Phishing Victims: Accept Financial Responsibility?

The US President's Identity Theft Task Force has released it's interim report and the final recommendations are due in November this year. The task force is co-chaired by Alberto Gonzales, US Attorney General and Federal Trade Commission Chairman Deborah Platt Majoras.

The interim recommendations of the Identity Theft Task Force were announced following a meeting of the Task Force today at the Justice Department.

“As with any crime, victims of identity theft suffer feelings of violation and stress, but in these cases, victims have the added burden of cleaning up the mess that the identity thieves leave behind,” said Attorney General Gonzales. “The President created the Identity Theft Task Force to oversee the implementation of real and practical solutions at the federal level to defeat this ongoing intrusion into the lives of law-abiding Americans. Today’s recommendations move that process forward.”

“Conquering identity theft demands that we work as a team to develop tools that strengthen law enforcement, practices that enhance data security, and programs that help consumers in prevention and recovery,” said FTC Chairman Majoras. “Through these initiatives, we are taking solid steps toward eradicating this persistent consumer problem.”

Who pays for the loss of money stolen from your bank account as a result of ID Theft by Phishers or other Cyber Criminals using key logger trojans? Today the bank does to keep you as a customer. This is why the government and most large institutions who are the largest targets have already completed or are in the process of implementing two-factor authentication. However, will it be enough?

"The Bank of Ireland incident is one of the first public cases of a bank seeking to force phishing victims to accept financial responsibility for their losses, but it likely won't be the last. Phishing scams continue to proliferate, as Netcraft has blocked more than 100,000 URLs already in 2006, up from 41,000 in all of 2005. Financial institutions continue to cover most customer losses from unauthorized withdrawals. But after several years of intensive customer education efforts, the details of phishing cases are coming under closer scrutiny, and the effectiveness of anti-phishing efforts taken by both the customer and the bank are likely to become an issue in a larger number of cases." So, should a bank be forced to pay back a customer who has lost money to phishers? Or is it ultimately the customer's responsibility to make educated use of technology?

When bankers realize that Online Banking is an Operational Risk that requires more proactive measures you will begin to see your customer agreements modified and you will have to accept some of the risk. Examinations and investigations are going to be a standard operating procedure if you make a claim of unauthorized withdrawls or transfers from your account. The first place to look is on your own computer for the spyware that may have been utilized to steal your login and password. It won't be too much longer before the banks will be in the business of auditing your home PC to make sure that you have the correct anti-phishing, malware and virus protections. Or even to make sure you have the correct token for access to the banking site.

At some point, the consumer might have to bear more of the burden of risk management or pay the price of accepting the fact that you may have no more recourse to recover stolen funds from your account by the institution itself. But those days are still a long way off in the future. As our new generation of "Bank Robbers" already know, you don't have to wear a mask and walk through the front door any longer. All you have to do is find a few thousand unprotected machines each day and then wait for that unsuspecting consumer to hand over the keys to their bank account.

In the end, the consumer will pay for the mounting financial losses. One way or another.

A Convergent Framework of Risk Management...

Operational Risk Management has many facets in the eyes of the modern Chief Risk Officer (CRO). Last month, the High-level Principles for Business Continuity were summarized at the Basel Committee on Banking Supervision.

Recent acts of terrorism, outbreaks of Severe Acute Respiratory Syndrome and various widespread natural disasters have underlined the substantial risk of major operational disruptions to the financial system. Financial authorities and financial industry participants have a shared interest in promoting the resilience of the financial system to such disruptions.

To that end, financial authorities have been working closely with financial industry participants to establish a consensus as to what constitutes acceptable standards for business continuity. Much of this work to date has been focussed at the national level. At the international level, while there have been several regulatory and private sector initiatives on the business continuity front there has not been a concerted effort to draw together the lessons learned from major events and translate them into a set of business continuity principles that is relevant across national boundaries and financial sectors (ie banking, securities, and insurance). Furthermore, consistent with their focus on preserving the functionality of the financial system as a whole, financial authorities undertaking these initiatives have tended to give priority to critical market participants. The lessons learned from past experience, however, are applicable to a broader audience.

This paper represents an effort to address these gaps. It is intended to support international standard setting organisations and national financial authorities by providing a broad framework within which more detailed business continuity arrangements might be developed that are more closely tailored to unique sectoral and local circumstances. The principles also provide a consistent context for those arrangements and thereby promote a common base level of resilience across national boundaries.

Since 2004, The Tower Group has been shouting the need for banks to automate now in the midst of the Basel II momentum. While business performance has converged with Basel II, the key understanding needed is what do Business Performance & Basel II have to do with my survivability as a money center bank?

Basel II introduces a convergent framework of risk management and controls that will encourage banks to invest wisely in IT and improve the efficiency of their business operations. Banks that adopt effective enterprise risk management platforms will reap business benefits that go well beyond regulatory compliance.

Knowledge Management is coming to banking in a way that the bean counters never imagined. With the focus on Operational Risks, the only way to be able to correlate new threats with the current asset base is through automation.

The industry is now at the implementation phase of Basel II. Few banks have the perspective and resources to experiment and establish their own enterprise risk management models that include this new field of operational risk. Notwithstanding their attention to business continuity and reputational risk matters, most banks have still to inscribe operational risk procedures in the broader picture of business management and operational efficiency. Not only may banks improve their operational efficiency by streamlining business processes, but they also can tap important benefits in operational resilience, responsiveness and flexibility to innovate. By adopting automation models for integrated business and risk management, proactive banks may derive significant returns from a concerted enterprise approach.

Corporate Data Policy: How good is your Inventory Management?

Stewards of corporate data have little or no understanding where their data is located. Not only this, customer and consumer information was ranked less important to protect from theft or loss of confidentiality than intellectual property and sensitive business information in this survey from the Ponemon Institute.

Vontu and Ponemon Institute conducted the first U.S. Survey: Confidential Data at Risk to better understand the nature and extent of issues that occur because companies do not have adequate control over the storage of sensitive or confidential data at rest. Our independently conducted survey queried 484 respondents who are employed in corporate IT departments within U.S.-based business or governmental organizations.

The survey focused on the following four issues:

1. How pervasive is the problem of unprotected confidential data at rest?

2. How do information security practitioners locate sensitive or confidential business information that resides (somewhere) within their organization’s IT infrastructure?

3. What technologies, practices and procedures are employed by organizations to locate and control sensitive or confidential data at rest on peripheral or temporary devices such as laptops, PDAs and memory sticks?

4. What are the issues, challenges and possible impediments to effectively locating unprotected sensitive or confidential data residing on peripheral or temporary devices?

When will customers and consumers demand that their information be put on the same level of priority as a organizations own trade secrets? In most cases, an organization will not devote resources to the confidentiality, integrity or availability of customer data unless it is demanded by regulators, laws and auditors.

Not until a state Attorney General or the SEC begins their investigations do companies realize that they are way behind in the process of identifying where their data is and where it is unsecured or exposed to the possibility of being modified, destroyed or stolen.

The four types of data considered to be most at risk in an organization are intellectual property, business confidential information, customer and consumer data, and employee data. It is interesting to note that most respondents believe the most serious kinds of data breaches involve the loss or theft of intellectual property and business confidential information.

Customer and consumer data and employee data are ranked third and fourth, respectively. The types of intellectual properties believed to be most at risk include electronic spreadsheets, competitive intelligence and source code.

And companies like Vontu are well positioned to provide some of the tools to assist organizations in protecting their valuable corporate information assets. Privacy of consumer information should not have to be legislated if an organization has an effective Governance Execution Strategy. This execution of the information inventory is in many cases left up to internal employees in the IT department. Continually under staffed and fighting fires prevents the systematic and consistent execution of day to day change controls and thereby leads to a widening exposure of vulnerable data considered valuable to the company or the consumer.

When it comes to lost or stolen laptops, servers, and backup tapes, the age old saying about an "Ounce of prevention…" applies more than ever. Implementing Data Loss Prevention has become a best practice in Fortune 1000 companies that are building strategies and processes to reduce their risk associated with lost or stolen laptops, servers, and backup tapes.

On the Eve of 9/11: Flashback to the Future...

On the eve of 9/11/2006 we look back five years and it seems like it was yesterday. Tomorrow we might be at a church memorial services, as we will in downtown Washington, DC. Saying prayers for those who have fallen, and their families.

Yet, tomorrow will not only be full of emotions of years past. It will be prayers for the future. That our children across the globe will somehow be able to call this date in history the beginning of a new world order.

The Operational Risks we all endure on a daily basis are there in front of us. Some are more obvious and predictable. They have a history and a pattern to be analyzed and forecasted. Those risks that are low probability and have little or no historical context are the events to fear.

The new world order in front of us today is increasing complex and dynamic. Chaos seems to be a good adjective for much of what we see and hear in our daily consumption of news and media. How can any person in Moscow, Beijing, Tokyo, Sydney, LA, NYC, DC, London, Paris, Madrid, Baghdad, Kabul or Rome make sense of what the future holds for mankind?

The only certainty is that the speed of change and the age of unreason will unfold at a velocity that our children will call the "New Normal". The flashback to the future is nothing more than an accelerated version of the past. Gods Speed to all of us!

Privacy in the Board Room: The Ethics of Surveillance...

Corporate Governance in the board room itself is blazing out of control at Hewlett Packard (HP) as a result of an internal investigation. The finger pointing, board resignations and ethics questions are all in the news. And that is just a very small story on the entire landscape of corporate digital surveillance or internal investigations. This is a business your insurance company is funding and for good reason.

The entire episode—beyond its impact on the boardroom of a $100 billion company, Dunn’s ability to continue as chairwoman and the possibility of civil lawsuits claiming privacy invasions and fraudulent misrepresentations—raises questions about corporate surveillance in a digital age. Audio and visual surveillance capabilities keep advancing, both in their ability to collect and analyze data. The Web helps distribute that data efficiently and effortlessly. But what happens when these advances outstrip the ability of companies (and, for that matter, governments) to reach consensus on ethical limits? How far will companies go to obtain information they seek for competitive gain or better management?

It will be interesting to see if the California Attorney General is going to get into the middle of the battle. Yet, there seems to be less discussion about the ability of a skilled investigator using "Social Engineering" techniques to obtain the information in question.

Hackers like Kevin Mitnick call it "social engineering." Other folks call it plain old lying. But today's private investigators have a new word for obtaining information under false pretenses; they call it "pretexting," and it's apparently big business.

We wonder about the new legislation brewing in state capitals to extend the data privacy laws and the national Gramm-Leech-Bliley Act (GLBA)to telcos, ISP's and other repositories of personal information. Bankers have been working for a decade to stop the same criminal activity of stealing information to use in a fraudulent manner. It won't be long before your phone company will be sending you those privacy disclaimers in the mail and two-factor authentication will be the norm when you log in to Verizon Wireless.

Strategy Acceleration: Surviving the Basel 7...

So what are the seven loss event categories of Operational Risk Management according to Basel:

Internal Fraud

Loss due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity, discrimination events, which involves at least one internal party.

External Fraud

Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party. These activities include theft, robbery, hacking or phishing attacks.

Employment Practices and Workplace Safety

Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination.

Clients, Products & Business Practice

Losses arising from unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature of design of a product.

Damage to Physical Assets

Losses arising from loss or damage to physical assets from natural disaster or other events. See disaster recovery or business continuity planning.

Business Disruption & Systems Failures

Losses arising from disruption of business or system failures. This includes loss of due to failure of computer hardware, computer software, telecommunications failure or utility outage and disruptions.

Execution, Delivery & Process Management

Losses from failed transaction processing or process management, from relations with trade suppliers and vendors. This includes Transaction Capture, Execution & Maintenance Miscommunication, Data entry, maintenance or loading error Missed deadline or responsibility, Model / system misoperation Accounting error, entity attribution error, Delivery failure, Collateral management failure Reference data maintenance, Monitoring & Reporting Failed mandatory reporting obligation, Inaccurate external report (loss incurred), Customer Intake & Documentation Client permissions / disclaimers missed Legal documents missing / incomplete, Customer / Client Account Management Unapproved access given to accounts, Incorrect client records (loss incurred), Negligent loss or damage of client assets, Trade partners, non-client vendor misperformance and vendor disputes.

Operational Risk Management in your enterprise may be centralized or decentralized based upon your organizational structure. However, one item should not be overlooked when it comes to effectively executing across these categories. Strategy Acceleration is paramount if you are going to survive.

THERE ARE 6 WAYS to ACCELERATE STRATEGY EXECUTION.

Creating strategic foxholes with your executive team. This ensures that your senior team is clear on strategic intent, aligned with what it will take to make any endeavor "executable," and committed to achieve expected results.

Identifying and implementing key levers for strategic performance improvement. This ensures that result measures are tied to the business and behavioral changes needed to produce them and establishes accountability for results.

Rapidly cascading strategic clarity, buy in, rollout plans and commitment from the executive suite to the front line. Getting everyone who is essential to strategic results executing from the same playbook.

Operationalizing a Strategy Realization Office. Putting the execution infrastructure and resources in place to manage acceleration and ongoing execution of your critical business strategies. Defining, designing and staffing the function of Strategy Execution Officer.

Applying a strategy portfolio management approach to maximize return on investment and minimize shareholder risk. Providing the mechanism for your executive team to manage priorities, timing, investment, risk, return, resources, capacity and results from your strategies.

Increasing the nimbleness of your leaders and people at all levels so they are prepared to absorb any strategic initiative needed to ensure your organization's success. Leaders from top to bottom will learn the key steps to building a nimble company - one that is capable of executing major strategic initiatives more effectively and efficiently than any of your competitors.

Authentication Risk: Solving the Multifactor Question...

U.S. Bankers are in crunch mode to make decisions and finish risk assessments by year end. Multifactor Authentication is the issue at hand as Operational Risk Managers wrestle with vendors and their own IT organizations.

"Less than four months remain for banks to meet the Federal Financial Institutions Examination Council's year-end deadline for Internet banking authentication, but some confusion remains over what is an acceptable solution. When the FFIEC agencies initially released the guidance on Oct. 12, 2005, many banks were left scratching their heads as the guidance explicitly states that it "does not endorse any particular type of technology." Rather, the FFIEC says, banks should assess their own risk and decide which solutions best meet their individual needs.

Adding to the confusion, bankers, vendors and experts have fixated on the term "multifactor authentication." But the FFIEC never explicitly states that multifactor authentication is the only way to comply. According to the FFIEC's guidance, "The agencies consider single-factor authentication, as the only control mechanism, to be inadequate for high-risk transactions involving access to customer information or the movement of funds to other parties."

While authenticating the person who is logging into the secure Internet banking site is important, it is equally important for the consumer's chosen banking site to be simultaneously authenticated.

Mutual Authentication

Mutual authentication is a process whereby customer identity is authenticated and the target Web site is authenticated to the customer. Currently, most financial institutions do not authenticate their Web sites to the customer before collecting sensitive information. One reason phishing attacks are successful is that unsuspecting customers cannot determine they are being directed to spoofed Web sites during the collection stage of an attack. The spoofed sites are so well constructed that casual users cannot tell they are not legitimate. Financial institutions can aid customers in differentiating legitimate sites from spoofed sites by authenticating their Web site to the customer.

Techniques for authenticating a Web site are varied. The use of digital certificates coupled with encrypted communications (e.g. Secure Socket Layer, or SSL) is one; the use of shared secrets such as digital images is another. Digital certificate authentication is generally considered one of the stronger authentication technologies, and mutual authentication provides a defense against phishing and similar attacks.

One way to solve the issue is to find a company who has taken all of these technology hurdles and has found a viable solution for FFIEC compliance. See Boulder, Colorado based Authenticol to add to your short list.

Metrics: How to Measure Change...

Identifying operational risks to corporate assets is not new. Applying the correct metrics to determine where and how you measure change is a growing arena for a new breed of enterprise risk professionals.

Measures mapping: a way to identify risk mitigation strategies and evaluate their effectiveness is a key component for any initiative on How to Use Metrics and George Campbell has some very relevant places to begin:

We are all familiar with the highway sign "Dangerous Curve, Reduce Speed Ahead." Many of the measures discussed in this story may be applied to provide the CSO and key constituents with similar caution signals. They become the earliest prompts for more in-depth analysis of trend dynamics that allow you to look at the root causes of problems, not just the symptoms.

Examples of incident trends that help diagnose risks to address include:

1. Increased frequency or severity of accident, crime or policy infraction rates

2. Reduced mean times between failures on critical equipment with increased downtime

3. Increased number or severity of negative background investigation rates in specific hiring populations

4. Excessive passwords for access to different "secure" applications, which results in shared passwords and visible posting of passwords

5. Abnormal response times to calls for service

6. Outsourcing sensitive business processes without requisite due diligence

7. Elimination or reduced testing of building evacuation plans, which leads to employee confusion and injury during real incidents

8. Degradation of timely software patch application or increased virus activity in specific client groups

As a former CSO at Fidelity Investments Mr. Campbell has hit most of the critical silos of risk accross the enterprise. Whether it be people, processes, systems or external events, one thing is certain. Without a metrics program in place, how do you measure change? Not so much if we are winning or losing the battle against internal fraud, information security breaches or stolen corporate assets. But the nature of the changes and the potential root cause of those changes.

Competitive and regulatory drivers including BSA, Patriot Act, Basel II and Sarbanes-Oxley have increased pressure on executives to understand and manage risks more effectively. Top level executive mandates include:

* Protect corporate reputation and brand integrity
* Meet current and future regulatory requirements
* Provide visibility into possible risks and limit actual losses
* Achieve a fast response and recovery from actual negative events
* Maintain / improve customer satisfaction
* Increase quality and productivity of risk management processes

But, satisfying these mandates presents three core challenges to risk and compliance officers:

* Detecting risks is not sufficient; how will you manage and respond to them?
* In the face of changing regulations and cross-departmental systems, how will you govern the process?
* With so many point solutions, how will you justify the redundant investment and effort to deliver each one?

Asia Pacific: OPS Risk Spend on the Rise...

Operational Risk Spend in Asia Pacific is growing rapidly due to the revised Basel II accord which requires explicit assessment of operational risk, endorsements by consultants on the impacts of effective operational risk management systems, and continuous threats from the likes of terrorist attacks.

Financial Insights estimates total Asia/Pacific spending for operational risk systems at US$74 million in 2006. In the next five years, this number is projected to amplify to an inflation-adjusted US$246 million, equivalent to 3.3 times the current value or a compound annual growth rate (CAGR) of 27.2 percent.

This outlook by IDC is taking into consideration the different tiers of institutions including buy-side and sell-side along with banks plus insurers.

Operational risk management was designed to assist institutions identify matrices to determine an institution's risk tolerance, perform data monitoring and analysis to increase visibility of exposures, and create early alerts for immediate corrective action. Several industry incidences illustrated the undeniable correlation between operational risk management and sound business practices, and demonstrated that having control mechanisms in place to minimise operational risk elicits genuine paybacks through loss minimisation and reputation protection.
Consequently, the implementation of operational risk management solutions is accelerating in Asia/Pacific.

Beyond Fear: Evidence of Aviation Plot...

The Terror Plot Exposed this morning is just one more piece of evidence that the US and UK homeland remains under attack.

The Department of Homeland Security is taking immediate steps to increase security measures in the aviation sector in coordination with heightened security precautions in the United Kingdom. Over the last few hours, British authorities have arrested a significant number of extremists engaged in a substantial plot to destroy multiple passenger aircraft flying from the United Kingdom to the United States. Currently, there is no indication, however, of plotting within the United States. We believe that these arrests have significantly disrupted the threat, but we cannot be sure that the threat has been entirely eliminated or the plot completely thwarted.

For that reason, the United States Government has raised the nation’s threat level to Severe, or Red, for commercial flights originating in the United Kingdom bound for the United States. This adjustment reflects the Critical, or highest, alert level that has been implemented in the United Kingdom.

The nature of the imminent threat and the Operational Risks associated with keeping the investigation under cover any longer prompted authorities to "Go Public" with the plot early today. While only 21 individuals have been arrested at this point in time, the weeks ahead will tell a more detailed story about links to Pakistan and possibly al-Qaida.

The era of suicide bombers is extending month by month and year by year. Vigilance in our thinking about what is possible and how effective their strategy can be, is imperative.

Terrorists have used suicide bombs for decades. As the suicide attacks in New York and London have demonstrated, this tactic has now become a threat to parts of the world previously untouched by suicide terrorism.

Suicide bombers may use a lorry, plane or other kind of vehicle as a bomb - either carrying explosives or using the fuel aboard the vehicle as a makeshift explosive - or may conceal explosives on their persons. Both kinds of attack are generally perpetrated without warning. The most likely targets are symbolic locations, key installations, VIPs or mass-casualty 'soft' targets.

When considering protective measures against suicide bombers, think in terms of:

* Denying access to anyone or anything that has not been thoroughly searched. Ensure that no one visits your protected area without your being sure of his or her identity or without proper authority. Seek further advice through your local police force's CTSA.

* Establishing your search area at a distance from the protected site, setting up regular patrols and briefing staff to look out for anyone behaving suspiciously; many bomb attacks are preceded by reconnaissance or trial runs. Ensure that such incidents are reported to the police

* Effective CCTV systems can help prevent or even deter hostile reconnaissance, and can provide crucial evidence in court

* There is no definitive physical profile for a suicide bomber, so remain vigilant and report anyone suspicious to the police.

CSO Job Security: Training To The Rescue...

Businesses Don't Get It when it comes to training employees on security technology and policy.

What's particularly alarming is that the desire for security compliance doesn't sync with the effort businesses put toward training and education, both within the IT department and throughout the workforce. Monitoring user compliance ranked as the No. 1 security priority in a survey of 966 U.S. companies polled by InformationWeek Research and Accenture. Security policies typically define who has access to data, how it can be used, where customer data can and can't be stored, any potential legislation the company is subject to if the data is breached, and whether data must be encrypted.

Still, more than half of U.S. companies surveyed say security technology and policy training would have no impact on alleviating employee-based breaches, a sentiment shared by more than half of the companies surveyed in Europe and China as part of the InformationWeek 2006 Global Security Survey. In fact, most companies surveyed worldwide admit they don't train their employees on information security policies and procedures on a regular basis, preferring instead to deliver ad hoc training.

Can you imagine being a CSO or CIO on the witness stand today? Or maybe it's just a deposition. The legal counsel for the plaintiff asks a simple question like:

Does your company have a written policy for training new employees on security technologies and controls?

Yes.

Does this written policy specify how and when a new employee shall be trained on security procedures and controls?

Yes.

Can you please state the number of formal training sessions held last year on security technology and policy at your company?

No.

Can you estimate the number of new employees trained last year according to your companies written policy?

No.

And the pain and suffering continues as the CxO realizes that the chain of evidence does not show a clear and demonstrable strategy for training employees on security controls. It does not follow the written policy of the company. Game over.

Given the increase in the number of data breaches, businesses can't allow security polices to become hampered by ambivalence and red tape. Next time, it could be your job on the line.

Public-Private Partnerships: Understanding Regional Interdependencies...

The Business Roundtable has released it's findings on U.S. Preparedness for A Major Cyber Catastrophe.

The Roundtable report identified major gaps in the U.S. response plans to restore the Internet:

* Inadequate Early Warning System – The U.S. lacks an early warning system to identify potential Internet attacks or determine if the disruptions are spreading rapidly.

* Unclear and Overlapping Responsibilities – Public and private organizations that would oversee recovery of the Internet have unclear or overlapping responsibilities, resulting in too many institutions with too little interaction and coordination.

* Insufficient Resources – Existing organizations and institutions charged with Internet recovery should have sufficient resources and support. For example, little of the National Cyber Security Division (NCSD)’s funding is targeted for support of cyber recovery.

In its report, the Roundtable concluded that these gaps mean that the U.S. is not sufficiently prepared for a major incident that would lead to disruption of large parts of the Internet and the economy.

Karl Brondell, who heads up the Cyber Security Working Group of the 160-member Business Roundtable, an association of CEOs at leading companies, presented a group report to the Federal Financial Management Subcommittee, saying the nation lacks coordination between the public and private sectors in the event of an internet outage.

The report, "Essential Steps Toward Strengthening America's Cyber Terrorism Preparedness," found major holes in planning, including an inadequate warning system to identify possible internet attacks, unclear responsibilities among public and private partners should an incident occur and unsatisfactory resources to recover from an attack.

The Business Roundtable is on the right track when they recommend that a public-private partnership be established to address these vital issues. What is important to remember is that this will be difficult and almost impossible to achieve on a national level. The interdependencies of our Critical Infrastructures including the Internet are a regional issue. This requires a public-private dialogue and coordination with metro areas and tri or quad state regions. Only when you have the exercises and the testing locally will each party better understand their own vulnerability. This is when each company or city realizes the necessary planning for supply chain redundancy and the criticality of logistics strategy.

The CEO's can talk and publish reports yet it will be the operational risk professionals, contingency planners and emergency managers who do the heavy lifting. They are the people who are making a difference everyday to make our country more resilient to the impact of major economic and public safety threats. These are the people who are "doing" and still not "talking".

Critical Infrastructure Resiliency: SCADA

The SCADA and Control Systems Procurement Project provides the operational risk context and knowledge for any CISO, CIO or CTO who is procuring new software to control Critical Infrastructures. It is also a good lesson for those projects where the information assurance policies require a strict protocol for purchasing new systems and software. This project is the first of many efforts to create a more resilient infrastructure and to mitigate the risk of future attack on these vital systems in our daily public and private sector operations.

SCADA (Supervisory Control And Data Acquisition) generally refers to the systems which control our critical infrastructures -- such as electric power generators, traffic signals, dams, and other systems. Protecting our critical infrastructure and process control systems is a vital component of our nation's readiness and response efforts. The SCADA Procurement Project, established in March 2006, is a joint effort among public and private sectors focused on development of common procurement language that can be used by everyone. The goal is for federal, state and local asset owners and regulators to come together using these procurement requirements and to maximize the collective buying power to help ensure that security is integrated into SCADA systems.

This is a major step towards risk mitigation in the systems that keep our economy running on a daily basis. Without more resilient systems, our financial and healthcare sectors are at the mercy of a myriad of exploits by "Digital Adversaries".

To reduce control systems vulnerabilities, the DHS National Cyber Security Division (NCSD) established the Control Systems Security Program (CSSP) and the US-CERT Control Systems Security Center (CSSC). The CSSP coordinates efforts among federal, state, and local governments, as well as control system owners, operators, and vendors to improve control system security within and across all critical infrastructure sectors by reducing cyber security vulnerabilities and risk. The US-CERT CSSC coordinates control system incident management, provides timely situational awareness information, and manages control system vulnerability and threat reduction activities.

US National Preparedness Month: September 2006...

September 2006 is US National Preparedness month and the perfect time to manage Operational Risks both at home and your business.

The U.S. Department of Homeland Security and the American Red Cross are working with a wide variety of public and private sector organizations to educate the public about the importance of emergency preparedness. Throughout September, these organizations are providing information, hosting events and sponsoring activities that disseminate emergency preparedness messages to and encourage action in their customers, members, employees, stakeholders and communities across the nation.

1SecureAudit is pleased to be coalition partners again in 2006 to help business executives better prepare their communities for “All-Hazards”. “Our goal is to provide on-going public awareness campaigns this September through our webinar series on Corporate Emergency Response Teams and Terrorism Risk Management said Peter L. Higgins, Managing Director and Chief Risk Officer at 1SecureAudit.”

The goal of the month is to increase public awareness about the importance of preparing for emergencies and to encourage individuals to take action. Throughout September, Homeland Security will work with a wide variety of organizations, including local, state and federal government agencies and the private sector, to highlight the importance of emergency preparedness and promote individual involvement through events and activities across the nation.

In order to impact preparedness on a macro level, you have to begin the process at the micro level. Business leaders start the training, awareness and readiness at home with their own family members. Reviewing the place they will all meet in an extreme emergency when they may become separated. Establishing the single point of contact out-of-state that each family member will contact in order to check-in. This step is imperative as much of the telecom networks will be unavailable on a local level for connecting phone calls. The likelihood of reaching a designated contact out of the local area is much higher.

Once the family is prepared, then move on to the business where you work. Create your own Corporate Emergency Response Team (CERT) to create readiness exercises for your community in your building, Business Park or campus. As you roll-up your business community to the local city or county level, now you can coordinate with your public community. Do you know the station number of your local fire and EMS First Responders? Do you know the name of the Captain(s) that may be on duty the day a significant event takes place in your area? If you don't, then you should.

Once the business and local community is prepared and coordinated, then move up to the metropolitan level or state level. This is where the largest catastrophes will be coordinated with the Department of Homeland Security or other federal agencies. Does your business or local community have a seat at the Emergency Operations Center (EOC)? What measures are in place for you and your team to assist and collaborate with the state or federal authorities in times of crisis?

At the end of the day, it all comes back to managing operational risks. Making the right decisions in advance to preempt threats. Secondly, and simultaneously preparing for the time when "Mother Nature" or the "Suicide Terrorist" severely impacts our lives and our economy.

The Risk of Silos of Fraud Detection...

The Silos of Detection are under scrutiny in many financial institutions who are plagued with fraud.

Mission-critical data and consumer-specific information often are the target for savvy thieves who prey on the financial services industry. Further, as consumers, employees and external business partners demand -- and are given -- greater access to sensitive data, banks are more susceptible than ever to internal security breaches.

Clearly, fraud is a costly fact of doing business. Approximately 3 million adults said they were victims of ATM or debit card abuse in 2005, according to a survey by Stamford, Conn.-based Gartner that focused on the global IT industry. These incidents resulted in $2.75 billion in losses, with an average loss of more than $900 per incident, Gartner reports. Another 1.9 million online financial services users were victims of illegal checking account transfers, the study adds. These hijacked accounts resulted in nearly $3.5 billion in losses -- an average of roughly $1,800 per incident. Banks absorbed most of these losses, Gartner points out.

Operational Risks are being tracked and counted. More processes are in place to try and get a grasp of the data and the trends to create new procedures. Transfer of risk is creating even more issues. Is any of this working as quickly or effectively as management would like?

If fraud is at the heart of operational risk, then human behavior is no doubt at the center of fraud. To understand how to minimize fraud, you must have a more substantial grasp on the human motives for fraud. And to better understand those human behaviors, a risk manager must know the clues and cues for detecting what people are exploiting the organization with deception and new tactics for achieving their goals across business boundaries. The USA Patriot Act is one tool that has targeted the center of this human behavior.

"These and other regulations are forcing companies to look at all customer activity, even across silos," says Rosenoer. That is where the CRO comes in. "The role of the CRO -- or chief risk officer -- is to ensure the bank is compliant across these regulations," he explains. "Further, the CRO bridges business continuity in the event of fraudulent events. Again, this is not just an online problem. CROs are evaluating money laundering rings, compromised internal systems or anything that is threatening the enterprise."

e-Discovery: A "Perfect Storm" for Corporate Chaos...

The FBI Task Force on "Backdating" options is in full swing in the Silicon Valley.

The U.S. attorney's office here has launched a stock options backdating task force to investigate allegations that Silicon Valley companies and individuals defrauded shareholders by retroactively changed grant dates for stock options.

The task force is currently investigating several Bay Area companies to determine the extent of alleged efforts to defraud shareholders in the dating and awarding of stock option grants, according to a statement released by the U.S. Attorney's Office. The task force includes members of the U.S. Attorney's Office and the FBI, the statement said.

If you are a company who is under scrutiny, then you should make your Document Retention Policy Team and on staff e-Disovery staff familiar with the new rules going into effect for electronic discovery.

New rules for electronic discovery of documents in civil cases go into effect in December -- and they could cost users millions or even billions of dollars if they fail to comply.

Last September, the Judicial Conference of the U.S. Supreme Court's Committee on Rules of Practice and Procedure recommended changes that force companies involved in a civil lawsuit to sit down and hammer out what records are fair game for electronic discovery. In general, the resulting 300-plus page document describing the new e-discovery criteria says that companies involved in civil litigation must meet within the first 30 days of a case's filing to discuss how to handle electronic data. The discussion must encompass retention practices, the types of records required and their electronic format, as well as what is considered "accessible" data, said John Bace, an analyst at Gartner Inc. in Stamford, Conn. Failure to comply with the new rules could be costly.

"Falsification or backdating of financial documents may call the integrity of companies' financial statements into question, can constitute fraud on the company, shareholders, and the market, and may give rise to tax violations," said U.S. Attorney Kevin V. Ryan, who is heading the task force.

Operational Risks associated with document retention, legal discovery and liability is a "Hot" topic for most Chief Risk Officers. More so, a continuing challenge for the CIO on how much money to budget for storage, back-up and archiving. However, if the companies policy and procedures are already up to date on the Business Crisis and Continuity Plan then most if not all of the organizations concerns on e-discovery issues should be trivial.

Unknown to the General Counsel and the Director of Business Continuity is where policies overlap and where there might be gaps. This is the place where risk exposure is extensive and the likelihood of an incident is high. A "Perfect Storm" of corporate chaos in the making.

Avian Flu: The Risk of Pharma Divergence...

This McKinsey article on Avian Flu has some valid points:

• To counter the threat of a global flu pandemic, policy makers, health care organizations, and the pharmaceutical industry must collaborate to develop a market-based approach to expand vaccine production capacity.

• The most effective way of doing so would be to stimulate demand for the annual winter flu vaccine, finance research into the development of pandemic vaccines, and reach an agreement on the amount of additional capacity required around the world.

• Simultaneously, pharmaceutical companies must develop a fourth strain, targeting H5N1 and other avian-influenza strains, and seek regulatory approval to add it to the existing annual winter flu shot.

• Although these shots would not include the eventual pandemic strain—which cannot be known until it appears—people immunized with them would develop antibodies against a potentially deadly virus.

Crisis, Command and Control Training in Large Global Enterprises...

1SecureAudit Launches Operational Risk Solution for Crisis, Command and Control Training in Large Global Enterprises

Lessons learned from large-scale disasters and new blended threats require an adaptive Incident Command System (ICS) for training executives; crisis managers and emergency operations center staff

1SecureAudit, an emerging leader in Operational Risk Management Solutions for the Financial and Healthcare Services Sectors, and its strategic partner Innovative Management Concepts (IMC), today announced an Internet Web-Services Solution designed for an organizations executives and crisis staff to better prepare for wide area emergencies and global incidents.

“The challenges and concepts of network-centric warfare (NCW) are now being applied to post 9/11 scenarios as CxO’s, Incident Commanders and Emergency Operations Centers (EOC) are learning new standards and skills to be more resilient in a new “All-Hazards” worldview,” said Peter L. Higgins, Managing Director of 1SecureAudit.

The 1SecureAudit Crisis, Command & Control Training Management System (C3TMS) powered by IMC is a Network-Centric Web Services solution. It was designed and is currently deployed for Command and Control (C2) rehearsals in the US Air Force.

The US National Incident Management System (NIMS) is applicable across a full spectrum of potential commercial incidents and hazard scenarios, regardless of size or complexity. Clients will utilize C3TMS to make rehearsals more practical, less time consuming and at a significantly lower cost to produce. This means more exercises and tests in a safe and secure setting. It provides the continuity of operations team with real-time, realistic scenario simulations configured “On-The-Fly” to provide executives with the assurance to carry out their crisis missions with confidence and clarity.

1SecureAudit Crisis, Command & Control Training Management System is available immediately for organizations that require compliance with new regulatory and legal standards for business resiliency, emergency preparedness and continuity of operations planning.

Turnover Risk: Emotional Intelligence Factors...

The turnover in personnel in your organization could increase your operational risk.

Freddie Mac (FRE) on Wednesday released its annual report for 2005, with Chairman and Chief Executive Richard Syron describing the year as one that brought "reason for pride" as well as "some disappointment."

Freddie Mac said elsewhere in its information statement that "we have recently experienced high employee turnover rates, which strain existing resources and contribute to increased operational risk.

"We are also assessing our standards of performance and how we enforce those standards to create a more effective culture of accountability," the firm added.

There are many examples of how strained resources and a lack of personnel contribute to the increase in operational risks. Today's search on their corporate website under careers produced 216 job postings that mention "risk" and 19 of these are operational risk. Enforcing standards of performance is another matter in itself and remains a challenge for any enterprise the size and complexity of Freddie Mac.

In this research paper Key Personnel: Identification and Assessment of Turnover Risk by Craig Schreiber and Kathleen Carley you can find some of the answers for this significant business issue:

Intellectual work is the central commodity of any knowledge-based enterprise. Personnel are not simply brought in to run the assets of these companies as they are for more traditional manufacturing and service based enterprises. The personnel are the assets and as such, identifying and retaining key personnel is a major concern for knowledge-based enterprise.

While this example from a study at NASA is not even close to the financial services environment from a workplace perspective, it is valid from a knowledge worker point of view. When your personnel are your assets, turnover risk can be a real and present threat. What can a CEO or Executive Management do to mitigate the growing threat of turnover in personnel?

Some of the answers may be found in "Emotional Intelligence" by Daniel Goleman.

"The airplane cockpit is a microcosm of any working organization. But lacking the dramatic reality check of an airplane crash, the destructive effects of miserable morale, intimidated workers, or arrogant bosses---or any of the dozens of other permutations of emotional deficiencies in the workplace----can go largely unnoticed by those outside the immediate scene. But the costs can be read in signs such as decreased productivity, an increase in missed deadlines, mistakes and mishaps, and an exodus of employees to more congenial settings. There is, enevitably, a cost to the bottom line from low levels of emotional intelligence on the job. When it is rampant, companies can crash and burn."

The Board of Directors may want to ask about the Emotional Intelligence of corporate management at the next board meeting and put this on the operational risk dashboard.

More Aspirational than Operational...

One day we could be asking ourselves about the insight gained from understanding aspiration, and then acting upon it. In the context of effective Operational Risk Management, understanding and detecting people's aspirations are critical to the safety and security of your business.

We should be thanking Robert S. Mueller, III and his team for preemption of what could be just one of many unknown operational plans by domestic terrorists. Here are a few words from his speech at the City Club of Cleveland June 23rd:

It has been nearly five years since the last terrorist attack on America. Yet there is no room for complacency. As we have seen in recent months, our enemies are adaptive and evasive. They are taking full advantage of technology. They are combining their resources and their expertise to great effect. We must do the same.

Our greatest weapon against terrorism is unity. That unity is built on information sharing and coordination among our partners in the law enforcement and the intelligence communities. It is built on partnerships with the private sector and effective outreach to the public as our eyes and ears. It is built on the idea that, together, we are smarter and stronger than we are standing alone.

No one person, no one agency, no one police department, and no one country has all the answers. We may not always know where and when terrorists will attempt to strike. But we do know they will try again. And we must combine our intelligence, our technology, and our resources to stop them.

We face many challenges today, both from overseas and from those living in our midst. But we must not let terrorism change our way of life.

Being vigilant is not enough these days. You also need courage and lot's of it. The courage to have unity. Organizations are doing just that and many are not waiting to find out if the FBI can preempt every possible plot to harm our economic way of life. Yet, they are doing it in collaboration and in cooperation with people they know and trust. People they can count on to preserve and protect our corporate assets. Organizations such as WashingtonDCFirst is just one example of how the private sector is working along side the public sector to increase the resiliency of our Critical Infrastructure. And the emphasis is on resiliency because everyone has finally concluded that "protection" in itself is a zero sum game.

People who aspire to be known for their criminal or terrorist act will continue to achieve their goal some of the time. Whether it is the lone homegrown variety or the organized and well funded class, we must remember that preemption in their aspirational phase is preferred over recovery in the operational phase. It is safe to say that regardless of the amount of money and manpower being applied to the security of the Sears Tower, it will never be enough. Bob Mueller is right. All we need is more "Unity".

Protection vs. Resiliency: The New Standards for BCM...

The latest AT&T Business Continuity Study has been published and the results are surprising. Operational Risk Professionals should take note that 28 percent of the companies do not have adequate plans in place to cope with natural or other disasters.

AT&T Inc.'s fifth-annual Business Continuity Survey released Tuesday, which polled about 1,000 CIOs and IT executives at U.S. companies with more than $10 million in annual revenue.

Nearly 30 percent of executives who participated in the survey said their company has suffered from a disaster. Eighty-one percent of executives said cyber security is part of their overall business plan for interruptions in 2006, up from 75 percent in 2005.

Eight out of 10 companies have revised plans in the past 12 months, including 48 percent that say they've been updated in the past six months. Of those companies with plans in place, 40 percent say they have not tested their plan in the past year.

Companies in Los Angeles, Miami, New York and Washington, D.C. were among the most prepared and made their disaster recovery plan a high priority, compared with those less prepared in Detroit, St. Louis and Seattle.

Since 40 percent of those with plans in place have not tested in the past, the real question is why? Is it the lack of time or resources and money? Is it the fear that new planning will have to take place once "Lessons are Learned"? It may be all of the above. Dr. Sean Gorman a Ph.D from George Mason University has some answers that may become the standard for a "Methodology for Critical Infrastructure Resiliency."

His argument is this:

The first step in any comprehensive plan for ensuring the resilient operation and reliable delivery of services is the establishment of a methodology by which standards and metrics can be set. There needs to be a common methodology by which stakeholders can objectively quantify investment in business continuity by measuring resiliency.

His work at FortiusOne is catching the eye of Venture Capitalist's since the Operational Risk tools that he and his team are developing have significant impact with any firm with Enterprise Risk Management priorities. This includes financial hedge funds as much as the large commercial retailers who have logistics, transport and supply-chain applications.

FortiusOne’s target market encompasses both the public and private sector. The former includes federal, state, local and international segments, with primary emphasis on Homeland Security, National Defense, Intelligence and Emergency Management for critical infrastructure vulnerability assessments and consequence management.

FortiusOne’s private sector market addresses risk analysis for the Banking/Financial Services, Transportation, Energy, Telecommunications, Insurance and general Supply Chain segments with primary emphasis on business continuity planning, business optimization and disaster recovery. Market size exceeds $40B and is upward trending in both public and private sectors. Recent events and consequences related to hurricane Katrina, terrorist threats and attacks, and corporate management/mis-management events have created intense interest in FortiusOnes’s products and services.

Infrastructure Resiliency Methodology provides the enterprise with the business case for investment. How do you know where to spend valuable budget dollars to get the most value for your investment in terms of increased resiliency? The fact is that you have to test, exercise and provide scenario simulations to find the failures. This will provide the operational impact and economic analysis that management and the Board of Directors need to authorize budgets that have a significant return.

There is more help on the way for Business Continuity Management (BCM) as PAS56 evolves into BS 25999:

BS25999 v PAS56

PAS56, published in 2003, provided a series of recommendations for business continuity management good practice. It was always intended to be the forerunner of a new standards for BCM (BS 25999). The first draft has been commented on and returned as of June 19th. If you liked what you have seen in ISO 27001 then you will see a similar approach in the next relase of the Code of Practice for Business Continuity Management, BS 25999 Part 1. This standard is not intended to be a beginners guide to BCM and will not cover the activities of emergency planning.

In this new code of practice the taxonomy is established:

Resilience: Ability of an organization to resist being affected by an incident.

The Homeland Security Advisory Council (HSAC) Critical Infrastructure Task Force is setting the policy and the pace for the future. "While protection is a necessary component of building resilience, resilience is not an inevitable outcome of strategies that focus on protection." This provides the foundation for changing our mindset from Critical Infrastructure Protection (CIP) to Critical Infrastructure Resiliency (CIR).

Board of Directors: Beware of Reputation Risk...

How do Board Directors understand risk vs. how their companies manage risk? A recent study by The Conference Board entitled "The Role of the US Corporate Board of Directors in Enterprise Risk Management" finds out the answers:

When we asked directors personally, many said they approach risk on a case-by-case basis in connection with a specific strategic issue such as a merger or acquisition or the entrance into a new market. This may not constitute a sufficiently robust process to satisfy directors’ fiduciary responsibilities.”

The new research found significant differences in how directors understand risk and how their companies manage risk. Moreover, directors may have more of a top down understanding of risk. The Conference Board study finds: Although 89.5 percent of directors say they fully understand the risk implications of the current strategy,

- Only 77.4 percent of directors say they fully understand the risk/return tradeoffs underlying the current strategy.

- Only 73.4 percent of directors say their companies fully manage risk.

- Only 59.3 percent of directors fully understand how business segments interact in the company’s overall risk portfolio.

- Only 54.0 percent have clearly defined risk tolerance levels.

- Only 47.6 percent of boards rank key risks.

- Only 42 percent have formal practices and policies in place to address reputational risk.

Directors are, however, sensitive to the need for additional information:

- While 71.8 percent of directors believe they have the right risk metrics and methodologies in making strategic decisions, 47.6 percent of directors would like to see more data analysis related to the company’s risk profile.

The good news is that almost half of those surveyed think that they need more data analysis to determine the companies true risk profile. The bad news is the same number of Boards actually rank their risks. This means that half of those surveyed, do not rank their risks. Is this possible?

Certainly these organizations are measuring risk. They have tools and systems to gather the data and to analyze it. They have some kind of Risk Model to assist in the ranking of those areas that have high impact and high exposure. These areas of risk in the upper right quadrant, correct?

The report, is authored by Carolyn Kay Brancato, Matteo Tonello, and Ellen Hexter of The Conference Board. These findings are based on a comprehensive research effort on the topic that incorporated personal interviews with 30 board members, analysis of Fortune 100 board committee charters, and a broad survey of 127 board members. The report has not yet been released, but is forthcoming.

It seems that at least with this small number of board members surveyed, the topic of Reputational Risk is still a mystery as 58% say they still don't have policy in place. In Brian Murray's book Defending the Brand his introduction says it all:

Digitalization and the convergence of networked communications mediums have forever changed the way we live and conduct business. Broadband and wireless technologies, networked appliances, and multipurpose consumer devices promise to embed digital networks even deeper into our everyday routines. Unfortunately, while such technological advances have created fantastic opportunities, they have also facilitated new, unscrupulous business tactics and provided a haven for criminals who thrive on the victimization of corporations and consumers alike.

The Board of Directors who are not taking "Reputation Risk" seriously may have more work ahead of them. Protecting your assets goes well beyond the surveillance cameras and the clear presence of armed guards. 9 out of 10 incidents that impact corporate reputation will begin with information. And it may end with that information being in the hands of those that will exploit you with piracy, fraud, counterfeiting and deceit. Mr. Murray is correct when he says: "Fierce competition and economic pressures have exacerbated the situation as ethics fall by the wayside in the struggle for profits and survival."

The Modernization of Investigative Techniques Act (MITA)

As the Canadian terror plot unfolds, financial district operational risk managers and contingency planners are hard at work. Targets including the Toronto Stock Exchange, an unspecified military installation and the headquarters of the Canadian Security Intelligence Service were at the center of the plan.

The Royal Canadian Mounted Police announced Saturday that authorities had foiled a terrorist attack and said 12 men and five teenagers had obtained 3 tons of ammonium nitrate fertilizer, three times the amount used in the 1995 Oklahoma City bombing that killed 168 people.

But some police later said that although the suspects had sought to obtain ammonium nitrate, they actually had been delivered a safe substance instead during a sting last Friday.

According to court documents cited by the Canadian Broadcasting Corp., 20-year-old Zakaria Amara led efforts to buy enough ammonium nitrate through sellers on the Internet to make three truck bombs and had obtained a remote triggering device that investigators found at his home in Mississauga, just west of Toronto.

And the legislators are listening now to the Royal Canadian Mounted Police (RCMP) and other risk managers about reviving the "Modernization Investigative Techniques Act" (MITA). Even though this plot was interdicted, there may be back up operations in place. This new bill will give the investigators with greater tools to do their job and keep Canadians from the same fate as those in Oklahoma City and New York. In both cases, an Ammonium Nitrate truck bomb was used to inflict hundreds of casualties and hundreds of millions in lost property.

Police have credited Internet surveillance with playing a key role in last week's arrests of 17 terror suspects who are alleged to have plotted attacks in Toronto and Ottawa.

Police and intelligence officials have insisted that their technological capabilities have not kept pace with new technologies used by terrorists and organized crime, and have asked for the law to require telephone and Internet networks to build in quick and easy access for wiretaps and surveillance.

The Modernization of Investigative Techniques Act (MITA) is intended to ensure that telecommunications service providers build and maintain an interception capability on their networks that allows for the lawful interception of communications by law enforcement agencies and the Canadian Security Intelligence Service (CSIS).

Similar legislation is already in place in many countries including the United States, the United Kingdom, France, Germany and Australia. This Act will also require service providers to provide subscriber contact information upon request and in accordance with strict privacy safeguards.

ID Theft: "Data Encryption Utilized on Premises"

Now that data theft has hit the US Military not just the veterans, agency CIO's and CSO's will be on the operational risk hot seat.

Personal information stolen from the home of a US government employee included data on 2.2 million military, officials said on Tuesday.

It was previously thought the data only related to some 26 million veterans.

The Department of Veterans Affairs (VA) said as many as 1.1 million on active service, 430,000 National Guardsmen and 645,000 reservists may be affected.

The lawsuits have started and they are asking for $1,000 for each person affected. That's just the beginning. The Inspector General's and the Auditors will be ramping up this season to make sure nothing like this happens again. Unfortunately, it will. As information becomes the most valuable target for theft, the criminals will cease robbing banks and homes for cash and credit cards and just steal computers and hard disc storage. Recent news has shown that banks are being broken into and nothing but the computers are stolen. Home invasions of prominent business executives or government workers who may also have that valuable information on their laptop may soon be at greater risk.

What is the answer to try and deter this wave of crime? Deterrence for the information itself. While many have objected to the value of encryption or encrypting data because it's too expensive, hard to administer or slows down the process, now it may be a more relevant option. See PGP to learn more.

Mobile computers are quickly emerging as the industry standard for increasing user productivity and efficiency. The portable nature of these devices also increases the possibility of loss or theft. Operating system login authentication alone cannot protect sensitive data on disks. If a system is ever stolen or lost, an enterprise may be exposed to significant risk of financial loss, legal penalties, and brand damage.

PGP Whole Disk Encryption for Enterprises locks down the entire contents of a laptop, desktop, external drive, or USB flash drive, including boot sectors, system files, and swap files. Encryption runs as a background process that is transparent to the user, automatically protecting valuable data without requiring the user to take additional steps.

Sometime soon the warning signs on the front lawn or on the bank door will say:

"Data Encryption Utilized on Premises"

Backdating: What is your E-Discovery Readiness Factor?

There is additional volatility in the wind as the SEC steps up investigations of "Stock Option" grants prior to August of 2002. The focus is on Backdating of Grants to executives and whether the grant dates were backdated to a time when the stock price was at it's lowest. Stock Option grants are to be priced with an exercise price that equals the current price of the stock. "Backdating" is the intentional grant date setting to a point in the past when the price was lower, so to increase the gain upon exercising.

In general, government probes are being launched to determine whether the grants were backdated to a point shortly before the company announced good news, so option holders could capitalize on a lower market value. Although the practice is considered controversial by many investors, backdating is legal if disclosed in regulatory filings, allowed by the company's own policies, and accounted for properly.

Six of the 22 companies named in the Moody's report are rated by the agency. They are: Affiliated Computer Services, American Tower, Caremark Rx, Jabil Circuit, Juniper Networks, and UnitedHealth Group.

What are the implications?

Accounting restatements to start with. Tax issues to follow. Even the resignations of senior executives in the midst of a continuing investigation by the SEC and Justice Department. The fact is that backdating is a credit risk on paper. It is an Operational Risk in behavior.

Be prepared to produce all relevant records upon receipt of the discovery request. Even the most proactive organizations are already doing their own internal reviews before the financial auditors ask for this information. Send a message to all relevant personnel responsible for the information archives to be ready to produce the documents on all stock option grants for new hires and executives who receive regular grants as part of their total compensation.

Compensation Committee's will soon be dictating that future grant option dates be timed for the "open window" after earnings announcements. This will increase the confidence that executives are not getting special treatment upon hiring or for annual performance bonuses. Look to the savvy organizations to also time their annual performance reviews with employees so that any other stock option grants are done so in the next calendar "open window".

Caremark Rx Inc. shortchanged investors by granting senior executives backdated stock options, allowing them to buy shares at artificially low prices and exposing the company to costly legal actions.

That's according to a shareholder derivative lawsuit filed against the company in federal court here.

The company denies that any backdating of options occurred.

The plaintiff threat is now gaining momentum and it would be in most high profile companies to recheck their "E-Discovery" Readiness Factor. The documents produced five or six years ago will no doubt be under the magnifying glass of the auditors and investigators in the weeks and months ahead.

Reinventing Corporate Security for Business Survival...

The Reinvention of the T-Mobile security assurance functions is another example of continuing convergence strategy at global organizations.

Now, in one room sit three of the top security executives recruited to effect change at T-Mobile by creating a new asset protection division. They are: Frank Porcaro, vice president and director of the new asset protection division; Ed Telders, director of information security, policy and compliance; and Rick Roberts, senior manager of security services. With them in the room, of course, is the pink elephant.

The asset protection group—Porcaro's group—is the heart of the makeover. Asset protection will converge physical and information security and, at the same time, create two new groups, including an information security group and a full business continuity/disaster recovery group. In the past year alone, asset protection has grown from four employees to 18, with several of those new hires having CSO-level experience.

Meanwhile, as it's under construction, asset protection is also being moved to another division, risk management and assurance, to be closer to related functions like audit and investigations. In the end, T-Mobile hopes to have one department—risk management and assurance (RM&A)—through which all security functions flow.

The strategy for Business Survival begins with an understanding of how your corporate assets are being attacked, both online and offline. Both physical and digital.

Our corporate assets are under attack by a continuous barrage of new laws, new employees, new competitors and new exploits. Business survival in the next decade will require a more effective and robust risk strategy to deter, detect and defend against a myriad of new threats to the organization.

Modern day attackers include hackers, spies, terrorists, corporate raiders, professional criminals, vandals and voyeurs. Simply said, these attackers use tools to exploit vulnerabilities. They create an action on a target that produces an unauthorized result. They do this to obtain their objective.

The Mission
Deter the attacker from launching a salvo of new threats to compromise your organizations assets. You first have to understand the value of your corporate assets to determine what are the most valuable in the eyes of your adversary. You must make it increasingly more difficult for these valuable assets to be attacked or you will find yourself under the constant eye of those who wish to create a significant business disruption.

These attackers are individuals who take on these quests or objectives for several key reasons. They include financial gain, political gain, damage or the simple challenge, status or thrill. It’s your job to create deterrence for each one of these objectives.

The Take Away
In order to effectively deter potential risks to your corporate assets, first you have to understand what they are and how valuable they are in the eyes of each kind of attacker. The more valuable the target, the more deterrence it requires.

OPS Risk Consultancy Growing at 10% Annually...

Bank spending on operational risk management (ORM) software and services is set to grow at a compound annual growth rate of 4.7% to reach $1.38bn by 2010, according to an annual study released by Chartis Research.

Chartis says the ORM software market - estimated to be $163m in 2006 - is set to grow at a compound annual growth rate of 7.7% to hit $219m by 2010.

Meanwhile ORM related consulting services will continue to grow at a healthy 10.2% compound annual rate. This will be fuelled by Sarbanes-Oxley, Basel II and other risk or governance regulations. As the second wave emerges, Chartis says it expects systems integrators to increase their activity in this area and derive increased revenue from it.

"One reason ORM is getting hotter is due to the fact that legal counsel and outside counsel are advising clients to error on the side of over-compliance", said Peter L. Higgins, Managing Director & Chief Risk Officer at 1SecureAudit. "Showing the auditors and investigators a trail of due care and evidence of doing the right thing in their transparency and reporting is paramount. Those who are left out can trace the root cause of their fines and operational losses from ignoring such significant issues as suspicious activity reporting (SAR)", Higgins concluded. Until now, some organizations did not realize that they too are subject to such requirements:

Financial institutions have been filing increasingly larger numbers of Suspicious Activity Report (SAR) forms since the 2001 terrorist attacks, according to statistics from the U.S. Treasury Department's Financial Crimes Enforcement Network (FinCen). Financial institutions filed more than 689,000 SAR forms in 2004, and the SAR tally for 2005 appears likely to eclipse that mark. The first half of 2005 alone saw more than 435,000 SAR forms filed. The figures for the second half of 2005 and beyond are not yet available. There are several reasons for the increase in filed reports, including an expanded definition of the types of firms that must report suspicious activity, as specified by the Patriot Act. Since January 2002, the list has been expanded to include money-order issuers, insurance companies, broker dealers, mutual funds, currency exchanges, and futures commission merchants. Another reason is that financial institutions are erring on the side of caution, filing anything remotely suspicious in order to minimize the risk of fines or regulatory hassles. "What the lawyers are telling the bankers is, when in doubt file a suspicious-activity report," explains banking consultant Bert Ely.

A recent example of ignoring the compliance laws for the Bank Secrecy Act(BSA) that include Anti-Money Laundering(AML) programs can be found at Liberty Bank of New York.

Liberty Bank failed to implement an adequate system of internal controls to ensure compliance with the Bank Secrecy Act and manage the risks of money laundering. Liberty Bank lacked adequate written policies, procedures and controls reasonably designed to ensure the detection and reporting of suspicious transactions. Liberty Bank's policies and procedures did not clearly delineate responsibility for detecting, evaluating and reporting suspicious activity, or provide guidance and instruction on the decision and approval process for suspicious activity reporting.

The reason that ORM consutling services are growing at +10% annually is because there are still people out there who don't think they are a Money Service Business(MSB) and secondly those that realize they are, have not implemented the programs effectivley even at some of the larger institutions.

Hurricane Preparedness Week: May 21-27...

"Preparation through education is less costly than learning through tragedy."
- MAX MAYFIELD, DIRECTOR
NATIONAL HURRICANE CENTER

History teaches that a lack of hurricane awareness and preparation are common threads among all major hurricane disasters. By knowing your vulnerability and what actions you should take, you can reduce the effects of a hurricane disaster. This year Hurricane Preparedness Week is May 21-27, 2006.

As NOAA will announce the 2006 Atlantic Hurricane Season Outlook at 11:00 AM EDT Monday, one can only wonder if we will have more than the 26 named storms last year. The preventive measures that have taken place are many and yet are we still as prepared as we could be? The 2005 hurricane season, the busiest and most destructive on record with 28 named storms, 15 of them hurricanes, has made many people along the Atlantic and Gulf coasts more wary as they prepare for a 2006 season. This year, researchers predict 17 named storms, including nine hurricanes.

In the 2005 Business Continuity - The Risk Management Expo survey of 251 companies raised many questions about the 30% who said they did not have a Business Continuity plan in place. The key concerns are as follows:

1. Even if there was existence of a plan in 70% of the respondents, only 27% of the key personnel are even trained on the plan.

2. Does the plan cover all hazards of just the ones that have been prioritized by the key staff?

3. How does staff communicate to their employees during the crisis?

4. How would share holders, institutional bond holders, and the board view the company when they find out that the company doesn't have or hasn't exercised their crisis management plan?

In any plan, people are the key to business recovery and survivability. And in post disaster analysis, little consideration was given to the supply-chain. The vendors, suppliers and service organizations that keep your corporate operations running each day. Many suffered tremendous delays in the recovery process because contingencies were not in place prior to the crisis event.

Communications is always the biggest failure during times of crisis. When the primary communications systems fail, that is when you will know if you have been training enough. Victims will soon find out how well you have prepared. Accurate, timely, consistent and relevant information are the foundation for any resilient framework for communications. Most city, state and federal emergency-management authorities still can't communicate by phone or radio in a crisis, because a $2 billion special outlay for so-called "interoperability" is mired in legislative wrangling or being spent without federal coordination.

Flu Pandemic: NIMS to the Rescue...

An operational risk benchmarking survey conducted by The Risk Management Association in April 2006 indicates that many financial institutions are preparing for a possible flu pandemic.

Key findings are:
-- Large North American institutions with asset sizes greater than $10 billion are taking the threat seriously. Least concerned are banks with assets of less than $500 million.
-- Most banks expect disruptions to last three to nine months.
-- Two-thirds expect 30% or more of their key workers to be absent during peak periods of disruption.
-- More than 60% have identified someone to lead the planning, but less than a third have rolled out plans and begun regular testing.
-- Only about a third of banks are well along in establishing policies for such things as employee compensation, evacuations, and reducing workplace transmission of risk.

Participants in RMA's "How Serious Is the Threat of a Pandemic and What Are Bankers Doing about It" included 190 financial institutions. Of those, 168 are from North America, 14 from Europe, and eight from Asia, Australia, and Africa. The results are broken out by geographic area and asset size, with respondents' asset sizes ranging from under $500 million to over $500 billion.

Continuity of Operations and Business Crisis Conintuity Management experts are prepared to handle the requirements from the two thirds of the banks who still HAVE NOT begun regular testing. Along with the typical exercises where a third of the work force stays home for a day to see how the IT assets handle the load, there is much to do with the testing of your third party suppliers and critical supply chain vendors.

Make sure that the people you trust to get you through the tests, exercises and consulting advice are NIMS compliant. The National Incident Management System (NIMS) in the US is the standard for a comprehensive, national approach to incident management that is applicable to a full spectrum of potential incidents. This includes a myriad of hazard scenarios, regardless of size or complexity.

All corporate officers who plan on being part of the Unified or Area Command must have the tools and the training far in advance to accomplish COOP or BCP goals. Here is the scenario:

"An outbreak of a suspicious flu-like virus has broken out throughout the State. So far, victims seem to have contracted the virus through personal contact, but public health officials cannot trace the source of the virus to naturally occurring outbreak. Because the contamination area is spreading, the entire region has been placed on alert. This incident should be managed by an Area Command."

Using Incident Command System (ICS) protocols in combination with the NIMS framework allows the organization to become more resilient to the risks associated with a major disruption in business operations. This may include denial of service, both online and offline, lack of key personnel, or quarantine of company facilities. For more information and answers to how to get your company NIMS compliant and ready for the next tornado, hurricane, earthquake or terrorsit incident, see WashingtonDC FIRST.

Criminal Intent: Digital Surveillance Dominates Q1...

Seventy percent of malware detected during the first quarter of 2006 was related to cyber crime and more specifically, to generating financial returns. This is one of the conclusions of the newly published PandaLabs report, which offers a global vision of malware activity over the first three months of the year. Similarly, the report offers a day by day analysis of the most important events in this area. This report can be downloaded from Panda.

This report confirms the trend of criminal intent of the developers of malicious code to steal information for financial gain. Most successful are the bots and spyware code that lives silently on your corporate executives lap top after spending a week away traveling. Since the tendency for using "Free WiFi" exists in many hotels and other travel zones, the lap top becomes vulnerable to an infection. And when that lap top is reconnected to the docking station back at HQ, the real threat begins.

Digital Surveillance using malicious code is not new. The art is now a science. Ask any 19 or 20 year old in the Engineering or Computer Science Department at a major university. The use of spam and other techniques for spreading the use of the malicious code makes it imperative that your detection and defense strategies are sound and operating on a daily if not hourly basis. Organizations are under a barrage of attacks that are random and sophisticated, and are deployed with a multifaceted approach to gain the required exploit results. These new blended threats include a salvo of virus and worm technology into an smart and yet elusive attack vehicle.

According to FBI studies, more attacks are propagated and launched internally than externally. Companies are deploying internal intrusion detection systems that place monitors or agents on multiple department segments, and e-mail anti-virus systems that prevent viruses from moving.

Many organizations are exploring new devices that IDC has coined Unified Threat Management(UTM) appliances: Effective UTM requires:

* Low total cost of ownership. Total system costs must be less than the expected loss if there are security breaches due to lack of control. The solution must decrease the time to protection and ongoing overhead to achieve a lower total cost of ownership. Security threats are constantly changing, and the system must adapt to these changes on a constant basis with little to no user intervention.

* Coordination. Security breaches can occur between mismatched technologies, so whenever possible layer the security approach. Since many threats have multiple attack signatures, one layer prevents a certain portion of an attack while another layer catches the rest. The network’s security posture must adapt in unison for comprehensive protection.


* Reduced complexity. To achieve maximum security, solutions must be easy to implement, and the components must work well together; if not, incident detection (and resolution) becomes difficult if not impossible. Vital considerations include time-to-response and automation of appropriate protection.

Consider an evaluation of SonicWall to find all three advantages in your enterprise.

The Risk of External Supply-Chain Interdependencies...

In what countries do you operate? Do you source raw materials from politically unstable regions of the globe for your end products? Are you subject to a myriad of taxes, tariffs and duties including new security measures in our ports? How complex is your sales and distribution channels? At the end of the day the big question is: What is my financial, operational and economic risk exposure in the event of a disruption in our external supply-chain?

The risk of external supply-chain interdependencies has been talked about for many years. Monte Carlo simulations, scenario analysis and other methods have been effective in the determination of what the magnitude of a loss event may look like. Once the dollar analysis is done and you know that your exposure is $XXM. or $XB., then what do you do with that information?

Much of the outcome of this exercise may go into the next strategic planning phase on who you need to partner with or create an alliance with in order to satisfy certain future contingencies. Once you realize that you need more than one source for a raw material or a key service to run your business, then the real analysis begins. Who and where do I find the best alternatives for this vital component in my global supply-chain?

If you begin your due diligence now on the top 10 vital components in your supply-chain contingency planning exercise you might have these all completed, through the legal department and signed within a few months time. If you are lucky. Then you must really test the new supplier or source for your product or service to determine how smooth they operate when you pick up the phone or send the "Alert".

The ultimate architecture requires an "Adaptive Supply-Chain" that will provide cross-border agreements and resilient mutual-aid partners to assist in times of crisis. Just shifting production from one country to another may not be enough to mitigate the disruption in a vital component of the manufacturing process or delivery of services. Having a reflexive and responsive supply-chain is only one of many contingencies in a robust Business Crisis and Continuity Management plan.

When was the last time you reviewed your key suppliers and sourcers plans for continuous operations and their record for testing these plans? This will be the place you find your greatest weakness in external supply-chain management. In the US, it is now less than 30 days away from the next hurricane season. Gasoline prices and fuel costs are impacting every sector of the economy. One thing is for sure. You are in complete control of your readiness factor. And your readiness factor is directly proportional to your interdependencies in your supply-chain.