The Third Wave of Hacking Cyber-Crime as a Service Thomas Bennett CEO, ThreatSTOP Inc. Board Director, Dragos Former Board Director, Cylance Former Executive Chairman, Veracity Security Lia 1

What Actually Happens Now Gain Access. Physical AND Logical– employees, vendors, or hackers for hire. Learn the Procedures. Eavesdrop to understand the business processes. Gain Privileges. Keylogging, Process Hijacking, and Entitlements. Steal. Old/static receiver accounts used, steal from correspondent accounts. Distract Responders. Mask activities with DDOS–to obfuscate the crime(s). Cover Their Tracks. Employ log filtering and/or wipe files or systems used. Launder. Transfer funds through varied routes from local to remote banks. Cash Out. Convert to cryptocurrencies, or direct transfers to payees. Malware is a Tool Distraction and Obfuscation are Tactics Fraud and Theft are Techniques

The Evolution of Cyber Threats “Cybercrime-for-hire business appears to be so lucrative and booming that hacker gangs can't keep their crews staffed” -Bank Info Security, September 14 2016

Phase of Cyber Threats PHASE 1: Business Interruption Disrupt continuity of business (technology) for competitive (social, economic, financial) purposes; also distract from efforts to probe and penetrate networks.  PHASE 2: APT (Advanced Persistent Threat) Activities Gain and maintain access in order to observe, document/record, and catalog access and information as a commodity service offering.  PHASE 3: Extortion/Fraud/Theft Subscribe to access that others have already gained (hackers for hire or MAAS/BAAS catalog operators –aka “CAAS”) to perpetrate financial and economic crimes. Utilize technology as tools to distract investigators.

Phase 1 3-Phase construct and content courtesy of Dr. Shane Shook

Phase 2 3-Phase construct and content courtesy of Dr. Shane Shook

Phase 3 3-Phase construct and content courtesy of Dr. Shane Shook

We are well into the Third Wave… Where’s it coming from? Portugal, Russia, Netherlands, the U.K. and Iceland

Think of it as Angie’s List for hacking services

Think of it as Angie’s List for hacking services This is a Growth Industry!

What a sophisticated CAAS attack looks like SWIFT (Global Payment Network) Content courtesy of Dr. Shane Shook

Cybersecurity Disclosure Act 0f 2017 First introduced in 2015 Requires companies to include in their SEC disclosures to investors whether anyone on the company's board is a cyber security expert. If such an expert does not exist, the company must disclose how it plans to mitigate the lack of expertise on the board.  Initially targeted at publicly traded companies, but… Realities of Government Regulations Regulations take a life of their own, and tend to be supported and given immortality by fines Witness General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679): 2-4% Gross Revenues Things of a certain kind flow downhill, and private companies will be in the cross-hairs

Thank You Thomas (Tom) Bennett e: tom@cyberdirector.org LinkedIn: https://www.linkedin.com/in/thomasbennett101

NACD Texas TriCities Chapter Thank you for attending! To download materials from past programs, please visit http://utah.NACDonline.org/Resources/meeting.cfm Register for our programs at utah.NACDonline.org Chapter Administrators: Julie Pitts, Regional Director, jpitts@NACDonline.org Heather May, Chapter Administrator, heather.may@NACD-Utah.org 5/14/13 Driving and Surviving with the Next Generation at Work | Houston, Texas