1 Cybersecurity and web-based attacks A perspective from Symantec Zoltan Precsenyi Government Affairs Manager International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

Agenda 2 About Symantec 1 The web: a powerful tool 2 Cyberattacks: the threat landscape 3 Future trends: growing challenges 4 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

3 About Symantec International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

Symantec™ Global Intelligence Network Identifies more threats, takes action faster & prevents impact Information Protection Preemptive Security Alerts Threat Triggered Actions Global Scope and Scale Worldwide Coverage 24x7 Event Logging Rapid Detection Attack Activity 240,000 sensors 200+ countries Malware Intelligence 133M client, server, gateways monitored Global coverage Vulnerabilities 40,000+ vulnerabilities 14,000 vendors 105,000 technologies Spam/Phishing 5M decoy accounts 8B+ messages/day 1B+ web requests/day Austin, TX Mountain View, CA Culver City, CA San Francisco, CA Taipei, Taiwan Tokyo, Japan Dublin, Ireland Calgary, Alberta Chengdu, China Chennai, India Pune, India 4 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

5 The web: a powerful tool International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

6 The web Cybercrime steadily growing International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

The web Underground Economy a soaring market Credit card information & bank account credentials still on top Big range in bulk prices for credit cards 7 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

The web Attack Kits Get a Caffeine Boost 8 Java exploits added to many existing kits Kits exclusively exploiting Java vulnerabilities appeared More Info: Detailed information available in ISTR Mid- Term: Attack Toolkits and Malicious WebsitesISTR Mid- Term: Attack Toolkits and Malicious Websites International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

9 The web Communication channel for criminals as well news.intelwire.com/2011/07/internet-provides-terrorists-with-tools.html CommunicateRecruit Equip Instruct International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

10 Cyberattacks: the threat landscape International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

11 Organized Crime Rings Well Meaning Insiders Malicious Insiders Extremists At this stage, terrorism is more a scenario than an actual incident Effective communication and money laundering tool that should not be interrupted Historically terrorism scenarios envisage cyber-attacks as amplifiers International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Threat Landscape The actors inside and outside

Symantec Internet Security Threat Report (ISTR), Volume Organized Criminal Well Meaning Insider Malicious Insider Disruption of critical infrastructure operations Large-scale DDoS attacks Malware outbreaks within protected networks Stealthy ex-filtration or unintended loss of confidential data Website defacing Threat Landscape The objectives information and/or infrastructure

13 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, Threat Landscape Asymmetric warfare small investment, big damage

14 Threat Landscape OSINT collection International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

Threat Landscape Social Networking + Social Engineering = Compromise 15 Hackers have adopted social networking – Use profile information to create targeted social engineering – Impersonate friends to launch attacks – Leverage news feeds to spread spam, scams and massive attacks Detailed review of Social Media threats available in The Risks of Social NetworkingThe Risks of Social Networking More Info: International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

16 EXFILTRATION Confidential data sent to hacker team in the clear, wrapped in encrypted packets or in zipped files with passwords 4 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Threat Landscape Targeted Attacks process

Threat Landscape Targeted Attacks evolution 17 High profile attacks in 2010 raised awareness of impact of APTs Stuxnet was incredibly sophisticated – Four zero-day vulnerabilities – Stolen digital signatures – Ability to “leap” the air gap with USB key – Potential damage to infrastructure Detailed review in the: W32.Stuxnet Dossier & W32.Stuxnet W32.Stuxnet DossierW32.Stuxnet More Info: International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

18 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Threat Landscape Malicious activity by country

93% increase in Web-based attacks from 2009 to 2010 Spikes related to specific activities (new attack kits, current events, etc.) 19 International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Threat Landscape Web based attacks on the rise

20 Future trends: growing challenges International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

21 TechnologyStrengthsWeaknesses Cloud Enhanced overall security capabilities: Detection Protection Backup and recovery Blurred individual security perimeter: Loss of control over certain assets Increased interdependencies New single points of failure Virtualisation Flexibility and efficiency: More resilient infrastructure Better use of hardware Enhanced interoperability Segregated tasks run on shared assets: Physical proximity between isolated virtual environments Higher exposure to more vulnerabilities Mobile Well, mobility: Access to data anytime, anywhere Federated identity management Better convergence between different communication channels Well, again, mobility: Lower security awareness and culture Cross-exposure of federated identities to vulnerabilities in one of them Increased risk of data loss through device loss International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Technology landscape Mega Trends

Threat Landscape 2010 Trends 22  Social Networking + social engineering = compromise  Attack Kits get a caffeine boost  Targeted Attacks continued to evolve  Hide and Seek (zero-day vulnerabilities and rootkits)  Mobile Threats increase International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011

23 Threat Landscape Attribution will remain an issue International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Who is behind the attack? What are their motives? Do you know? Can you be sure? Can you disclose the information? Should you? Can you respond? Should you? How?

Mind your people: Strong authentication for identity and access control Security awareness training Protect your devices: Advanced reputation security Device management Removable media control Harden your systems and networks: Vulnerability assessment Intrusion prevention and web gateway filtering 24 Protect your information: Encryption Data loss prevention Understand the threat in close to real time: Advanced reputation security Network threat and vulnerability monitoring Respond: Security incident management Back-up and recovery International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011 Security Landscape What you can do to protect your assets

Thank you! Copyright © 2010 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Thank you! 25 Zoltan Precsenyi International Conference on Terrorism and Democracy in the 21st Century, Budapest, September 29-30, 2011