2014: the year so far in cyber security Brian Markham, Director Compliance and Risk Services Division of IT 10/8/2014
2013: What a year Snowden/NSA Revelations Target/Neiman Marcus breaches Security in the news!
Some things to keep in mind Clicks are king Consider the source Hack vs. breach vs. something else Hat color
Nothing is ever 100% secure!
Home Depot
What happened? April 2014 - September 2014 Malware was variant of BlackPOS used in Target attack
What was the impact? 56M credit and debit cards compromised Largest credit card breach in history Credit monitoring for all customers between April and September!
What did we learn? Home Depot’s security program could have been better Compliance ≠ Security Data breaches have a material impact on a company’s finances and reputation
iCloud Photo “Hack”
What happened? Apple’s iCloud service was exploitable through a common access control flaw Credentials were guessed, accounts accessed Personal photos and videos were leaked Apple corrected the flaw, improved overall iCloud security
What was the impact? Discussion of cloud security Discussion of cloud privacy Victim shaming Apple publicly defends their commitment to security and piracy
What did we learn? Use two-factor authentication Security questions = Insecurity questions Victims are victims
Heartbleed
What happened? A vulnerability was found in the OpenSSL cryptographic software library Exploited the heartbeat extension of OpenSSL’s TLS/DTLS Exploitation was not detectable CVE-2014-0160
What was the impact?
What was the impact?
What was the impact? Websites using OpenSSL 1.0.1 - 1.0.1f are vulnerable and needed to be upgraded to 1.0.1g Up to 66% of the web sites exposed (Apache and nginx) New certificates issued Panic!
What did we learn? Open source software has many benefits; perfect security not one of them! OSS needs support and resources, especially when widely used Asset management is important
Shellshock
What happened Bash is the default shell for Linux and Mac OS X CVE-2014-6271
What was the impact?
What did we learn?
University of Maryland
What happened? Attacker used pivot points to explore the UMD network Found something good Reset user credentials for administrators Smash and grab
What was the impact? 287,580 records of faculty, staff, students and affiliated personnel Five years of free credit monitoring 100,000 X $20 = $2M Total costs ~$10M
What did we learn? Educational institutions will continue to be a “soft” target for attackers Rapid response is key Know your data!
Content Management Systems (CMS)
What happened Vulnerabilities in popular content management systems Drupal, Joomla, and Wordpress
What was the impact?
What did we learn?
Summary Security is in the news now more than ever These are complicated, difficult problems; very different from traditional crime and security
Any Questions?