old days,companies had all their servers onsite, but now they have off-site serviceproviders. What does that shift mean forcybersecurity?Jeffrey: I feel better if my clients use adata center to house their servers and/ordata as opposed to an on-site data center,or even a closet. Third-party data centerstypically have strong security measures inplace.Isle: The data centers and cloud providers are staffed by professionals whoknow how to do security. But that said,they need to know your security requirements. You need to write a contract withyour cloud provider that spells out yoursecurity requirements. For example, youmight have geographical limitations ofwhere the service provider can physicallystore the information. If I’m in an EAR- orITAR-regulated industry, my data has to bein the U.S., it can’t be moved to Taiwan.Without that stipulation in the contract,they can store the data anywhere in theworld that they have excess server space.Wasson: Alternatively, you might bedealing with the European Union, wherethey don’t think the U.S. is very secure,so they don’t let data be repatriated backhere.Jeffrey: That’s why it’s important thatyou’re working with your data center service provider to ensure that they understand your needs.Eichten: In wrapping this up, can youall provide some closing thoughts so wecan sleep at night?Isle: The good news is this isn’t rocketscience. Studies show that the majority ofthe exploits are leveraging known vulnerabilities. Basically, we are not closing thedoor to keep the bad guys out. We are notbeing diligent about security. No amountof technology will make up for the lackof organizational security policy, procedures that build organizational resiliencyand training. The training must be fromthe CEO to the janitor. The training bringsthe whole organization together aroundthe policies and procedures. You need tocreate a security environment that measures and learns from how your security isworking. That’s the only way an organization can make meaningful changes relatedto cybersecurity.Jeffrey: You know that fraud and databreaches happen. You can’t think that yourcompany is not a target, because that is nottrue. It’s important to know and understand your risks, so you can put the rightcontrols in place. Things like proper training, appropriate procedures and monitoring will help. It’s all about the three-leggedstool of people, processes and technology.Using those tools appropriately can helpprevent fraud and cyberattacks.Wasson: A lot of companies are taking the stance that compliance is security, but that’s a bit of a faulty idea. We seecompanies say, “We’re compliant with X,”and then they stop. But at the end of theday, no one will care about protecting yourbusiness the way you are, and you have togo above compliance to secure your dataand your people. Unless companies aregoing above and beyond, they’re going tofind themselves in a very hot situation. Toecho previous comments, your greatestvulnerability will be your people. Technology will perform as it’s told, but people don’t work that way. So, you have tofocus on how to prevent events by trainingand communicating with your employees.And finally, remember that security is anongoing process that you have to continuously monitor.
financial services, professional services, and energy and utilities industries. His areas of experience include internal audit, risk assessment, financial and operational risk management, governance. He is the lead client service partner on numerous eng
