How can accountants use cyber forensics and big data to enhance cybersecurity?
By Majella Gomes
Cyber threats today are deadly, malicious and mercenary, and all of us should be worried.
“Anyone can be affected,” stated Geetha Rubasundram, Senior Lecturer & Chairperson, Centre of Professional Transformation in Accounting & Finance, Asia Pacific University, moderating the recent Cyber Forensics, Cybersecurity & Big Data session at the recent MIA Forensic & Fraud Investigation Conference 2018. Examples of major cyber issues include Ransomware that locks users out of their own systems, or malwares that can impact and endanger public infrastructure and safety, to name a few.
The investigations are becoming more complex especially with focus on Data Protection, Encryption, technology that promotes anonymity, and the use of the Deep / Dark Web by cybercriminals and members of the public. Misuse of the Dark Web and the business of Crimeware-as-a Service increases the risk of cybercrime for just about anyone, whether it is members of the public, businesses or government. Anonymity plays a significant role in terms of the success rate and tools used for detection, litigation impacts and overall, investigators around the world.
So how can accountants as business partners and the frontline against cybercrime and financial crime be of help? The following are some rules for boosting your organisation’s defences and mitigating risks:
Craft and Enforce Effective Data Management Protocols
Since people are the weak link, it is imperative that stringent policy be in place to manage an organisation’s data, that extends to who can access it, and how it is handled from acquisition to disposal, including the channels that are used to access it, such as laptops, mobile phones and other hand-held devices. The growing use of cryptocurrency is further complicating matters and will require a re-examination of policies as these can be traded seamlessly across borders, eluding security, surveillance and taxes. The expansion in technological use comes with a pressing need for privacy and the safeguarding of personal information, the theft of which could lead to identity fraud and more disruption.
Enhance skills in Documentation and Presenting Evidence
“Data is everywhere,” said Dr. Farouk Abdullah, Chief Data Scientist, Azendian Solutions. “We have more data now than the human race has ever had before.” This includes financial data, the province of accountants.
Presenting data as evidence is a key skill for accountants, especially forensic accountants as expert witnesses, and a challenging one to learn. “Keep everything documented with the intention of presenting it in court,” advised Mohd Zabri Adil Talib, Head, Digital Forensics Department, CyberSecurity Malaysia. He said forensics was essentially a marriage of science and law, and globally-accepted scientific methods were generally legal. Expert witnesses need to prove their competence and must be certified. The process of examination must be accredited and forensic lab methods must meet internationally acceptable standards.
Train People – the Weak Link in Technology
Raul Paolo Miranda, Global COO, CTO & CISSP Cybersecurity Professional, stressed that proper controls must be put in place from the outset, because technology can also be weaponised against individuals and organisation by cybercriminals.
Regardless of how sophisticated technology is, the weakest link is mostly human. A lot of education will be necessary for vulnerable sectors of society like the elderly and children, to protect them from scammers. Data analytics, a powerful tool against fraud, can help companies by identifying trends and making sense of large amounts of data, so they can easily understand what is happening in their environment in order to take appropriate and timely security measures.
Monitor Online Behaviour
As if technology wasn’t enough of a challenge, crime syndicates are leveraging technology and data to facilitate crime. Zabri noted that these syndicates buy data on individuals to track behaviour patterns, hence the need for ethics and caution when using the Internet.
Oversharing is particularly dangerous; the urge to constantly update one’s FB status, for instance, should be suppressed to avoid becoming a victim of cybercriminals. At corporate level, management needs to be convinced that such threats exist and encouraged to institute measures that kick in at the first sign of a breach. These measures should include comprehensive documentation of all transactions as well as a First Responders team.
Be Vigilant
Despite what seems to be common knowledge about the vagaries of the cyberworld, most Malaysian firms are not ready for cyber threats, concluded the panellists. Some firms weren’t even aware of who had access to their information! Because cyber threats are growing exponentially, and because of the existing shortfalls when it comes to IT, Malaysian companies will always be playing catch-up, said Dr. Farouk.
The key is to be vigilant. “Online behaviour should reflect offline behaviour,” he advised. “Get data governance right; get the right people in.”
