Taking on Tomorrow's Challenges Today Taking on Tomorrow's Challenges Today Almost every organisation has been attacked …. But most don’t know about it! 13 th February 2013

What are we going to cover … Why should I care? What is going on out there – and do you really know what is going in your estate? What can I do? Questions?

Hands up – if you trust the security of your IT systems? Do you feel safe?…

1.Breach of Bar Council Guidelines on Information Security and thus the Data Protection Act Barristers have to work around current IT performance / device limitations 3.ICO attempting to place a fine of £500,000 and the associated bad press ”The policies and procedures of my chamber, not only guarantees, but enforces me and my colleagues to be in breach of the Bar Council Guidelines and the Data Protection Act!!!!” What do legal folk worry about, when it comes to IT security?

How are they getting in so easily?...

ClientServer Clients Environment

Clients environment

Accessing a compromised (hacked) website ClientServer Full control of the client

Compromised Server Client’s command shell with user’s permission Run commands Found a “protect” folder Inside the “protect” folder, a confidential.txt The content is confidential A closer look at the attack

The content is confidential Checking user’s information and domain Discovered Active Directory IP address Discovered user’s privilege in the domain A closer look at the attack Compromised Server

Legitimate website, but compromised Runs a Java exploit and starts a Fake AV Fake AV disables firewall, real AV, installs keylogger and hides. Finally creates beacon to C&C server and adds the system to a botnet A common attack – is to just replace the security products on the desktop

Client examples Financial ServicesPublic SectorTelecomUK Retailer  Global think tank  Results in 2 weeks of monitoring of one office with 80 users: ▪ 9 Infections (11%) including one zero- day attack ▪ 6 Unique malware types ▪ 5 Successful Call Backs  Top 100; Fortune 500  Results in 2 weeks of monitoring of one office with over 750 employees, covering most of the IT administrators: ▪ 120+ endpoints infected (16%) ▪ ~7k callbacks detected ▪ 15 unique types of malware  2000 Outlets  Results in 3 weeks monitoring communication out of a single UK datacentre: ▪ 34 endpoints infected ▪ 8 Callbacks detected with 2 successful to German C&Cs ▪ 6 unique types of malware  Over $150B in assets  Results from 2 weeks of monitoring of one office with 600 users: ▪ 6 Infections (Help desk, Back Office and a Fund Manager) ▪ Unique malware types ▪ Successful callbacks detected Is the Legal sector a target? …

Overview 4 - “Rule 702 of the Code of Conduct states:... must preserve the confidentiality of the lay client's affairs...” Overview 6 - “The use of the term "should" in these guidelines refers to good practice,.....; a general practice which deviates is unlikely to be acceptable.” Overview 8 - “Monetary penalties of up to £500,000 may be imposed Such penalties may not be covered by professional indemnity insurance.” Overview 18 – Regular Scans and keep operating systems up to date Overview 19 – Take care to avoid infection Overview 20 – All passwords should be 9 characters and contain at least 3 out of 4 (Upper, Lower, Number, Symbols) Overview 23 – Encrypt portable media Overview 24 – Encrypt disk and folders (when used at home) Overview 28 – Encrypt Overview 30 – If PDA, smartphone is used for , strong password and encryption should be used Overview 31/34 – EU / storage providers should be used Overview 33 – Assure 3 rd party providers Overview 40 – Retention of PII should be reviewed regularly Overview 42 – Strong Disposal What is the Bar Council Guidelines on InfoSec…

Text Firewalls NGFW WAF IPS Secure Web Gateways Anti-Spam Gateways Network DLP Host IDS HostEncryption Peirmeter Malware Protection HostAV Host DLP HostApplicationControl Anti- DDOS Info. Rights Encryption NAC and I&AM Patch Management Security Information Event Management Information Security Response (including forensics) Governance, Risk, and Compliance Management Security Testing, Vulnerability Management & Assurance Security Awareness Cloud Encryption Appliances MDM and BYOD Security Organisations need a comprehensive Security Architecture, with the professionals to operate it

3 Make everyone aware and make them care Encrypt, Encrypt and then Encrypt some more (31) Monitor your IT estate – incidents can escalate very quickly 1 2

16 But don’t forget the basics... Data IdentifyAssessAddressControl

Questions?