How hostile actors can steal your clients’ data, and how to stop it

0:12Simoney Kyriakou: Hello and welcome to the latest episode of FT Advisor Margin Notes with me Simoney Kyriakou, editor of FT Advisor. By now everyone will have heard of the words artificial intelligence and most people will have experimented with using AI tools in some form or another. And even if you have not, I am very sure that you will have been forced to watch some AI NinjaCut videos on social media. But while many people in financial services have experimented with various tools, and obviously we've spoken to some business owners who've already started rolling them out in their businesses, how much do we really know about the risks of being always on, anywhere, using any tool?

0:53Simoney Kyriakou: And of course, it's not just AI, but any software can become a gateway for bad actors if it is not properly guarded. This podcast will qualify for CPD, at the end of which you should be able to explain what sort of things might go wrong with chat GPT and AI tools, to understand and list ways to protect your businesses from cybercrime, and to be able to summarise ways that you can enhance personal security and safety. So, here to speak with us about some of these risks and how to mitigate them is Adam Owen. He's the Managing Partner of Strategic Insights Advisory for the Heligan Group. Adam, welcome to the podcast.

1:31Thank you. Nice to be here.

1:33Simoney Kyriakou: Thank you very much. Let's get straight into it. There is a new kind of warfare going on, and it seems to be going on all the time, isn't it? Cyber warfare. Could you just explain what that is? so cyber warfare the sort of academic definition i suppose would be what state actors do to other state actors which involve a digital domain um it manifests itself in lots of different ways um what we're seeing out of the us now in their cyber doctrine is what really has been going on covertly and not publicly admitted for a long time which is that the cyber domain is really used to blind the adversary while the kinetic the stuff that goes bang you'd really use to break them so the idea is that it gives you an element of cover to enable you to move undetected for as long as possible but there's lots of other dimensions to it as well i mean we've seen examples of that i think a few years ago we had the ft someone was trying to use loads of bots to flood the the system so we've created safeguards and processes around that but we've seen other newspapers as well being hacked or news sites being hacked by um alleged um sort of russian infiltrators or state um state-sponsored infiltrators elsewhere these these risks are real you know it's not just something it's not the plot of some kind of spy novel is it not at all it's um it happens all the time it happens by state actors so hostile foreign intelligence services um and it also happens by with non-state actors so criminal organized criminal groups um any bad actor seeking to get an advantage by attacking what has become a very interconnected um an available world by the fact that we're principally all connected to the internet yeah my old editor hal used to say in the old days people used to go into a bank with a scarf around their face and a gun and hold it up.

3:35Simoney Kyriakou: Nowadays, they just push a few buttons on a computer. I mean, obviously, it's not quite as simple as that. But it does seem like the parameters have shifted. And if you're operating safeguards, sort of in a physical world, you really need to think about your safeguards in a virtual world. You do. I mean, I'd say there's, there's three domains to think about. There's obviously the physical domain, the locks on the doors, the alarm systems for um for a really simple way of explaining it um the digital domain which is all the things we talk about in terms of cyber security but the human domain often is the element that most people don't think enough about the reality is you can have all the physical security and all the cyber security in the world you know tier one banks investing huge amount of money into that but if you can trick someone into providing you access on the basis of influence and manipulation all the rest of it stands for nothing that's right so how can we protect then the humans i mean i'm thinking was it 2006 2007 that was it nationwide or someone left their laptop on a on a train you know just like human error human mistakes and human frailty and vulnerability i mean can we ever really mitigate against that the reality is you can only do so much in terms of training and awareness humans are fallible right we make mistakes all the time that's just part of being human I think one thing to know is you need to make it as easy as possible for people to admit if you like that they've done something wrong or made a mistake because that enables you to get ahead of it really quickly if it's a culture where people are scared because of the consequences that's not a good culture to have so training awareness and culture is is so much but One of the most interesting things about us as humans is we like to be liked and therefore sometimes we don't ask the uncomfortable question because we're worried about someone being annoyed or thinking that we're not a nice person.

5:42You see it all the time when someone walks into a building without a building pass and no one challenges them because they don't want to be rude.

5:52Simoney Kyriakou: Is that when you try to follow me through the gates here? A bit like that, yeah. Testing out your security, but you stopped me. But let's look at that. What sort of uncomfortable questions should we get used to ask? Well, you know, so let's think about a company paying an invoice. There's been a change of bank account on the invoice. Rather than just processing it, get some confirmation of it. Building access. You know, someone in an area that perhaps they shouldn't be, whether that's an old school filing cabinet or perhaps it's someone accessing files and you've got visibility through the safeguards you've got in place from an IT perspective ask the question you know trust but verify is a pretty important adage in this world trust but verify I like that but sometimes it's really hard for someone to make that verification and I remember that case it was last year or the year before, of that worker who went on a Zoom call with his boss and there were about five or six people in the same room as him.

6:56Simoney Kyriakou: And they said, why haven't you authorised this payment? You were meant to have authorised it two days ago. Why have you escalated it? And they were all there and he felt, oh my gosh, that's not just my boss. I can see my boss. I can see all of my colleagues. I recognise all of them. I've got to do it. And he transferred several million pounds and ended up, of course, being deep faked. I mean, trust and verify is a great adage, but it's getting harder to verify, isn't it? It is. I mean, that's the deep fake problem. It was actually 25 million, I think, which is astonishing when you think of what was achieved off the back of probably a very low spend and probably three to five seconds of voice clips, which someone could get from this in order to make that sort of gain.

7:43but there would be protocols that you could get you could get in place to prevent that the reality is transactions like that shouldn't happen on the basis of being instructed to do so without any secondary verification it's the simple stuff that saves you it's the process in place that says no transaction above a certain threshold will take place without some kind of independent verification I think there was something interesting in the culture of that organization though that meant the person acted you know almost sort of fearing they were going to get into trouble if they didn't do as they were told really quickly so with all of this there's the digital and cyber but then there's actually how humans interact with each other

8:24Simoney Kyriakou: that makes a difference does it make sense for a company then to train every single member of its staff on all the business protocols around it and around infrastructure and around security most companies will write things down in policies to make themselves feel better the reality is no one reads them no one reads them um you know policy without comprehension is just paperwork it's nothing else so um sorry just to say for our lawyers obviously i read all of my policies back to back and obviously you read all of yours of course and every time i sign it i've read every single word exactly but the reality is is that um people will take the line of least resistance on most things.

9:07So it's important to have things written down and particularly in a regulated sector, when something happens, regulators will do a look back and they'll say, well, what was in place to prevent this from happening? So from a defensibility point of view, back to the lawyer comment, in order to be defensible, you do have to have it in black and white what the policy is. And you do have to trust people to read and act on them. but we also shouldn't doubt that people are inherently maybe lazy as unfair but they make lives easy for themselves as much as possible so i'd say focus on the stuff that really matters the rest of the stuff is probably not going to end your business but the big stuff needs to be really felt every day but there's also an element of that sort of the big stuff that needs to be

9:57Simoney Kyriakou: felt every day people do feel it but perhaps they feel it more when they come into the office but we're also doing hybrid working now so a lot of times we're working from home but using company equipment and you know i think there isn't a single person in the uk who can honestly say i only ever use my work laptop for work purposes and as soon as i want to go and check my lottery numbers or check my isa then i log out and i go onto my personal laptop i don't know anyone who does that maybe maybe you do um he's nodding obviously uh for the purposes of the lawyer again um but there was also then that element of people might then have downtime on their work computer and they might go into chat gpt or google ai or ask some questions and it might not be work related but again that could be a gateway couldn't it absolutely so what do people need to to look out for how do we sort of put these boundaries and barriers in place the perimeter is actually much bigger than people think so people are very so people it security um managers are very conscious of what they define as the perimeter which is you know everything connected to the office 365 environment or whatever it may be but as you say there's this sort of shadow it problem um whether it's hardware or software but you're right things like chat gpt very commonly used They have huge benefits, but they're a massive attack surface, both in terms of what it could mean in terms of something that could be exploited by an adversary to get access to systems.

11:35And there are things that you can do to be more resilient along that. But, you know, there's a world of difference from a cost perspective in terms of what a tier one bank will have in place versus a small financial sole trader advisor operation, you know. so um there's that to think about um but with the whole chat gpt sort of agentic assistance um evolution it's often about the data that you're putting into it and what is being done with that it's leaving your systems it's not controlled so many companies have no ai governance policy um and there is a real lack of awareness and understanding as to what the genuine risks are by, for example, putting client data into these agentic assistant platforms?

12:24Simoney Kyriakou: Sure. So I might be using it as a small financial advice firm. I'm using CheckGPT. I've paid to use a premium version. I'm trying to get some reports done. I'm putting some information into this. I'm not putting people's names in, but I'm trying to be safe and create a report. I've paid I think I'm doing it the right way what are the dangers what what could be happening well there are new products on the market which try and give an extra level of assurance in terms of the data control so there's tools where they will sanitize the information before it's uploaded to any large language models in order to pump out some kind of answer to you so that means no addresses no phone numbers no date of birth and i numbers that sort of thing yeah the personal identifiable identifying information the stuff that makes you identify the human person behind the data um i think that's going to be a real growth area but again it's still data leaving your systems going somewhere else um and you know you can opt out of training um you can put various measures in place you could delete the data after you've you've used it but the reality is it's you're still putting a level of confidence and assurance into a system that you have no insight into and often you've taken some other companies word for it around what they're doing with your data the other thing to say is back to the sort of cyber warfare and nation-state hacking issue well obviously the data centers the data that's going into these models is of increasing interest to hostile actors both state and and criminal in order to sort of get real insight into what's actually is going on um so you know i think the reality is we can't keep up with the evolution the security mechanisms can't keep up because the benefits to operations and kind of uh human performance um and efficiency are vast um and the the big companies the banks have got great um leverage in terms of scale don't they so they can they've got teams whole teams of people working to make sure everything is safe like updating creating bug fixes that sort of thing a small financial advice firm they you know some of the firms i spoke to last year one one firm has got two financial advisors and they turned over nearly 200 million and that's in sort of new um new inflows last year you know when you're talking about that level of figures how is a firm with just two financial advisors going to have all the latest up-to-date security and software i mean it just seems like financial advisors would be an easy sort of low-hanging fruit soft target for bad actors you're absolutely right what i would say though is um you can do so much to protect yourself that costs very little i mean look at the striker attack in the us so medical engineering firm something like 130 140 billion market cap and they were penetrated by an iranian linked hacktivist hacking group and managed to wipe i think it was something like 200 000 devices remotely wiped by getting access to their mobile device management platform well how did they do that?

15:55Was it some really sophisticated tool that they developed in secret? No, it was an unsecured admin account and a phishing email. The cost of closing that gap was really minimal. The consequence was huge. So the reality is, if you just follow, frankly, the basic government guidance on how to secure a small business, you're probably going to stop 98 plus percent of attacks um and then the whole uh you know the the level of sophistication you would need to get to the remaining let's say two percent for argument's sake you're probably a scale of sophistication where you're in the nation state sort of actor anyway so there's way more we

16:39Simoney Kyriakou: can do just on basics and hygiene and sounds like common sense as well and getting indecent business protection that covers cyber attacks yeah cyber criminality at least it gives you some kind of fall back so you're not paying for it out of your own pocket yeah definitely with so many i mean you know i work in we call it risk intelligence fundamentally it's risk management ultimately the the best thing you can ask whether it's personally or as a business are things like if x was to happen what would i do spot the problem before it arrives most people can identify the the most likely things that will go wrong from let's say an operational perspective and work back from there, how could I have stopped it happening in the first place?

17:24And through that process, you'll be able to plug so many gaps and it will just make you so much more resilient as a result of it. But very few people are having those conversations.

17:33Simoney Kyriakou: That's because it's quite new and exciting. And the sell that it's been given is it'll save advisors hours and hours of brainpower and admin work every week. And it means they can see more clients and take more people on and do more with less. And all those things sound really attractive when you want to go out and win clients and future-proof your business. But obviously then the risks of not paying attention to your IT can actually be really devastating. How can advisors also work with clients on this? Because quite a lot of them, the clients will be high net worth or the higher end of the mass affluent.

18:17Simoney Kyriakou: The clients themselves could get a phone call pretending to be from their son or daughter who's prevalent all over social media. Dad, I'm stuck somewhere. I need you to sort of Venmo me or cash out for me, you know,£2 ,000 right now. How do advisors work with clients to prevent clients from simply logging onto their portals and taking the money and doing dodgy things themselves? What we do when we work with high net worth clients and family offices is we do a number of things. But the first is to say that when they engage us, we will do a sort of vulnerability assessment. Okay. So we essentially adopt the role of a malicious attacker.

18:59And we seek to gather as much information about them as we possibly can, as if we were going to attack them. And that reconnaissance phase where we map everything we can without, this is not access to any closed intelligence. This is open source. Facebook. x linkedin exactly data breaches so um routinely people will use the same email address for multiple different accounts what's worse is they often use the same password for multiple different accounts i'd never do that exactly um and when companies get breached skype to give an old example was a great example where the credentials were leaked online so you'd find someone's email address you'd find their plain text password which is normally their dog on a date of birth or something like that and that same password could be used to access every other account that they had what's worse is because of a lack of awareness or understanding and because the reality is in a security world people will always opt for convenience over security sadly they won't have in place things like two-factor authentication yeah so once you've got that password you've got everything yeah is this a is there a generational divide here i've spoken to

20:20Simoney Kyriakou: both sort of um gen x my own gen generation and boomers and they're really ultra careful um some of them are not but mostly as a whole they're quite ultra careful because they've been brought up to you know in a world of actually writing things down and putting under lock and key and the youngest generation are used to putting their whole life history on social media so you can exactly see where they are and what they're doing and even physically locate them right there and then. But do you think the younger generation perhaps are a bit more digitally savvy than the older? I mean, are there sort of generational differences that we could kind of look at?

20:55Yes, to an extent I think that is true because I think some of the things that they take for granted in terms of sort of standard security basics, they probably I would say they know without really being taught they just understand that that's the right thing to do it would be ridiculous not to

21:15Simoney Kyriakou: Is that the Gen Zers or the Boomers? Zers I'd say the the problem is is that particularly not just in more affluent circles there is a generational whether issue is the right word But people want to make a name for themselves. People often want to be famous. They want to be influencers. They want to be somebody within that sort of, you know, sphere of social media. And so whilst they might have their online accounts protected to a level that perhaps other generations don't, they might be way more susceptible to things like scams. gams you know so um people that are trying to cultivate a level of trust with them in order to whether it's get money or whatever it may be and so because they've got their eye on wow this person's going to give me my big break um often that's the attack vector that's not necessarily thought about as much right so that could also be something that advisors will need to talk to their clients about and just say you know make sure your young people are not posing with the license plate on their ferraris in front of uh all their instagram followers yeah because it's very easy to clone you know we've seen it here we famously claire barrett a couple years ago had her instagram page cloned and she managed to get it shut down but you just don't know who you're dealing with and it's very very clever you know especially when they can use your face and your voice yeah that's right and of course what are they seeking to do sometimes it's about financial gain sometimes it's just as simple as reputational damage yeah they just cost a lot exactly so and sometimes irrecoverably you know so um yeah some discipline about what you post um and what you reveal through that post is really important so you know if we're working with a client and they're going on um a holiday around the med in in a yacht um we will make sure that everyone understands that you're not to be putting photographs revealing locations or other people because all of that can be exploited by threat actors and that's the digital footprint that people are concerned about exactly right and even if you've locked down your instagram account well if i was an adversary i'd just find a way to get you to accept a follow request from me and when you're someone that sort of measures the the sort of credibility of their profile based on the number of followers then often people will you know just um agree to a follow immediately and then you've got access to things that other people don't so but even even away from the sort of the wealthy people posting their yachts and their nice dinners on instagram financial advisors also have their own digital footprint what do they need to be aware of in terms of their own digital footprint because they think they're playing by the books in a regulated environment they're not being silly on social media but they're still there aren't they yeah i mean the reality is is you know many of the risks that they're exposed to would be the same of any person in any other industry i mean you know the classic is um from a sort of petty crime volume crime perspective is um maybe don't give so much information in a way that would allow for example a burglar to plan um an attack on your property because you're saying when you're going to be away from the house or something like that so you know part of it is about just being a bit more switched on to how the information you put out there could be weaponized against you i think that's true of any person in any industry and it's all about sort of obviously protecting the consumers protecting small businesses protecting infrastructure i'm going to ask you a question and if you just give me the answer no then it's be really depressing but is the uk itself ready for a full-scale digital attack what do you mean by full-scale digital attack so let's say there's a coordinated bit of cyber warfare going on they want to dismantle our infrastructure so they might want to hack into street cameras or hack into um traffic light systems cause chaos you know it's one of the sort of classic sort of disrupt and sort of steal the news story, steal the news agenda.

25:32Simoney Kyriakou: If you want to dismantle a regime, you kind of do these kind of things. I've been watching a lot of slow horses, obviously. You know, it could be done, couldn't it? Yeah, I think it's very real. I think from a very sophisticated foreign state, they could do a huge amount of damage. And there's only so much you can do to prevent that. So, you know, I've used the examples of banks as an example of people you know institutions with a lot of money with a lot of interest in protecting systems the budgets reflect that the actions that do reflect that but when you talk about infrastructure critical national infrastructure often there's lots of technology in there which is very legacy very old the patching mechanisms that would work for a small business running the latest office 365 environment is very different to some of this legacy technology so the reality is we do a lot you know our government does a lot to protect systems um but there really is only so much they can do in in the face of um something like that so i think the reality is yes we are vulnerable um but it's it's it's a race that we probably can't keep up with i think it's changing by the way i think we've spoken about ai and agentic assistance Well, that will also apply in a cyber defence environment too.

26:56And it is increasingly. I think the problem is there's a stopgap in between where that technology could be weaponised offensively before we have the defensive catch up, if you like.

27:09Simoney Kyriakou: Is that because we only know what's going to be a problem when it happens? That's right. And, you know, some of the most advanced cyber defence systems now will routinely attack systems. They'll routinely penetration test, learn lessons from that patch as they go along. But we're not there yet in terms of that being a very infallible mainstream capability, but it's increasingly getting there. So the stopgap in between is the hostile actors using it to routinely try and penetrate systems, which is a concern. It happened to the NHS last year, didn't it? Yeah, it did. Huge damage. and there's lots of other systems that could be attacked too.

27:51Simoney Kyriakou: We've got the tax system as well. I mean the government's pushing on making tax digital and it's investing millions of pounds into doing so and having everyone being able to access all their information through government portals all at once. It sounds like it's ripe for the picking. Yeah, and this is the same reason why in part people are concerned about things like national ID databases. the reality is much of our data is already in government systems already but having it all available in one place is a very attractive pot of data for someone with hostile intent to attack so if you're going to do that you need to be able to trust the government that they have appropriately secured it and i think probably people are quite skeptical on that point because of things like the nhs yeah so we've looked at sort of the digital gateways we've looked at human beings and human fallibility let's talk about sort of literal hardware okay and sort of servers and databases what practical steps can people put in place to protect their hardware and protect their own passwords protect their own software and everything that they're using on it how can i protect my phone okay right the phone is a good place to start isn't it because we all have them we all use them all day long um a few things to think about um type of phone is a consideration the reality is the most common phones be it like android um systems and apple systems they're actually pretty secure um so the latest google pixel or the latest iphone from a hardware perspective you're in good shape um you need to make sure that you're disciplined in terms of application updates yes now you can program it to do it automatically and routinely but i would check verify then there's the operating system updates as well when they come out and they say that and there are bug fixes and they sort of put this little line at the bottom of the update generally that means they found an exploit and they need to patch it fair enough so you need to be ahead of the game on that and patch the phone and is that does that also apply to all the little apps as well because you think i can't be bothered to update or i'm running low on data rather than delete all my cat videos let's not bother to update this particular app always update the apps because um you know a lot of these apps so in the apple ecosystem there's um there's some guardrails around um the application development the same kind of argument goes in terms of what who is accessing that data right i mean there's been horror stories with things like tiktok where there's been identification of the amount of data that's actually shared back with TikTok everything from yes you know there's been scare stories around key loggers to geography geolocation data everything so the reality is you can do things around that you can lock down your phone you can have a completely separate device on which to use social media apps if you really want to use them but many people aren't going to bother with that um so being selective about what you download onto your phone but most importantly making sure it's all up to date is the the first thing you should always do and this is probably the thing that gets stolen out of your pocket it could just be someone who wants to kind of wipe it and flog it again yeah mostly it is mostly it is but it could be someone who thinks this is a way of getting in particularly if they know that you work for a company and they're watching you go in and out of important buildings and canary So if you're a lawyer working on a really contentious dispute, which might have some very wealthy people behind it, if you're a wealth manager with access to lots of client information, you might stage a phone theft in order to access the phone.

31:37So you think it's just been nicked by some scallywag. Some oik. Some oik. Very Victorian. But actually it could be someone, a sort of hostile intelligence operative in a private capacity that's been told to acquire their phone. So then we need to think about things like password security on the phone. Now, face ID, loads of people have. well if the face id um defaults to a standard four or six code um pin code then actually it's as secure as that pin code so if you were a hostile actor seeking to do that without giving too much tradecraft away for someone wanting to do it then you would surveil your target you would get close to them on the tube you would watch them access their phone you might create the conditions to force them to enter their pin.

32:34Once you've got the pin, then you stage the robbery and then you've got access to everything.

32:39Simoney Kyriakou: Excuse me, could you just help me out? I'm a bit lost and my maps aren't working. Can you show me? That's exactly it. You miss your calling. How do you know we're not doing it on the side? I'm only a journalist. So I like, and it's annoying, but you get used to it, is alphanumeric passcodes on things like your iPhone. So it's a mixture of letters, ideally special characters, so letters with accents on it um it means that if someone's looking over your shoulder they're not going to memorize that phone they're not going to see you they're not going to memorize that code it's difficult for them and of course the other layer are privacy screens we should be having privacy screens on our phones because then the person looking over your shoulder is not seeing what you're putting in the phone interesting and what about the connectivity with bluetooth as well people using remote headsets that can be logged into or how can you protect that as well because lots of advisors will be doing taking calls and stuff on the train or listening to podcasts on the train listening to the ft advisor podcast on the train they'll be using their bluetooth headphones how hackable are those so there are vulnerabilities with bluetooth um all of this is about proportionality so i would say for anyone working in the legal or wealth profession financial profession because of course also be um insider information right in relation to a transaction which would be very useful potentially for short sellers or whoever else so understand what the threat picture looks like and then have proportional measures in place to stop the hacking the acquisition the unlawful acquisition of the data so one mitigation might be that you only use wired headphones to have calls but again people like airpods well i don't know i'm really old i like using wired headphones i do actually but uh well maybe with those gen x's maybe gen x are the ones that aren't going to get hacked but no very very good point actually wired headphones be safe use phone screens um safety screens i like i like all these i like all these tips these are really practical.

34:45Simoney Kyriakou: I could talk to you all day about this, but I'm aware that I have to go and change my password now on probably most of my sites that I use. I really thank you so much, Adam, for coming in and talking to us about some of the risks and giving us some practical tips to follow, which are quite common sense, really. And that's really great. Thank you very much. Thank you. And thank you all for listening. This podcast will qualify for CPD. You should be able to explain what sort of things might go wrong with chat GPT and AI tools, to understand and list ways to protect your businesses from cybercrime, and to be able to summarise ways that you can enhance personal security and safety.

35:27Simoney Kyriakou: Until next time, take care and be safe.

35:52If you've used Babbel, you would. Babbel's conversation-based technique teaches you useful words and phrases to get you speaking quickly about the things you actually talk about in the real world. With lessons handcrafted by over 200 language experts and voiced by real native speakers, Babbel is like having a private tutor in your pocket. Start speaking with Babbel today. Get up to 55 % off your Babbel subscription right now at babbel.com slash acast. Spelled B-A-B-B-E-L dot com slash acast. Rules and restrictions may apply.

36:28Simoney Kyriakou: Shipping, billing, admin, payroll, marketing. You're managing all the things. So why waste time sending important documents the old-fashioned way? Mail and ship when you want, how you want with stamps.com. Print postage on demand 24-7 and schedule pickups from your office or home. Save up to 90 % with automated rate shopping. That's why over 1 million small businesses trust Stamps.com. Go to Stamps.com and use code PODCAST to try Stamps.com risk-free for 60 days.