Interviews

Ransomware seems more prolific than ever. Why is that and do you think we’ll see that change at all in the near future?

Published

1 year ago

July 6, 2022

admin

Paul Prudhomme, Head of Threat Intelligence Advisory at Rapid7

Multiple factors have encouraged the proliferation of ransomware. One factor is the snowball effect, in which successful ransomware attacks fuel more ransomware attacks. Victims who pay ransoms encourage more attacks by demonstrating that ransomware is profitable. Paying ransoms further encourages more attacks by giving attackers more financial resources with which to fund more numerous or ambitious attacks.

The rise of the remote workforce has also created more opportunities for attackers to gain access to targets by targeting the home infrastructure and personal devices of remote employees and compromising remote access services (such as RDP and VPNs) and virtual communication platforms (such as Slack and Zoom). The initial access brokerage market, in which specialised vendors acquire and sell compromised network access to other criminals, has thrived as a result of this transformation. Ransomware attackers are key customers for this market and have thus been able to scale their operations along with it.

Another factor is the ability of ransomware attackers to develop new tactics in response to organisations’ defences in a cat-and-mouse game. For example, many organisations implemented more robust backup systems as a defence against ransomware, so as to relieve the pressure to pay ransoms by maintaining the ability to restore files without paying ransoms. Ransomware attackers adapted to this challenge by adding a second layer of extortion to their attacks, in the form of data disclosures. Threatening to disclose compromised data if a victim refuses to pay the ransom works around organisations’ backup defences, which are useless against the threat of data disclosure.

Paul Prudhomme

Russia, Ukraine, and other former Soviet republics have historically provided a safe haven for ransomware operators and many other criminals, as long as they restricted their attacks to targets beyond that region. The Russian invasion in Ukraine has already had a significant impact on ransomware operators in both countries, but the ultimate long-term implications are still to be determined as the war continues. Some implications thus far have included: the damaging leak of internal chat records from the Conti ransomware group, in response to its threat to retaliate for foreign cyberattacks on Russia; financial disruptions to Russian criminals due to the economic isolation of Russia; and disruptions of Internet service and other functional problems for ransomware operators in Ukraine due to war damage.

Can you explain what ‘double extortion’ is and why has it become a popular technique for ransomware gangs?

“Double extortion” refers to the addition of a second layer of data disclosure threats to ransomware attacks, beyond the historic focus on encrypting files and holding them for ransom. A “double extortion” attack involves threatening to disclose compromised data from the network of a ransomware victim if the victim refuses to pay an additional ransom line item for that.

The threat aims to put more pressure on victims to pay more by subjecting them to the risk of additional harm to their business through exposure to fraud or further compromises, legal or regulatory liabilities, damaged reputations, the exposure of intellectual property or other trade secrets. It also aims to maximise profit from ransomware attacks by further monetising an attacker’s access. This tactic emerged in response to organisations’ implementation of more robust backup procedures, which are effective against the file encryption layer of ransomware attacks but useless against the threat of data disclosure.

From the research, customer and patient information was the most frequently leaked data in the financial industry, was this different when compared to other sectors and, if so, why is this the case?

Our research found that customer/patient data was the second-most popular category of files for ransomware attackers to include in data disclosures across all industries, but it was the most popular category for victims in the financial services industry by a very wide margin. Leaking customer/patient data is a popular tactic for use against customers/patients in all industries because it erodes consumer/patient confidence in them and can thus be an effective way for ransomware attackers to hit victims where it hurts – that is why we chose the phrase “pain points” in the research report title.

We believe that this point is even more valid for the financial services industry because they depend even more heavily than other industries on customers’ confidence in their ability to protect their money and their personal information. Ransomware attackers would thus be more likely to leak customer data from a financial services victim because it would put more pressure on the victim to pay.

What can financial organisations do to protect themselves against double extortion attacks and ransomware more broadly?

One of the goals of this report was to enable organisations to identify those “pain points” that ransomware attackers are most likely to target in the data disclosure layer of a ransomware attack. These insights, such as the above-mentioned emphasis on customer data in the financial services industry, can help financial institutions and other organisations identify those assets that ransomware attackers are most likely to target. Organisations can provide those most frequently targeted assets with additional layers of defence.

One additional layer of defence is network segmentation, with the goal of preventing attackers from ever accessing that data in the first place, even if they do gain access to other parts of the network. Another layer of defence is file encryption, so that the files would be useless for the purpose of data disclosure, even if attackers do gain access to them.

Financial institutions can defend themselves against ransomware much like organisations in any other industry. Anti-phishing education can make employees less likely to click on the malicious email attachments and links that often initiate attacks. Spam traps can prevent many malicious messages from ever reaching employees in the first place.

Securing remote access services, such as RDP and VPNs, is a critical defence against ransomware attackers and the initial access brokers that provide many of them with access to compromised networks. RDP services are popular targets for brute force attacks, and should be disabled if not in use. If RDP is in use, the organisation should implement rate limiting and require two-factor authentication, preferably via mobile app rather than SMS. VPN software should receive regular updates to patch it for newly discovered vulnerabilities that attackers can and often do exploit. Accounts on remote communication platforms should have two-factor authentication to prevent attackers from compromising them and using them to expand their access by impersonating legitimate users.

Are there any other cyber threats targeting the finance sector that should be top of mind for businesses?

One of the most severe threats to financial institutions is the risk of large-scale fraud via compromised access to interbank payment systems such as SWIFT. Such attacks in the past have been attributed to state-sponsored North Korean actors, as well as some of the more sophisticated Russian-speaking criminals. Such attacks are less common than other threats but can have more severe consequences when they do happen.

Up Next

Overcoming the threat of voice fraud in the financial industry

Don't Miss

How MFA can protect the financial sector from the unprotectable

Interviews

An Interview with Niall Kiernan

Published

2 months ago

July 28, 2023

admin

TINTRA PLC FINALISES JOINT VENTURE WITH ARTIFICIAL INTELLIGENCE PARTNER

Niall Kiernan, Senior Director of Product Management for eCommerce and Marketplaces at Vertex

Tell me a bit about your career, your journey into the tax industry, and your progression towards your current role at Vertex?

“I wouldn’t say I have a classic tax background in the way that many of my peers would at Vertex. I joined Citibank in 1999, where I started to build my career as a product manager.

What the banking and payments industry gave me – especially now as we move towards a convergence of payments and tax within the eCommerce space – was a solid understanding of how payment flows work, which is critical to eCommerce and marketplaces.

Over the following five years post Citibank, I worked in the banking regulation software space, in banking book collateral management, which is a particularly complex and highly-regulated area.

From there, I moved into product safety regulation to work with some of the largest brands in retail and became very familiar with the product lifecycle, looking at areas such distribution and delivery chains. I held a position as Head of Product at a company called Taxamo, for example, which initially served digital services eCommerce businesses. It was here that I found my footing in indirect tax and developed an understanding of how it impacts the eCommerce journey – which is at the core of what Vertex does for its clients.

Joining Vertex has allowed me to expand this knowledge even further, and draw great insights from our team of subject matter experts to address new, emerging challenges for clients in the realm of indirect tax – which is constantly evolving each day.”

What does your day-to-day role at Vertex involve?

“As Senior Director for Product and Marketplace I’m responsible for the Vertex ecommerce strategy, working with various stakeholders and our exec team to ensure the strategy is robust, well understood, and flows throughout the organisation. I work very closely with the various other departments – particularly engineering on one side and our commercial organisation on the other.

Niall Kiernan

This is to ensure we’re regularly interacting with and listening to our customers, understanding their feedback, and merging that into our requirements to continuously improve our products to solve market challenges. Then, on the commercial side of Vertex, from sales to marketing, we can refine our go-to market message so that it is positioned correctly and resonating with these customers.

We’re always aiming align our marketing messaging with the conversations our sales teams are having, so that everything they’re doing matches up with the products we’ve built. Ultimately, Vertex’s goal is to deliver quality products to our customers, and it’s my responsibility to ensure that happens.”

What trends within omnichannel commerce are you currently experiencing? What are the common challenges customers are experiencing within the eCommerce and marketplace space?

“In terms of omnichannel commerce, a particular challenge for traditional ‘bricks and mortar’ businesses is tapping into the eCommerce or marketplace channel, from a marketing perspective as well as a logistics perspective.

If a customer is buying a product online as opposed to walking into your store, this raises a multitude of issues. Where are the goods stored? How will they be transported to the purchaser? And how am I going to calculate the tax on these goods? If a customer is online, it’s difficult to determine where they are based and what taxes need to be applied.

Then, for the more sophisticated companies, from an eCommerce perspective, challenges lie in that they want to grow fast and move across borders quickly, which brings hurdles like the logistics of delivering, determining the right payment provider, and applying the best tax system. Managing these complexities is costly, so Vertex’s goal is to facilitate a frictionless tax management process so that businesses can focus their resources on expanding their reach.”

In your opinion, what encompasses a great eCommerce and marketplace strategy, to meet these challenges?

“With a great eCommerce strategy, speed is critical. In a world where we can purchase something on a phone in a couple of taps or clicks with modern technology, we become very impatient when it comes to the purchasing process. If a customer thinks they are buying something for £10, but there’s an extra tax for another £5 or an extra delivery charge they weren’t expecting, they are very quick to drop out of that purchasing cycle.

That’s why a good eCommerce strategy should encompass a fast, frictionless experience to ease the process for the buyer. Any eCommerce business or marketplace must focus on that speed and latency.

From a tax compliance and calculation perspective, what is needed is a solution that integrates with the existing buying process, taking the burden off sellers and customers.”

What is your view on where the global eCommerce sector is heading? What trends or disruptions can we expect over the next 10, 20, 50 years?

“The current trends point to a continued increase at which the speed of eCommerce is growing, as well as an optimisation of distribution chains which will further improve the buying process. Considering the likes of Google Business Message (GBM) and the advancement of AI, the process will rapidly become optimised further as these tools are more readily used.

There will also be a focus on improving the ways in which we deliver goods, for example, using drones to optimise the transportation process. Even virtual reality has the potential to allow customers to virtually walk into a shop or see how something looks without having to set foot outside the house, further optimising the purchasing experience for consumers.”

What does it mean to you to be an industry leader in the tax software sector?

“We’re very proud of who we work with at Vertex, with 60% of the Fortune 500 using our services, which gives us the scope to be trusted thought leaders in the tax software space. With 40 years in the tax industry, it’s great to see that people will come and talk to us about new ideas and opportunities for projects.

For example, we’ve recently launched a new product called Iris which helps clarify sustainability and tax compliance obligations. It’s great for Vertex to broaden out from tax calculation and determination and solve more problems in the end-to-end flow of retail and eCommerce.”

What does the future look like for Vertex?

“We know that at our core, Vertex is a tax calculation and determination business, and that’s what has helped us grow over the years, expanding from the US into international spaces. At the same time, our customers are looking more and more for an end-to-end tax management solution, and over the last couple of years, we’ve really expanded into that area.

Now, we focus on filling the gaps of the end-to-end flow so that customers know they can come to Vertex to get quality products that meet all their needs. I think in the future, we are going to look to continue that trend, and work with customers and our partners to understand what these needs are in the fast-evolving eCommerce sector.

New business models are emerging all the time – with new ways of selling, charging for and delivering products – so new regulation challenges are created as a result. As Vertex evolves, we want to continue to address these challenges and improve our products and services to ensure fast and frictionless eCommerce for businesses.”

Copyright © 2023 Vertex, Inc. All rights reserved. The information contained herein is intended for information purposes only, may change at any time in the future, and is not legal or tax advice. The product direction and potential roadmap information is not a guarantee, may not be incorporated into any contract, and is not a commitment to deliver any material, code, or functionality. This information should not be relied upon in making purchasing, legal, or tax decisions. The development, release, and timing of any features or functionality described for Vertex’s products remains at the sole discretion of Vertex, Inc. Any statements in this release that are not historical facts are forward-looking statements as defined in the U.S. Private Securities Litigation Reform Act of 1995. All forward-looking statements are subject to various risks and uncertainties described in Vertex’s filings with the US Securities and Exchange Commission (“SEC”) that could cause actual results to differ materially from expectations. Vertex cautions readers not to place undue reliance on these forward-looking statements which Vertex has no obligation to update.

About Vertex

Vertex, Inc. is a leading global provider of indirect tax software and solutions. The company’s mission is to deliver the most trusted tax technology enabling global businesses to transact, comply and grow with confidence. Vertex provides solutions that can be tailored to specific industries for major lines of indirect tax, including sales and consumer use, value added and payroll. Headquartered in North America, and with offices in South America and Europe, Vertex employs over 1,300 professionals and serves companies across the globe.

Interviews

“The Underdog to Top Dog Mentality”

Published

2 months ago

July 18, 2023

admin

By Korosh Farazad, Co-Ceo, Farazad Investments.

Pleasure to have you here. Please tell us about your presence being a global Boutique Investment House.

Thank you for having me. Farazad Investments is a subsidiary of Farazad Group, and it compliments rather than competing with the other subsidiaries of the group of companies. Mostly, 80% of the business model specialises in the Real Estate Capital Markets with a strong emphasis on the hospitality investments. We focus on an A-Z structure, where we assist our clients with all elements of the capital stack (combination of different types of financing constitutes a mix of debt and equity instruments, each with varying levels of risk and return.), identifying hotel operators whether they are franchise operators or Hotel Management Agreements (HMA), different F&B concepts to compliment the region, theme of the operator, providing ideas and concepts for other revenue streams for the asset and not simply focused on the revenues from the room and occupancy rates. Having the ability to operate worldwide, it allows us to cater to clients in different countries and regions. We provide a personalized and tailored services to meet the unique needs of our clients in the real estate and hospitality sectors alongside other sectors that are not strictly hospitality driven (multi-residential, industrial, student-housing, etc.). We have a developed expertise and deep knowledge in these areas, allowing it to offer specialized advice, strategies, and solutions. Everything is done in-house, from the initial assessment to deal structuring and execution, which allows us to take full responsibility for the work we do and always have a direct dialogue with our clients and investment partners.

The other 20% of our business model is Corporate Finance, M&A’s, and introducing qualified companies with a healthy EBIDTA and business plan, to become a public company (IPO) within their jurisdiction.

We have a very talented team of people working for the company in Hong Kong, Seoul, and London, which allows us to have a wide reach of different equity investors, lenders at our fingertips to introduce potential opportunities subject to pre-underwriting the deal to understand the validity of the transaction and its success ratio. We currently have two companies that are going IPO in S. Korea and the other in Melbourne, Australia. The Korean opportunity is absolutely going to revolutionise hearing aid and I think by the time this interview published, the company will be officially a public company.

As of date, Farazad Investments continues its global business expansion. What are the upcoming strategies?

Let me start by saying, I never thought that the company would be in the position that it is today with roughly US$ 1 Billion in deal flow and mandates in its books, and more importantly, the expansion of the other subsidiaries, which are Farazad Advisory, Farazad Ventures, Farazad Facility Services and HYDE Recruitment (outsourcing temporary workers to Hotels across UK to fill in the labour gap post BREXIT).

Sector Diversification: To focus on diversifying client base across various sectors. By expanding the expertise beyond a single industry, this way, we can can reduce risk and capture opportunities in different market segments.

Geographical Expansion: We are aggressively considering expanding presence into new geographical regions or markets. This would constitute establishing offices or partnerships in key global financial centres to attract a wider range of clients and access different sources of capital.

Enhanced Deal Sourcing: We have planned and now in action to develop robust deal sourcing capabilities to identify attractive investment opportunities. This may involve leveraging technology, data analytics, and networks to discover untapped markets and high-potential projects.

Specialized Advisory Services: This goes back to the subsidiary companies complimenting and not competing, our specialized advisory services that provide unique insights and value-add to clients. This includes in-depth sector expertise, customized financial solutions, and strategic guidance throughout the investment lifecycle.

Innovation and Technology: Embracing technological advancements and innovation can significantly enhance efficiency and client experience. We have monitored this sector and have considered investing in advanced data analytics, artificial intelligence, and automation tools to streamline processes, improve decision-making, and provide real-time insights to clients.

Sustainable and Impact Investing: There is a growing trend towards sustainable and impact investing. With 90% of our transaction, we have incorporated environmental, social, and governance (ESG) into our client’s investment strategy, only if one was not implemented prior to them introducing the transaction to us. Further, we offer clients opportunities to align their investments with their values with ESG would is an imminent win for all parties.

Capital Markets Expertise: Given the mandate to raise both equity and debt financing, this requires for us to always be tuned and up to date on market trends, maintaining relationships with investors and lenders, and offering innovative financing structures tailored to clients’ needs.

Client Relationship Management: One of the core and fundamental focuses for us is building strong, long-term relationships with clients. By providing exceptional client service, maintaining open lines of communication, and understanding their clients’ evolving needs, they can foster loyalty and attract new business.

As a CEO of a boutique investment house, what are the leadership and management skills you have implemented to have the team benefit from?

Clear communication: One of the most essential skills for any leader is the ability to communicate effectively with the team. Despite the challenges this may have, I have developed a clear communication plan and ensure that everyone is aware of their roles and responsibilities.

Empathy: Being an empathetic leader means understanding and acknowledging the team’s perspectives and needs while leading them towards achieving company goals. Encourage and motivating the team to speak up, listen actively to their concerns, provide solutions, and foster a safe and respectful work culture.

Focus on Goals: Focus on setting clear and measurable goals for my team so that they can strive to achieve them. These goals can further motivate them and allow them to showcase their individual strengths and work collaboratively to achieve the shared goals.

Lead by example: Leading by example is a crucial aspect of a good leader. It means that I must always demonstrate the qualities that I want my team to embrace. Show initiative, be proactive, prompt, organized, and disciplined.

Continuously learn and develop: As a leader, it is super important to continuously teach/guide and develop their skills to become better. Encourage them to learn and grow by providing ongoing training and development opportunities to enhance their skills and knowledge where and if needed.

Do you have a hobby outside of work that helps you be a better leader?

As a CEO and running several companies literally simultaneously on a day-by-day basis and making precise and calculated decisions is part of the process and therefore, engaging in hobbies or as I call it “different value-add activities” outside of work can be instrumental in enhancing leadership skills and adapting to a constantly changing world.

Reading: Cultivating a habit of reading helps broadens my knowledge and understanding of various subjects, including business, leadership, economics, technology, and global affairs. It enables me to stay informed, think critically, and make well-informed decisions in a rapidly evolving business landscape.

Physical Fitness: I maintain and try to maintain an active lifestyle through exercise or walking to my meetings and getting in my 10k steps on a daily basis, which not only promotes my well-being but also fosters discipline, resilience, and determination.

Traveling: One of the values and perks my job offers is the travelling. I travel on average once per outside of UK; this is either day trips or overnight stays. This most certainly allows me to experience different cultures, meeting diverse individuals, and experiencing new environments that most certainly expands my perspective and develops my adaptability. I am proud to say, I have lived in several different countries and for me, adapting is no longer a challenge, and it is considered art!

What do you expect 2024 to bring?

To be perfectly candid, we had no idea how 2023 was going to turn out and we managed to overcome some very challenging times in terms of cost of financing, identifying different equity partners with the same vision and alignment with ours and our clients.

Of course, the specific outcomes can be influenced by various factors and are subject to market conditions and economic trends. To continue with the positive streak and not get side tracked with the volatility of the markets and pessimism, we focus purely on

Market Conditions: The performance of the financial markets can greatly impact the activities of our group. If the global economy continues to grow steadily, it will create a favorable environment for investment and capital raising activities. However, market conditions can be volatile and subject to various risks, including geopolitical events, regulatory changes, and economic downturns. It’s crucial to stay vigilant and adapt to changing market conditions.

Deal Flow: As of 30 May 2023, we have roughly US$ 750 million of mandates within our active pipeline. The deal flow can be influenced by market sentiment, investor appetite, and industry-specific trends. If the economic environment remains favorable, we can easily see increased activity in mergers and acquisitions, capital raising, and advisory services.

Technology and Innovation: The financial industry is undergoing rapid technological advancements, including digital transformation, automation, and artificial intelligence. Embracing these innovations can enhance operational efficiency, streamline processes, and improve client experiences, which has had integrated this year but 2024, this process will be ramped up significantly.

With the foundation that I have created just within the last 5-years has allowed the company to work seamlessly and continuously grow by average 20% on average. This is simply with the structure, which I have explained above.

Talent and Team Development: As the CEO, last year, I started preparing and nurturing a talented and diverse team for the long-term success of the brand. Therefore, for 2024 and beyond, investing in employee development, attracting top talent, and fostering a culture of innovation and collaboration will be vital.