Learning from the Interserve experience

Another GDPR breach was in the news this week following the latest findings made by the UK Information Commissioner’s Office and covered by Lexology.

What is the measure of effective cyber security is sometimes difficult to determine; particularly for those charged with improving their oversight of cyber security risk. Performance advisories rather than directives are the typical form of guidance from regulators and specialist security agencies – and that makes it difficult. This recent case in the UK is particularly relevant in that it provides a number of lessons for other businesses when it comes to what is required for effective cyber security. Rather than a cautionary tale, this blog seeks to highlight how the line between the successful management of security issues and a security control failure can be impacted when an organisation is under commercial stress or otherwise distracted from matters of cyber governance.

The background

The business was undertaking significant financial restructuring immediately prior to and during the relevant period and so it is impossible not to wonder what budgetary constraints and resource limitations the business was operating under. Through necessity rather than choice.

The company was the victim of a phishing attack, which led to the exposure of 113,000 employees’ (not customer) personal data. The Information Commissioner’s Office (ICO) found that between March 2019 and December 2020, Interserve failed to adequately protect personal data, which led to the data breach between March and May 2020.

1.    Lessons

The ICO found that aspects of security were lacking which contributed to the breach occurring or its severity and the loss of data. The failures are listed below, but it was an unsophisticated attack; with the attacker only having to breach the most fundamental of security controls to gain access to the data.

The circumstances Interserve found itself in are not unique; like many other organisations, even now, focused on operational issues and concerns, at the expense of their cyber security resilience.

The ICO highlighted the following failings:

• Processing personal data on unsupported operating systems
  • This posed a risk to the data as older operating systems can contain security vulnerabilities and are no longer updated by the vendors.
• Failing to implement appropriate end-point protection at the time of the attack
  • Endpoints are on the frontline of many threats. They are where users interact with files, click on links, open emails or access applications. Defending endpoints and monitoring users is therefore an important security capability.
• Failing to undertake adequate vulnerability scanning and penetration testing
  • The existence of unpatched software applications and operating systems provides known weaknesses that attackers can exploit to gain initial unauthorised access to an environment.
• Failing to implement appropriate and effective information security training
  • A high proportion of attacks are found to be due to human error. Therefore, training users to avoid common security mistakes (like weak passwords or reusing credentials), and to be aware of the risks of social engineering and phishing attempts, is a vital line of defence.
• Using outdated protocols
  • Irrespective of whether these are insecure protocols or obsolete ones, they all provide attack avenues to the system to capture credentials or subvert systems using network-based exploits.
• Failing to conduct effective and timely investigation into the cause of the initial attack
  • This comes down to incident response. The ability to detect an attack quickly, and at an early stage, diagnose what is going on, and take steps to remediate it are vital to avoiding a cursory probe by an attacker turning into a major data loss.
• Failing to effectively manage access to privileged accounts.
  • Administrative accounts need to be limited to those that need them, and only available until they are no longer needed. Users of those accounts must not use them to browse the Internet or access emails– the risk of a clicked link or accidentally opened attachment is simply too great.

These security issues listed above remain common causes of security breaches; and are often pre-cursors to a prospective attack.

2.    The origin of the breach

Interestingly, the breach originated in a subsidiary/group company, rather than in the holding organisation. The holding company, however, was the one ultimately held responsible.

… [Interserve] was held to be the relevant controller for the purpose of enforcement, despite the fact the actual phishing attack and security failings involved a number of group companies.

Source: Penningtons Manches Cooper LLP

This really underlines the need for central cyber security oversight over subsidiary businesses – federated IT and security environments must implement oversight and provide performance assurances to their parent organisation. Business units need to report in an objective and standardised format across the group companies to ensure consistent reporting, visibility and unified oversight. A parent company cannot escape responsibility for the wider group’s information security, and is the organisation the ICO will turn to for governance and compliance matters.

3.    Ineffective policies and controls

… although Interserve had extensive policies and standards governing information security, in fact these policies were not implemented nor were they subject to appropriate senior management oversight

Source: Penningtons Manches Cooper LLP

This is not uncommon. Senior management believes that security controls are in place and effective, but the reality is that they have not been implemented, poorly configured or even ineffective against the threats. It does seem that the safety belts were there but not used; but when the business is under pressure, these issues are more likely to slip through.

4.    The penalty

The penalty imposed on the company was modest when compared to the maximum possible under GDPR.

But it’s important to remember, any financial sanction comes atop of the costs of the investigation, clean-up and remediation costs; and any compensation paid to those affected by the loss of their personal identifiable information. Damage to the brand and issues of reputation and the potential legacy of mis-trust can only add to a costly lesson learned.

Conclusion

Once again personal identifiable information has been exposed; and once again the cause was found to be weak basic security controls and a lack of oversight.

The primary take-away for the reader is that while someone is inevitably responsible for its oversight, cyber security impacts operations, security and risk and ultimately senior executive teams and even boards. And each stakeholder has an interdependent role in the effective end-to-end management of security controls through a systematic risk management and reporting process.

This cannot be taken on trust, neither can it be something that is reviewed at an annual security audit. Security is too important and time critical for that.