Raise Your Hand If. Todays Cybersecurity Risks. June 14, WBA BOLT Summer Leadership Summit 1. May 4, 2018

Transcription

1 WEALTH ADVISORY OUTSOURCING AUDIT, TAX, AND CONSULTING Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC registered investment advisor Todays Cybersecurity Risks May 4, 2018 Raise Your Hand If 2 WBA BOLT Summer Leadership Summit 1

2 Ten Ways to Lose EVERYTHING Ways to Lose EVERYTHING 1. Users clicking links 4 WBA BOLT Summer Leadership Summit 2

3 10 Ways to Lose EVERYTHING 2. Users clicking links 5 10 Ways to Lose EVERYTHING 3. Users clicking links 6 WBA BOLT Summer Leadership Summit 3

4 10 Ways to Lose EVERYTHING 4. Users clicking links 7 10 Ways to Lose EVERYTHING 5. Users clicking links 8 WBA BOLT Summer Leadership Summit 4

5 10 Ways to Lose EVERYTHING 6. Users clicking links 9 10 Ways to Lose EVERYTHING 7. Users clicking links 10 WBA BOLT Summer Leadership Summit 5

6 10 Ways to Lose EVERYTHING 8. Users clicking links Ways to Lose EVERYTHING 9. Users clicking links 12 WBA BOLT Summer Leadership Summit 6

7 10 Ways to Lose EVERYTHING 10. Users opening attachments 13 CLAconnect.com Thank you! Randy Romes, CISSP, CRISC, MCP, PCI QSA Principal, Information Security, Direct: linkedin.com/company/ cliftonlarsonallen facebook.com/ cliftonlarsonallen twitter.com/ CLAconnect youtube.com/ CliftonLarsonAllen WBA BOLT Summer Leadership Summit 7

8 Current State of Cybercrime What are the Bad Guys Doing? 15 Current State of Cybercrime All about the Benjamins Theft of personally identifiable information (PII) Payment fraud Ransomware Hacking is run like a business where people specialize in different areas 16 WBA BOLT Summer Leadership Summit 8

9 The Cost Global cybercrime cost businesses up to: $400 BILLION annually Some estimate it will reach: $2.1 TRILLION by Theft of PII Every organization stores information about their employees in electronic format Payroll/Tax/W2 address Many store other sensitive data Credit card information Health information 18 WBA BOLT Summer Leadership Summit 9

10 Marketplace for Stolen Credit Cards Attackers buy and sell data on cyber black market The Dark Web Similar to amazon.com 19 Payment Fraud Every organization interacts with their bank electronically Wire transfers & ACH payments Online banking Corporate Account Take Over (CATO) Compromise accounts/credentials that can move money 20 WBA BOLT Summer Leadership Summit 10

11 Payment Fraud Can occur via technical means Attackers hack into finance computers Banking Trojans monitor online banking Create fake employees in payroll/ach file Can occur via non technical means Social engineering Coerce employee to send money E.g. Fake CEO s cost businesses BILLIONs over last 3years 21 CATO Lawsuits UCC Electrical Contractor vs. Bank > $300,000 stolen via ACH through CATO Internet banking site was down DOS? Contractor asserting bank processed bogus ACH file without any call back Escrow Company vs. Bank > $400,000 stolen via single wire through CATO Escrow company passed on dual control offered by the bank Court ruled in favor of bank Company s attorneys failed to demonstrate bank s procedures were not commercially reasonable 22 WBA BOLT Summer Leadership Summit 11

12 A Unique CATO Example EXAMPLE 1 3 Customer accounts Adam and Beth Accounts compromised previously No changes Joe Account compromised PII Changed New/replacement debit card ordered Account to account transfers initiated (to Joe account) Funds removed from Joe account EXAMPLE 2 3 Customer accounts Mike and Sue Accounts compromised previously No changes Ann New account set up with minimal funds Customer to customer transfers initiated (to Ann account) Funds removed from Ann account Unique twist related to Core Conversion 23 Ransomware 24 WBA BOLT Summer Leadership Summit 12

13 Ransomware Cryptolocker, Locky, WannaCry, etc. Encrypts all data, holds in ransom for $$ Data on local machine and on network Can affect non Windows OS (e.g. Mac) 25 Lessons Learned When I Hacked a (you fill in the blank) 26 WBA BOLT Summer Leadership Summit 13

14 Attacking a Mortgage Company Performing Reconnaissance Who s who in the company? Gather addresses Understand what services are exposed to the Internet Webmail VPN PACS 27 Attacking a Health Care Company 28 WBA BOLT Summer Leadership Summit 14

15 Attacking a Foundation 29 Attacking a CPA Firm 30 WBA BOLT Summer Leadership Summit 15

16 Attacking a Community Bank Let s Go Phishing Determine what you want Remote access program Credential harvesting Impersonate an internal employee Most SPAM filters don t block this by default Much higher success rate 31 Attacking a Hospital 32 WBA BOLT Summer Leadership Summit 16

17 Attacking a Farm Credit Association 33 Attacking a Law Firm 34 WBA BOLT Summer Leadership Summit 17

18 Attacking a Clinic 35 Attacking a Radiology Company 36 WBA BOLT Summer Leadership Summit 18

19 Attacking a Dentist Clinic 37 Attacking a. 38 WBA BOLT Summer Leadership Summit 19

20 What Does The Internet Perimeter Look Like (The Attack Surface) Externally Exposed Services Webmail VPN Helpdesk Portal VMware Desktop Clinical Studio Lexmark Diagnostic Viewer Merge PACS 39 We Are Inside Now What Do We Do Internal network access now what? Find sensitive information Most employees have direct access to sensitive info File shares and applications that are too open Elevate privileges Often find administrative privilege issues Abuse weak password policies 40 WBA BOLT Summer Leadership Summit 20

21 Password Cracking (I mean auditing ) Password Audit Total Number of passwords audited 855 Passwords cracked 794 Passwords that were all letters 63 Passwords that were all numbers 5 Passwords that were an English word 20 Passwords that were a word with numbers appended to it 200 Passwords that were the same as the username 6 Passwords that do not meet Windows complexity Password Cracking (I mean auditing ) 42 WBA BOLT Summer Leadership Summit 21

22 Strategies & Action Items How Can Organizations Protect Themselves 43 Strategies Our information security strategy should have the following objectives: Users who are aware and savvy Networks that are hardened and resistant to malware and attacks Resilience Capabilities: Monitoring, Incident Response, Testing, and Validation 44 WBA BOLT Summer Leadership Summit 22

23 Policies People, Rules and Tools What do we expect to occur? How do we conduct business? People Tools ` Rules Standards Based Change Management, based on a Governance or Compliance framework: FFIEC CIS Critical Controls PCI DSS 45 CIS/SANS Critical Controls security controls 46 WBA BOLT Summer Leadership Summit 23

24 Defined Standards 47 WBA BOLT Summer Leadership Summit 24