A united defense against a triple threat

Security threats with remote working

Remote working has reduced the ability of companies to monitor behavior, which can increase fraud risk and create major cyber security weaknesses. According to our study, “nearly nine in 10 respondents say that working from home has negatively affected the effectiveness of their companies’ fraud prevention measures, compliance risk mitigation or cyber security. For some, it has damaged all three.”

For example, confidential meetings that used to occur in person are now often held online. This raises a number of questions about the security and integrity of these meetings. Are the meetings being recorded? Who has access to those recordings? Are there unwanted listeners online or in the rooms? Are there vulnerabilities in the software platform(s) being used? Online meetings can put sensitive information at risk, and bad actors that capture this information can sell it on the dark web for insider trading purposes, competitive intelligence-gathering, or broad distribution to unintended audiences.

Furthermore, if a company suffers a cyber attack, the compliance team may not have appropriate and immediate access to physical hardware to address the situation. In traditional office settings, laptops can be physically sequestered from a network, and data can be collected from workers in person. If a company does not have the ability to investigate with speed and precision, the risk of not uncovering the full extent of the attack will only increase.

Steps for companies to consider

Our study suggests that many companies might have room for improvement in the way they address the threat loop of non-compliance, fraud, and cyber attacks.

For example, 60 percent of U.S. respondents report that their suppliers and customers are increasingly demanding proof of compliance with data-privacy regulations, and 48 percent say the same about corruption and money-laundering legislation. However, very few respondents say their companies reflect international best practices in their anti-corruption compliance (18 percent), environmental compliance (21 percent), and anti-money-laundering compliance (22 percent).

In the same way, 70 percent of respondents report that their companies uncovered fraud over the past 12 months. But only 35 percent of U.S. respondents say their companies have a program in place to prevent, detect, and respond to fraud.

Finally, 81 percent of respondents are “somewhat or completely satisfied” with how long it takes their companies to recognize a cyber attack. However, respondents tell us it takes about a month, on average, for a cyber attack to be fully contained, suggesting a potentially fatal lack of urgency.

Companies to address the threat loop of non-compliance, fraud, and cyber attacks:

• Implement a comprehensive enterprise risk assessment process that includes fraud and misconduct, compliance issues, and cyber security weaknesses that focus on actual — not hypothetical — risks.
• Promote a culture that encourages ethical conduct and a commitment to compliance. As part of this, senior management should establish standards and procedures to prevent and detect fraud, mitigate cyber security risks, and monitor regulatory compliance.
• Develop and publicize ways for employees and relevant third parties to report suspected wrongdoing and seek advice about laws, regulations and company standards of conduct. Organizations where employees believe they have a responsibility to raise their hands and report misconduct are the ones that will likely detect fraud, non-compliance, and misconduct early.
• Understand the extent of the company’s exposure to cyber-attacks. Traditional cyber risk assessments often occur only on a monthly or annual basis and are relatively targeted in nature, but companies should conduct continuous external scanning for hardware vulnerabilities, software vulnerabilities, and misconfigurations. Having an operationalized technology and process to identify and remediate threats against the attack surface is critical.
• Adopt leading practices around identity protection and security. Measures like multi-factor authentication are generally low in effort but high in value.

Most companies have some defenses in place, but comprehensive excellence is rare. Meanwhile, non-compliance, fraud, and cyber attacks represent a clear and potentially expensive threat that will only increase in the future — all the more reason to strengthen the company’s threat-mitigation capabilities, starting today.