EVOLVING THREATS, VULNERABILITIES AND COUNTERMEASURES Jean-Michel Kaoukabani Byblos Bank GROUP NOVEMBER 2017

OUTLINE MAJOR SECURITY INCIDENTS IN 2017 HACKERS V/S SECURITY PROFESSIONALS BRIEF ON SECURITY STANDARDS/GUIDELINES AND NATIONAL REGULATIONS RECOMMENDATIONS

HACKERS V/S SECURITY PROFESSIONALS

MAJOR SECURITY INCIDENTS 2017 Financial Sector Major Large Data leaks (ex: EQUIFAX) Nation-state cyber weapons leaked and used by criminals (ex: ETERNAL BLUE) Biggest ransomware to date (WannaCry) Macro Based Downloaders continue to evolve Cyber Criminals continue to exploit vulnerabilities in websites to drop/spread malware Software for attacks on ATMS Cyber Criminals have shifted their focus to the Cryptocurrency industry for "quick profit“ and anonymity. Specialized Threat Analysis and Protection (STAP) market is challenged by new obfuscation techniques

HACKERS V/S SECURITY PROFESSIONALS Hackers act very fast Date 21-11-2017 User Nickname: Embedi Published POC on github: Vulnerability CVE 2017-11882 Few hours later: Cobalt Cybercrime Group conducted mass email sending a malicious attachment Domain names cards-cbr <dot> ru was registered 21/11/2017 (the day of email sending) Hackers are security aware and innovative Most of financial companies have SPF, DKIM and DMARC set on their domains and use SMTP/TLS Analysis of technical headers show that attackers avoid spoofing techniques. Instead they hack companies that are in most of the cases partners of SWIFT, Microsoft, Oracle IBM ... and send the malicious emails from these hacked domains.

HACKERS V/S SECURITY PROFESSIONALS Security Companies are slow It takes long for AV or security companies to identify malware or malicious/infected Domains. 2 days after

HACKERS V/S SECURITY PROFESSIONALS Security Companies lack information We identify on a daily basis arsenals of Malicious contents available on the internet and still unknown by AV & Security Intelligence providers. We know where they are posted and their analysis allows us to understand what they do! Forensic analysis led by Byblos Bank Forensic team CLEAN  BAD 

SECURITY STANDARDS/GUIDELINES

LEBANESE BANKING SECTOR REGULATIONS Circular 123- Business Continuity Plan Circular 69- Electronic Banking and Financial Operations Circular 222- IT security Guidelines Circular 272- IT Security in banks and Financial Institutions Circular 21 - Auditors reports of Banks (Internal Control) Memo 2012/9 - Security measures related to ATMs

BUT HACKERS ARE FAST AND HIGHLY SKILLED STANDARDS, REGULATIONS, FRAMEWORKS, GUIDELINES OR BEST PRACTICES HELP US BUILD OUR DEFENSE SYSTEMS. BUT HACKERS ARE FAST AND HIGHLY SKILLED Everyone is vulnerable and no one is 100% safe WHAT CAN WE DO T0 FILL THE GAP

RECOMMENDATIONS UNITY MAKES STRENGTH Anti-Virus companies started to share malware info (ex: Cyber Threat Alliance) GCC Experience: UAE UBF launched recently the ISAC SWIFT ISAC sharing security info and IOCs with their customers LEBANESE FINANCIAL INSTITUTIONS National ISAC is needed Should be moderated by an independent trustworthy party (EX: BDL or ABL)

THANK YOU