Cyber Security in the Supply Chain

Cyber Security is generally accepted to encompass the protection of our interconnected information systems and assets including hardware, software, applications and data.  In that range of topics, one of the most important areas of concern for Cyber Security professionals is Vulnerability and Patch Management within the realm of Security Operations.

Vulnerability and Patch Management is the ongoing practice of ensuring that your systems and applications are kept up to date, scanned for known and unknown vulnerabilities.  The conventional wisdom is simple – when a software vendor provides security updates for critical application, these should be installed as soon as possible. Right?

Microsoft issues security patches for Windows and Office applications on the second Tuesday of each month. Apple issues security updates a handful of times per year.  Other vendors have similar programs.

When a vendor issues security updates, they usually disclose the particular security vulnerabilities that it was intended to fix.  So, as soon as a security update is released, the vulnerability becomes “public”. Now that the vulnerability is available (to bad actors) it is even more crucial that the fixes be applied in a timely manner.

All of this assumes that the vendor (the “Supplier” of this particular “Supply Chain”) has not already been compromised.  Imagine if a hacker could get in to the systems of our software supplier, make changes to released software that add malware.  Diligent users would unknowingly, and quite reliably continue to install updates, that now include malware.

If this sounds like a nightmare scenario, it is.  And it has already happened.

Examine the case of the Not Petya worm.  This started at a small company in Ukraine that supplies a piece of software called M.E.Doc.   You probably don’t use M.E.Doc. so you are not worried, right? M.E.Doc. is accounting software, used in Ukraine (think Quicken/TurboTax) and is required for filing national taxes.  So a large number of Ukraine based companies use it. In the spring of 2017, outside forces (likely Russian) hijacked the company’s update servers, injecting malware that included a small, but critical backdoor into the software.  As users updated their systems, they were infected with a backdoor, which laid latent for a month or two.

Then, the attack was launched.  The attack leveraged other vulnerabilities in Windows known as Eternal Blue and Mimikatz. These vulnerabilities rely on being “inside” the network of a company, behind the firewall, and once there, were able to spread globally encrypting data and asking for ransom.  Large multinational companies were affected, including banks, large shipping interests, manufacturing and more. If your company had an office in Ukraine, you may have been affected. If one of your suppliers, to whom you connect has offices in Ukraine, or is connected to someone who does, you might have been affected.

The upshot is this: Supply Chain security in Cyber Security is a now multi level concern.  Security professionals must now consider not only who might get in to their own network, but who might get in to their supplier’s network and who might get in to their suppliers’ supplier’s networks, and so on.

As is the case in other areas of Supply Chain security, we must concern ourselves with not only preventing bad things from happening, but assuming that they can, and trying to limit what can be done when bad things happen anyway.

And there is no simple answer.  Keep systems up to date to protect from know vulnerabilities.  But know that these updates can themselves introduce other vulnerabilities.

This article was written by Dave Ehman and edited by Kristina Weber. For more content like this, be sure to subscribe to Centry Blog for new articles every other week on topics relevant to the security industry. Follow us on Twitter @CentryCyber and @CentryLTD!

What is Social Engineering?

One of the most common methods of fraud is social engineering. This refers to a calculated deception that targets people in order to obtain sensitive information relative to their business, identity, or finances.  

There are two main categories of social engineering: (a) Mass Fraud, which is mostly comprised of basic techniques meant to scam a high quantity of people; and (b) Targeted Fraud, which is a highly-specialized method of fraud that singles out a specific individual or company.

The majority of these schemes follow the same general path. It begins usually with gathering information on a topic or target. Once enough information about the target has been obtained, scammers can focus on developing a false sense of security and trust with their target. In cases of mass fraud, this could look like replicating the design of a Netflix customer service email, or in targeted fraud establishing enough of a friendly rapport with an individual over the phone that they feel comfortable providing more and more information. Once this has been established, scammers can exploit any of the identified vulnerabilities and ultimately execute the scam.

Social engineering works because it preys on our instinct to trust.

Let’s say you are at work and receive a call or email from a “colleague” asking for some sort of account number or other piece of information related to the business. If you haven’t had any training on your company’s confidentiality policy, you might not think twice about providing this person the information they ask for. After all, they might seem trustworthy, or talk about things in a way that would give you no reason to suspect they aren’t a fellow coworker. That’s because they have meticulously studied how to prop up the illusion.

These types of attacks are common; all you need to do is look at the news to find examples. Just recently it was found that hackers connected to the Russian government were impersonating US State Department employees and sending emails with downloadable attachments. These attachments would then install software that could provide the hackers access to internal systems.

These fraud attempts aren’t just work-related. They can target you at home, too.

The Internal Revenue Service (IRS) of the United States just issued a warning about a new tax related scam. A surge of emails recently have been impersonating the IRS and using “tax transcripts” as bait to trick users into opening documents that contain malware. The malware behind this scam, Emotet, has been historically associated with posing as financial institutions in order to encourage people to download the malicious attachments. The IRS has recommended that if you have received one of these emails to delete it or forward it to phishing@irs.gov.

So how can you protect yourself?

Individuals can take the time to be vigilant of unfamiliar calls and emails. Sometimes social engineering won’t be a singular attempt. It could be repeated calls over years that slowly harvest the information needed to execute a scam. When in doubt, you can double check with the source, and avoid providing personal information. Meanwhile, companies can develop a guide for handling sensitive information to avoid blunders with fake employees. With sufficient training, employees can be taught to recognize different types of fraud and have an established plan for handling it should they come across it.

This article was written by Kristina Weber of Centry Global. For more content like this, subscribe to our blog and follow us on Twitter @CentryLTD!

Finnish Security Awards 2018

We are honored to have been part of the Finnish Security Awards (FSA), which took place last month in October 2018. This is the fourth time that this event has been organized, thanks to Turvallisuus & Riskienhallinta, a Finnish security and risk management magazine.

This year the awards were held at the Old Student House in Helsinki. The opening ceremony featured a presentation about the future of security and safety by Professor Esko Valtaoja. There are eleven award categories at FSA, and each one had its own jury that was comprised of respected professionals in the industry.

A number of us at Centry attended the awards ceremony, and Mr. Risto Haataja of Centry was a member of the jury that selected Security Company of the Year!

This slideshow requires JavaScript.

Finding a Due Diligence Provider for your Business and Why it Matters

Company risk manifests in a myriad of ways, some seemingly easy to overlook and others more obvious. One of the biggest risks in day to day operations for companies comes from third parties – distributors, potential employees, suppliers, service providers, contracts, clients, vendors, etc. Basically, anyone on the outside who encounters your business can potentially become a threat.

Many security providers cannot address the risks and complex environment in hostile and emerging markets. They lack the needed infrastructure and cultural understanding to be able to provide services of high quality in locations outside of their area of familiarity, as majority of them are based in Europe or the USA.

The security provider should be a key to success, helping companies in business growth, finding new markets and mitigating potential risks.

What you don’t know can hurt you

Companies need to make informed decisions. The initial analysis of potential ventures and associated risks will show you the situation at hand and how to move forward.

Due diligence is an important part of every process at a business, from mergers and acquisitions to finding the right suppliers and clients.

Comprehensive due diligence is extremely important to getting the whole picture of an applicant or a third-party business relationship. Without going through this process, you expose your business to countless threats.

Making an assumption based on surface-level information could lead to difficulty conducting business, or at worst, breaching sanctions.

It is true that financial losses can be offset by insurance when damage has already taken place, but the stains on the company’s image and reputation are not covered by insurance policies.

Due Diligence makes it possible to secure the business environment before the incident occurs. In the case of cost structure, this can be found to be more of an investment as opposed to an expenditure.

What kind of provider do you need? The most suitable provider will be the one who has already dealt with the same or similar case in the market you want to operate and has built their network. They can aid you in determining potential risks as well as creating a mitigation agenda and budget through their local resources.

Field agents can provide insight into the environment you will be operating. They have years of professional experience and know the details of the potential uphill battle with the dangers and risks. There is no substitute for local knowledge.

It can be invaluable to know the backgrounds and affinities of the stakeholders that influence the company’s operations. Even if the investigated entity is perfectly compliant and lawful, these types of reports can be helpful simply on a level of benefitting the business relationship with information and perspective. The best results with Due Diligence investigations are often achieved when the process is outlined and integrated into the company’s entire business strategy.

Finding the security provider you need is not an easy task. Seek references and assess the capabilities of each provider. Look for companies who work on the ground and know the environment. The ideal partner has developed their network in the location you want to operate in and they possess local knowledge and expertise.

No one has all the answers, but you can find most of them by choosing the right security provider.

This article was written by Daniel Dadikozyan of Centry Global. It has been cross-published in the CIISCM magazine. For more content like this, be sure to subscribe to Centry Blog. If you have any questions or comments about due diligence services, feel free to reach out to us at info@centry.global!

 

Golden Visa for Sale! Now on special offer for the 1%

European passports and Schengen visas are the most desired traveling documents in the world. Not only do they grant the most traveling freedom, they give access to a safe and stable living environment, with free speech, in a market that can fulfill all your needs.

Many EU countries have taken advantage of this by offering entry in exchange for investment. This kind of activity is commonly referred to as a Golden Visa Program. For the subject countries, they are indeed golden, because they have the potential to bring in billions of capital into the country. Latvia, for example, used the program to stabilize its economy after the financial crisis.

According Transparency International, such programs have been in existence since the 1980s, and currently at least 12 EU Member States are offering them. Usually the reward is a residence permit, however Cyprus and Malta offer a fast track to citizenship should the customer invest enough money, and Portugal offers the citizenship option after a six year waiting period.

While the controls in most European countries should prevent individuals who are sanctioned by the EU from obtaining citizenship, many individuals took advantage of Golden Visa programs prior to implementation of the current international sanctions. It is a complicated matter for a nation to try to implement sanctions on its own citizens and capital that is invested within the country.

Most of these programs are legitimate, but the way they are set up invites abuse. Real estate is one of the easiest ways to launder dirty money, and these programs are taken advantage of all over the place.  

Some of the Golden Visa and Golden Passport programs are complex and might involve long red tapes and waiting periods. Of course, sometimes a suitable facilitation payment can fix that…

Latvia Golden Visa Program

The Latvian Golden Visa Scheme was heavily criticized. From 2010 to 2014, Latvia offered it at a discount price of EUR 71,150 if invested in countryside real-estate. The price for living in Riga was doubled to a value of EUR 142,300. As you can see, this could very easily be taken advantage of by someone looking to spend dirty money.

The number of people who took up this offer increased substantially  in 2014, the same year that Russia annexed Crimea. Almost 90% of the visa applicants came from Russia and countries that were formerly in the Soviet Union.  Thus, a program that had originally been intended for economic development and brought wealth to Latvia in the previous years had become embroiled in political significance.GV-by-Year

Picture 1: Latvian Golden Visas per year (Source)

The negative effects of the program eventually convinced the Latvian Administration to dismantle the discount in 2014. The greatest risk of these visa programs was spying, according to the deputy head of the Latvian Security Police in a 2017 parliamentary committee hearing. Then, of course, there was the risk to the economy, since many applicants were unable to prove the legality of their money. Although the program has since been dismantled, the effects of it and risks introduced by it will be felt for years to come.

Hungarian Golden Visa Program

Another interesting notorious golden visa program was the one in Hungary.

The Hungarian Golden Visa program was slightly different than in Latvia. Instead of it being based on investment in real estate, applicants had to buy a state bond from one of eight companies that had solitary rights to sell them on the behalf of the government. These bonds, which totaled up to EUR 300 000, were not inexpensive.

The results of this program were remarkable. The eight companies were able to earn about USD 600 million – and that’s a conservative estimate – over the course of the years that this program was running from 2013 to 2017. (OCCRP May 16, 2018)

The program ended in 2017 after criticism concerning the integrity of the eight bondseller companies. They were pretty mysterious – most were registered in offshore tax havens and it wasn’t completely clear who exactly profited from the sales.  

An investigation conducted by g7.hu and Transparency International Hungary uncovered the way these companies worked. Basically, companies would be assigned to territories around the world and allowed monopolies to sell the bonds under the program. But the way these companies were assigned required inside knowledge and connections – it wasn’t like it was a public tender. They had to have known about it separately since it was never advertised. Per the law, all the applicants were meant to be listed on the Hungarian Economic Committee’s agenda, but this was not always the case.

Although the Golden Visa program in Hungary has since been shut down, there are some rumors that a new ‘golden’ immigration program may be coming. Direkt36 reported that this new program was advertised by a Hong Kong based company on the Chinese platform WeChat. This new program now more closely resembles Latvia’s program, where applicants are required to invest a value of EUR 78 000 into Hungarian real estate.

Case Study: Who buys the visas? 

methode%2Fsundaytimes%2Fprodmigration%2Fweb%2Fbin%2Fb5259512-d8a9-4588-a80a-b4ca90e78b9d.jpg

Picture 2: Screenshot of Mr. Bogolyubov from The Times

Mr. Gennadiy Bogolyubov, the Cypriot, the Israeli, the Brit, the Ukrainian

Main Source: EveningStandard 11 Sep 2018

Mr. Gennadiy Bogolyubov is a popular face in the oligarch edition of the Bold and the Beautiful. He and his business partner, Mr. Igor Kolomoisky, are some of the best customers for UK lawyers – the costs alone for the litigation with their rival Mr. Viktor Pinchuk was estimated to be over GBP 50 million. The allegations and adverse reputation of the duo include alleged murders, violent takeovers and other accusations of mafia-style activities.

The two partners were very successful in post-Soviet era privatizations. Allegedly, the hasty privatization of a national bank in Ukraine to PrivatBank enabled the duo and their associates to empty out the bank’s capitalization with a decade long fraudulent loan scam.

To protect taxpayers’ interest and due to demands from Ukraine government’s external financiers (i.e. USA) PrivatBank was re-nationalized in 2016. “When Ukraine’s finance minister went to oversee the nationalization of the country’s biggest bank in December 2016, he took with him a team of bankers—and a security detail of special-forces operatives” (Wsj.com April 6, 2018).

Amongst Mr. Bogolyubov’s hobbies are philanthropy, which he practices through Bogolyubov Foundation.

Golden Visa United Kingdom Tier 1 Investor Visa (2009)

Cyprus Golden Citizenship (2016)

Nationalities Ukraine, Cyprus, Israel, United Kingdom
Current Residence Switzerland
Net Worth Unknown, was Ukraine’s #3 richest in 2010 (Kievpost)
Frozen Assets At least USD 2.6 Billion, shared with Mr. Igor Kolomoisky
Costs to Ukrainian Taxpayers USD 6 Billion to recapitalize Privatbank
Close Business Partner Mr. Igor Kolomoisky, who, according to a quote from the British Court, has taken over companies “at gunpoint” in Ukraine. Mr. Kolomoisky is a former governor and listed as an inactive PEP (Politically Exposed Person) per Dow Jones
Other Associates Mr. Alexander Zhukov, father of Roman Abramovich’s girlfriend
Powerful Enemies Mr. Viktor Pinchuk
London Real Estate GBP 62.5 Million home

GBP 20 Million house

Eaton Place Mansion

GBP 173 Million office block

Table 1. Mr. Gennadiy Bogolyubov’s Connections

This article was co-written by Oskar Savolainen and Kristina Weber of Centry Ltd. For more content like this, be sure to subscribe to Centry Blog for articles related to the security and risk industries.

Common Security Dos and Don’ts

internet screen security protection

Photo by Pixabay on Pexels.com

Security vulnerabilities pose a major threat to organizations. Breaches can be costly both in terms of finances and reputation. So what are some ways that businesses can take initiative in protecting themselves against some of the most common security threats?

Do screen job applicants and third parties

Comprehensive background checks and due diligence are extremely important to getting the whole picture of an applicant or a third-party business relationship. Without going through this process, you expose your business to countless threats.

Typical background checks may verify an applicant’s residence and professional history, where a comprehensive investigation including social media can identify more subtle connections that would alter the risk recommendation. If your business does not have the resources to do this on its own, we can help you with our team of professional investigators. Don’t hesitate to reach out!

For more on this subject, be sure to read our article on The Significance of Background Checks in Business.

Do come up with a robust security policy

Your organization’s security policy should cover procedures for preventing, detecting, and acting upon misuse, as well as guidelines for conducting due diligence. These should be crafted with a plan for investigating insider breaches as well.

A good security policy also contains risk management processes. Check out our guide here on the basics of forming a risk management plan.

Don’t overlook the threat of malicious emails

Your organization might go to extremes to secure their email system, and yet it remains one of the most vulnerable links in the chain. All it takes is for one person to inadvertently click on an malicious link or attachment to infect all the computers in the office.

A good rule of thumb is to never open a link or attachment if you don’t recognize the sender, and ensure that your employees are trained in recognizing this type of scamming/phishing behaviour. For help in training your employees on this, don’t hesitate to reach out to our cyber security team.

For more content like this, subscribe to our blog for regular updates in the security industry. If you have any questions or comments, feel free to reach out to us on Twitter @CentryLTD

Centry Opens New Office in Mexico City!

el-angel-de-independencia--mexican-landmark-552812595-59863bb2519de2001116a0d0

We are pleased to announce the expansion of Centry Global to Mexico!

Our new office is now open, located on the 17th Floor Torre Magenta, Paseo de la Reforma 284, Colonia Juarez, Distrito Federal, Mexico CP 06600.

new office.PNG

As an international security company, our work takes us across the world. With the opening of this office, we are now able to better serve our clients in the region.

At Centry, our focus is to develop long-term, communicative working relationships to provide you with the best resolutions to your security challenges. While our combined expertise primarily revolves around security and risk management, you will find among our ranks professionals in corporate and private investigations, fraud control, and experts in programming, software development, and more.

We look forward to meeting and working with more clients across Mexico. Please don’t hesitate to contact us!

📧 info@centry.global 📱 +52 55 4739 2665