Insider trading, a Russian banker and WhatsApp – the case for Audit

Nothing grabs the headlines like a story of a Russian banker that avoided being prosecuted for insider trading, with links to the polonium poisoning case in 2006 for good measure.  The banker in question deleted WhatsApp software from his phone before he handed it over to the investigators for the Financial Conduct Authority (FCA).  He said he deleted it to hide his friendship with a Russian politician, which would cause embarrassment if it were widely known.

Enterprise Apps for Business Communications

It got us thinking, this is a stark reminder not to mix business and personal communications – better to have an entirely different app for each.  Financial services business communications should be conducted using a suitable, commercial platform, that provides audit capabilities as standard. When all calls/messages/videos are audited, there can be no question over who said what to whom and when.  Even if the app is deleted from the phone, the audit log is still held centrally.

Home working increases the risks

With many more people now working from home, keeping sensitive commercial information secure is more important than ever. www.finextra.com recently ran a story explaining why the increasing numbers of people working remotely could lead to an increase in the instance of insider trading.

https://www.finextra.com/blogposting/19184/why-monitoring-news-to-detect-insider-trading-is-now-essential

“As a result of Covid-19, both the FCA and FICC Markets Standards Board (FMSB) have said they expect the combination of financial service employees working from non-office locations, alongside high levels of crisis-driven corporate fundraising, to create a perfect storm of conditions for potential insider trading. At the height of the lockdown, the majority of traders were working remotely – one survey showed that almost 60% of FX traders were working from home. Both the FCA and FMSB have raised concerns about the possibility that in such circumstances material non-public information (MNPI) could be overheard or inadvertently disclosed in other ways.”

In the same publication, Jonathan Pagett, acting CISO at the Bank of England observes that while the central bank already had strong remote access solutions in place including softphones on laptops, the challenge has been a shift in reliance on those core systems. He notes that there is the potential for an erosion of a strong security culture, and that there is a risk of people using unsanctioned shadow IT. https://www.finextra.com/newsarticle/36709/sibos-2020-is-ransomware-as-a-service-a-symptom-of-innovation/crime

Don’t Mix Business and Personal

There are many reasons to ensure that employees use the appropriate software during business communications with colleagues. While there may always be rotten apples, providing suitable mobile communication solutions to employees helps the rest to stay vigilant, and is a reminder to stick to company security best practice.

And on a slightly different note, if you don’t feel you need some of the advanced features of Armour Mobile but still want to keep complete control over your communications, your meta-data, and your contact lists, SigNet by Armour is just the job!! 

With or without audit, Armour Comms can help.

Contact us 

How secure are your communications with your Supply Chain?

How secure are your communications with your Supply Chain?

The pandemic, and for that matter, Brexit, have recently brought into sharp focus the role of the supply chain, and just how crucial it is to the running of many traditional businesses, including UK plc.  Thanks largely to Brexit planning, certainly most manufacturing businesses were holding reasonably high levels of stock and so were better able to cope with the issues raised by the restrictions of lockdown.  However, one area that gets discussed less often, is the security of communications with the supply chain.

Supply chain due diligence

Risks within the supply chain are many, and not least is the reputational damage to your own brand should something go wrong with one of your suppliers. Best practice due diligence is a standard part of risk mitigation for dealing with suppliers.  For example, most organisations have policies concerning the environment, modern slavery, bribery and corruption and corporate social responsibility, which suppliers are expected to comply with as part of commercial agreements.  However, despite all of these policies designed to protect the company, most organisations do not have procedures in place for communicating with partners and suppliers around sensitive or confidential issues, for example, product, pricing details, orders and contracts, formulae/recipes, logistics and warehousing arrangements. Any of these details could provide valuable information to your competitors, so communications should be secured.

This is particularly important because the very act of communicating with your supply chain has the potential to open up your organisation to much greater security risks. As the NCSC points out In its Secure Communications Principles document, published earlier this year (https://www.ncsc.gov.uk/guidance/secure-communication-principles-alpha-release), “Many organisations will wish to communicate securely with contacts outside of their own organisation. If a communications service does not allow this, then their members may revert to using an insecure service that does not meet these principles.”  People will always find a workaround to; a) get the job done, and; b) make their own lives easier.  For these reasons, it is imperative that a secure comms solution can be extended for use by trusted contacts outside of the organisation.

Consumer apps are not the answer

In the current climate consumer apps, like WhatsApp and Zoom, have been adopted by many, as the means of communication. However, both have their drawbacks. As well as the question over what happens to metadata when you are using an app owned and controlled by a global social media company, in the case of WhatsApp there is also its inability to provide GDPR compliance.  The security flaws in services such as Zoom (and MS Teams for that matter) have already been well documented https://www.bbc.co.uk/news/technology-52133349  with the new phenomenon of Zoombombing where miscreants join calls uninvited to listen in or hurl abuse. Consumer-grade apps, whether on the desktop or mobile devices, give no control of users on the system and no constraints on where confidential messages and attachments can be forwarded to.

There are many questions about consumer apps overall handling of personal data and metadata, and other security concerns, meaning these apps are simply not suitable for corporate communications. See our previous blog which explains why in more detail: https://www.armourcomms.com/2020/02/06/using-consumer-apps-for-business-use-is-illegal/?cat-slug=10  Despite this many people admit to using them  for business use: https://gdpr.report/news/2020/02/14/privacy-almost-half-of-whatsapp-usage-breaches-legal-terms/

A reliance on these apps could potentially leave businesses with significant vulnerabilities in their communications  So how can you communicate with trusted third parties within your supply chain securely?

Secure comms apps support white-listing and groups

Both Armour Mobile and SigNet by Armour provide the facility, subject to certain controls, for different groups or communities to communicate.

Setting up distinct groups and communities within Armour Mobile and SigNet is particularly easy using our Desktop admin module.  It ensures that those that need to communicate with supply chain contacts and external third parties are able to do so easily and securely.

Our client QuoStar, an IT support and consultancy provider that specialises in businesses going through growth and change has used Armour technology to:

  • Provide secure conferencing for numerous participants
  • Secure intra-company and company to company communications
  • Ensure calls and associated metadata are kept private
  • Protect data sent in messages, text or as attachments

 

At Sparten, a consultancy that provides discrete intelligence-led, unconflicted advice to high net worth families, corporates and their advisors, they use a range of enhanced security features from Armour that have proven particularly valuable when communicating with third parties:

  • Secure Conference Calls for voice and video – the microphone is isolated so no other app can eavesdrop
  • White Listing and Groups ensure the sharing of contact details is controlled
  • MessageBurn or Audit Trail – some operatives prefer to burn messages once read while others from a legal perspective prefer to keep a record for audit purposes.

 

For more information about how Armour solutions could help you to communicate more securely with your supply chain, read our case studies:

Sparten deploys Armour Mobile to strengthen intelligence led approach

https://www.armourcomms.com/2020/01/06/sparten-deploys-armour-mobile-to-strengthen-intelligence-led-approach/?cat-slug=10

QuoStar safeguards communications and prevents hostile interception of sensitive IP with Armour Mobile

https://www.armourcomms.com/2019/07/24/quostar-safeguards-communications-and-prevents-hostile-interception-of-sensitive-ip-with-armour-mobile/?cat-slug=10

Hybrid working – Longer term implications

The COVID-19 pandemic has certainly acted as a catalyst for the fast adoption of technology.  In some instances, the use of tech by organisations has transformed almost overnight, reaching a point that would otherwise have taken several years to achieve.

Workers everywhere have adjusted surprisingly well to a new world of work – the dining room table, or for those more fortunate, the study-cum-home-office.  As we gradually ease out of lockdown it’s time for businesses to plan the return to work, and what that actually looks like.

Due to the requirements of social distancing to control infection people have been asked to avoid public transport and crowded offices, working from home where possible. Even for those whose offices are opening, the requirements of social distancing mean that not all employees can be in the office at the same time, which means many organisations are looking at a staggered approach to people coming into the office, adopting a hybrid model where people divide their working time between home and the office.

Robust technology to support mixed home and office working

This means that the IT infrastructure that was cobbled together in just a few days to enable home working is now likely to become a longer term, if not permanent, arrangement. For most IT departments, this is a less than ideal way to deploy new technology, as there was little, if any time for testing.  In many cases people have used what ever technology they can get hold of, including consumer grade apps, or repurposing tools they had used within the confines of a protected work environment, for use at home (with a lot less network security, for example).

So, for the foreseeable future, until such time as the virus dies out or we find a vaccine, while people will come into the office they’ll be working from home a lot more. With this in mind, we are already working with several prospective customers on more robust, more secure apps that are designed for use in a mixed environment both inside and outside of the traditional managed work environment.

Three pressing reasons why Consumer Grade Apps don’t cut the mustard for home workers

GDPR – we know that most people find this really boring, but a fine of 4% of global turnover is no trivial matter.  If your employees are using a consumer app, like WhatsApp but there are others, for business purposes, they will be in contravention of GDPR guidelines.  Its only a matter of time before there’s a high profile case!

Zoombombing – the term now given to when someone crashes a video conference. Miscreants do this by intercepting a meeting request with login details, and join a call uninvited.  If they join as a prank to hurl abuse, you’ve probably got off quite lightly.  It’s the silent ones that are more deadly! They are simply eavesdropping to see what they can find out.  Hopefully you won’t be discussing anything that is confidential, sensitive or could passed on to your competitors to give them an advantage, but can you afford to take the risk?

Distinction between work and home – it is important to keep work and home life separate – even when it is all happening in the very same place! It is all too easy for conversations, messages and attachments to end up in the wrong place.  How often have you sent a message to the wrong person or group! When its information of a sensitive, or commercial nature, its even more important to keep control of it.

Armour Mobile

In all of these instances, a separate tool designed specifically for corporate communications, that can be used in the office and at home alike, with security baked in, makes a world of difference. The very distinction between an app for business communications with its own address book means that data is far less likely to go astray and your contacts’ details are protected.

  • A separate business address book – all contacts protected and cannot be shared without admin authorisation

 

  • Communications, including video conferences, cannot be joined by anyone other than those that have been invited

 

  • User experience is very similar to consumer grade apps, so there is very little training required, and it has all the features people expect, so no need to use a consumer app.

 

For more information about how Armour Mobile can provide a more secure and managed approach to communications from both home and office, contact us today: info@armourcomms.com

Avoiding the Biscuit Tin and other Challenges of WFH

Staying motivated and focused, keeping your nose out of the fridge or the biscuit tin, and keeping away from the distractions of social media, all the while managing home schooling and childcare.  There are many challenges to working from home – but also many benefits: no need to dress up, no long commute, more time with the family.

Security is another challenge, but may not be at the top of the list, particularly for those unused to working remotely.

Keeping sensitive or company confidential information private

People behave differently when they are in different environments, and this is equally true for work. When working from home there is often a tendency towards a more relaxed approach, and in an unfamiliar environment it is easier to make mistakes as the recent survey by CyberArk highlights: https://www.businesswire.com/news/home/20200603005158/en/Remote-Work-Study-Cyber-Habits-Home-Threaten

People may be using different computers/devices or different applications and they won’t be surrounded by colleagues to ask when they have a question about the changed look and feel of the IT experience.  Even those with a work-issued laptop, may find that applications look different to how they do in the office, for example, the need to use additional authentication during login, or to use a Virtual Private Network (VPN).

For all these reasons, people can be more susceptible to phishing and other cyber attacks; they’re in a different environment, using different systems, with different distractions. When everything is a bit unfamiliar, stress levels will be higher, and the ability to absorb new ways of working diminishes significantly. In our recent webinar Industry Leaders discuss the additional stresses of home working, and how to combat some of them: https://www.information-age.com/avoid-the-consumer-apps-how-to-collaborate-securely-and-productively-in-the-finance-sector

As well as an increased number of attack vectors, there are risks within the home

Shared devices – children using work laptops for home schooling may be going onto social media sites, clicking on unsafe links, downloading apps, etc.  The CyberArk survey reported that 29% of homeworkers admitted allowing other members of their household to use their corporate devices for activities like schoolwork, gaming and shopping. There are arguably as many risks in sharing your work device for non-work activities as there are in using an unmanaged device to access the corporate network.

Shared spaces – couples both working from home may be sharing a single office space, or the dining table.  This can present a myriad of issues, from overheard conversations within the household, to neighbours overhearing sensitive discussions via open windows/doors.  Screens may be on view internally and externally, yellow sticky notes with passwords left lying about, or paperwork left where others can see it.  At the very least, people should have secure home storage for papers and laptops.

Conference calls – we’ve all seen the videos that went viral of news reporters talking to camera as toddlers or pets appear in the background.  Where possible family members or housemates need to respect conference calls and those taking part in such calls should use headphones or earbuds with a microphone.

Extending the perimeter – cyber security at home

For years we have been warning against using WiFi in coffee shops and hotels, now organisations are reliant on the security of home WiFi!

There are increased challenges for corporate networks too, as they now need to learn to distinguish which ‘new users’ logging in from unknown IP addresses are staff working from home, rather than adversaries trying the hack the system.

People that are already stressed due to unfamiliar work routines and trying to balance work with additional home/family distractions are clearly more susceptible to the huge increase in COVID-19 themed phishing scams.

All of this means that IT and Security teams need to make extra efforts to keep remote workers safe. They need to show empathy and an understanding that security best practice is not second nature for non-techie home workers. They need to be prepared to provide extra training, but even that is not a silver bullet. As we’ve said plenty of times, security needs to be baked in, transparent to the user, and so easy to use that there is no temptation to look for workarounds.

Using the right tools for the job – what a genuinely secure app looks like

As was debated during the panel discussion at our recent Webinar (https://www.information-age.com/avoid-the-consumer-apps-how-to-collaborate-securely-and-productively-in-the-finance-sector/ ), apps are here and they are the future.  Organisations need to introduce Secure Enterprise Apps and give users the right guidance and support to use them. Our webinar demonstrates just how useable a genuinely secure communications app can be!

The security flaws in services such as Zoom and MS Teams have already been well documented https://www.bbc.co.uk/news/technology-52133349 with the new phenomenon of Zoombombing where miscreants join calls uninvited to listen in or hurl abuse. Consumer-grade apps, whether on the desktop or mobile devices, give no control of users on the system and no constraints on where confidential messages and attachments can be forwarded to.  There may be claims of end-to-end encryption, but what does that really mean? Do users understand what metadata they may be giving away to application vendors – data that can be highly valuable/useful in the wrong hands.

Consumer apps used for business where there is no audit, control or accountability, is a GDPR fine waiting to happen.

By providing the specific business apps to people to use for work, organisations can help their staff to delineate between business and social, keeping data safe, and separate!

As always, the NCSC gives some great guidance around working from home, how to communicate with staff and steps to take to ensure business data is kept safe; take a look at  https://www.ncsc.gov.uk/guidance/home-working

What have we learned in lockdown?

David Holman, Director, Armour Mobile

For some sections of society, working from home is now the new normal and, it’s looking set to stay that way.  We have seen several high profile organisations stating that staff will be working from home for the rest of the year and into 2021 https://www.zdnet.com/article/google-expects-its-staff-to-work-from-home-until-2021-and-its-not-alone/  This includes the likes of Google, Twitter, Facebook, Barclays Bank, and global ad and marketing agency WPP.

At Armour Comms, before COVID-19 we were totally committed to office based working. We thought that, for example, developers needed to be together to talk through problems and spark new ideas. We thought that people would be less productive working from home.

Now that it has been forced on us, we’ve been pleasantly surprised at just how well it has worked. Productivity is at least the same, if not better, and people seem to be communicating well (and securely), using our own technology.

Some of us have long commutes, up to four hours a day – that’s a huge amount of time saved, which all adds to a better quality of life.

However, for all the benefits both to the business and individuals, we do still need to maintain a sense of community and team.  We’ve hired new people during lockdown, and getting them up to speed, and ensuring they feel like they are part of the Armour family is harder without that face to face contact that we all actually quite enjoy.

Eating our own dogfood!

We’ve been using our own technology – in a real life situation, rather than testing it in the office where we have infinite bandwidth and excellent mobile coverage.  Now we’re running our business using Armour Mobile. Its working well (well we would say that wouldn’t we!), but its also given us an insight into some of those little niggles that all software comes with, and now we’re even more motivated to iron them out.

Feedback from our customers has been interesting too. For example, people need secure conference/video calls for two, three or four people, but they don’t always need to see 30 windows with a video of everyone on the call – bandwidth at home doesn’t often allow it. It’s giving us a focus on exactly where to improve the products.

So, Lockdown week 7 – what do we know?

  • Working from home is just as productive – most of the time
  • Keeping that feeling of being part of a team is much harder and needs concerted effort so that people don’t feel isolated
  • People always find a way to communicate – so you must give them the proper tools to communicate securely
  • Flexible working is here to stay, so we need to adapt to the new ‘normal’ in all aspects of the business.

Webinar – Collaborate Securely & Productivity – Hosted by Information Age

CLICK HERE TO DOWNLOAD

The dangers of relying on consumer grade apps for Enterprise communications

As many sectors are now settled into working from home, its time to take stock and ensure that the solutions you have in place are robust and sustainable.  Security risks have escalated as unscrupulous criminals look to benefit from the pandemic.  With workers feeling isolated, they are sometimes more likely to fall victim to scams.

Our forthcoming webinar, which we are hosting in association with Information Age, discusses the dangers of relying on consumer grade apps for communicating while working remotely, and suggests alternatives.

Our panellists include:

Don Randall MBE, former Bank of England CISO and on the advisory board for METCloud

Flavius Plesu, Founder and CEO, OutThink, and former CISO of Bank of Ireland UK

Andy Lilly, Director and Co-Founder, Armour Communications

Nicholas Ismail, Content Editor, Information Age

We’ll be addressing the following issues:

  • Are Consumer Apps good enough for use in the Enterprise – and why they are not
  • What are the Security Risks
  • The Danger from Corporate espionage
  • GDPR and Consumer Apps
  • If not Consumer Apps then What
  • Armour Mobile – what it does, and what it doesn’t!
  • Cautionary tales – real life situations
  • Benefits of using a certified, built for purpose, secure communications app

To register your place please visit:

https://www.information-age.com/avoid-the-consumer-apps-how-to-collaborate-securely-and-productively-in-the-finance-sector/

Armour Communications makes SC Magazine Awards short list

We are delighted to announce that Armour Comms has been shortlisted for the SC Magazine Best Mobile Security Solution – for the third year in a row!

The SC Magazine Awards are recognised in Europe and the US as the leading industry awards celebrating excellence in security and technology. Last year we took top honours and won the award which was presented at a gala dinner held at the London Marriott Hotel Grosvenor Square.  With the UK currently in lockdown due to the coronavirus the awards ceremony, which was due to take place on 2 June, has been cancelled, and the results will be announced online.

Tony Morbin, Editor-in-chief, SC Media UK said: “Our independent judges carefully consider each entrant against a range of criteria – but especially customer satisfaction – to determine who exemplifies best practice and will be this year’s winners. Plus we pick individuals to honour who embody those same attributes.

“Awards are about winners and praising success. This includes the success of every finalist who will have demonstrated that they are at the top of their game, each adding to our ability to defeat our adversaries, and that truly is worth celebrating.”

In the three years that we have been entering these awards our offering has developed significantly.  For example, for this year’s submission we were able to announce the launch and deployment of SigNet by Armour, our latest product which we are developing in parallel with our flagship product Armour Mobile.  SigNet by Armour has been developed for some  specific use cases and offers much of the same functionality, but based on 256bit encryption. It is also available as both a cloud or on-premises installation. The App provides the same ease of use as consumer grade apps, and is available for Android and iOS devices and for use with Windows 10 and Mac OSX desktops.

The other main difference – for those techies amongst you –  between the two product lines is that SigNet uses the double ratchet algorithm with prekeys and 3-DH key management to  provide confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, backward secrecy (aka future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity.

For more information on any of our solutions, contact us on +44 (0)20 36 37 38 01 or email us: sales@armourcomms.com

Seamless integration with Android phones

You never know what to expect when a new operating system is released and after the problems with Apple iOS 13 there was a bit of unease amongst the Armour developers. However, for now, the rapid and challenging changes in the functionality available on Android mobile platforms have continued to open up opportunities for seamless integration with Armour Mobile.

Armour Mobile and Android push notifications

You may be asking yourself what are push notifications and why are they important? Well, push notifications are the messages received from apps to provide timely information or other communications from other people when you are not in the app or using your device. These push notifications are a communication channel provided by the operating system to apps that want to use them, and on Android this is done via Google servers.

And an added bonus to battery life too!

Without push notifications, you would need to have your app continuously running or open i.e. ‘always on’, therefore requiring power, and so impacting battery life.

The Armour Mobile app securely delivers and handles push notifications for calls and messages, alerting the user to the incoming call, message or other event notification. The result is that Armour Mobile notifications are now tightly integrated with the battery-efficient, low-level interactions that happen fairly continuously between Android devices and the network.

This seamless coordination results in more efficient battery usage and given the importance of battery life I think we can all agree this is a good thing!

Seamless integration without compromising security

Armour Mobile ensures privacy by not exposing any sensitive information within the alerts themselves: the call / message / video notification remains anonymised until the user is logged in to the Armour app and authenticated to see and receive the call.

So, although notifications will be delivered via the Android push system, users can be assured there will be no impact to security and privacy. Sensitive information remains within the control of the Armour Mobile app at all times. Security and great user experience are the foundation of all our solutions and now Android users get an additional bonus of great battery life too!

And for users who still wish to use Armour Mobile for Android in a totally self-contained environment without the internet or push servers, just adjust the app’s settings accordingly and it will continue to work just as reliably in your private network.

COVID-19, how Armour Comms can help with increased home working

In light of COVID-19, Armour Comms is taking all precautions to protect staff and ensure uninterrupted service levels. We have robust business continuity plans which are designed to make sure that you as a client can get in touch with an Armour staff member, even in the midst of a global pandemic.

Enable Collaborative Working

With the recent developments most companies are looking at ways for staff to work securely from home. Armour Comms’ flagship product Armour Mobile will give you voice, video and messaging along with secure conferencing and file transfer which can be up and running within minutes from our commercial UK based cloud, also available with secure hosting from our partners.

Affordable Contracts

In order to assist our customers, we have relaxed our normal 12-month upfront contract to 3-months and will allow users to extend on a quarterly basis, with one-month cancellation.

Protect your Sensitive Data

With so many people likely to be home working in the next few weeks, trusting the security of large amounts of corporate data moving across the internet is an increased risk. Armour will mitigate that risk. CPA approval from HMG gives users peace of mind that our software, which is developed and supported in the UK, has been reviewed and our security checked by a third-party.

For further assistance, contact us at sales@armourcomms.com