Dr. Vaman Ph.D CISA CGEIT

Citibank Fraud – a case of systemic failure

In Enterprise Risk Management, Governance on January 5, 2011 at 12:37 pm

Citi that never sleeps gave sleepless nights to their Indian customers! A huge fraud to the tune of Rs. 400 Crores ( USD 86 Mill) rocked the financial world involving insiders. The fraud involved wealth management team – a relationship manager called Mr. Puri. According to news reports Puri diverted wealth management customers funds to his personal account & was trading in stocks. How can this happen in such a large global bank with fort-knox security? where are the checks & balances – where are the auditors?

Apparently Mr. Puri was using the entire Citi machinery – its computer systems, mails to generate falsified statements of accounts, portfolios and receipts merrily & was running this happily for sometime.  Citi also used to get BLANK investment forms signed off by the stupid high net-worth investors! The critical question is – How could this massive fraud go unnoticed for such a long time. More important is – How can a low level official such as Mr. Puri orchestrate this complex fraud as one man army? was he alone – certainly not possible.

Let us examine some best practices -

Most people in India do not know that fraud is a legal term and not a concept that changes with time. Fraudulent incidents in the information age have devastating effects. Every single piece of information in today’s knowledge driven era has a value attached to it, and is thus prone to fraud. Information leakage and technology or people failure in an organization result in major financial losses. Traditionally, audit was the best way to investigate frauds; however, in recent times with economies going from boom to bust, this profession has innovated drastically.

Recruiting a proficient team

A person investigating fraud must understand that every organization is susceptible to fraud as human behavior cannot be controlled, unlike policies, laws, and hierarchy. Hence, the question is how to investigate fraud after an incident has been reported.

Investigating fraud is not a one-man job and requires a competent and experienced team. The fundamental of any investigation is to have professionals with the right skills, knowledge, and experience. This team needs to be focused on the assignment and ensure resolution within a reasonable timeframe. Inexperienced or under-trained personnel could hinder the fraud investigation process.

Depending on the magnitude of the incident, the fraud investigation team should consist of:

•         A legal attorney/professional who is able to identify applicable compliance provisions, statutory regulations and their violations. In majority of frauds detected, the evidence obtained is purely circumstantial in nature and thus requires special skills to put forth the point in an appropriate manner and visualize the implication in the court of law.

•         A forensic accountant/auditor, who is not necessarily an accountant but an individual with a techno-functional background in specialized areas like business, finance, Information Technology (IT), and law.

•         A cyber forensic expert with appropriate technical knowhow and experience. Today, computer is a tool as well as a victim in financial crimes. Cyber forensic expertise is one part of forensic accounting practice that deals with various aspects of digital evidence, data recovery, data analysis, password recovery, and risk profiling of user. These crimes are most difficult to probe and prosecute because of jurisdictional issues and many times are cross-border in nature.

•         A field investigator who based on requirements of a forensic auditor collates the evidence, which is crucial for any investigation to be successful. Awareness of legal environment is critical for a field investigator and all evidence should be gathered and collected with respect to law of the land. Any violation of the same may result in the evidence getting tainted and becoming unacceptable in the court of law.

Using the SPEC (scope, plan, execute, close) model

Having an initial investigative hypothesis of the incident helps to understand where exactly the fraud investigation should commence. The SPEC model can be used to investigate fraud.

•         Scope: Post incident reporting, investigator/s need to gain maximum first hand information of the actual job. Understand and evaluate various factors such as cultural, regulatory, and legal to investigate a fraud. Speculate on different levels of investigative hypothesis, by approving and/or disapproving facts of the incident/s and the process of gathering evidence for the same. It must be noted that this is not the planning stage.

•         Plan: Plan the fraud investigation in a phased manner to maintain its intent and purpose. The plan stage includes establishing the investigative hypothesis, process mapping, scheduling timeframes, resource allocation, and reacting appropriately to facts/information while executing an investigation.

•         Execute: This includes supervision of the case, proving and/or disproving facts/information, and triggers raising such incidents. While investigating a fraud, the investigators should apply their knowledge, expertise and skills to deduce potential outcomes based on different theories such as the Fraud Triangle by Dr. Donald Cressey.

•         Close: This is the final stage of a fraud investigation, where the case is closer to completion. Investigation outcomes of the incident and appropriate recommendations are documented in a logical, coherent report.

An important fact is that corporations in India today do not update themselves on the different and continuously developing types of frauds and methods to investigate frauds. Corporations “act” or rather “react” only when a fraud occurs in their own backyard. Review of internal procedures and technological advancements not only in audits but also various departments assist in reducing fraudulent activities. Training the staff regularly by organizing fraud awareness programs keeps them abreast of the changing nature of frauds and ways to combat them effectively.

TIME TO START TAKING THE INTERNET SERIOUSLY

In Internet, MILITARY SECURITY on July 8, 2010 at 9:32 pm

TIME TO START TAKING THE INTERNET SERIOUSLY

Internet is a great opportunity as well as a dangerous threat. Nick Carr says that Internet makes people stupid. I don’t agree – it makes people smart. You have to find a method in the madness of using the Web. Just look at Europe where the idea of competition in the Internet space appears to focus on litigation, legislation, regulation, and criminalization. A country like India can benefit greatly by using Internet as a business platform. Many smart Indian entrepreneurs have done that. But there is room for many millions.

The danger of Internet is that it makes you and your identity vulnerable. Your social networking can be a threat. More and more Criminals and Terrorists are learning and getting smart with Cuber-terrorism.  In the near future you will see many cyber attacks on Indian companies and Governments.

Here are some thoughts from The Edge -

1.  No moment in technology history has ever been more exciting or dangerous than now. The Internet is like a new computer running a flashy, exciting demo. We have been entranced by this demo for fifteen years. But now it is time to get to work, and make the Internet do what we want it to.

2. One symptom of current problems is the fundamental puzzle of the Internet. (Algebra and calculus have fundamental theorems; the Internet has a fundamental puzzle.)  If this is the information age, what are we so well-informed about? What do our children know that our parents didn’t? (Yes they know how to work their computers, but that’s easy compared to — say — driving a car.)  I’ll return to this puzzle.

3. Here is a simpler puzzle, with an obvious solution. Wherever computers exist, nearly everyone who writes uses a word processor. The word processor is one of history’s most successful inventions. Most people call it not just useful but indispensable. Granted that the word processor is indeed indispensable, what good has it done? We say we can’t do without it; but if we had to give it up, what difference would it make? Have word processors improved the quality of modern writing? What has the indispensable word processor accomplished?

4. It has increased not the quality but the quantity of our writing — “our” meaning society’s as a whole. The Internet for its part has increased not the quality but the quantity of the information we see. Increasing quantity is easier than improving quality. Instead of letting the Internet solve the easy problems, it’s time we got it to solve the important ones.

5. Consider Web search, for example. Modern search engines combine the functions of libraries and business directories on a global scale, in a flash: a lightning bolt of brilliant engineering. These search engines are indispensable — just like word processors. But they solve an easy problem. It has always been harder to find the right person than the right fact. Human experience and expertise are the most valuable resources on the Internet — if we could find them. Using a search engine to find (or be found by) the right person is a harder, more subtle problem than ordinary Internet search. Small pieces of the problem have been attacked; in the future we will solve this hard problem in general, instead of being satisfied with windfalls and the lowest-hanging fruit on the technology tree.

6. We know that the Internet creates “information overload,” a problem with two parts: increasing number of information sources and increasing information flow per source. The first part is harder: it’s more difficult to understand five people speaking simultaneously than one person talking fast — especially if you can tell the one person to stop temporarily, or go back and repeat.  Integrating multiple information sources is crucial to solving information overload. Blogs and other anthology-sites integrate information from many sources. But we won’t be able to solve the overload problem until each Internet user can choose for himself what sources to integrate, and can add to this mix the most important source of all: his own personal information — his email and other messages, reminders and documents of all sorts. To accomplish this, we merely need to turn the whole Cybersphere on its side, so that time instead of space is the main axis.

7.  In the last paragraph I wrote “each Internet user”; but users of any computing system ought to have a simple, uniform operating system and interface. Users of the Internet still don’t.

8. Practical business: who will win the tug of war between private machines and the Cloud? Will you store your personal information on your own personal machines, or on nameless servers far away in the Cloud, or both? Answer: in the Cloud. The Cloud (or the Internet Operating System, IOS — “Cloud 1.0″) will take charge of your personal machines. It will move the information you need at any given moment onto your own cellphone, laptop, pad, pod — but will always keep charge of the master copy. When you make changes to any document, the changes will be reflected immediately in the Cloud. Many parts of this service are available already.

9. Because your information will live in the Cloud and only make quick visits to your personal machines, all your machines will share the same information automatically; a new machine will be useful the instant you switch it on; a lost or stolen machine won’t matter — the information it contains will evaporate instantly. The Cloud will take care that your information is safely encrypted, distributed and secure.

10. Practical business: small computers have been the center of attention lately, and this has been the decade of the cellphone. Small devices will continue to thrive, but one of the most important new developments in equipment will be at the other end of the size spectrum. In offices and at home, people will increasingly abandon conventional desktop and laptop machines for large screen computers. You will sit perhaps seven feet away from the screen, in a comfortable chair, with the keyboard and controls in your lap. Work will be easier and eyestrain (which is important) will decrease. Large screen computers will change the shape of office buildings and create their own new architecture. Office workers will spend much of their time in large-screen computer modules that are smaller than most private offices today, but more comfortable. A building designed around large-screen computers might have modules (for example) stacked in many levels around a central court; the column whose walls consist of stacked modules might spiral helically as it rises….

11. The Internet will never create a new economy based on voluntary instead of paid work — but it can help create the best economy in history, where new markets (a free market in education, for example) change the world. Good news! — the Net will destroy the university as we know it (except for a few unusually prestigious or beautiful campuses).  The net will never become a mind, but can help us change our ways of thinking and change, for the better, the spirit of the age. This moment is also dangerous: virtual universities are good but virtual nations, for example, are not. Virtual nations — whose members can live anywhere, united by the Internet — threaten to shatter mankind like glass into razor-sharp fragments that draw blood. We know what virtual nations can be like: Al Qaeda is one of the first.

12. In short: it’s time to think about the Internet instead of just letting it happen.


13. The traditional web site is static, but the Internet specializes in flowing, changing information. The “velocity of information” is important — not just the facts but their rate and direction of flow. Today’s typical website is like a stained glass window, many small panels leaded together. There is no good way to change stained glass, and no one expects it to change. So it’s not surprising that the Internet is now being overtaken by a different kind of cyberstructure.

14. The structure called a cyberstream or lifestream is better suited to the Internet than a conventional website because it shows information-in-motion, a rushing flow of fresh information instead of a stagnant pool.

15. Every month, more and more information surges through the Cybersphere in lifestreams — some called blogs, “feeds,” “activity streams,” “event streams,” Twitter streams. All these streams are specialized examples of the cyberstructure we called a lifestream in the mid-1990s: a stream made of all sorts of digital documents, arranged by time of creation or arrival, changing in realtime; a stream you can focus and thus turn into a different stream; a stream with a past, present and future. The future flows through the present into the past at the speed of time.

16. Your own information — all your communications, documents, photos, videos — including “cross network” information — phone calls, voice messages, text messages — will be stored in a lifestream in the Cloud.

17. There is no clear way to blend two standard websites together, but it’s obvious how to blend two streams. You simply shuffle them together like two decks of cards, maintaining time-order — putting the earlier document first. Blending is important because we must be able to add and subtract in the Cybersphere. We add streams together by blending them. Because it’s easy to blend any group of streams, it’s easy to integrate stream-structured sites so we can treat the group as a unit, not as many separate points of activity; and integration is important to solving the information overload problem. We subtract streams by searching or focusing. Searching a stream for “snow” means that I subtract every stream-element that doesn’t deal with snow. Subtracting the “not snow” stream from the mainstream yields a “snow” stream. Blending streams and searching them are the addition and subtraction of the new Cybersphere.

18. Nearly all flowing, changing information on the Internet will move through streams. You will be able to gather and blend together all the streams that interest you. Streams of world news or news about your friends, streams that describe prices or auctions or new findings in any field, or traffic, weather, markets — they will all be gathered and blended into one stream. Then your own personal lifestream will be added. The result is your mainstream: different from all others; a fast-moving river of all the digital information you care about.

19. You can turn a knob and slow down your mainstream: less-important stream-elements will flow past invisibly and won’t distract you, but will remain in the stream and appear when you search for them. You can rewind your lifestream and review the past. If an important-looking document or message sails past and you have no time to deal with it now, you can copy the document or message into the future (copy it to “this evening at 10,” say); when the future arrives, the document appears again. You can turn a different knob to make your fast-flowing stream spread out into several slower streams, if you have space enough on your screen to watch them all. And you can gather those separate streams back together whenever you like.

20. Sometimes you will want to listen to your stream instead of watching it (perhaps while you’re driving, or sitting through a boring meeting or lecture). Software will read text aloud, and eventually will describe pictures too. When you watch your high-definition TV, you might let the stream trickle down one side of the screen, so you can stay in touch with your life.

21. It’s simple for the software that runs your Lifestream to learn about your habits; simple to figure out which emails (for example), or social updates, or news stories, you are likely to find important and interesting. It will therefore be easy for software to highlight the stream elements you’re apt to find important, and let the others rush by quickly without drawing your attention.

22. Lifestreams will make it even easier than it is today for software to learn the details of your life and predict your future actions. The potential damage to privacy is too large and important a problem to discuss here. Briefly, the question is whether the crushing blows to privacy from many sources over the last few decades will make us crumple and surrender, or fight harder to protect what remains.

23. The Internet’s future is not Web 2.0 or 200.0 but the post-Web, where time instead of space is the organizing principle — instead of many stained-glass windows, instead of information laid out in space, like vegetables at a market — the Net will be many streams of information flowing through time. The Cybersphere as a whole equals every stream in the Internet blended together: the whole world telling its own story. (But the world’s own story is full of private information — and so, unfortunately, no human being is allowed to hear it.)

24. Ten years ago I wrote about the growing importance of lifestreams. Last year, the technology journalist Erik Schonfeld asked in a news story whether a certain large company “can take the central communication model of social networks — the lifestream — and pour it back into its IM clients.” (The story was headlined “Bebo Zeroes In On Lifestreaming For The Masses.”) “Lifestreaming” is a word that is now used generically, and streams are all over the net. Ten years ago I described the computer of the future as a “scooped-out hole in the beach where information from the Cybersphere wells up like seawater.”  Today the spread of wireless coverage and the growing power of mobile devices means that information does indeed well up almost anywhere you switch on your laptop or cellphone; and “anywhere” will be true before long.

25. From which we learn that (a) making correct predictions about the technology future is easy, and (b) writers should remember to put their predictions in suitably poetic language, so it’s easy to say they were right.

25. If we think of time as orthogonal to space, a stream-based, time-based Cybersphere is the traditional Internet flipped on its side in digital space-time. The traditional web-shaped Internet consists (in effect) of many flat panels chaotically connected. Instead of flat sites, where information is arranged in space, we want deep sites that are slices of time. When we look at such a site onscreen, it’s natural to imagine the past extending into (or beyond) the screen, and the future extending forward in front of the screen; the future flows towards the screen, into the screen and then deeper into the space beyond the screen.

26. The Internet is no topic like cellphones or videogame platforms or artificial intelligence; it’s a topic like education. It’s that big. Therefore beware: to become a teacher, master some topic you can teach; don’t go to Education School and master nothing. To work on the Internet, master some part of the Internet: engineering, software, computer science, communication theory; economics or business; literature or design. Don’t go to Internet School and master nothing. There are brilliant, admirable people at Internet institutes.   But if these institutes have the same effect on the Internet that education schools have had on education, they will be a disaster.


27. Returning to our fundamental riddle: if this is the information age, what do our children know that our parents didn’t?  The answer is “now.” They know about now.

28. Internet culture is a culture of nowness. The Internet tells you what your friends are doing and the world news now, the state of the shops and markets and weather now, public opinion, trends and fashions now. The Internet connects each of us to countless sites right now — to many different places at one moment in time.

29. Nowness is one of the most important cultural phenomena of the modern age: the western world’s attention shifted gradually from the deep but narrow domain of one family or village and its history to the (broader but shallower) domains of the larger community, the nation, the world. The cult of celebrity, the importance of opinion polls, the decline in the teaching and learning of history, the uniformity of opinions and attitudes in academia and other educated elites — they are all part of one phenomenon. Nowness ignores all other moments but this. In the ultimate Internet culture, flooded in nowness like a piazza flooded in sea water, drenched in a tropical downpour of nowness, everyone talks alike, dresses alike, thinks alike.

30. As I wrote at the start of this piece, no moment in technology history has ever been more exciting or dangerous than “now.” As we learn more about now, we know less about then. The Internet increases the supply of information hugely, but the capacity of the human mind not at all.  (Some scientists talk about artificially increasing the power of minds and memories — but then they are no longer talking about human beings. They are discussing some new species we know nothing about. And in this field, we would be fools to doubt our own ignorance.)  The effect of nowness resembles the effect of light pollution in large cities, which makes it impossible to see the stars. A flood of information about the present shuts out the past.

31. But — the Internet could be the most powerful device ever invented for understanding the past, and the texture of time.  Once we understand the inherent bias in an instrument, we can correct it. The Internet has a large bias in favor of now. Using lifestreams (which arrange information in time instead of space), historians can assemble, argue about and gradually refine timelines of historical fact. Such timelines are not history, but they are the raw material of history. They will be bitterly debated and disputed — but it will be easy to compare two different versions (and the evidence that supports them) side-by-side. Images, videos and text will accumulate around such streams. Eventually they will become shared cultural monuments in the Cybersphere.

32. Before long, all personal, familial and institutional histories will take visible form in streams.   A lifestream is tangible time:  as life flashes past on waterskis across time’s ocean, a lifestream is the wake left in its trail. Dew crystallizes out of the air along cool surfaces; streams crystallize out of the Cybersphere along veins of time. As streams begin to trickle and then rush through the spring thaw in the Cybersphere, our obsession with “nowness” will recede, the dykes will be repaired and we will clean up the damaged piazza of modern civilization.


33. Anyone who has ever looked through a telescope at the moon close-up has seen it drift out of sight as the earth slowly spins. In the future, the Cybersphere will drift too: if you have investigated one topic long enough for your attention to grow slack and your mind to wander, the Net will respond by letting itself drift slowly into new topics, new domain: not ones with obvious connections to the topic you’ve been studying; new topics that have deep emotional connections to the previous ones, connections that will no doubt make sense only to you.

34. The Internet today is, after all, a machine for reinforcing our prejudices. The wider the selection of information, the more finicky we can be about choosing just what we like and ignoring the rest. On the Net we have the satisfaction of reading only opinions we already agree with, only facts (or alleged facts) we already know. You might read ten stories about ten different topics in a traditional newspaper; on the net, many people spend that same amount of time reading ten stories about the same topic. But again, once we understand the inherent bias in an instrument, we can correct it. One of the hardest, most fascinating problems of this cyber-century is how to add “drift” to the net, so that your view sometimes wanders (as your mind wanders when you’re tired) into places you hadn’t planned to go. Touching the machine brings the original topic back. We need help overcoming rationality sometimes, and allowing our thoughts to wander and metamorphose as they do in sleep.

35. Pushing the multi-mega-ton jumbo jet of human thought-style backwards a few inches, back in the direction of dream logic, might be the Internet’s greatest accomplishment. The best is yet to be.

Source Credits – David Gelernterhttp://www.edge.org/3rd_culture/gelernter10/gelernter10_index.html

IVR – INFORMATION VISUALIZATION AND REPRESENTATION – 3D SECURITY?

In MILITARY SECURITY on July 6, 2010 at 8:08 pm

Information visualization and representation is defined as those capabilities employed to view, or make visible,
an abstraction of information using physical techniques that include those processing capabilities used to present a
data abstraction in a clear and appropriate manner.

In the future, information will be presented in a manner that is easy to comprehend quickly at any level of decision
making and in a presentation style chosen by the user. This capability will be available for individual or group
presentation, without requiring users to have knowledge of the underlying IS structure or internal activities. ISs will
collect, monitor, and protect information with such accuracy and reliability that the user is confident of the quality of
the data representation and accepts it as a basis for decision making.
The underlying ISs will contain an ability to initiate automated self-protection, automated maintenance and
repair, and automated disaster detection and recovery. This will be done in a reliable, self-checking and selfdeconflicting
fashion. When users are presented displays constructed from within an IS, they will have confidence in
the validity of these displays.
Data and analytic presentation will be rapid and inexpensive so that multiple users can simultaneously access
and inquire about the same information while residing at different locations and using quite different viewer style
preferences. Rapid “what-if” analyses will be processed simultaneously, without interference or delay to others
engaged in similar inquiry.

RATIONALE
Decision making in a military situation can be based upon manifold, interdependent (although not obviously
so) events or situations occurring anywhere in the world. Analyses and correlation of event content may require a
search through substantial amounts of data maintained in different formats distributed across memory located in different,
geographically distant systems. Decision makers will not be required to be sophisticated technologically or be
expected to initiate or define the details of inquiry methodology. Decision support data will be made rapidly available
to command authorities. A numeric data credibility level will be declared as a component of the results of each
inquiry.
Decision makers need analytic results of event correlation to be presented in a fashion congruent with their own
personal mode of thinking and understanding. Genetic variation creates humans who process information in quite
discordant dominant modes and in different combination’s of visual, quantitative, or verbal preference. To reduce misunderstanding,
ambiguity, or delay in forming a combat decision, data presentation styles will include a selective
capability to accommodate those individual preferences. A variety of scenario options that can be explored automatically
by the IS and presented in summary form will be available. Decision makers will be able to select and view
any desired level of detail upon voice command. Uttering an oral request will modify presentation scale. Analyses
will be initiated on request by pointing to a remote graphic, map, chart, or table displayed on a wall using a lightpen
or wand.

There may be a need for real-time gathering of information with ongoing specialized analyses, based not only
upon requested information but also upon algorithmically derived scenarios offered for optional consideration by the
decision maker. The IS will be able to present a projection of the consequences of actions currently being employed
and in progress. For example, the viewer could be presented with possible results of the current course of action,
based upon automatic algorithmically derived options. Combat is always less than predictable and infested with surprise.
This real-time analytic capability does not ensure the outcome, but it does improve a capability to discover
errors while sufficient time remains to intervene, recover, or support a stressed force.
In the future, many decision makers will become immersed in their information environment by using a 3-D
representation, such as holographic imaging or VR capabilities. The 3-D presentations will be appropriate for use by
individuals and groups. In some situations, robots will be employed to represent individuals acting in a scenario.
Individuals will not have to be collocated physically to participate but will appear to other participants in surrogate
likeness or simulation. This capability will compensate for situations with personnel limitations.
In addition to use in decision making, these presentation capabilities will be used for training and in a variety
of other aspects of military preparation

Follow

Get every new post delivered to your Inbox.