Issue 6 | Spring 2017 Perspectives A Fresh Look at Enterprise www.toriglobal.com/insights/perspectives Copyright TORI Global. All rights reserved. TORI Global, 62–24 Cornhill, London EC3V 3NH Issue 6 | Spring 2017 Contents Introduction Introduction from Editor, Katie Lawton 7 Things We get up close and personal with TORI Marketing Director, Carolyn Sanchez Cyber Security in 2017 Cyber Consultant, Jack Martin, gives us his predictions for the coming year PSD2 Everyone’s talking about it but what is this disruptive gamechanger? GDPR – Privacy is the Most Important Right We take a look at the key changes that this new regulation will bring C-Suite Chit-Chat A chat with Richard Wilson, former Chief Executive Officer of Société Générale Newedge UK CLIC Sargent A round-up of our latest fundraising toriglobal.com For more information about the content of this publication please contact us at: Welcome back! This is Perspectives, our regular publication aimed at giving you a fresh view of enterprise. INTRODUCTION Welcome to the sixth issue of TORI Global’s ‘Perspectives’ magazine and the first of 2017! Every quarter, we cover issues and trends in the business world with insights and interviews from leading professionals in their industry. As it’s the beginning of the year, this issue will cover some of the hot topics of 2017. First off, Cyber Consultant, Jack Martin, takes us through his predictions for the Cyber Security world. Along with fraud, cybercrime is now the UK’s most common offence which means that every business and every individual is a target. Next we take a look at The Second Payment Services Directive (PSD2) which is a fundamental piece of payments-regulated legislation in Europe. It entered into force in January 2016 but the Directive requires that all Member States implement these rules as national law by 13th January 2018. It is going to completely open up the payments world and businesses don’t have long left to prepare. Are they ready? 2018 is a big year for law and regulation as The General Data Protection Regulation (GDPR) comes into force across Europe from 25th May 2018. It represents the biggest shake-up of data protection laws in a generation. All organisations that process the personally identifiable information of EU residents will be required to abide by a number of provisions. We go into these on page 10. Our C-Suite Chit-Chat guest this issue is Richard Wilson, former CEO of Société Générale Newedge UK. ‘We asked Richard about his interesting career, millennials, and his ambitions for the year. Finally, we fill you in on our latest fundraising activities for our charity of the year, CLIC Sargent, including a 12-hour bike ride in Canary Wharf and a race day at Chepstow Racecourse. Whether you’re reading this on the tube or in the office, we hope you enjoy a little perspective… Best Wishes Katie Lawton Editor [email protected] TORI Perspectives is copyright of TORI Global and all rights are reserved. The contents of this publication may not be reproduced without prior permission. I would love to hear your thoughts so please contact me with any feedback: [email protected] 3 7 Things place – reaching girls at a young age so that they don’t think any field of work is unsuitable for women, especially technical roles, as well as coaching young women early in their careers so they have the confidence to push for leadership roles. What is your favourite place that you’ve visited? Carolyn Sanchez is TORI Global’s Marketing Director. This is a really tough one! I am going to have to be greedy and pick 2, but it’s impossible to choose between them! The first is Japan – the clash of the serenity of little moss covered temples in Kyoto with the urban madness of Tokyo, the joy of not understanding a single thing but finding something new and novel, and a little bit wacky, round a corner, and of course the food is just mind-blowing! My second place is Islay – a tiny island off the west coast of Scotland – and my absolute idea of heaven: windswept beaches, award-winning whisky and the warmest, funniest people I have ever met. Tell us about TORI’s recent brand redesign This year at TORI we celebrate our 15th birthday and it was the perfect opportunity for us to take a step back and look at our branding. One of the things I fell in love with when I joined TORI was the energetic, passionate and no-nonsense personality of the team here and we wanted to make sure that our brand was truly reflecting that. We are not like other consultancies – we have such a wealth of experienced practitioners who have been on the front line in C-level roles in global organisations that we don’t need to hide behind typical consultancy smoke and mirrors. The language we use in the redesign reflects that – we listen to your challenges and get straight to the point. Our photography really bold imagery with bird’s eye or ground up views - is designed to show we’re different too. We’re really excited to roll out the new design, especially on our new easy-to-navigate website. International Women’s Day was last month, what are your views on women at work? I have been lucky enough to work with some inspiring strong women during my career – often in very male dominated industries. I believe there are still many challenges facing women in their careers – from being afraid that you can’t succeed unless you behave ‘like a man’, or having to fight to be taken seriously, to the minefield of balancing work and family… But what I am most passionate about is the next generation of women coming into the work 4 Dead or alive, who would your ultimate dinner party guests be? My grandfather – he was a very gentle and intelligent man and the older I get the more I wish I’d had the chance to talk to him as an adult. Bjork – I have been a fan of her music since I was a teenager. She is so innovative and unpredictable, I’d love to find out where she gets her inspiration from. George Orwell – a friend recently introduced me to his essays and I am now hooked. We are living in such tumultuous times that it would be fascinating to hear his views on our current world. We have heard you are quite a mix of nationalities? Yes, I am half English, half French with a Spanish surname but having lived in Scotland for 16 years I like to claim a bit of that too! I like to take the best of both worlds: St Marcellin cheese with a dram of Ardbeg single malt. Favourite film? Leon by Luc Besson, hands down! Tell us something unexpected about yourself I trained in Muay Thai at university and I have had a series of amateur kickboxing fights. 5 Cyber Security – What to Expect in 2017 Jack Martin has over 5 years’ experience as a Technical Consultant at TORI, specialising in Cyber Security and Financial Crime. The exponential growth of the influence of internet and technologydriven interconnectivity between individuals and businesses, has led to giant leaps in innovation and technological advancement. However, it also means that the nature of crime has changed dramatically to match this new environment. Hack /hak/ verb “to gain unauthorised access to data in a system or computer” Technology always comes with a risk: what does this mean for our security? Hacking is a widely understood term, regardless of your knowledge of IT systems or technology, and is usually associated with criminal activity. However, this is a common misconception. In fact, hackers are likely our best ally in the fight against the growing threat of cybercrime. 6 The term ‘Hacker’ is thought to originate from MIT in 1961, where the model train club used early computers to modify the circuits that controlled the trains. Members of this group would later move on to computers and programming, building the basis of the world renowned technological advancements at MIT. Hacking has since progressed from its innocent roots, now encompassing both ‘ethical’ and ‘unethical’ activity. While one person may hack for fun, to modify or better technology or systems; others seek to break systems for personal, political or financial motivations. Since 2010 the number and size of breaches has increased rapidly from the smaller breaches like Sony in 2011 to the biggest breach of all time: Yahoo in 2013 losing 1 billion records. But as the rise in the number of data breaches grows, we are seeing other, sometimes more alarming, incidents on the rise. The term ‘Hacker’ is thought to originate from MIT in 1961, where the model train club used early computers to modify the circuits. Over the last 3 decades, technology has been a battleground from the first instances of self-replicating worms to the hacking of financial institutions. The ‘good guys’ have always been on the back foot, reacting to constant unknown threats. These attacks have numerous forms and affect everyone from online platform users or banking customers, to huge multinational corporations. People’s use of a particular service can be hindered or even removed, their privacy breached, their credit card details stolen or aspects of their lives exposed; whilst companies can be at risk of collapse due to the loss of revenue, or suffer a loss of customer faith or a drop in share price and fines from regulators. Data breaches have existed since before companies stored data digitally. However, it wasn’t until the shift to digital storage became the norm that the public became fully aware of the scale. The number of cybercrime incidents rose in the 80’s, 90’s and 00’s. With this in mind, here are my predictions for how the cybercrime landscape will look in 2017: what are the real threats and what can we do to prevent them? Internet of Things The Internet of Things (“IoT”) is growing rapidly with the demand for smart devices to be remotely accessible and smarter. Your fridge knows when you have run out of milk and will automatically order more for you; you can remotely control your heating with your mobile from anywhere with an internet connection or even unlock your front door with your smart phone. While connected devices make our lives easier, they lead to greater risks for consumers. If you can connect to it, someone can hack it. The market for IoT devices has become increasingly competitive and as a result many manufacturers sacrifice security for ease of use or price. On top of that, many devices use out of date firmware or security protocols without regular updates being pushed to them. This could lead to incidents where hackers gain access to a home electricity meter and redirect their own bills onto their victim or in more extreme cases, possibly even overload the system and cause a fire! US Congress passes the Fraud & Abuse Act. It is now a crime to break into computer system First National Bank of Chicago suffers a $70M computer theft A precursor to Ransomware is identified, the PC Cyborg Trojan The first DDoS attacks are reported The Hacking group Anonymous is formed The UK passes the Computer Misuses Act 1990. It is now a crime to gain unauthorised access to computer systems World Wide Web introduced to the public Cryptovirology is born, later known as Ransomware Possibly the most damaging worm is released, the ‘I Love You’ worm, infected millions of computers within hours Russian Hackers steal $10M from Citibank Ukraine’s power network is hacked Yahoo is hacked, 1 Billion records are stolen The Bitcoin exchange is hacked $460M is apparently stolen Sensitive US defence documents are leaked from the Office of the Secretary of Defence via a Spear Phishing attack Not only do these devices pose a threat to their own users, but also to others without them even knowing. Hackers are able to hide malicious programmes in everyday items that, when activated, can take part in a wider incident. For example, in the past, webcams have been used to store the ‘Mirai’ malware which would go undetected until activated by the cybercriminal as part of a huge network of infected devices that performed DDoS attacks. The Panama Papers are released, following the Mossak Fonseca leak in 2015 state-backed, seek to disrupt in the grandest ways possible, and in 2017 it is likely we will see several high profile hacktivist attacks seriously damaging major organisations, nations or political parties. Possibly even the upcoming French Presidential Election and the German Federal Election. This could take the form of a mass data dump on the dark web, or the encryption of businesscritical systems using ransomware until certain demands are met, or the altering or voting tallies in a major election… the list goes on. While connected devices make our lives easier, they lead to greater risks for consumers. These sorts of incidents are going to rise exponentially as more devices are connected to the Internet of Things, unless manufacturers start taking action to prevent unauthorised access. Hacktivism and Nation-State Hacking ‘Hacktivism’ is a growing concern for many individuals, large corporates and governments alike. Your average cybercrime will look to steal or manipulate for personal gain, but a hacktivist will seek to damage its target in the most public and catastrophic manner possible. We saw a rise in this in 2016 with the alleged attack on the US presidential election by a Russian-backed group, the leak of the Panama Papers and numerous WikiLeaks leaks by independent activists or groups. Hacktivists, whether independent or Ransomware is a malicious programme that encrypts files until certain requirements are met, for example, a ransom is paid. In 2016, several such attacks took place. Some were thwarted but many were successful because the threat of the consequences was too high to ignore. Businesses can be put in the difficult situation of deciding whether to try and break the encryption themselves, which could take several days or weeks and require the hiring of a third party specialist, or simply pay the ransom in exchange for the decryption key. This is a difficult situation for many firms – they don’t want to give in to the criminals, but their businesses are losing money whilst the company is unable to operate. Often these ransoms are paid because a day without revenue is worse than the cost of the fine. In 2016 the San Francisco Municipal Transport Agency was hit with a ransomware attack that rendered over 2,000 computers useless. During this time they were forced to allow all passengers to ride for free whilst they tackled the threat instead of paying the $73,000 ransom. Ransomware spans several areas of concern in the cyber world as it can be used easily to both disrupt and blackmail. Ransomware can amplify other cybercrime issues, especially the Internet of Things. This can range from a ransomware attack on your wireless-enabled car so you can’t drive it, to locking down a business-critical system and crippling all operations. This is fast becoming an easy way for cybercriminals to make money with surprisingly high success rates and it is likely to worsen in 2017. What Can Be Done: Top Tips Back up your personal photos and treasured memories. No one should have to pay a criminal just to be able to access their own files Increase the complexity of your passwords and refrain from using the same password for multiple logins Increase privacy on your social media profiles to combat social engineering tactics Always be sceptical when opening emails and if unsure always speak to your IT department first. It is better to question a suspicious email than to let in malicious code that could expose yourself or your business to cybercrime Have a robust back-up restore point system that allows you to quickly switch back to a system image prior to the attack Deploy a Unified Threat Management (“UTM”) platform into your environment 7 PSD2: The Second Payment Services Directive by Sally Sarma The first Payment Services Directive (PSD) was adopted by the EU in 2007. It provided a legal framework for all payments made in Europe, with the aim of increasing the speed, efficiency and ease-of-use of European payment services. 2018 is expected to be a game changing year for retail banking. PSD2 is expected to disrupt the banks’ monopoly on their customer account information and payment services. PSD2 will fundamentally change the payments value chain, what business models are profitable and customer expectations. Payment Initiation Service Provider (PISP) Account Information Service Provider (AISP) BEFORE BEFORE Disrupting the digital banking landscape The legislation aims to increase competition, innovation and transparency across Europe. Banks will no longer just be competing against banks, but everyone offering financial services eg challenger banks, financial technology firms (known as ‘FinTech’) and the technology giants. PSD2 enables bank customers to use third-party providers to manage their finances. Banks are obligated to provide access to their customer account information and ability to make payments, through open APIs (Application Programme Interface). Soon we may be able to use social media messaging, like Facebook or Whatsapp, to pay our bills and analyse our spending, while still having money safely in our current accounts. Bank 1 Customer Bank 2 Customer Bank European law in force in the UK Theresa May expressed her intention for the UK to remain the “best place for science and innovation,” with continued collaboration with the EU on technology initiatives. To maintain “certainty,” EU law in force in the UK when the European Communities Act is repealed, would be converted into full UK law. Even if this provision is watered down during negotiations, PSD2 is likely to impact payments going into and coming out of the EU. In order to thrive in a post-PSD2 market, it will take far more than doing the minimum in order to be compliant. Retailer Card Scheme Merchant Bank Bank 3 Card Details Money AFTER AFTER Bank 1 Customer AISP Retailer PISP Bank 2 Customer Bank 3 Bank 8 Authentication Authentication Money Account Information 9 GDPR – Privacy is the Most Important Right By Sally Sarma The General Data Protection Regulation (GDPR) will be enforced across Europe from 25th May 2018. It represents the biggest shakeup of data protection laws in a generation. In the Digital Age, GDPR seeks to address the delicate balance between governments and corporations gaining deep insight into our behaviour, and individual freedom. Privacy in the Digital Age: Improving trust in the digital economy: Many of you will have heard the expression “if you have nothing to hide, you have nothing to fear”. This is often traced back to Nazi government propaganda and George Orwell’s novel, ‘1984’. Orwell foretold a dystopian future where the state closely monitors the population. New technologies give businesses incredible insights into our spending patterns and behaviour which can be used for forecasting and influencing us. However, greater global interconnectivity creates data security risks: a number of high profile companies have been hacked and foreign powers like Russia are believed to be more actively hacking Western institutions. Former National Security Agency contractor, Edward Snowden, who revealed the extent of US state surveillance at home and abroad said “privacy allows us to determine who we are and who we want to be”. More often than not, it appears that we live in an open and too easily accessible data-filled world. States and corporations are literally watching us through data. What does individual privacy mean in this data-saturated environment? “What information do you hold on me?” Individuals have greater transparency and legal rights: “We hold the following information on you...” “Are you sure that’s all you hold?” “Yes, we have comprehensive data search and retrieval capabilities that mean we can quickly identify and locate all customer information” Company “Certainly, if you can supply the following details for the company...” “Can you transfer my data to XYZ company” Customer “Can you delete all my data?” 10 GDPR is a big move towards a Digital Single Market. It standardises data protection rules across the EU and firms targeting EU citizens so it protects EU citizens even if a firm is based outside of the EU. Companies will have to be more transparent about how and why personal data is used and it gives people more say over what can be done with their data. The regulation will introduce tougher fines for non-compliance and breaches. “We can delete all data that we are not required to maintain for regulatory purposes” Personal data must be processed lawfully, transparently and for a specific purpose. Once the purpose is complete, the data is no longer required and should be deleted. Consent must be a positive action by the data subject, not just passive. People can request access to any information that a firm holds on them and be informed why the data is being processed, how long it will be stored and who gets to see it. ‘Right to be forgotten’ requires the data to be deleted when it is no longer required for the original purpose or consent is withdrawn. ‘Right of data portability’ allows requests to move data to another firm free of charge and within one month. ‘Right to sue’ is for compensation for emotional distress from a breach, without having to show an economic loss. Tougher sanctions to encourage good data security: Companies have to appoint a data protection officer (DPO) who will advise the firm and act as the main contact for the Data Protection Authority. There is a duty to report data breaches to the people affected and the regulator within 72 hours of the firm becoming aware of the breach. Failure to meet the 72 hours deadline could result in a fine up to the greater of 10 million Euros or 2% of global annual turnover. Non-compliance or breach could result in a fine of 20m Euros or 4% of global annual turnover of the group, whichever is larger. This year a major bank is expected to fail due to a cyberattack. The recent hacking of Tesco Bank was the largest in UK banking history. Under GDPR, data breaches could bring down corporations due to the size of the fine, class action law suits for breach of data privacy and drop in share price. What does this mean for the UK after Brexit? Theresa May has expressed her intention to keep the UK friendly to the tech sector. Although the Brexit strategy may change, GDPR and other EU laws in force in the UK at the time that Article 50 is invoked are expected to be converted into full UK law. GDPR will impact all areas of a firm’s Operational Model, from policy and process to people and technology. 11 C-Suite Chit-Chat with Richard Wilson A Q&A with Richard Wilson, ex-CEO of Newedge. Hi Richard, thank you for taking the time to speak to us. You’ve had an impressive career to date, can you take us through your journey so far? 1 I started as a graduate trainee at Lloyd’s Bank in 1988, then after a year I joined Société Générale as a Swaps back office clerk and worked my way up until I was given the opportunity to be Head of Derivative Operations. After about 18 months I became the Head of Financial Management which I did until 1993 until I was 27. I then moved to New York where I became Head of Strategic Development for Finance over there and we went on a rapid growth from 600 people to about 3,500 in under 3 years. I ran Programme Management for the Americas for a couple of years, largely around global programmes and merger integration. In 1998 I became the Head of IT for the US, and in 2000 I became the Corporate CIO for Soc Gen Investment Bank based in Paris. I did that for a couple of years and then became the first global CIO for Fimat which subsequently became Newedge through merger with Calyon Financial. In 2009 I became the COO for Europe and then a year later became UK CEO. We were required to convert from being a bank into an Investment firm which went live on 1st November 2011 to become the largest single regulated entity in the country. I remember the day because it was the same day that Man Financial went bust which made for an exciting time! I continued as CEO until 2014 and then stepped up to Chairman. Since then I have spent a 12 lot of time advising. In 2015 I led the remodelling of the Target Operating Model for the Co-Op Bank and then took over as CAO there for a year. More recently I have spent a lot of time working on the housing a slum problem in India targeting Mumbai as a pilot. 2 To what do you owe your success, especially what seems like very fast success from such a young age? It didn’t feel fast at the time… I changed role every 18 months or so. There was definitely some good fortune – being involved in areas where there was lots of change going on and working with people who believed in you. The only recipe that I found early on was simple hard work. First one in and last one out. Look after your people and try and stick to your principles. Nothing clever. ‘Keep your promises’ is what I tell everybody. If you keep your promises and look after your team, you’ll do ok… I was also driven for a long time by a fear of failure. I come from a very unglamorous background. Local state school in Scotland and so on. I thought I wasn’t really adequate which drove me to keep working harder. Interesting point about hard work being the simplest recipe… They say nowadays that millennials don’t really know what hard work is because everything has been handed to them. Do you think that’s true? 3 No. I think everyone’s full of stories. People like to put badges on things, things come and go... I don’t know how you can label an entire generation in any way at all. I’ve been more taken by the impact of religion and culture as a driver of people’s behaviour. If you try and put a finger on millennials, you’d probably say they’ve got access to more information than before. But people are people. They don’t work with you because you tell them to, they work with you because they want to. If you can set the bar somewhere where it’s a challenge for everyone, but can get them there, people will tend to step up and if they don’t then you find something else for them to do. 4 You went from being Head of IT to CEO of a bank which is unusual. Was this down to planning or opportunity? That’s more a measure of the quality of the leadership of the people I was working with. They would look at you for who you were rather than what badge you wore. The opportunity was there and I put my hand up. In life if you don’t step up or step in, things just pass you by. You have to grab opportunities. Sometimes they’re bad. In my life, I’ve made one or two whopping mistakes. For long term success, if you can’t be inspired by the people around you and you don’t share values then it probably won’t be much fun. And if you’re not happy, it’s very hard to be successful. 5 What are the key issues facing large financial firms in 2017? I think that there are 3 things out there. One is that the majority of the large financial firms have a big cost problem. They’re being attacked by new tech players or increased regulation – the new world won’t work with their current tech structure so they’ll just struggle. Two is the digital world, the new generation of automation and machine learning is going to decimate some parts of the sector. It’s all about data in the next generation. Third is risk management. As you take people out of the process and go digital, volumes go up and everything happens faster, and you have to have your risk management absolutely nailed on. liable but ultimately I was accountable and reputationally no one cares how it happened. You usually don’t get hurt for clever reasons. Most stuff that goes wrong is pretty basic. Talk Talk is a good example of the reputational impact. Once you’ve been turned over like that, you’re in trouble because people don’t trust you. 7 What is the biggest lesson you have learnt in business? Linked to what I said earlier about always keeping your promises, it’s trust. You need to always find out who you can trust to do business with. It takes a long time to understand people and see what they’re really made of. And you find out only when things get tough or when money is on the table. 8 Finally, what do you want to get out of the year to come? What are your ambitions? Now I have got over the fear of failure, which is not healthy, my aim is to have serious fun. I want to work with talented people and solve problems together and build something. Something that has a purpose. Thank you for talking to Perspectives, Richard! That leads quite nicely into my next question about a topic we have covered in this issue of Perspectives. GDPR will bring new regulations on the use of customer data. Do you think this will help with the issues you stated above? 6 It will help as it will make it a focal area but it will only be as good as the company is. You’ve got lots of institutions served by multiple suppliers who manage core functions for them so it’s not just how your organisation manages things it’s about how you can look through your providers too. In my professional life I have been hurt more by vendors making mistakes than by my own guys. I had an incident where a vendor left a laptop in the back of a taxi in the US. We didn’t know whether it had been used or not, but it was lost. There were fines and the vendor were 13 The TORI Global and CLIC Sargent charity partnership has been forged in light of an employee, Nigel Crutchley, sadly losing his son, Ben, to a brain tumour in 2012. As a result, Nigel has pledged to raise £1m for the young people and children supported by CLIC Sargent, and TORI want to help Nigel to reach this important target. TORI Global and CLIC Sargent February saw us undertake two fundraising events in aid of CLIC Sargent. The first was a 12-hour bike ride in Canada Place in Canary Wharf. On Friday 3rd February, we set up 4 spinning bikes at 7.30am and they were cycled non-stop until 7.30pm. We shook buckets all day long and were overwhelmed by the generosity of the public. Instead of just bucket shaking, we wanted to do something that would draw attention to us and raise awareness for children and young people diagnosed with cancer. We decided to cycle because on average families have to travel 60 miles to receive the specialist treatment their children require. Employees, associates, family, friends and clients took part on the day and we collected an amazing £5,000! 14 The second charity event in February was a charity race day at Chepstow Racecourse. On 25th February, TORI and friends took over the Coral Suite and enjoyed a day at the races along with taking part in some fundraising. The 4.15pm race, the ‘Ben Crutchley Memorial Supporting CLIC Sargent Handicap Chase’ was dedicated to Ben and his family and Grey Gold was the winning horse. After a successful raffle, and an even more successful auction, our day at the races raised a phenomenal £20,000 for CLIC Sargent. The next fundraiser sees our 5 graduates take on the Three Peaks Challenge where participants attempt to climb the highest mountains of England, Scotland and Wales (Scafell Pike, Ben Nevis and Snowdon) within 24 hours. You can support them by heading over to their fundraising page here www.justgiving.com/ fundraising/TORIGlobal3PeaksChallenge 15 toriglobal.com
© Copyright 2026 Paperzz