Risk management has historically been comprised of independent disciplines, with professionals focused on credit, market or operational risk. Over time, firms have been moving to a true enterprise view, with disciplines converging. This was underscored by the Financial Accounting Standards Boards latest Current Expected Credit Loss(CECL) standard that links credit, accounting and reputational risk assessments to help financial institutions estimate expected lifetime credit losses.

As this convergence has been taking place, new areas of risk have continued to emerge requiring credit and risk management professionals to widen their scope to effectively assess potential vulnerabilities within companies, supply chains and loan and investment portfolios. We now hear a great deal about climate and regulatory risk, for example. In addition, there is an ever-increasing focus on cyber risk, which escalated during the COVID-19 pandemicwith the move to remote work environments and the migration of company data to the cloud.

Cyber Risk is a Growing Concern

Statistics on cyber risk are astounding. The FBIs Internet Crime Complaint Center pointed to a 300% increase in reported cybercrimes during the pandemic,[1]while the U.N. disarmament chief pointed to a 600% increase in malicious emails.[2]In addition, in 2021 theWorld Economic Forum ran a survey among members of a cybersecurity leadership community (representing about 100 senior cybersecurity executives from around the globe) and found that 80% saw ransomware as a dangerous threat that is impacting public safety.[3]Moreover, 97% of this community pointed to business continuity as the main risk when it comes to ransomware attacks. Looking to recent events, the Russia-Ukraine conflict has raised alarm bells for the U.S. to prepare for Russian cyberattacks. "There is a growing concern that massive cyber warfare could be on the near-term horizon, which would certainly catalyze an increase in spending around preventing sophisticated Russian-based cyber attacks going after datacenters, networks, vulnerability points, and other highly sensitive data," wrote Wedbush analyst Dan Ives, who focuses on tech stocks, wrote in a Feb. 24 research note.[4]

Cybercrimes Impact Creditworthiness

As digital transformation takes hold across industries, cybersecurity is no longer the sole responsibility of IT departments and must be considered in assessments of credit risk. After all, computer-based systems are used to manage inventories and supply chains, communicate with customers and employees, generate online sales and much more. Technology breaches can result in a significant loss of revenue, large legal costs and damage to a companys reputation all on top of the time and expense associated with repairing networks and devices that have been affected. Such breaches can become a red flag for investors wanting to minimize vulnerabilities in their portfolios.

To help quantify the impact of cyber risk on a businesss creditworthiness, in 2021 S&P Global Ratings announced that it was further integrating the cyber risk expertise and insights of Guidewire Cyence Risk Analytics[5]into its product platforms to complement the companys own assessments.

Governance Plays a Critical Role

Boards of Directors are responsible for good corporate governance and the long-term viability of their organizations, and must take an active role in guarding against potential disruptions from cybercrimes. According to the World Economic Forum,[6]leaders need tools and guidelines in order to fulfill their obligations where cybersecurity issues threaten an organizations reputation and trust among players in an ecosystem. The Forum is therefore updating guidance for the corporate governance of cyber risk in response.

In addition, in recognition of the importance of governance in addressing cyber risks, the Cybersecurity andInfrastructure Security Agency's (CISA) CybersecurityDivision and the National Association of State Chief Information Officers (NASCIO) partnered to develop a state cybersecurity governance report, along with a series of case studies that explore how states govern cybersecurity. Together these pieces identify how states have used laws, policies, structures and processes to help better govern cyber risk as an enterprise-wide strategic issue, providing helpful insights for other states and organizations that face similar challenges.

All Firms Must Protect Their Businesses

Attacks are not only happening with large publicly listed companies, as sovereign states, government agencies and public institutions are acutely vulnerable, too.[7]There have been attacks on the U.S. city of Hartford and numerous Texas school districts, across municipal utility sectors and on the Irish healthcare system, to name a few.

Small private companies are not immune to attacks. A 2019 survey[8]found that an overwhelmingmajority of these businesses believed they were a target of cybercriminals, highlighting the growing awareness among this group about the impending threats. These attacks can cause small- and medium-sized enterprise to close their doors, evidenced by the fact that organizations with fewer than 500 employees spent an average of nearly $3 million per data breach incident in 2021, up 26.8% from the previous year.[9]

To help mitigate the potential negative credit impact of cyberattacks, robust cybersecurity remains vital. There is no substitute for a strong cybersecurity system from internal governance to IT software. Other key factors that determine how well entities manage cyber risk include: prompt remedial action, active detection, C-Suite support (including budget allocation) and a better understanding of risks arising from third-party providers or supply chains.

[4] Russian cyberattack risk may spur US cybersecurity investments, S&P Global Market Intelligence, February 24, 2022. Russian cyberattack risk may spur US cybersecurity investments | S&P Global Market Intelligence (spglobal.com)

[5] Guideware is a third-party firm and is not affiliated with S&P Global or any of its divisions. Guideware Cyence Risk Analytics are data listening and risk analytics products focused on understanding and modeling new and evolving 21st century risks.

See original here:
The Increase in Credit-Relevant Cyber Events - S&P Global

Today, National Security Advisor Jake Sullivan met with Argentine Secretary for Strategic Affairs Secretary Gustavo Beliz at the White House to discuss joint efforts to address the crisis in Ukraine, including Argentinas leadership at the Human Rights Council and addressing food security and energy resilience. They also spoke of the importance of responding to humanitarian crises. In addition, they continue their work on the roadmap for bilateral cooperation and a partnership for sustainable and inclusive development that has led to dialogues on information and communications technology, clean energy, satellite technology, and human rights since their first meeting in August 2021. They highlighted the importance of the knowledge economy and leading-edge technology in the recovery from the COVID-19 pandemic and promoted cooperation in strategic sectors such as green energy and lithium production. They noted the importance of a democratic and free internet and the importance of secure and trustworthy information and communications technology and services. They spoke about the importance of strengthening the multilateral development banks and attracting U.S. private investment to build a green, equitable, and inclusive recovery from the pandemic. Mr. Sullivan and Secretary Beliz discussed President Biden and President Fernandezs vison and shared commitments towards sustainable and inclusive development in the region that will be highlighted in the Summit of the Americas.

Read the original post:
Statement on National Security Advisor Jake Sullivan meeting with Secretary Gustavo Beliz of Argentina - The White House

In just the last few years, Europe has seen a sweeping law for online privacy take effect, approved far-reaching regulations to curb the dominance of the tech giants and on Saturday reached a deal on new legislation to protect its citizens from harmful online content.

For those keeping score, thats Europe: three. United States: zero.

The United States may be the birthplace of the iPhone and the most widely used search engine and social network, and it could also bring the world into the so-called metaverse. But global leadership on tech regulations is taking place more than 3,000 miles from Washington, by European leaders representing 27 nations with 24 languages, who have nonetheless been able to agree on basic online protections for their 450 million or so citizens.

In the United States, Congress has not passed a single piece of comprehensive regulation to protect internet consumers and to rein in the power of its technology giants.

Its not for lack of trying. Over 25 years, dozens of federal privacy bills have been proposed and then ultimately dropped without bipartisan support. With every major hack of a bank or retailer, lawmakers have introduced data breach and security bills, all of which have withered on the vine. A flurry of speech bills have sunk into the quicksand of partisan disagreements over freedoms of expression. And antitrust bills to curtail the power of Apple, Amazon, Google and Meta, the owner of Facebook and Instagram, have sat in limbo amid fierce lobbying opposition.

Only two narrow federal tech laws have been enacted one for childrens privacy and the other for ridding sites of sex-trafficking content in the past 25 years.

Inertia is too kind of a word to describe whats happened in the United States; theres been a lack of will, courage and understanding of the problem and technologies, said Jeffrey Chester, the executive director of the Center for Digital Democracy, a public interest group. And consumers are left with no protections here and lots of confusion.

The prospects that any legislation will pass imminently are dim, though regulations at some point are almost inevitable because of the way tech touches so many aspects of life. Of all the proposals currently in front of Congress, an antitrust bill that would bar Apple, Alphabet and Amazon from boosting their own products on their marketplaces and app stores over those of their rivals has the best shot.

A co-author of the bill, Senator Amy Klobuchar, Democrat of Minnesota, said Democratic leaders had promised it would go to a vote by this summer. But even that bill, with bipartisan support, faces an uphill climb amid so many other priorities in Congress and a fierce tech lobbying effort to defeat it.

If history is a guide, the path toward U.S. tech regulation will be long. It took decades of public anger to regulate the railroads through the creation of the Interstate Commerce Commission in 1887. It took nearly 50 years from the first medical reports on the dangers of cigarettes to the regulation of tobacco.

Theres no single reason for the sludge of progress in Congress. Proposals have been caught in the age-old partisan divide over how to protect consumers while also encouraging the growth of business. Then there are the hundreds of tech lobbyists who block legislation that could dampen their profits. Lawmakers have also at times failed to grasp the technologies they are trying to regulate, turning their public foibles over tech into internet memes.

Tech companies have taken advantage of that knowledge blind spot, said Tom Wheeler, a former chairman of the Federal Communications Commission.

Its what I call the big con, where the tech companies spin a story that they are doing magic and that if Washington touches their companies with regulations theyll be responsible for breaking that magic, he said.

In the vacuum of federal regulations, states have created a patchwork of tech rules instead. California, Virginia, Utah and Colorado have adopted their own privacy laws. Florida and Texas have passed social media laws aimed at punishing internet platforms for censoring conservative views.

Amazon, Alphabet, Apple, Meta and Microsoft said they supported federal regulations. But when pressed, some of them have fought for the most permissive versions of the laws that have been under consideration. Meta, for instance, has pushed for weaker federal privacy legislation that would override stronger laws in the states.

Techs lobbying power is now on full display in Washington with the threat of the antitrust bill from Ms. Klobuchar and Senator Charles E. Grassley, a Republican of Iowa. The proposal passed its first hurdle of votes in January, much to the tech industrys surprise.

In response, many of the tech companies mobilized an extensive lobbying and marketing campaign to defeat the bill. Through a trade group, Amazon claimed in television and newspaper ads that the bill would effectively end its Prime membership program. Kent Walker, Googles chief legal officer, wrote in a blog post that the legislation would break popular products and prevent the company from displaying Google maps in search results.

Ms. Klobuchar said the companies claims were hyperbole. She warned that by fighting the proposal, tech companies might be choosing the worse of two difficult options.

They are letting Europe set the agenda on internet regulation, Ms. Klobuchar said. At least we listened to everyones concerns and modified our bill.

The inaction may appear surprising given that Republicans and Democrats are ostensibly in lock step over how tech companies have morphed into global powerhouses.

Consumers need confidence that their data is being protected, and businesses need to know they can keep innovating while complying with a strong, workable national privacy standard, said Senator Roger Wicker, Republican of Mississippi. The U.S. cannot afford to cede leadership on this issue.

Lawmakers have also forced many tech chief executives including Jeff Bezos of Amazon, Tim Cook of Apple, Sundar Pichai of Google and Mark Zuckerberg of Meta to testify multiple times before Congress in recent years. In some of those televised hearings, lawmakers of both parties have told the executives that their companies with a combined $6.4 trillion in market value arent above government or public accountability.

Some of these companies are countries, not companies, Senator John Kennedy, Republican of Louisiana, said in a January antitrust hearing, adding that they are killing fields for the truth.

But so far, the talk has not translated into new laws. The path to privacy regulations provides the clearest case study on that record of inaction.

Since 1995, Senator Edward J. Markey, Democrat of Massachusetts, has introduced a dozen privacy bills for internet service providers, drones and third-party data brokers. In 2018, the year Europes General Data Protection Regulation took effect, he proposed a bill to require a consumers permission to share or sell data.

Mr. Markey also tried twice to update and strengthen privacy legislation for youths following his 1998 law, the Childrens Online Privacy Protection Act.

With every effort, industry lobbying groups have denounced the bills as harmful to innovation. Many Republican lawmakers have opposed the proposals, saying they dont balance the needs of businesses.

Big Tech sees data as dollar signs, so for decades theyve bankrolled industry lobbyists to help them evade accountability, Mr. Markey said. Weve reached a breaking point.

Read more:
As Europe Approves New Tech Laws, the U.S. Falls Further Behind - The New York Times

Kenyon Farrow| Guest columnist

Republican Larry Householder talks to the press after his expulsion

Expelled and indicted, Republican Larry Householder didn't rule out running for political office again.

Laura A. Bischoff, The Columbus Dispatch

At this point most peopleare familiar with House Bill 616, which somehave nicknamed Ohio's Dont Say Gay."

The bill would ban "any curriculum or instructional materials on sexual orientation or gender identity" and "divisive or inherently racist concepts and any other concept that the state board of education defines as divisive or inherently racist."

More: What's in Ohio House Bill 616, the divisive concept bill that includes sexual orientation?

And while there is a lotof discussion to be had about why these bills are bad for students andeducation, thats not theirintended purpose.

More: Kenyon Farrow: 'Too smart' Dave Chappelle has fallen for 'old right-wing political device'

In addition to being a cheap and cynical political ploy to scapegoat the LGBTQ and Black and brown people whove fought for education curricula to represent the full experiences of people in the U.S. and in Ohio, these bills are really a way to keep the total and utter ubiquity of scandals the Republican legislators are facing out of the minds of Ohioans when they go to the polls this year.

TheGOP does not want Ohioansto think about House Bill 6as they enter the voting booth.

Passed in 2019, the billwas a $1.3 billion bailout for two nuclear plants and two coal plantsone of which is not even in the state of Ohioas ostensibly a favor to First Energy, who stood to make $170 million annually as a result (this isnt counting the $61 million in bribes that were used to push the bill through).

As of now, five people former House SpeakerLarry Householder of Glenford includedhave been arrested.

Sam Randazzo, whoGov. MikeDeWines appointedOhio Public Utilities Commission chair,was paid $4 million from FirstEnergy.

More: Top state regulator paid millions for part-time work, FirstEnergy agreement shows

Questions still remain as to what point DeWine knew about the alleged bribe being paid.

Instead of talking about this, were spending time talking about whether kids should learnone of their classmates may have two moms or dads.

But there is much worse.

.

In the middle of the COVID-19 pandemic, as Ohioans were dying by the dozens per day and millions were out of work due to stay at home orders, the lack of legislative approved funding for basic internet security and technology upgrades allowed for scammers to file fraudulent claims, costing the state $3.8 billion,and costing hunger and hardship to everyday Ohioans who were out of work and not able to meet their own basic needs.

Ohio Medicaid Director Maureen Corcoran, who owned stock in United Healthcare gave their Ohio subsidiary (United Healthcare Community Plan of Ohio) the state contract to manage the states Medicaid program, even while theyve been ranked almost dead-last on federal oversight reports and denying the contract of a company that ranked near the top.

In essence, Corcoran handed $1.2 billion in 2019 alone in funds paid for by Ohioans through taxes to a company ranked low in its transparency and oversight.

Corcoran has refused to hand over its oversight documents and even say if she took these federal oversight reports into consideration when she chose to hand the system over to them to manage.

Waittheres even more.

More: Our View: While your groceries go up, DeWine, LaRose, Huffman, Cupp waste millions to keep power

The Ohio voters overwhelmingly approved a measure in 2018 to put an end to partisan gerrymandering, and 2021 was the year to redraw the districts based on the then-newly released census data.

The Ohio Redistricting Commission, which is dominated by five Republicans, refused to sit down and create a transparent and open process for setting new maps to not break communities up and create oddly carved out districts merely to benefit one part or another.

More: In Ohio's redistricting battle, Gov. Mike DeWine said he'd take the lead. But did he?

They would not meet with the twoDemocrats on the commission and over and over, submitted maps that violated the spirit of the law and gave Ohio voters a big middle finger by creating maps that were heavily partisan.

So much so the Ohio Supreme Court, which has a Republican majority,rejected the maps over, and over and over and over again.

More: Top Ohio House Republican leader: 4 Supreme Court justices should be 'benched'

Thechaos is leading two primary elections instead of one.

The mess will cost Ohioans millions.

These are the issues the Republicans dont want on the minds of Ohioans when they go vote this year. But Ohioans have much on their minds.

Facing a precarious future with a virus that has killed over 38,000 Ohioans alone, most people I know are thinking aboutrising inflation resulting in outrageous food and gas prices.

More: Our view: Let Ohio teachers teach truth. Educators, kids casualties of raging culture war

The GOP is selling the most cynical agenda, scapegoating teachers trying to make sure students are academically and socially prepared to live in a world with other people who may in fact be different from themselves, instead of dealing with the mess theyve left the state after years of supermajorities that they created and are desperate to perpetuate for their own greed and power.

I hope Ohioans see the through the smokescreen.

Kenyon Farrow is a Black gay activist and writer based in Cleveland Heights.He serves on the board of the LGBT Center of Greater Cleveland.

Follow this link:
Farrow: Ohio Republicans rather you focus on 'kids with 2 dads' than mountain of scandals - The Columbus Dispatch

Russian cybercriminals dominate the threat landscape, aided largely by a government that has heretofore turned a blind eye to their illicit dealings as long as their attacks target organizations and individuals outside of Mother Russia. However, since Russia's invasion of Ukraine on Feb. 24, the Kremlin has made a series of moves that threatens to disrupt the delicate balance that exists between them.

Without an extradition treaty with the United States, most of these cybercriminals operate with impunity or are nabbed when traveling outside of the United States. But in recent months this has not been the case. Several administrators and hosting providers were arrested in Russia in the past year for allegedly breaking the unspoken agreement between the government and cybercriminals. On Jan. 14, the Federal Security Service of the Russian Federation (FSB), in concert with US authorities, arrested members of the REvil ransomware-as-a-service (RaaS) collective that was responsible for the Kaseya attack. About a week later, the FSB detained four members of the Infraud Organization, including the group's founder, Andrey Novak, who was also wanted by the FBI. Though Russia is responsible for detaining these cybercriminals, these arrests and illicit marketplace takedowns have been few and far between and seem to signal more of a public relations ploy than a formal desire to stop cybercrime that affects its Western counterparts; there is no formal cyber alliance between Russia and the United States.

In some ways, Russian cybercrime has always been different, even in the underground. Russian cybercriminals, often young men, have had the autonomy to target foreign victims and establish various Dark Web-based marketplaces, card shops, and forums that attract like-minded threat actors. Wanted posters for these cybercriminals may very well be accompanied by images that showcase their Instagrammable lifestyles poses that include expensive luxury automobiles, exotic cats, and stacks on stacks of US dollars.

Connection to CybercrimeThere is a demonstrable connection between the Russian government and cybercrime. Public records show that Alyona Eduardovna Benderskaya is the wife of "Evil Corp" ringleader Maxim Yakubets and daughter of FSB agent Eduard Bendersky. The exotic cat-wielding Bogachev has also been associated with Yakubets regarding money laundering for various malware schemes. Former cybercriminal-cum-FSB officer Dmitry Dokuchaev sought the services of Shaltai-Boltai ringleader Vladimir Anikeyev and Yahoobreachers Alexsey Alexseyevich Belan and Karim Baratov. Dokuchaev was also sentenced to six years in prison for treason, so perhaps there is no love lost there. Aleksei Burkov, founder of cybercrime forum "DirectConnection" and co-administrator of "MazaFaka," was recently released from the United States and returned to Russia short of his nine-year sentence. Despite these indictments, all of these Russia cybercriminals remain at large, housed and protected in Russia.

But Russia may unconsciously be eating its own: Russia's war with Ukraine has resulted in a global effort to isolate Putin and, as a result, Russian cybercriminals are feeling the pressure.

For one, Russia has taken an aggressive stance on Internet blocking, which has increased since the start of the war and is affecting the ways in which cybercriminals operate. News and social media websites are actively being censored to create a filter bubble within Russia's borders. Previous reports indicate that Russia has attempted to block Internet protocols such as DNS over HTTPs (DoH) and DNS over TLS (DoT), threatening the security and privacy of Internet communications. Russia is also blocking access to the Tor network, which is having an effect on freedom of speech and the landscape through which cybercriminals can communicate. While dissidents are downloading VPNs in greater numbers, threat actors are actively seeking workarounds that bypass Russia's deep packet inspection (DPI) capability. Threat actor recommendations include "anti-DPI" technology, Tor bridges, and VPN-to-VPN services, though the effectiveness of these countermeasures remains to be seen.

Secondly, Russia previously faltered in implementing its "sovereign Internet," finding difficulty in going from an open global Internet to a closed one. Cybercriminals may be able to gamble on Russia unsuccessfully disconnecting from the Internet. While countries like China have been more successful in closing their borders to disinformation, dissent, and foreign influence, it has come at the cost of vast human, technical, and financial resources. Other examples, such as Iran's walled garden and North Korea's restricted Internet, have demonstrated that cybercrime can persist, though usually it is at the behest of the government.

Thirdly, foreign governments are also making it difficult for Russian cybercriminals to cash out and launder the proceeds of their criminal campaigns. On April 5, German law enforcement, in concert with the US Justice Department, shut down Hydra, Russia's largest cybercrime marketplace. The Treasury Department's Office of Foreign Assets Control (OFAC) followed by sanctioning over 100 cryptocurrency addresses and virtual currency exchange Garantex. The sanctions followed a September 2021 initiative to disrupt ransomware payments by sanctioning Suex, and then Chatex, which have helped facilitate ransomware payments to threat actors. All three were tied to the "Moscow tower," which has been a hub of money laundering and cash-out activity. These sanctions are affecting cybercriminals' ability, in combination with sanctions against Russian financial institutions, to move cryptocurrencies from illicit activities (such as ransomware payouts) into fiat currencies.

Changing Face of CybercrimeCybercrime has a way of transforming. When one threat actor group is taken offline, another one takes its spot. There has never been a shortage of victims, and despite increased cybersecurity, there are always loopholes that can be exploited. Russian cybercriminals will have a difficult time overcoming the recent sanctions, although they are not a panacea. Russia has benefited from an overly permissive stance on cybercrime, and cybercriminals have acted with impunity. However, the increased restrictions on protocols, illicit services, and cybercrime marketplaces will make it increasingly difficult to financially benefit from conducting cyberattacks within Russia's borders. The implicit treaty between Russia and cybercriminals has been broken, and it is yet to be seen how they respond.

View original post here:
How Russia Is Isolating Its Own Cybercriminals - DARKReading