Finnish Security Awards 2018

We are honored to have been part of the Finnish Security Awards (FSA), which took place last month in October 2018. This is the fourth time that this event has been organized, thanks to Turvallisuus & Riskienhallinta, a Finnish security and risk management magazine.

This year the awards were held at the Old Student House in Helsinki. The opening ceremony featured a presentation about the future of security and safety by Professor Esko Valtaoja. There are eleven award categories at FSA, and each one had its own jury that was comprised of respected professionals in the industry.

A number of us at Centry attended the awards ceremony, and Mr. Risto Haataja of Centry was a member of the jury that selected Security Company of the Year!

This slideshow requires JavaScript.

5 Basic Digital Privacy Tips for the Average Person

As interconnectedness and personalized browsing experiences have become the norm in today’s society, our lives – increasingly impacted by our digital footprint – have become less private.

The right to digital privacy has been a slow growing movement, and its biggest marker was the General Data Protection Regulation that affected the EU. It was a legislation that marked digital privacy as a right, not a privilege, and companies all over the world scrambled to make sure they met compliance requirements. Now, for users in the EU, the internet has become a more transparent place for how information can be used or accessed. But, of course, it is still a work in progress.

Digital privacy is a massive topic that can be very easy to get lost in, especially if you’re new to to it. However, you don’t need to be a security expert nor do you need any particular reason to bolster your privacy on the internet. So, here are some simple security pointers for the average web user:

1. Keep your OS updated

The first thing you will want to do on any device is to make sure that it’s updated. As annoying as the notifications can be, they’re there for a reason– updating is important, and not staying on top of them could mean your device has a critical security vulnerability. So whether it’s installing the new macOS update, iOS 12, or Windows update, etc. just make sure that you take the time to do it, or set up your device to update automatically (usually configurable in settings).

2. Be mindful of Public WiFi networks

Public WiFi and open networks are notorious for security vulnerabilities, and connecting to one could pose a risk to your information. While it’s better to avoid connecting to them at all, sometimes you need to, so if you do, here’s some steps you can take. First, you’ll want to make sure that you turn off network sharing (usually preferences can be found in wifi settings on your computer). On Windows devices, you can also make sure you have Windows Firewall enabled.

When browsing connected to a public network, it’s best to avoid anything sensitive, such as banking. You should check to make sure that what websites you navigate begin their web address with HTTPS, as well.

3. Use a secure web browser

Make sure that you are using a secure web browser. Mozilla Firefox and Google Chrome are some good choices depending on what you want. If your priority is maintaining as much privacy as possible online, Firefox is better as it has more options for privacy and security. It is also the more lightweight program of the two, which would run more smoothly on computers with less RAM.

Google Chrome is also a comparatively secure option in terms of protecting you from malicious websites, however it is less private as a lot of data about your internet usage goes to Google. That may be a positive or a drawback to you depending on your priorities – if you want privacy, it’s not so great, but if that’s not extremely important to you and your computer is equipped to handle Chrome’s resource demands, then it’s a solid choice as well for speed and reliability.

In either browser, make sure you take the time to navigate to the Privacy and Security settings and adjust them to your preference. Some of the settings you can choose are to clear your browsing data/history, unselect the option to send usage statistics to the company, enable Do Not Track requests, etc.

Additionally, you can install an ad blocker extension/addon, such as uBlock Origin, in both browsers that serve as an additional line of defense against unwanted scripts running on websites that you visit. This can be easily obtained for free through the Chrome Web Store or Firefox Addons.

4. Secure your social media profiles

One common mistake that people make on social media platforms like Facebook and Instagram is that they have their profiles set to public. This means that anyone, anywhere can view your profile and all the content on it. This is great for a business page, but maybe not so much for your personal profile.

Every big social platform has privacy and security options. These can usually be found in the settings menu, where you can navigate to the relevant sections to adjust what you want to be seen. On Facebook, you have full control over who can see your posts and friends lists, as well as whether you can be searched by your email address or phone number.

Location settings – especially in mobile apps – are important to adjust as well. Snapchat is a big one for this, as people on your friends list can observe your location in real time through the Discover function unless you have disabled this feature and turned on “Ghost Mode.”

5. Consider using a VPN

Finally, if you want to take your security one step further, you can look into getting a VPN — that is, a virtual private network. VPNs have significant privacy advantages by encrypting your connection and acting basically as an intermediary between your device and the internet. They mask your IP address, which is basically as telling in the digital world as your home address is otherwise. The VPN works by routing your traffic through its own servers, and gives you the option to appear to be from any location of your choosing.

But since you are relying on the VPN in this way, it’s important that you get a trustworthy one, such as F-Secure Freedome. Most free VPNs are unreliable at best or actively malicious at worst.

Overall, online security and privacy is what you make of it. But these simple steps will at least ensure that you’re going in the right direction. For more in-depth information on the topic, be sure to follow @CentryCyber on Twitter.

This article was written by Kristina Weber of Centry Global. If you would like help or have questions, feel free to contact us via email at info@centry.global! Be sure to subscribe to Centry Blog for original bi-weekly articles relevant to the security industry.

Golden Visa for Sale! Now on special offer for the 1%

European passports and Schengen visas are the most desired traveling documents in the world. Not only do they grant the most traveling freedom, they give access to a safe and stable living environment, with free speech, in a market that can fulfill all your needs.

Many EU countries have taken advantage of this by offering entry in exchange for investment. This kind of activity is commonly referred to as a Golden Visa Program. For the subject countries, they are indeed golden, because they have the potential to bring in billions of capital into the country. Latvia, for example, used the program to stabilize its economy after the financial crisis.

According Transparency International, such programs have been in existence since the 1980s, and currently at least 12 EU Member States are offering them. Usually the reward is a residence permit, however Cyprus and Malta offer a fast track to citizenship should the customer invest enough money, and Portugal offers the citizenship option after a six year waiting period.

While the controls in most European countries should prevent individuals who are sanctioned by the EU from obtaining citizenship, many individuals took advantage of Golden Visa programs prior to implementation of the current international sanctions. It is a complicated matter for a nation to try to implement sanctions on its own citizens and capital that is invested within the country.

Most of these programs are legitimate, but the way they are set up invites abuse. Real estate is one of the easiest ways to launder dirty money, and these programs are taken advantage of all over the place.  

Some of the Golden Visa and Golden Passport programs are complex and might involve long red tapes and waiting periods. Of course, sometimes a suitable facilitation payment can fix that…

Latvia Golden Visa Program

The Latvian Golden Visa Scheme was heavily criticized. From 2010 to 2014, Latvia offered it at a discount price of EUR 71,150 if invested in countryside real-estate. The price for living in Riga was doubled to a value of EUR 142,300. As you can see, this could very easily be taken advantage of by someone looking to spend dirty money.

The number of people who took up this offer increased substantially  in 2014, the same year that Russia annexed Crimea. Almost 90% of the visa applicants came from Russia and countries that were formerly in the Soviet Union.  Thus, a program that had originally been intended for economic development and brought wealth to Latvia in the previous years had become embroiled in political significance.GV-by-Year

Picture 1: Latvian Golden Visas per year (Source)

The negative effects of the program eventually convinced the Latvian Administration to dismantle the discount in 2014. The greatest risk of these visa programs was spying, according to the deputy head of the Latvian Security Police in a 2017 parliamentary committee hearing. Then, of course, there was the risk to the economy, since many applicants were unable to prove the legality of their money. Although the program has since been dismantled, the effects of it and risks introduced by it will be felt for years to come.

Hungarian Golden Visa Program

Another interesting notorious golden visa program was the one in Hungary.

The Hungarian Golden Visa program was slightly different than in Latvia. Instead of it being based on investment in real estate, applicants had to buy a state bond from one of eight companies that had solitary rights to sell them on the behalf of the government. These bonds, which totaled up to EUR 300 000, were not inexpensive.

The results of this program were remarkable. The eight companies were able to earn about USD 600 million – and that’s a conservative estimate – over the course of the years that this program was running from 2013 to 2017. (OCCRP May 16, 2018)

The program ended in 2017 after criticism concerning the integrity of the eight bondseller companies. They were pretty mysterious – most were registered in offshore tax havens and it wasn’t completely clear who exactly profited from the sales.  

An investigation conducted by g7.hu and Transparency International Hungary uncovered the way these companies worked. Basically, companies would be assigned to territories around the world and allowed monopolies to sell the bonds under the program. But the way these companies were assigned required inside knowledge and connections – it wasn’t like it was a public tender. They had to have known about it separately since it was never advertised. Per the law, all the applicants were meant to be listed on the Hungarian Economic Committee’s agenda, but this was not always the case.

Although the Golden Visa program in Hungary has since been shut down, there are some rumors that a new ‘golden’ immigration program may be coming. Direkt36 reported that this new program was advertised by a Hong Kong based company on the Chinese platform WeChat. This new program now more closely resembles Latvia’s program, where applicants are required to invest a value of EUR 78 000 into Hungarian real estate.

Case Study: Who buys the visas? 

methode%2Fsundaytimes%2Fprodmigration%2Fweb%2Fbin%2Fb5259512-d8a9-4588-a80a-b4ca90e78b9d.jpg

Picture 2: Screenshot of Mr. Bogolyubov from The Times

Mr. Gennadiy Bogolyubov, the Cypriot, the Israeli, the Brit, the Ukrainian

Main Source: EveningStandard 11 Sep 2018

Mr. Gennadiy Bogolyubov is a popular face in the oligarch edition of the Bold and the Beautiful. He and his business partner, Mr. Igor Kolomoisky, are some of the best customers for UK lawyers – the costs alone for the litigation with their rival Mr. Viktor Pinchuk was estimated to be over GBP 50 million. The allegations and adverse reputation of the duo include alleged murders, violent takeovers and other accusations of mafia-style activities.

The two partners were very successful in post-Soviet era privatizations. Allegedly, the hasty privatization of a national bank in Ukraine to PrivatBank enabled the duo and their associates to empty out the bank’s capitalization with a decade long fraudulent loan scam.

To protect taxpayers’ interest and due to demands from Ukraine government’s external financiers (i.e. USA) PrivatBank was re-nationalized in 2016. “When Ukraine’s finance minister went to oversee the nationalization of the country’s biggest bank in December 2016, he took with him a team of bankers—and a security detail of special-forces operatives” (Wsj.com April 6, 2018).

Amongst Mr. Bogolyubov’s hobbies are philanthropy, which he practices through Bogolyubov Foundation.

Golden Visa United Kingdom Tier 1 Investor Visa (2009)

Cyprus Golden Citizenship (2016)

Nationalities Ukraine, Cyprus, Israel, United Kingdom
Current Residence Switzerland
Net Worth Unknown, was Ukraine’s #3 richest in 2010 (Kievpost)
Frozen Assets At least USD 2.6 Billion, shared with Mr. Igor Kolomoisky
Costs to Ukrainian Taxpayers USD 6 Billion to recapitalize Privatbank
Close Business Partner Mr. Igor Kolomoisky, who, according to a quote from the British Court, has taken over companies “at gunpoint” in Ukraine. Mr. Kolomoisky is a former governor and listed as an inactive PEP (Politically Exposed Person) per Dow Jones
Other Associates Mr. Alexander Zhukov, father of Roman Abramovich’s girlfriend
Powerful Enemies Mr. Viktor Pinchuk
London Real Estate GBP 62.5 Million home

GBP 20 Million house

Eaton Place Mansion

GBP 173 Million office block

Table 1. Mr. Gennadiy Bogolyubov’s Connections

This article was co-written by Oskar Savolainen and Kristina Weber of Centry Ltd. For more content like this, be sure to subscribe to Centry Blog for articles related to the security and risk industries.

Safe Online Dating

My Post

Online dating is a great way to connect with people. Throughout the history of the internet, it has gotten better and better. Most millennials meet their partner online compared to other ways of meeting new people. It’s quicker and easier than ever, where a date with a new person can be arranged within an hour’s notice through your smartphone.

How We Can Help

Despite the concerns that may be raised with some of the risk-related content in the article, online dating overall isn’t a bad thing nor is it something to fear. You can be immensely rewarded and fulfilled by it, and many happily married couples have their origins online. The only thing is, that you have to educate yourself on the environment. Dating online has a different range of risk factors than, say, meeting someone at a nightclub, but just like monitoring your drink in that example, there are steps you can take to avoid being taken advantage of.

We at Centry have been inspired to help people like you after hearing so many stories of online dating gone wrong. We believe you can find something real if you go about it mindfully. So, we are happy to announce that we have opened up an identity verification service called Date Check Online that provides three different levels of private checks to make sure that the person you are talking to is who they say they are. These checks are performed by investigative professionals who have been trained to spot red flags and have data sources available to them to search names against known sex offender registries and watchlists, so it’s a smart way to support your initial Facebook sleuthing if you have a funny feeling about someone.

The Risks

New technologies and phenomena often bring with them concerns that need to be addressed. With the ease of availability comes volume, and, as in any kind of risk management, with increased volume comes increased risk. Online dating can be immensely rewarding, but it should be conducted responsibly; individuals should be aware of their personal safety concerns and online dating risks should be managed accordingly.

Misrepresentation and Catfishing

Misrepresentation is always a risk with online dating, whether it’s something like hiding the fact that someone is married or using a photo on the profile that doesn’t accurately reflect their appearance. It’s so easy to lie behind a digital barrier that you never really know who the person is that you are talking to until you meet them, and even then there could be facts that haven’t been disclosed.

When misrepresentation is deliberate to the point of falsifying an identity, it’s called Catfishing.

It’s a term that refers to situations where someone has been involved in an online romance under the guise of a fake persona. Oftentimes these people will take images of attractive men or women from Google Image Search, come up with a fake name, and create life stories for these personas in order to take advantage of the people who fall for them.

We have all heard of the horror stories of grown  men using these fake personas to take advantage of young girls, but this concept exists across all genders and can affect anyone.

At best these circumstances result in broken hearts and feelings of betrayal when the lie is discovered, but they could also cost you your life savings. Huffington Post reported on a 69 year old woman in Florida who spent two years in a relationship with an individual that ultimately ended up abusing her trust to make money. Over the years of their relationship and phone calls and texts, she had funneled him roughly 1 million USD for the purpose of what she believed was to help him run his business.

Action Fraud reported that targets of romantic fraud lost approximately 41 million GBP in 2017. This number is likely also only the tip of the iceberg, especially considering that it can be humiliating to be taken advantage of in such a way, which can discourage victims from coming forward about their experiences.

Greater Risks for Women

The risks with online dating are greater for women, considering worst case scenarios such as physical or sexual assault, trafficking, or worse. While things like this can also happen to men, statistics for these crimes are heavily skewed toward female victims and that fact cannot be ignored.

This is all the more difficult considering that a number of dating websites perform no screening whatsoever on people who sign up for it. Which means that registered sex offenders can sign up– and approximately 10% of sex offenders use online dating sites.

Online Dating as a Business Risk

For businesses, online dating is a relevant factor that can affect several risks. It is so prevalent that the odds are that someone around you is participating in it. In your technology reliant workplace, most employees feel it is important to have their smartphones with them all the time, and the honeypot tradition has its roots in a long history of espionage. An online romance is a shortcut vector for red teams to breach your company’s security. Other concerns may elevate risk in business travel: online dating apps have been known to be used to lure victims into situations where they can be easily robbed.

While we think that implementing dating controls to your corporate policies is a bad idea, we urge individuals to think about how your personal communications may have have an effect on your professional security. Business is also a great analogy for online dating: as an entrepreneur you would have to take risks that could have negative outcomes, however, with the right planning, the positive outcomes are much much more likely and the impacts of the negative ones are minimized.

Safety, responsibility and integrity considerations aren’t hindrances – they are success enablers. As we always recommend, trust your instinct, and use resources provided to you.

Feel free to reach out to us on any of our social media platforms or on the Date Check website if you have any questions or comments!

For more content like this, please subscribe to Centry Blog. This article was written by Kristina Weber and Oskar Savolainen of Centry Global.

Centry Opens New Office in Mexico City!

el-angel-de-independencia--mexican-landmark-552812595-59863bb2519de2001116a0d0

We are pleased to announce the expansion of Centry Global to Mexico!

Our new office is now open, located on the 17th Floor Torre Magenta, Paseo de la Reforma 284, Colonia Juarez, Distrito Federal, Mexico CP 06600.

new office.PNG

As an international security company, our work takes us across the world. With the opening of this office, we are now able to better serve our clients in the region.

At Centry, our focus is to develop long-term, communicative working relationships to provide you with the best resolutions to your security challenges. While our combined expertise primarily revolves around security and risk management, you will find among our ranks professionals in corporate and private investigations, fraud control, and experts in programming, software development, and more.

We look forward to meeting and working with more clients across Mexico. Please don’t hesitate to contact us!

📧 info@centry.global 📱 +52 55 4739 2665

 

Typosquatters

Man typing

Of all the myriad of ways that we can be duped, scammed, or otherwise taken advantage of on the internet, “typosquatting” remains one of the easiest to stumble into.

Perpetrators of this scam will purchase site domain names that are very similar to popular pages that people visit, usually by changing the .com part of the web address to .cm. This preys on people who make typos, which is, suffice to say it – all of us.

These duped sites can range from being pop-up laden cesspools riddled with viruses or malware, to near-replicas designed to fool users into inputting login information that can be manipulated later.

So, who is doing this? While these types of tricks can occasionally be tied down to lone actors (given how easy it is to obtain a domain name), KrebsOnSecurity identified the marketing firm Media Breakaway LLC to be behind more than 1500 of these false .cm domains. The company is headed by one Scott Richter – a convicted felon who has been the target of several successful lawsuits for illegal spamming. Other companies related to Richter include Dynamic Dolphin and affiliate[dot]com, also related to email spam.

Just how many people are falling victim to these scams? More than 12 million in a 3 month time frame – amounting to a potential of 50 million per year, according to an analysis conducted by Matthew Chambers. Several of these visitors additionally were found to be coming from .gov and .mil sites in the USA, which are the official federal government and military domains. Many popular news sites, social media, banking, and music streaming sites have these malicious doppelgangers.

The actionable item to protect yourself in this situation ultimately boils down to a matter of double-checking the web address before you hit enter, or bookmark your most commonly visited sites.

For more information on this subject, feel free to reach out to us @CentryLTD on Twitter or any of our other social platforms.

Supply Chain Security Introductory Guide

architecture-bay-boat-326410

Having a secure logistics supply chain can save your company millions in terms of assets and reputation, and here at Centry, we have the know-how to help you. Two of the biggest certifications that we offer consultation on in our supply chain security program include the Authorized Economic Operator (AEO) authorization and compliance with security standards of the Transported Asset Protection Association (TAPA).

What is AEO?

The Authorized Economic Operator (AEO) Program is an initiative of the European Union geared toward securing logistic supply chains against trafficking and financial fraud. Being an Authorized Economic Operator is beneficial – it is an open declaration that your company has a lower risk and threat evaluation.

Basically, traders who meet the criterion of the program are entitled to enjoy benefits of trade in international supply chains. Some of these benefits include things like easier admittance to customs simplification programs, fewer physical and document-based controls, priority treatment if selected for control, and reputational advantages such as recognition as a safe and secure business partner, improved relations with customs and gov’t authorities, and reduced theft and losses.

What is TAPA?

When you become a member of TAPA, you are taking a stance for your company with an internationally recognized leader of the fight against cargo crime. TAPA is a worldwide coalition of manufacturers, shippers, carriers, insurers, service providers, law enforcement, and government agencies. It is inclusive of every type of organization or company facing the problem of cargo crime within the transportation supply chain.

TAPA security requirements have expanded to global recognition as the industry standard for cargo facility and transport security, notably:

  • FSR (Freight Security Requirements)
  • TSR (Trucking Security Requirements)

These standards exist to help TAPA members reduce losses, and to provide a platform for more uniform conformance with state of the art security. Carrier hubs and depots that are TAPA certified guarantee with minimum security standards for manufacturers, and they are suitable for inclusion in contractual agreements.

Centry was recently appointed to be the TAPA Service Center in Thailand, becoming the main TAPA service provider in the country, supplying our services also to the general region of South East Asia.

Our supply chain security team supports organizations that are interested in enhancing the resilience of their supply chains by applying for international certificates and authorizations.

Who Can Benefit from this? ​

Our program is suitable for both organizations who are just beginning the journey toward a more secure supply chain, and organizations that have an established security resilience culture, but wish to improve it with objective knowledge. In order to ensure that the efforts of the organization receive the recognition they deserve, we support our customers in complying with the requirements of AEO, C-TPAT, ISO 28000, TAPA FSR and TSR certificates and authorizations.

Where to Begin

For businesses looking to begin the journey toward securing their supply chains, we provide our full spectrum of services that are aimed at guiding the customer through the whole process of certification and security– from preliminary discussions to the maintenance phase of the security management system.

Our primary objective is to support the creation of a system that suits the existing culture and processes of the organization. This begins with determining the desired outcome for the program, followed by examining the operations to understand the business and pinpoint the critical areas. When the key areas have been identified, we provide our expert knowledge to comply with the requirements of the certificate or authorization. This includes system upgrades, creation of documents, training of staff and third parties, inspections of third parties and ensuring compliance with internal requirements.

How to Extend Your Knowledge

For an organization with established security resilience culture, we provide objective and up-to-date knowledge and services regarding supply chain security. The service can be directed to specific issues or give an overarching view of the whole organization. It ensures that the team tasked to ensure supply chain resilience has the up-to-date information regarding key topics and solutions required to enhance the main business. The services we provide include: site and system assessments to ensure compliance with requirements, workshops and training sessions for key stakeholders, classroom sessions for larger crowds, e-learning solutions to ensure global coverage and intelligence services to clarify the opportunity and threat profiles for business objectives and areas.

As global supply chains involve long subcontracting chains, we provide third-party monitoring solutions. We conduct assessments and investigations on behalf of the organization to their third parties for an objective compliance evaluation against any security requirements.

All of these services can be included with Centry’s Security Manager as a Service -package. With it, the organization has the up-to-date knowledge available, when it is required.

If you have any questions or comments, feel free to contact us at info@centry.global.