Fighting Cybercrime in the UAE: Building a Treasury Game Plan
By Eleanor Hill, Editor
Do you know who to call if your ERP is hacked? How will you make payments if treasury systems are disabled? Is cyber insurance the best form of risk mitigation? These questions and more were answered during a recent roundtable discussion hosted by Abu Dhabi Commercial Bank (ADCB) – which saw corporates, industry experts and ADCB executives share best practices on keeping treasury secure in the digital age.
Cybercrime activity in the UAE is on the rise, with malware and phishing attacks being the most prominent vectors. In fact, the UAE now ranks eighth in the most cyber-attacked countries in the Middle East and Africa region. Electronic fraud cases are also increasing in the UAE, and although the government is imposing heftier fines for cybercrime, the perpetrators remain extremely difficult to track – and can be working from anywhere in the world.
In an increasingly digital world, treasury needs to be on the front foot when it comes to cybersecurity. This is precisely why ADCB hosted roundtables in Abu Dhabi and Dubai on this topic in April 2019, led by Isaac Thomas, Head of Transaction Banking, ADCB and Sherie Morais, Head of Business Development, Transaction Banking, ADCB.
Building on a successful Digital Innovation Debate in 2018, these interactive cybersecurity sessions kicked off with an update on market conditions from Monica Malik, ADCB’s Chief Economist. Then the baton was handed over to Mimecast’s Jeff Ogden, GM Middle East and Hany George, Technical Specialist, to bring the cybersecurity topic to life. Mimecast provides email security and cyber resilience solutions.
“There are an enormous amount of cyber breaches happening around the world on a daily basis,” began Ogden. It is not only the growing number and scale of these attacks that is a concern for treasurers, he explained, it is the fact that cybercriminals are now attacking all sectors – the majority of bad actors are simply looking for organisations that are easy to hack.
“Over the past year, we’ve seen many SMEs coming under attack,” Ogden explained. “But all companies are at risk – and this is now becoming a boardroom issue. The challenge is that boards often do not know how to tackle cybercrime, or they underestimate the seriousness of the situation, so fail to take the appropriate action.”
Top cyber concerns
Understanding the nature of current threats is key to grasping the true risk potential. According to a recent survey carried out by Mimecast, the top threats companies in the UAE are concerned about are: ransomware; supply chain attack; CxO fraud; and phishing.
“Ransomware is now pervasive in the corporate sector, where cybercriminals can charge higher ransoms,” said Ogden. “The good news is that ransomware is declining globally as organisations are becoming wiser to the attack vector and putting better protection and back-ups in place. Consumers and companies are also learning that paying the ransom doesn’t necessarily guarantee that your data will be unencrypted – or not within a rapid timeframe, at least.” One audience member commented here that best practice advice from cyber insurance firms now suggests that treasurers do not pay ransoms, for the exact reasons stated above.
While ransomware may be declining as an attack vector, supply chain attacks are on the rise. These involve hackers exploiting weak points in the company’s buyer-, supplier- and partner ecosystem in order to compromise the individual or organisation. “Many e-commerce sites have been impacted by this, with British Airways (BA) being a prime example. Browser code inserted into the company’s website led to customer credit card details and personal information being stolen. Over a two-week period, 380,000 of BA’s customers were hit,” Ogden explained.
This makes conducting due diligence on suppliers even more critical. “You have to think about all of the relationships in your supply chain and probe them for weaknesses. Clear expectations must be set in terms of cybersecurity expectations and procedures to follow in the event of a breach,” he advised.
More of a concern than ransomware, according to Mimecast’s survey is so-called CxO attacks. These are impersonation rackets that involve fraudulent communication and can involve any C-suite member, from the CEO and CIO to the CFO. “Eighty-five per cent of organisations we have surveyed in the past year in the UAE have suffered an impersonation attack. And seventy-three per cent of those experienced a direct loss as a result – ranging from data loss to loss of jobs within the organisation,” Ogden warned.
“These attacks are becoming much more sophisticated. It’s no longer a question of spotting fake emails because of spelling mistakes. The hackers are very smart and patient. They will sit inside an organisation for months, gathering information, profiling the executive in question, learning how to impersonate them, reading their emails, looking at their calendar, and waiting for the right moment to strike.”