The information in this presentation is marked as: 29/12/2018 The information in this presentation is marked as: Protection level eu-LISA PUBLIC 04/04/17 • IEBN Business Network Event

Ransomware The human factor 29/12/2018 04/04/17 • IEBN Business Network Event Protection level eu-LISA PUBLIC

29/12/2018 Digital extortion www.itvscience.com

Anatomy of the digital extortion 29/12/2018 Anatomy of the digital extortion Different families of ransomware Lifecycle includes: infection, installation, handshake with C², encryption Infections through the web or emails Might require the active participation of the victims

Phishing is the tool Use of the emotion (fear, curiosity, greediness) 29/12/2018 Phishing is the tool Use of the emotion (fear, curiosity, greediness) it can affect our ability to think critically Impact the decision making process Force you to click

29/12/2018 Coinbase phishing

29/12/2018 UPS Phishing

29/12/2018 RSA phishing

Awareness in eu-LISA Technology alone cannot keep you safe 29/12/2018 Awareness in eu-LISA Technology alone cannot keep you safe Systematic security briefing for the personnel (the weakest link) Security is a shared responsibility Keep company and employees safe Phishing is a real threat

Awareness in eu-LISA Critical thinking Is the sender someone I know? 29/12/2018 Awareness in eu-LISA Critical thinking Is the sender someone I know? Was the email awaited? Are the requests reasonable? Does it trigger any emotion? Does it request to take an (immediate) action?

Hover links through emails 29/12/2018 Awareness in eu-LISA Hover links through emails Move the mouse over the link But DO NOT CLICK! Reveals where the link wants you to go Make sure it is a legitimate address

Awareness in eu-LISA URL Deciphering 29/12/2018 Awareness in eu-LISA URL Deciphering Attackers may buy domains that resemble the real domain “–” instead of a “.” as a subdomain separator Trusted- … secure- … is a different domain! http://secure-YOURBANK.com

OhMyGod: I have clicked… 29/12/2018 Awareness in eu-LISA OhMyGod: I have clicked…

Awareness in eu-LISA Report it using the designated channel 29/12/2018 Awareness in eu-LISA Report it using the designated channel Thank you approach (no blame) Do not: Forward the suspected email Copy and paste links Delete the malicious email

Policy and procedures Encourage safe behavior 29/12/2018 Policy and procedures Encourage safe behavior Use of corporate email address Where to store relevant information Good, old, offline backups Convenient way to report incidents

Liaise with relevant authorities 29/12/2018 Liaise with relevant authorities CERTs Law enforcement Eu Agencies

29/12/2018 The Hamletic doubt A loud no! But…

The Hamletic doubt A loud no (in principle) 29/12/2018 The Hamletic doubt A loud no (in principle) The answer can be more complicated…

The Hamletic doubt Why do not: 29/12/2018 The Hamletic doubt Why do not: No guarantee that you will have your files back You would support the organised crime You would encourage perpetrators do continue As a good payer, you will be targeted soon again

The Hamletic doubt But that is not how the world works! 29/12/2018 The Hamletic doubt But that is not how the world works! What if restoring costs more that the ransom? Life or death matter (medical systems) Business critical systems Btw, how do we buy bitcoins?

29/12/2018 Conclusions Malware is not pastime for youngsters, it’s a real business! Phishing/malware is going to continue to be a problem Phishing/malware education in the security awareness program Develop a response program

Conclusions Understand regulatory reporting requirement 29/12/2018 Conclusions Understand regulatory reporting requirement Have a ransom strategy Exercise it! Whatever is the ransom strategy, plan ahead!

29/12/2018 QUESTIONS?