printer friendly version

It is what is inside

Fraud is a growing concern in corporate South Africa, assisted by the economic downturn and the growing use of technology in all spheres of life. The PwC Global Economic Crime Survey from November 2011 confirms this, finding “economic crime continues to be a serious issue affecting South African organisations”.

The survey also noted that cybercrime has emerged as a ‘significant contributor’ to losses and is now the ‘fourth most common economic crime in South Africa and globally’.

Another recent study by the Centre for the Study of Financial Innovation (CSFI), in association with PwC, found that companies have to increase investments in technology to defend against fraudulent activity, both from within and external to the organisations.

An unsettling comment in the CSFI report states, “We have seen an alarming shift in the perpetrator profile towards senior management. This is also reflected in the types of economic crime that are being committed.”

Threats from inside

“This shift is alarming because senior staff are usually more trusted and given access to more privileges,” says Phillip Gerber, MD of Magix Security. “Not only do these people have easier access to sensitive systems and data, they often have access to funds and data and the means to steal them.”

Phillip Gerber, MD of Magix Security

Gerber notes that although syndicates play a major role in economic crimes, they are not always to blame. “The fact is, fraud within companies has some sort of insider involvement. In most instances the crime goes unseen until someone notices that money is missing.”

However, it is not always the financial losses that hurt businesses the most. PwC notes: “South African respondents report a significantly higher impact of non-financial consequences of economic crime than their global counterparts.” Sometimes fraud has a prolonged effect on the business, in the form of loss of trust and brand damage long after the case is closed.

Results from a recent ITWeb Insider Threat Survey, sponsored by Magix Security found that as many as 71% of South African companies had discovered cases of fraud committed by their own employees over the last few years.

The survey was conducted to investigate the level of awareness of insider threats in South African businesses and to determine how prepared organisations are to mitigate these risks. The results showed that, while awareness of the threats posed by trusted people within organisations was growing, few companies are in a position to effectively protect their systems and data.

Technology the key

The only effective way to manage this situation is to continually monitor what employees are doing. With technology, all activities can be monitored invisibly, in real-time and any anomalous behaviour flagged. Magix Security is helping a number of South African clients tackle internal threats from unscrupulous employees. The company has deployed a specialised software solution called Intellinx at a number of sites across the country.

Intellinx is a software product that tracks end-user activity on almost any platform, without creating additional overhead on systems or requiring the installation of hardware or software on the host or client machines. The product gives management the ability to record the interaction of end users with all applications, zoom-in on specific suspicious activity and replay every screen accessed and every keystroke within an application.

The Intellinx business rule engine tracks end-user behaviour patterns triggering alerts on suspicious events in real-time. Gerber notes that this type of monitoring must be done as part of the corporate security policy to ensure it has the desired effect. “An ad-hoc approach will not get the results required.”

In fact, the Magix Security ITWeb Insider Threat Survey found that 42% of companies have no mechanism for monitoring users and only 15% have a reliable software inventory mechanism to prevent malicious and unlicensed software from being installed on corporate systems.

The Ernst & Young 11th Global Fraud Survey found: “Despite the increased incidents of fraud, corporate entities’ responses to fraud allegations appear to be ad hoc and inconsistent. ... It is our experience that this will seriously undermine the success of investigations into fraud and corruption.”

“More than ever, companies need to accept that fraud in all its forms is a reality and will increase along with the global economic problems,” says Gerber. “Furthermore, you cannot rely on people’s honesty to prevent fraud, but must be proactive in identifying and preventing crime before it is able to impact the organisation.

“Automated monitoring is an effective way to prevent fraud as many people are inclined to think twice when they know they are being watched. Those that still proceed will have their work cut out for them as their plans will be thwarted at the first sign of unusual or unauthorised behaviour.”

Share this article:

Further reading: