TACKLING CYBER CRIMEBDO RISK ADVISORY SERVICES

Audit • Advisory • Tax

The Leader for Exceptional Client Service

BDO Cyber and Forensics Laboratory

BDO IN SOUTH AFRICA PROVIDES AUDIT, ADVISORY AND TAX SERVICES TO A BROAD RANGE OF CLIENTS – FROM LARGE JSE-LISTED COMPANIES TO INDIVIDUALS AND SMALL AND MEDIUM-SIZED ENTITIES.

As the South African member firm of BDO International, the world’s fifth largest accounting network with offices in over 154 countries, we have been delivering exceptional client service to our clients since 1963. In South Africa we work with clients countrywide from offices in Johannesburg, Durban, Pretoria and Cape Town.

Because of their skills and experience, our people are trusted to deliver the quality of service that our clients expect. We offer a tailored approach to every client and our people have the skills and experience to take responsibility for the work they do. We are agile and quick in responding to client demands.

Our approach involves listening to our clients, understanding their expectations and delivering the calibre of service associated with a leading global financial services firm.

DELIVERING EXCEPTIONAL RISK ADVISORY SERVICES

Our Risk Advisory team is skilled in providing the full range of Risk Advisory services to companies. We offer a suite of services to help our clients manage risk within their business.

Our diversity of technical and professional experience, coupled with the entrepreneurial nature of our global network of Member Firms, clearly differentiates us and delivers distinct advantages for our clients through:- director-led teams with a hands-on approach that translates into the insight and authority

required to tailor a service to meet each client’s needs unrivalled cultural insight and team diversity- tailoring of robust and creative solutions relevant to local conditions

THE BDO CYBER AND FORENSICS LABORATORY

Data in any business is constantly accumulating, even while you sleep - and 80% of data created today is vulnerable to attack.

WHAT HAS CHANGED?

Attacks on traditional IT systems can be devastating, resulting in massive loss of money, privacy and intellectual property. Even worse, attacks on the Internet of Things (IoT) potentially threaten our business’s safety and sustainability. This threat landscape exists alongside the ever-increasing demand for technology to be embedded into coordinated devices used in healthcare, manufacturing, financial services, automobiles, aviation, critical infrastructure and smart city initiatives.

It is important to understand three things about cyber exposure:• Cyber exposure can hurt your organisation in multiple ways • Cyber exposure is not confined to purely technical areas • If not addressed, exposure leads to incidents that will harm your organisation

Ways in which cyber exposure can harm an organisation• Financial loss• Stock price decline• Increased costs

WHAT SHOULD YOU DO?

• Make sure you understand all your cyber exposures (Risk Management)• Analyse and size potential exposure (Risk Quantification)• Determine factors that create, enhance or minimise your cyber exposures (KRIs)• Create strategy to address exposures by Treating, Tolerating, Terminating or Transferring the

exposure (Insurance)

BDO Risk Advisory Services has partnered with FIDS and Goldn’Links Cyber to develop a laboratory specifically aimed at assisting clients ensure they are adequately prepared for any cyber attack. We implement sophisticated risk management processes for clients to help them better understand and mitigate the various cyber-related risks to which they are exposed.

We offer a distinctive approach which is based on various state of the art service offerings as set out below.

• Lost revenue • Regulatory intervention• Reputational loss

CYBER EXPOSURE MANAGEMENT - WHY SHOULD YOU CARE?

BDO CYBER AND FORENSICS

LABORATORY

COMPREHENSIVE INFRASTRUCTURE AND APPLICATIVE ASSESSMENTS INCLUDING PENETRATION TESTING

A full scale assessment combines all attack methods and vectors used by “hackers” to simulate a real-life attack against a company. The service utilises a combination of all means necessary to achieve a specific goal, similar to a ‘capture the flag’ exercise which is determined prior to commencing the engagement.

The ‘flag’ is determined with the respective client entities and may include a variety of goals such as: Proof of concept to insertion of malware to the target network, gaining admin credentials on corporate servers or workstations, gaining access to corporate employee emails etc. while using the various attack methods including: infrastructure, applicative and spear phishing attacks and any other means possible.

One of the most common and successful attack methods used by today’s cyber criminals is called spear phishing. Nowadays, almost all successful breaches to companies around the world have proven to make use of this attack method whereby criminals gather preliminary intelligence about specific employees belonging to the targeted organisation (using various social engineering methods, social networks and underground forums) followed by a carefully planned attack which encompasses use of fraudulent emails, websites and communications as an entry point to the network.

In a phishing campaign we simulate a real life spear phishing attack in an effort to test the organisational awareness to such threats and evaluate the company’s protection measures in place to mitigate such risks. We will provide the client with a detailed documentation of the outcome, process and insights gathered throughout the simulation and recommend mitigation solutions.

Prior to commencing the simulation, we will work with the client’s team to agree on a specific goal which will be used as success criteria to the simulation, corresponding to the client’s mind-set and risk appetite. Such criteria may include: Insertion of a customised malware, leaking sensitive information out of the target network, gaining admin control over specific server/application or domain, bypass existing security controls etc.

INFRASTRUCTURE OR APPLICATIVE PENETRATION TESTING

We will provide you with a single penetration test which encompasses either the application or network layer of a single external facing system. The penetration test can be conducted against internal applications or servers as well as provide adequate access granted remotely. The test can also be conducted from the client’s premises.

Collection Anaysis Projection

Device activityProcess activityUsage patterns

Comprehend the data through the eyes of an attacker

Real-time insights of cyber security and operational incidents

FORENSIC DATA ANALYSIS

As IT systems evolve, the risk of fraudulent or erroneous manipulation of your business’s data increases. Forensic data analytical services can provide you with reasonable assurance that your organisation’s data is complete, accurate, reliable and valid.

Our offering:

• Salaries and payroll analysis• Procurement analysis• Journal entry testing• Sales analysis• Accounts receivable & accounts payable analysis

Data analysis process:

• Data integrity: verifying the accuracy, validity and completeness of data• Data mining: identifying data trends• Data cleansing: identifying erroneous data for correction• Data migration: ensuring completeness of data transfer• Data management: produce informative reports from multiple databases

UNDERSTANDING ALL YOUR CYBER EXPOSURES

Are you aware of cyber exposures arising from your activity in regard to the following parameters?• Sensitivity of data and transactions • Cyber activity and your security implications• Privacy requirements• Complexity of computer systems • Maturity of computer systems• Legal requirements• Status of security policies and procedures • Effects of social media • Compliance requirements• Cloud computing activity and applications used• The Internet of Things (IoT)• The Internet of You (IoY)

WE TAKE IT PERSONALLYWE TAKE IT PERSONALLY

If you would like help in understanding and implementing a cyber exposure management programme in your organisation, please contact

Graham Croockgcroock@bdo.co.za0826067570

BDO Risk Advisory Services (Pty) Ltd, a South African company is a member of BDO Southern African Coordination (Pty) Ltd, a South African company, which is a member of BDO International Limited, a UK company limited by guarantee, and forms part of the international BDO network of independent member firms.

BDO is the brand name for the BDO network and for each of the BDO Member Firms.

March 2016

We also offer the following services:

• Auditing• Business Services and Advisory• Company Secretarial• Corporate Finance• Employee Benefits• HR Advisory• Risk Advisory• Taxation• Wealth Advisory

www.bdo.co.za