1
magazine
Embracing High-Performance Culture Valerijus Ovsianikas
CEO, Tickmill Europe Ltd.
Cyber-Security, Risks and Developments Kipros Politis
Trust: The New Currency for Business & The Golden Rule of Leadership
The importance of workplace security
Frixos Mozoras
Michael Virardi
Security Risks for Fintech, Trading Platforms Brokers and Their Users Panicos Georgiou
Issue #2 - December 2023
2
2
Contents 03 04 12
Editor’s Note Embracing a High-Performance Culture Valerijus Ovsianikas
The importance of workplace security Frixos Mozoras
16
Trust: The New Currency for Business & The Golden Rule of Leadership
20
Cyber Security: A Year in Review, Major Attacks Recap & Trends in 2024
24 28
Michael R. Virardi
Kypros Politis
Security Risks for Fintech and Their Users Panicos Georgiou
MUST-SEE Event Qube Events - 16th NextGen Payments & RegTech Forum CEO Lilly Pavlou
Editor’s Note It gives me great pleasure to welcome you to the second edition of FintechView Magazine for which I have acted as Editor-in-Chief. This is an issue dedicated to the multiple challenges the fintech industry is facing. Some of the most prominent ones include security breaches, data security, big data and AI integration, low transparency, compliance and regulations, high competition, lack of expertise and employee engagement, poor management, and a poor user experience. The rapid emergence of numerous fintech start-ups in the finance sector has contributed to the growth of many other sectors and trust in the workplace has been emerging as one of the most popular topics. A happier workforce is clearly associated with companies’ ability to deliver better customer satisfaction, while recent research by Haiilo reveals that highly-trusted workplaces enjoy a 50% higher employee productivity. When employees trust their leaders, when safety and business sustainability becomes a top priority internally and it reflects externally, and customers can enjoy a safer and transparent service. In this issue we present to you high-level executives, leaders and specialists in their sector, who share with us their insights on the above-mentioned challenges, the latest trends, and best practices in leadership. Enjoy!
Drosoula Hadjisavva Consultant Editor-in-Chief
Read us online www.fintechview360.com Contact us: Consultant editor in chief: Graphic Designer: Photo Production: Content Support:
Follow us info@fintechview360.com • marketing@fintechview360.com Drosoula Hadjisavva Demetra Ioannou Petros Demetriou Maria Phytidou
The information contained in this publication has been obtained from sources the publishers believe to be correct. The publisher wishes to stress that the information contained is ‘general’ in nature and for informational purposes only, promoting personal opinions and thoughts.
4
Valerijus Ovsianikas CEO, Tickmill Europe Ltd.
Embracing High-Performance Culture
“
At Tickmill, our values guide us to cultivate a healthy corporate culture and uphold a high-quality standard in the workplace. We aim to create an atmosphere of transparency, honesty, integrity, and teamwork, where our people can feel motivated, valued, and fairly rewarded.
”
What’s a successful business approach nowadays especially in the forex brokerage sector? In his book “Principles”, renowned investor Ray Dalio, has outlined the fundamental principles that drive a successful business approach, and these have resonated deeply with me as they offer practical and actionable guidance for achieving personal as well as professional goals. The main takeaway of the book is that finding the truth is the best way to make decisions, and that our ego, emotions, and blind spots will inevitably impede the discovery of the truth. Dalio presents his major strategies to overcome these weaknesses, including practicing total receptivity, extreme honesty and transparency, productive conflict, and credibility-centered decision making. Following your principles is paramount, regardless of your area of work or your responsibilities in your company. You must determine what is acceptable for you in your daily work to achieve your final goals. This is also in line with the editor’s note in the first issue of fintechview magazine, which states that one of the critical elements for driving a business is having the right people and the right team in place. Here is principle number one: When you are building your team, you need to foster a strong corporate culture and an environment where employees feel inspired, motivated, and creative. What is the company culture that Tickmill wants to promote? At Tickmill, our values guide us to cultivate a healthy corporate culture and uphold a high-quality standard in the workplace. We aim to create an atmosphere of transparency, honesty, integrity, and teamwork, where our people can feel motivated, valued, and fairly rewarded.
Presenting
5
Valerijus Ovsianikas CEO, Tickmill
6
Tickmill’s corporate culture is built on four fundamental pillars: TRANSPARENCY We practice openness by communicating openly, sharing information and knowledge, and building trust and strong bonds within our teams. We implement an open-door policy by valuing team members’ opinions and contributions, ensuring their efforts are recognized, and providing adequate support and feedback when needed. We reject hierarchical thinking by treating every member of our team as equally important. We facilitate ease of communication by allowing freedom to contact any member of the company through various communication channels (Slack, email, face-to-face). HONESTY We hire honest, trustworthy, and reliable professionals. We foster open communication and feedback by enabling direct and honest dialogue between departments and encouraging the exchange of diverse ideas. This way, we are able to identify and implement the best possible solutions. We demonstrate accountability by ensuring all our employees are able accept responsibility for their actions. INTEGRITY At Tickmill, we believe that integrity is inextricably linked with honesty. We uphold integrity by adhering to the TM values, crafting a moral code of conduct, that is both individual and collective, for all our TM members to follow. We respect our people’s culture and background and foster a culturally diverse company that supports diversity, equity, and inclusion. SYNERGY We enhance synergy by collaborating to achieve a greater purpose (our departments and team members can work together seamlessly to complete a project, create a campaign, or organize a successful event). Success is never a one-person job. It is always the collective efforts of a team that produce the best results. At Tickmill, we bolster creativity and productivity by empowering our people to collaborate, experiment, and exchange ideas so that they can achieve their common goals. Since the inception of our company, our mission has been to provide the optimal environment for our traders and team members to grow and succeed in their endeavors. To accomplish this, we equip them with all the support, knowledge, and tools they need to achieve their objectives.
7
8 What does it mean for Tickmill to know/implement these values? Our corporate culture is based on our core values, which serve as a moral compass for our employees and their daily interactions with other colleagues and clients. Our values – transparency, integrity, honesty, and synergy – guide us to work together towards a common objective and to respect one another as well as our clients. Our values also inform our service to our clients. We practice transparency by sharing information about the company and our trading conditions, including our fair pricing structure with no hidden fees. We uphold integrity by following best practices in the industry and collaborating with regulators to provide the safest possible service. We demonstrate honesty by putting traders first and offering some of the best trading conditions in the industry. We enhance synergy by enabling our different departments to work together closely and flexibly to meet the ever-changing needs of the market and our traders. At Tickmill, implementing and embodying our core values is of utmost importance to us. We inspire our employees to live by the TM values and apply them in everything they do. We consider it essential for all our 300 staff members to understand and embrace these principles as the bedrock of our business. At Tickmill, we believe that this continuous cultivation of our corporate culture is the key to our success.
“
We inspire our employees to live by the TM values and apply
them in everything they do. We consider it essential for all our 300 staff members to understand and embrace these principles as the bedrock of our business. At Tickmill, we believe that this continuous cultivation of our corporate culture is the key to our success.
”
How many years has Tickmill been in business, and what’s your long-term vision? Tickmill was founded in 2014, and we’ve celebrated our 9th-anniversary this August. Despite our company’s relatively young age, Tickmill has enjoyed remarkable growth and success mainly due to the extensive experience of its top management team in the financial industry. They have managed to skillfully navigate a dynamic financial world and deliver a high-quality product. Our long-term vision at Tickmill is to emerge as a global leading brokerage firm by utilizing our in-house technology across the entire value chain. What is, in your opinion, the future of the forex industry, and how is Tickmill preparing for it (mentioning AI, new products, fintech, etc.)? The forex industry is currently faced with numerous challenges, especially in the regulatory arena. The increasing complexity and diversity of the regulatory frameworks, requires forex brokers to constantly monitor and update their policies and procedures to align with the changing regulatory requirements and expectations across different jurisdictions. Tickmill is committed to complying with the regulatory frameworks across the different jurisdictions where it operates. Currently, we hold licenses across a number of different regions including CySEC in Cyprus, FCA in the UK, as well as licenses in South Africa, Labuan, and Dubai. One of the primary challenges in the forex industry is automating various business processes to simplify complexity. With the integration of AI and other advanced tools, our capabilities for automation are ever evolving. Moreover, the industry has become highly competitive, requiring sophisticated solutions in payment systems, lead generation, and more. This technological threshold can also create significant barriers for newcomers who may lack the required capital bandwidth to enter the fintech space. Looking to the future, the industry is also expected to undergo even further consolidation, much like what has occurred in the US, where only a few major players will dominate the market. Currently, Tickmill is actively working on introducing its proprietary trading platform as the next step in its technological evolution.
9
“
One of the primary challenges in the forex industry is automating
various business processes to simplify complexity. With the integration of AI and other advanced tools, our capabilities for automation are ever evolving.
”
Who is Who | Valerijus is a former staff member of Deloitte and Microsoft and has previously served as the CEO of Admiral Markets. He is currently the CEO of Tickmill Europe and a member of the Board, as well as the Chairman and one of the shareholders of Tickmill Group, where he brings over 40 years of valuable business experience. Valerijus has shared his business insights and approach in his 2008 book, “Forex 101,” as well as in numerous articles. His motto is to always do something in the best possible way or not do it at all.
10
11
We combine advisory and industry experience to provide efficient solutions. Deneo Partners is an advisory firm that provides a wide range of services to both private and corporate clients. Our management and employees aim to provide solutions to the most complex issues our clients face, through a hands-on and professional approach that safeguards and enhances value.
Value Enhancing Exper • Investment Firms: Full-service provider to global investment firms and regulators including but not limited to Cyprus (CySEC), the UK (FCA), South Africa (FSCA), Dubai (DFSA) and many offshore jurisdictions like the Seychelles (FSA), Mauritius (FSC), the British Virgin Islands (FSC), the Bahamas (BFSB) and the Vanuatu (FSC). • E-Money & Payment Institutions: Assist with the initial set-up and licensing and provide ongoing support post-authorization. • Crypto: Assist clients who wish to register as Crypto providers around the globe, including Crypto Asset Service Provider (CASP) with CySEC or Virtual Currency Provider License (VASP) in Estonia.
• Company Formation: Sm process within the Republi other European and offshor • Corporate Services: Ran services, always striving for • Trademark Registrations property services, includin name protection. • Premium Directorships: A of senior executives w industries and sectors, both • Legal Opinions: Collabora firms to assist clients in pro Opinion and to understand limitations.
• Compliance & AML: Assist companies globally by offering compliance and AML support in various jurisdictions including Investment Firms in Cyprus and Securities Dealer firms in Seychelles. • ICARA & Capital Adequacy: Advise and collaborate with clients on preparing for the ICARA and capital adequacy requirements and providing all necessary reports. • Outsourced Compliance: Outsourced compliance officer services to Securities Dealer firms regulated by the Seychelles FSA or alternatively assist with locating fit and proper compliance officers.
• Mergers & Acquisitions solutions for acquisitions, ventures and other transactions. • Capital Raising: Acting advisers and guide clients capital raising. • Corporate Restructuring: W determine the causes performance and devise a plan that will help create v
• Internal Audit: Preparation of internal audit reports for Management and the organization’s Internal Audit Committee. • Accounting: From systems set-up to financial reporting, we provide ongoing support for complex accounting issues. • Tax Planning: We offer a wide range of international tax services, including personal and corporate tax. • External Audit: Preparation of statutory audit of financial statements based on International Auditing Standards (IAS).
• Banks: Full banking service of banking institution and a the way to the opening o accounts. • EMIs & PSPs: Finding financial institutions whic supervised and regulated by governmental agencies.
Serviced Offices
CYPRUS • SEYCHELLES deneopartners.com info@DeneoPartners.com
• Offering clients the opp substance for their com equipped, dedicated se locations in Limassol, Cypr according to local regulato
12
Frixos Mozoras Technology & Business Development Director Securité One
The importance of workplace security
“
Organizations can’t afford to let their guard down, instead, they must proactively anticipate threats in order to avoid them and ensure the safety and security of their business.At Securité One, we have carefully studied and focused on how such a dynamic working environment operates, so that we are able to serve our clients effectively.
”
What is workplace security and why is it important? Workplace security refers to the measures put in place to protect people, assets, and information from physical and digital threats. When thinking about workplace security, especially within sophisticated and complex environments such as the fintech sector, it’s important to ensure you have the right measures in place to guard against both physical and digital security threats. Physical security involves the safeguarding of physical assets, such as employees, equipment, visitors, and office space. On the flipside, digital security refers to the protection of data, information, ideas, and systems, vital to the success and integrity of your business. Organizations can’t afford to let their guard down, instead, they must proactively anticipate threats in order to avoid them and ensure the safety and security of their business. This requires proper planning, tools, and teams. Fintech companies have a dynamic working environment, where collaborators, such as Securité One, must meet their standards of efficiency, quality, and unique needs. At Securité One, we have carefully studied and focused on how such a dynamic working environment operates, so that we are able to serve our clients effectively.
13 What are the needs today’s Fintech companies have with regards to security? In today’s modern workplace, there’s a lot to protect. And not everything is evident to the untrained eye or easy to spot. That’s why security in the workplace starts with the right strategy both physically and digitally. The characteristics that a a security partner should understand in order to respond to today’s Fintech companies needs, include: • The size and fluctuation of the personnel according to the circumstances. • The locations, both local and global, and the different security challenges and cultural practices in each region. • The number and diversity of the departments with different working hours and schedules. • The potential risks of internal threats from staff who may have access to sensitive information or be influenced by external groups. • The presence and importance of on-site servers that support a large area or region. • The division and usage of the office space by the same or different staff members. • The variety and complexity of the office facilities, such as work areas, servers, warehouses, kitchens, dining areas, gyms, car parks, call centers, etc. • The frequency and scope of the renovation and relocation of the premises. • The possibility and impact of dissatisfied customers targeting the fintech companies. • The high level of network security required to protect the data and systems. • The number and responsibilities of the departments and their data access rights, such as the department of process ing of assets, department of purchases, head IT, IT security department, maintenance department, and director. • The occurrence and nature of ad-hoc events and VIP invitees.
14 How can geopolitical crises affect such corporate environments with regards to security? It’s a fact that geopolitical issues are affecting business and the economy in general. At the corporate environment level, we have observed throughout the years that when geopolitical issues occur, like for example the recent wars between Russia - Ukraine or Israel and Palestine, safety needs to be increased especially when there are conflicting interests due to financial and banking issues, employment cost effectiveness, or racist behavior from nationalist groups among employees. Our responsibility is to act proactively when we observe any constant changes and replacement of staff in multinational organizations based in Cyprus, and to ensure that no organization or individual is targeted by other nationalist groups who may obtain information from staff already working in-house giving them an opportunity to cause data leaks or other damages.
“
At the corporate environment level, we have observed through-
out the years that when geopolitical issues occur, like for example the recent wars between Russia - Ukraine or Israel and Palestine, safety needs to be increased especially when there are conflicting interests due to financial and banking issues, employment cost effectiveness, or racist behavior from nationalist groups among employees.
”
What products/tools improve workplace security? There are a number of efficient technologies out there to help you accomplish your security goals, but here are a few to get you started: Access control technology / It’s important to control building access to your offices. To achieve this, you need to invest in an access control system. Access control can come in different forms. Some of the most common access control systems you may be familiar with include badges, QR codes, facial recognition, or touch ID. For workplaces, access control means you can manage building security in one or all of your office locations. You can control who can enter your building and with what level of permission, giving you peace of mind that your people and property are secure. Intruder & Fire Safety alarms / Installing sensors and alarms throughout the workplace can help detect potential security breaches. For example, motion sensors can trigger an alarm if someone enters a restricted area, while smoke detectors can alert personnel to potential fires. By using sensors and alarms, you can quickly respond to security threats and prevent damage or theft. Visitor management system / A visitor management system (VMS) verifies that only authorized visitors enter the workplace. It allows you to monitor who is on-site and when. To avoid any unwanted guests and security breaches, you can use your visitor management solution to screen visitors before they enter your office. CCTV / CCTV is another technology that can help you monitor and secure your workplace. CCTV stands for closed-circuit television, which is a system of cameras and monitors that can record and display video footage of the premises. CCTV can help you deter and detect intruders, vandalism, theft, or other criminal activities. It can also help you gather evidence and identify suspects in case of a security breach. What’s Securité One mission and vision? Securité One applies modern security practices and methods to provide security solutions for dynamic working environments. We offer durability and trust in our services. Driven by expertise, communication, directness, our proud team, and 24-hour support, we deliver multi-level security services, including security system installations, security system services, patrols, and more. Securité One was established to offer excellence and viable solutions to the contemporary security challenges of modern businesses operating within a fast-changing environment. Our experts have the knowledge and expertise required to address a wide range of security issues or any other physical threats. Our ambition is to become and be recognized as the most trustworthy and reliable private security company across Europe, by implementing and offering the highest levels of security services within dynamic markets. At Securité One, we continuously expand our range of products and improve the quality of our services leveraging our client-first approach, and we are proud to deliver on our promises! “Securité One applies modern security practices and methods to provide security solutions for dynamic working environments. We offer durability and trust in our services.”
15
Who is Who | Frixos Mozoras is the Director of Technology and Business Development at Securité One, a leading provider of security solutions for dynamic working environments. He brings over a decade of hands-on experience in physical and technological security, as well as a certification in security training. He is also the founder and CEO of Securité One and has successfully launched several other security companies and training academies. He holds an MBA and a bachelor’s degree in Security Management. Headed by Frixos Mozoras and with offices based in Limassol, Securité One serves multinational organizations across Cyprus.
16
Michael R. Virardi Group HR Director of GR8 Tech & Owner of PERHA Group
Trust: The New Currency for Business & The Golden Rule of Leadership How can trust (or lack of it) impact a business and how can a leader cultivate trust? TRUST IS THE NEW CURRENCY. My experience over the last 22 years has shown me that there are four (4) simple steps that your salespeople can take to become not only trusted advisors but also value contributors to your customers and to your organisation.
“
The word ‘trust’ may not appear on any balance sheet but the concept can make all the difference between success and failure. In the end, it’s all about trust.
”
STEP 1: LISTEN TO THE CUSTOMER A few years ago I had the good fortune to cooperate with Kardex , a billion-dollar company listed on the Swiss stock exchange. The man who hired me – Demetris Koulountis, the firm’s Regional Director – told me that his success was based on the fact that he always walked into the first meeting with a new customer without having any of his company’s leaflets and brochures on him. Why? “The first meeting,” he said, “is all about the customer. Successful salespeople do not barge in and try to take over. They arrive as trusted advisors, trying to make sense of their prospective customer’s needs and wants before even thinking about suggesting any of their own products. If possible, they will lay the foundations for building a relationship with him or her.” Mr. Koulountis added that, in his view, “people buy people” and in his 30 years of experience this parameter has not changed even slightly. Successful salespeople, like Kardex’s Regional Manager, understand that empathic listening and scrupulous note-taking are more important than hard selling and impulsive discounting. STEP 2: AIM TO CREATE VALUE FOR THE CUSTOMER In 2011 I came across a bar that was very different from those I had experienced in hotels during my travels all over the world. It was on Fifth Avenue in New York City and it was called a “Genius Bar”. Unlike other bars, this one dispensed advice instead of alcohol! It was Apple’s attempt to create a significant competitive advantage over its competitors and I don’t mind admitting that the “Genius Bar” succeeded in turning me into a loyal Apple customer. I am typing this newsletter on a MacBook Pro, it is being saved automatically on an Apple Time Capsule and my iPhone is ringing in the background reminding me that it is time for a break urging me to get myself in motion. The “Genius Bar” was a successful attempt to raise expectations and delight customers by giving them way more than they hoped for. Successful salespeople also need to act like geniuses since those are the people who meticulously study their competition, invest hundreds of hours in ‘getting acquainted’ with their products and services and keeping abreast with the latest developments in their industry. Only
17 then are they able to dispense the right kind of information and advice that is crucial for their customers to take a buying decision. Successful salespeople understand that price does not build relationships. Trusted advisors do. STEP 3: SPEAK TO AND FROM THE HEART There is no denying that Millennials live much of their lives staring at their smartphone screens. They will even be found ‘checking in’ on Facebook and whichever social media channels they choose whilst at the dinner table with family and friends. They post pictures of almost everything that catches their eye and their imagination – and yet the majority of restaurants that I have visited still choose to have password-protected Wi-Fi! As the mobile phone becomes ever more ingrained in our daily lives, why do so many business fail to differentiate themselves by offering their customers password-free Wi-Fi? The establishments that miss out on the opportunity to make their customers’ lives easier lose not only time (responding to customers’ requests for Wi-Fi access – as I and many others did today at the restaurant we chose to visit for lunch with the family) but also the opportunity to extend their brand’s outreach and reputation if customers mention that they are currently at a particular place of business. More importantly, they miss out on touching their customers’ hearts by making the overall dining experience seamless and pleasant. Successful salespeople understand that people buy emotionally and then justify their purchase rationally. So you should aim at your customer’s heart, surprising and delighting him at every turn. Successful salespeople take a lot of notes during meetings with customers and subsequently make a point of seeing that all the notes are summed up (in an offer, a report or a proposal) in the very words used by the customer. They will follow up the meeting with a “thank you” e-mail, which not only differentiates them from their competitors but invariably delights and surprises the customer. They will never insist on telling customers “We are the best”. Actions, not words, are what will convince them of this. STEP 4: SACRIFICE THE CUSTOMER, NOT THE RELATIONSHIP A few years back my wife Christine was appointed Human Resources Partner with a prestigious global company. With such companies come benefits and incentives, one of which, in this case, is the provision of free medical insurance for the whole family. When she presented me with the all-inclusive medical insurance policy which was just as good as our existing one, I decided to call my insurance agent to let him know that I was weighing my options and considering stopping my current plan. He went crazy! He tried to camouflage the fact that he was threatening me by pretending that he was, in fact, advising me. He told me, for example, that if I stopped the policy and decided to renew it at a later date, I would not be able to enjoy all the benefits I had now. He made no attempt to put himself in my shoes and look at how I would benefit from the change of insurance provider but simply panicked at the thought of losing me as a customer and, most probably, his commission too. However, I am pleased to report that, when I presented the case to his Manager, I found not only a sympathetic ear but a far more relaxed and understanding attitude. He started by saying that he would reimburse my already paid annual premium as soon as I decided to terminate the plan and he added that he wanted the best for me and would be in a position to understand the situation once he had taken a look at Christine’s new company medical insurance scheme. He later got back to me and acknowledged that it was in some aspects better than his. He drew my attention to three basic parameters that I had to take into consideration. Having carefully considered them, I ended up downgrading my medical insurance but staying on as his customer. The Manager knows that his company will receive less money from me this year but, by acting as a trusted advisor, he not only added value to his company (unlike my insurance agent) by keeping me on board but he also preserved a six-year relationship.
18 Successful salespeople go to great extremes to protect the relationship, even if this means losing the customer in the process. It is easy to think that price and cost issues are the only ones we need to take care of, especially when times are tough. However, the best investments are usually long-term and there is no better investment for a company to make than in its people and its customers. The word ‘trust’ may not appear on any balance sheet but the concept can make all the difference between success and failure. In the end, it’s all about trust. What is the secret to effective leadership? The best and possibly the shortest definition of leadership that I have come across is not by any of the many inspiring leadership gurus. It is by Dee Hock, the founder and former CEO of VISA (he conceived the name of the global credit card system), who put it like this: “PhD in Leadership, Short Course: Make a careful list of all things done to you that you abhorred. Don’t do them to others, ever. Make another list of things done for you that you loved. Do them for others, always.” Hock’s simple yet powerful definition of leadership reminds me of the verse in the Bible – “Do unto others as you would have them do unto you”, commonly known as The Golden Rule. It is also a reminder that leadership is not just about achieving your goals but about building relationships with the people you lead. When you treat others the way you want to be treated, you create a culture of trust, respect and support. The first part of Hock’s “short course” involves reflecting on your own negative experiences from the past. These might include: • being micromanaged, • not being given credit for your work • being treated disrespectfully. By remembering the effect of such negative experiences on yourself, you become more aware of how you do not want to treat others. The second part of the “short course” involves reflecting on your own positive experiences from the past. This might include: • being given opportunities to learn and grow, • being recognized for your achievements • being treated with kindness and respect. By remembering the effect of such positive experiences, you become more aware of how you want to treat others. Tom Peters, the well-known American writer on business management practices, said that Dee Hock’s ““PhD in Leadership, Short Course”” is “about 99% of what you need to know” and he explained: “If it made you madder than hell when you were an unempowered 23-year-old person, then as a 33-year-old manager, don’t do it to somebody else!” The beauty of Dee Hock’s “short course” and the Golden Rule is that both are incredibly simple yet profound. Making those few words your motto can literally change the way you do business and, by treating others as you want to be treated, you stand a much better chance of creating a culture of excellence and achievement. So, let’s all take time to reflect on our own behaviour as leaders and strive to become better every day.
Who is Who | Michael R. Virardi is a world-renowned trainer, speaker and best-selling author with over 20 years of experience in empowering leaders and organizations to build and nurture a winning culture. Michael has delivered workshops, facilitation sessions and keynotes to over 24 countries and has collaborated with some of the most prestigious organisations in the world including Coca Cola, Google and Ericsson. He is best-selling author and through his books (“Positive Impact” and “Crisis?Let’s Beat it!”), mentoring programmes, and e-course “Stand Up, Stand Out”, Michael communicates his passion for reaching people and allowing them to unlock aspects of themselves they did not realise they had.
19
Kypros Politis Cyber Security Architect - Team Lead
Cyber Security: A Year in Review, Major Attacks Recap & Trends in 2024
“
Emerging trends include double-extortion, where attackers steal sensitive data before encrypting it, and triple-extortion, where they threaten to release data, sell it, or use it for other malicious purposes. Organizations should prepare by implementing robust backup and recovery plans, regularly updating and patching software, conducting employee training to recognize phishing attempts, and investing in advanced threat detection and response capabilities.
”
What should businesses do proactively to defend themselves from cyber security assaults and incidents and limit their impact? Online business and especially fintech should proactively defend against cyberattacks and limit their impact. Businesses should conduct regular cybersecurity risk assessments to identify vulnerabilities and threats. Prioritizing risks based on potential impact and likelihood is helping to develop a risk management strategy to mitigate and monitor identified risks. Staying compliant with cybersecurity regulations and finally ,businesses should define a cybersecurity strategy and roadmap which is essential for businesses to enhance their protection against cyber threats. By proactively taking these measures, organizations can significantly enhance their cybersecurity posture, reduce the risk of cyberattacks, and minimize the impact of incidents when they do occur. Remember that cybersecurity is a shared responsibility involving technology, processes, and people within any organization. What is the significance of Zero Trust security in 2023, and how does it differ from traditional security models? Zero Trust security is crucial in 2023 because it challenges the traditional security model of “trust but verify.” In a Zero Trust model, organizations never trust any user or device by default, even if they are inside the network perimeter. Instead, they continuously verify and authenticate users and devices, granting access on a least-privilege basis. This approach is essential because it acknowledges that threats can exist both outside and inside the network, making continuous verification and strict access controls critical for security.
21
How are artificial intelligence and machine learning being used to enhance cybersecurity defenses? Artificial intelligence (AI) and machine learning (ML) are playing a significant role in cybersecurity in 2023 and 2024. They are being used to analyze vast amounts of data and identify patterns indicative of cyber threats. AI and ML can automate threat detection, improve the accuracy of anomaly detection, and enhance incident response by providing real-time insights. These technologies also help in behavioral analysis to detect insider threats and advanced persistent threats that may evade traditional rule-based systems. What are the emerging trends in ransomware attacks for 2024, and how can organizations better prepare against them? In 2023, ransomware attacks continue to evolve with Research specialists (CPR*) reporting an 8% increase in global weekly cyberattacks in the second quarter, marking the highest volume in two years. Cybersecurity predictions for 2024 broadly fall into seven categories: Artificial Intelligence and Machine Learning; GPU farming; Supply chain and critical infrastructure attacks; cyber insurance; nation state; weaponized deepfake technology and phishing attacks. Emerging trends include double-extortion, where attackers steal sensitive data before encrypting it, and triple-extortion, where they threaten
22 to release data, sell it, or use it for other malicious purposes. Organizations should prepare by implementing robust backup and recovery plans, regularly updating and patching software, conducting employee training to recognize phishing attempts, and investing in advanced threat detection and response capabilities. *CPR: resource is Check Point Research With the increasing adoption of IoT devices, what are the main cybersecurity challenges organizations face in securing their IoT ecosystems in 2023? IoT security is a critical concern in 2023 due to the proliferation of connected devices. Challenges include device vulnerabilities, lack of standard security protocols, and difficulties in patch management for IoT devices. Organizations must implement strong device authentication, network segmentation, and monitoring to protect against IoT-related threats. Additionally, they should consider the entire lifecycle of IoT devices, including secure provisioning and decommissioning. Can you foresee how cyber security will develop in 2024? We expect to see advancements in AI-driven cyber attacks and corresponding defenses. As technology evolves, so do the methods of those looking to exploit it. There will likely be increased emphasis on securing IoT devices, given their proliferation in various aspects of our lives. Quantum computing might also become
more prevalent, posing both opportunities and challenges for cybersecurity. Additionally , in terms of regulations, we might see more stringent data protection laws and cybersecurity standards globally. Governments and organizations will likely continue to invest in cybersecurity measures to protect sensitive information. Of course, these are just predictions, and the landscape can change rapidly. We all need to keep an eye on reputable tech and cybersecurity sources for the latest trends and advancements!
“
In 2024 we expect to see advancements in AI-driven cyber attacks and corresponding defenses. As technology evolves, so do the methods of those looking to exploit it. There will likely be increased emphasis on securing IoT devices, given their proliferation in various aspects of our lives. Quantum computing might also become more prevalent, posing both opportunities and challenges for cybersecurity.
”
Who is Who | Kypros, Cyber Security Architect - Team Lead at eSafe, has over 25 years of expertise in the field of IT and specializes in seamlessly combining network centric and data-centric controls. As an experienced Security Expert, he has a passion for developing powerful defense techniques. Kypros previously held the position of Associate Manager at the IT/Infrastructure Security Division at the Hellenic Bank for over 16 years.
23
24
25
Panicos Georgiou
Panicos Georgiou, CEO, eSafe Solutions Ltd
Security Risks for Fintech, Trading Platforms Brokers and Their Users
“
Fintech and Brokers store their clients’ data on servers, which
can be either self-managed or cloud-based. Cloud-based servers are rented from third-party hosting companies, whereas self-managed servers are owned and operated by the brokers themselves. Both types of servers entail security risks that require proper management by the brokers or their vendors.
”
What are the most common security risks that brokers can face? Brokers store their clients’ data on servers, which can be either self-managed or cloud-based. Cloud-based servers are rented from third-party hosting companies, whereas self-managed servers are owned and operated by the brokers themselves. Both types of servers entail security risks that require proper management by the brokers or their vendors. For instance, brokers who use cloud-based servers may delegate the management to external vendors, which exposes them to potential threats from the vendors or the cloud providers. Moreover, hackers may attempt to access the passwords and devices of the brokers’ executives and clients by using social engineering techniques. It’s therefore crucial to carefully examine the security risks that brokers face in order to be able to propose viable solutions.
“
Hackers can access the unguarded client information and use it
for malicious purposes, such as hacking the client device, blackmailing, extorting, or selling the data to other scammers on the black market. Thus, any misconfiguration or lack of privacy settings can enable attackers to gain access to a server and the customer data, posing serious threats to the brokers’ business and reputation, as well as the clients’ security and privacy.
”
26 What options do brokers have when it comes to protecting their clients’ data? As we’ve already established, brokers have two options for storing their data on servers: using a cloud-based service provided by a third-party hosting company, or setting up their own personal data center. Both options have advantages and disadvantages in terms of data security. Cloud-based services can reduce the operational costs and complexity for brokers, but they also depend on the competence and reliability of the external vendors who manage the cloud configuration. A mistake by a vendor can expose the brokers’ data to attackers. This is exactly what happened in the case of the FBS forex broker, who left their Elasticsearch server unprotected and unencrypted. The Elasticsearch server of FBS contained client’s personal identifiable information such as IP addresses, mobile device models, full names, email addresses, phone numbers, passport numbers, Google ID’s and even unencrypted passwords – all of which fell into the hands of the hackers. While personal data centers can give brokers more control and flexibility over their data, they also require the employment and payment of experienced IT professionals who can ensure proper security practices. Brokers who use shortcuts or neglect security measures can also compromise their data, as well as face legal and reputational consequences. Therefore, brokers need to carefully weigh the pros and cons of each option and choose the one that best suits their needs and resources. However, even if brokers choose the most secure option, they are not immune to the risks of hackers, who can exploit any vulnerability or loophole in the server configuration or the client device. Hackers can access the unguarded client information and use it for malicious purposes, such as hacking the client device, blackmailing, extorting, or selling the data to other scammers on the black market. Thus, any misconfiguration or lack of privacy settings can enable attackers to gain access to a server and the customer data, posing serious threats to the brokers’ business and reputation, as well as the clients’ security and privacy What is the most common type of phishing attack that modern-day brokers face? 91% of successful data breaches started with a spear phishing attack. Spear phishing is a type of email scam that targets a specific individual or group of individuals within an organization. Cybercriminals can either send emails that appear to be legitimate to a large number of targets and hope that some of them will click on the malicious link (also known as the spray and pray method), or send a customized email to a single target. LinkedIn is a useful source of information for cybercriminals, as they can profile their targets based on their employment history and other details that are displayed on the social media platform. Spear phishing involves the following steps: • Obtaining the target’s email address: Cybercriminals can use special software to extract email addresses from search engines or purchase the email data from other sources. • Bypassing the antivirus software: Cybercriminals can use open-source software such as Metasploit, which was originally designed for testing security vulnerabilities, to detect the type of antivirus software or network vulnerabilities that the target has. Then, they can design the malware in the email to evade the antivirus software detection. • Egress filtering: This is a process that checks all data that leaves a network, so cybercriminals use payload software to encrypt the information that is sent from the target’s network to the Metasploit server. • Social engineering: Cybercriminals conduct research on their targets by checking their Facebook posts, LinkedIn profiles, etc. to find out personal information, such as their spouse’s name, children’s name, or vacation destinations. They use this information to craft a convincing phishing email that mimics the style and tone of a legitimate sender. • Malware installation: Once the target clicks on the link in the email, malware is secretly installed on their system. This malware is usually a type of a key-logger software that records the target’s passwords and sends them back to the cybercriminal. How do cyber criminals target a broker’s clients? According to Forex Beginner UK, there has been a significant rise in cyberattacks that aim to steal the personal and financial information of brokers’ clients. Trading app users in particular are among a highly targetted group for cybercriminals, who have been exploiting the increased demand for online trading services since the onset of the pandemic. Cybercriminals use various methods of phishing, such as SMS messages, emails, and cold calls, to deceive the users into revealing their app passwords, credit card details, or clicking on malicious links. Once the cybercriminals obtain this information, they can easily access the trading app and transfer funds out of the user’s account, unless the broker has strict withdrawal policies. One way to enhance the security of a broker’s trading app is to implement two-factor authentication, which adds another layer of verification to the password layer. This layer could be an SMS message or an email message that contains a code that the user has to enter to log in. However, cybercriminals can also mimic this process and send fake verification SMS messages or emails to the users, in order to trick them into giving away their login information. Therefore, users also beed to be educated on how to be vigilant and cautious when they receive any communication from their brokers or trading apps, and always ensure that they verify the authenticity and legitimacy of the sender and the content.
What are some common practices that can help brokers protect their data and clients against cyber attacks? Some common practices that help brokers protect their data and their clients against cyber security attacks include: • Not sharing sensitive information on social media. Social media platforms, such as LinkedIn, Facebook, etc., can provide cybercriminals with valuable information that they can use to launch phishing attacks against brokers or their clients. This information can help the cybercriminal craft a convincing phishing email that mimics the style and tone of a legitimate sender. Therefore, brokers should educate their traders and staff on how to use social media responsibly and securely, and avoid disclosing any sensitive or personal information that could be exploited by cybercriminals. • Implementing organizational email policies. Brokers should have software in place that filters and scans the emails that their employees send and receive. This is important because cybercriminals can extract employees’ email addresses using complex scripts or purchase them from other sources, and use them to prepare spear phishing attacks. If a proper filtering and scanning system is in place, it can block or detect malicious emails and prevent data breaches. • Providing education and training on cybersecurity. Both employees of brokerages and clients using their trading apps should educate themselves on cybersecurity periodically. A brokerage could organize training courses on cybersecurity for its employees and test their level of compliance by deploying dummy phishing attacks. Clients using online trading platforms should also be informed and instructed on how to recognize, prevent, and report cyber threats. Education and training on cybersecurity can help foster a culture of security and responsibility among employees and clients, and reduce the risk of human error or negligence. • Enabling two-factor authentication (2FA) protocols for logging in to systems and apps. Authenticating with a password alone may not be enough, so 2FA adds another layer of verification, such as a code sent to a mobile device. This helps secure a trading platform and prevent unauthorized access, phishing, and identity theft. Clients using online trading platforms should also create strong alphanumeric passwords that contain capital letters, special characters, and numbers, and change them regularly. • Adhering to anti-money laundering laws. Brokers should always look out for red flags and suspicious withdrawals from clients’ accounts. A client who rarely withdraws money and suddenly begins to withdraw is a red flag that could indicate a compromised account. Moreover, anti-money laundering laws require brokers to trace and stop money laundering activity by conducting due diligence on customers and reporting withdrawals above certain threshold limits to the relevant authorities. Doing this can help prevent loss of funds and aid fund recovery even after an account has been compromised. • Managing employee disengagement. Organizations should ensure that disengaged employees are treated fairly and retrieve all official information from them. A malicious employee could sell organizational data and leak client information to cybercriminals or competitors. Although the law may catch up with them eventually, the damage would have already been done, as clients would be exposed to data breaches and lose money. Therefore, organizations should monitor and address employee disengagement and ensure that all sensitive data is securely erased or transferred from their devices
Who is Who | Panicos Georgiou is an accomplished IT Security professional with over 20 years of experience in the field of Cyber Security. Panicos is a successful entrepreneur representing some of the leading security vendors whilst providing cutting-edge technologies and extensive knowledge in this niche area. Over the years he has helped organizations mature their security posture while addressing their current and future needs. He is in a privileged position to provide consulting and integration services, monitoring and incident response to a wealth of prestigious organizations such as government, banks, law firms, financial institutes, shipping and more.
28
MUST-SEE EVENT The 16th NextGen Payments and RegTech Forum, an inspirational gathering connecting leading decision-makers from across the entire Payments and RegTech community. The two-day event took place on 2-3 November 2023, at the luxurious Four Seasons Hotel in Limassol, Cyprus. High-achieving specialists inspired the participants with their knowledge and innovative concepts on how to evolve business activities in the world of technology advances, regulations, empowered customers and continuous development in a disruptive economy. Lilly Pavlou, Executive Director at Qube Events commented:
“
QUBE Events was established in 2016 - so we’ve been in business for over seven years! Our QUBE motto is “Where Great Minds Unite!
”
QUBE Events are created to provide an authentic platform where business leaders can build and cultivate long-lasting relationships in a healthy and productive space. We focus on hosting high-level international conferences for senior executives, predominantly in the Fintech sector, with a strong influence in Payments, Banking, RegTech, Finance, Financial innovation, Private Wealth, and Forex. What sets QUBE Events apart is our strong focus on quality, our attention to detail, and our immense passion for what we do. We host events in Malta, Belgium, Cyprus, Ireland, Switzerland, the United Kingdom, and Greece, and in 2023 launched our Payments & RegTech series in Austin, Texas, in the USA. We are very proud to have built an excellent reputation within the events and conferences space - and I’m very excited for the year ahead and the events coming up in 2024!”
29