Personal data is now a tradeable commodity on the sinister ‘Dark Web’ used by criminals, Mark Brown, executive director, cyber security and resilience at Ernst Young has told Business News.
He said:‘ Cyber crime is the most organised criminality globally today. It is worth billions.’
Asked who the people doing this are he said: ‘They are true organised criminals.
‘You have the organised crime syndicates, you have nation state sponsors, there are ideological activists and then you have the insider.’
Expert Mr Brown who is London based, speaking to Business News during the inaugural island tech summit sponsored by Wi-Manx, gave some chilling information.
He said: ‘In terms of organised criminality you can, if you know where you’re looking, go on to the internet and simply find people for hire. Defrauded credit cards, anything like that. You can subscribe to a service offering which will take a company down, guaranteed. They [the criminals] will offer a money back guarantee on some of this stuff now, they are that confident about it.
‘Personal data is a tradeable commodity.’
Mr Brown was one of a number of speakers who addressed an audience of more than 250 business people from the Isle of Man at the Villa Marina last week.
Wi-Manx sponsored the inaugural tech summit with the emphasis on cyber crime and sharing knowledge with businesses.
The event came just days after the highly publicised TalkTalk cyber attack.
And the Financial Times last week revealed that personal details of more than 600,000 customers were stolen from companies in the UK in 2014, laying bare the extent of digital weaknesses in British business in the run up to the TalkTalk cyber attack.
The FT said senior UK government officials had said ‘tens of thousands’ of Britons’ identities were currently for sale on the ‘dark web’.
Mr Brown of EY told Business News the cyber criminals can strike anywhere including the Isle of Man.
‘They don’t care where they get the information from. It can be the biggest multinational corporation in the world through to a local corner shop in the island.’
Hesaid the corner shop could be a target because it processes credit card and debit card payments and if there were weaknesses in the system personal details could be stolen.
‘This shows the spectrum of risk that exists,’ he warned.
Talking about the ‘dark web’ used by criminals Mr Brown added: ‘Round about 70 to 80 per cent of the internet is not google searchable.
‘The concept of the dark web is you need to know exactly where you are going.
‘That’s where the underground fraternity sits.
‘They are very transient.
‘The absence of international jurisdiction is key here. This is the loophole they exploit.
‘It’s very difficult in the interconnected world we live in today to pin down jurisdictional liability.
Mr Brown who has had ‘years in the trenches’ working in business is part of a big team from EY - Ernst Young management consultants.
‘We are there to be a trusted adviser to organisations who need help.’
He said the cost to the UK annually around 2011-2012 was in the regionof £27 billion. The cost globally in a report last year put global cost of cyber crime in the region of £400 billion a year.
He sent this message to businesses of all shapes and sizes in the island: ‘This is a topic you simply have to be aware of.’
Dietrich Benjes, of Varonis, a company involved in protecting sensitive information from insider threats, told Business News 85 per cent of all data breaches are internal and it was vital companies wise up on knowing who has vital information within their organisation.
‘There is a cost involved but organisations are trying to protect their assets. Would you bank with an organisation who could not ensure that only you and your partner had access to your accounts?
Would you bank with an organisation who weren’t able to detect whether your card was being used in Morocco, Mumbai or Manchester at the same time? I know I wouldn’t.’
Asked if businesses in the Isle of Man would be wrong to think they cannot be touched by the criminals he replied: ‘Utterly.
‘I suppose if they don’t use information technology, and have typewriters and filing cabinets then they probbaly don’t have to worry.
‘But as for organisations who have email, who have the web, who create files and information it’sa different matter.
‘Do they value their data? It’s the personal information in organisations.’
American Mr Benjes said ‘without a doubt’ there will be more examples of companies being cyber attacked as in the TalkTalk case.
‘I’d bet the farm on it - that’s an American expression. These things happen every day, a multitude of times every day.’
Tony Rowan, chief technologist with a company called Exclusive Networks debated whether a mobilised workforce was more at risk from hacking, attacks and cyber crime.
For example, he said on average an organisation will lose around five per cent of its laptops a year through theft or loss.
Mr Rowan said in his opinion passwords should become a thing of the past.
‘We should be using better systems using multi-factor authentication, using your iris, your fingerprint for example. If we could get ridof passwords it would be one of the best things we could do.’
He said theoretically typing in a password should be a secret but people could be watching over your shoulder, ‘shoulder surfing as we call it’
‘And many people seem to make the same mistake, they tend to use the same password for lots of things.
‘So if they [criminals] find your passport for something innocuous, maybe your Facebook account then they will be able to, likely as not, be able to log in to one of your bank accounts or other accounts that you are using. And passports do tend to be very weak.’
Asked what the best password should include he said: ‘Mixed upper and lower case, mixed characters.
‘The pound sign is a good one to include if the system will let you. United States hackers, for example, don’t have a pound on their keyboard. So it’s difficult for them to type that.’