James Trenholme

Bank of England’s Sasha Mills sets out the banks expectations around operational resilience for FMIs. Some key points hinting at regulatory focus in the run up to April 2025… 1. Growing emphasis on cyber and data corruption scenarios as some of the most demanding 2. Ensuring that extreme but plausible scenarios provide a full exploration of resilience issues 3. Adopting more comprehensive resilience testing regime over time not just tabletops 4. Considering broader market impacts and involving market participants in testing 5. Growing emphasis on third party risk and the forthcoming critical third party regime While this speech focuses mainly on payment systems - the themes will be familiar to most FIs in their recent dealings with regulators. While April 2025 focusses many people’s minds - we can all be certain that regulatory interest in resilience will not diminish after that date. We wait with interest for the next rounds of supervisory engagement as the regulators digest everyone’s latest self assessments. #operational resilience

62

1 Comment

ICO urges organisations to strengthen cyber security amid rising attack risks The ICO reports a sharp increase in cyber attacks, urging sectors like finance, retail, and education to bolster cyber security.

1

In January 2022, a Which? Money investigation highlighted significant security weaknesses in the Monzo Bank banking app, making it the lowest-scoring app in their tests. Despite these findings, our recent research at FORTBRIDGE indicates that these vulnerabilities remain unaddressed. Our investigation found that Monzo still does not require Face ID or Touch ID by default, making it alarmingly easy for a thief to access the app if they steal an unlocked device. Additionally, Monzo's app only requires authentication every 90 days, providing a long window for unauthorized access. We demonstrated how a thief, once in possession of a stolen device, could bypass Monzo's extra security checks and retrieve the card's PIN using the app's flawed video verification method. This means a thief could easily transfer money out of the victim's account, replicating the same issues identified by Which? over two years ago. To learn more about Which?'s investigation, read this article : ➡ https://lnkd.in/e5fzekKW For more details about our findings , read the blog post here ⬇ https://lnkd.in/epqWV-hX

5

https://lnkd.in/eZfp59HD Schools need greater support and funding for protection and mitigation against such attacks. If a school is run as an academy can they face an ICO fine? There were 347 cyber incidents reported in the education and childcare sector in 2023, a BBC report revealed. It represented a 55% increase on 2022.

11

1 Comment

Do you think fraud is a ‘silent threat’ to national security? With the rise in awareness surrounding romance scams – which are often carried out by organised crime groups with ties to human trafficking – it’s clear that fraud isn’t an isolated crime. This article by Helena Wood is a great summary of the worrying state of fraud and what the UK is doing to tackle it: https://hubs.li/Q02zcxl60 #Fraud #Scams #FinancialCrime

4

Here again, we are seeing calls for the Government to reduce the October 7th PSR regulation reimbursement limits to prevent "stifling innovation". However, It can be argued that reducing reimbursement limits would also stifle innovation in fraud prevention. It is true that the PSR's Regulation sets high targets, but we must also accept that this is in order to reduce crime and the proceeds of crime in our financial systems. https://lnkd.in/gjaEtuG2 #APPFraud #PSR #reimbursment

7

‘Organisations must do more to combat the growing threat of cyber attacks’ says the UK’s data protection regulator, the ICO. They go on to say ‘…we will take action, including fines, against organisations that are still not taking simple steps to secure their systems’ In their report they say that: ❗ Cyber threats are increasing year on year. ❗ You need to consider the nature of your activities when deciding what is appropriate for your organisation ❗ Most ransomware incidents are usually the result of poor cyber hygiene rather than sophisticated attack techniques. ❗ 91% of UK companies stated they had experienced at least one successful email-based phishing attack in 2022. More than a quarter of those (26%), also reported direct financial losses as a result. ❗ There has been a ten-fold increase in password-based attacks from 2022 to 2023. There were 11,000 attacks per second in April 2023. During their review, they observed that it’s also important to appreciate the importance of governance and ensure that resources with appropriate skills are available. If you need help to do more to combat the growing threat of cyber-attacks, get in touch, as we can help. From ‘light touch’ consulting to full service delivery we can help you implement appropriate information security governance, risk management, and compliance. https://lnkd.in/eKt8Mdu4

6

The cyber threat landscape is constantly evolving. UK businesses are increasingly targeted by sophisticated attacks such as AI-driven phishing scams, deepfake frauds, and ransomware. These threats compromise sensitive data and disrupt business operations, leading to substantial financial losses. Stay ahead of these threats with multi-layered security strategies and a culture of cybersecurity awareness. Are you prepared for the next wave of cyber threats? At Kiiro we can help your business stay secure. Get in touch with our team today to find out more. https://lnkd.in/dYGBzQ7T #CyberThreats #BusinessProtection #UKSecurity

8

The cyber threat landscape is constantly evolving. UK businesses are increasingly targeted by sophisticated attacks such as AI-driven phishing scams, deepfake frauds, and ransomware. These threats compromise sensitive data and disrupt business operations, leading to substantial financial losses. Stay ahead of these threats with multi-layered security strategies and a culture of cybersecurity awareness. Are you prepared for the next wave of cyber threats? At Kiiro we can help your business stay secure. Get in touch with our team today to find out more. https://lnkd.in/dYGBzQ7T #CyberThreats #BusinessProtection #UKSecurity

7

Here are some of the fundamental reasons why TREs (Trusted Research Environments) and SDEs (Secure Data Environments) are crucial to protecting sensitive data on the Public Cloud. At CloudKubed, we use the #AzureTRE Accelerator to build secure environments that can be used not only for accelerating research but also for data storage and security, using cloud-based Airlock controls to prevent unauthorised data leakage. This is fundamental to protecting and securing data in the Public Cloud. #Microsoft #trustedresearchenvironment

8

Financial and medical sectors are the hunting ground for of choice for hostile actors. Best to check your defenses and see if you match up to the DORA requirements

2

Despite the search engines' efforts to combat scams through identity verification processes, fraudsters are still finding ways to impersonate well-known brands like British Airways and Tesco. 🛩️🛒 Here's what you need to watch out for: 📞 Speed dial a scammer Fake ads on Bing that direct you to call a phony British Airways helpline, where scammers try to steal your sensitive information. 🌐 Fake contact details on genuine websites Scammers cleverly link their ads to search results on the real British Airways website, making it seem like you're seeing legitimate phone numbers. 🎡 Fake spinning wheel competitions Bogus ads on Google that appear to link to Tesco.com but actually lead you through a series of redirects to a fake "RewardsFlow" website, where they try to collect your personal data. It's alarming to see how sophisticated these scams are becoming. The key takeaway? Always be cautious when clicking on ads, no matter how convincing they may seem. Double-check the URL and contact information before sharing any sensitive data. I like people to go out of that site and contact them through their official website to check the authenticity of the call or claim. You just have to assume these days that everything might be a scam unfortunately. Has anyone you know been a victim of something like this? https://lnkd.in/dkXphu_m  #cybersecurity #cybersafe  #securityeverywhere Francis West -------------------------------------------------------- Dedicated to Your Cyber Security  Our mission: To protect 1,000,000 businesses from cybercrime by 2026. Register Now: How does AI impact your Cyber Security? https://lnkd.in/dSH5kBEE Watch our previous session: Backing up your data is the last line of cyber defence! https://lnkd.in/gkMdAQjX Follow our page https://lnkd.in/edVpnGQa Book a call https://lnkd.in/efjUXeVv Visit our website https://lnkd.in/gnH8FxQw ----------------------------------------------------------

11

2 Comments

🚔 You have probably seen news about UK police catching criminals who were catching IMSIs.  In May, two suspects were arrested in Manchester and London for allegedly using a 'text message blaster' to send thousands of smishing messages, impersonating banks and official organizations. 😮 It's interesting to see how the situation varies by region. My colleagues mentioned that what those English crooks tried to set up for SMS push using Fake BTS has been a real issue in Brazil since at least 2021. Jokingly, they said that LATAM is quite a quadrant leader in this area. 🌎 What is the situation in your country? How easy is it to buy some SDR and assemble a Fake BTS, or are there markets with ready-to-use solutions? #CyberSecurity #Smishing #IMSIcatcher #TelecomSecurity 

25

3 Comments

The Bank of England has introduced #CQUEST to allow #FinancialOrganisations to benchmark their cyber technological and security operational resilience. Our Security Consultant, Justin Greenwood-Delgado, explains what the assessment is and how AMR CyberSecurity can assist financial organisations. Download the whitepaper below👇 https://lnkd.in/ez7u5hfk #Finance

5

More good news in stopping smishing fraud, but does anyone else see the problem here? “About 25,000, who have been identified, will be sent text messages warning them which fake online payment services and shopping sites could have taken their money. They will be advised to go to a Metropolitan Police website for advice.” It’s time for the fake delivery scam to be replaced with the fake scam scam. “250 GBP has been spent from your account at Amazon without your knowledge. Vist https://p0lice.co.uk to get a refund” We have to be better than this. It seems long overdue to introduce SIM registration in the UK so there is a record of who owns which number. Police bust global cyber gang accused of industrial-scale fraud https://lnkd.in/eg-GG887

24

2 Comments