The impact of -borne threats Why companies should recognise and embrace the need for change.

Phishing Attacks per Year Source: RSA (2014)

Phishing Campaigns per Year Source: APWG (2013)

Reality Check Source: APWG (2013) Change in measurement methodology 300% increase

Phishing sites reported to association or vendor Phishing sites reported to other bodies Phishing sites not reportedPhishing s sentOther -borne threats The Thin End of the Wedge

Why is Accurate Measurement Important? “To measure is to know… If you cannot measure it, you cannot improve it.” Lord Kelvin

New measurement Upstream ISPs Getting Upstream for Accurate Measurement Current measurementDownstream vendors Data filters Fuller picture

Upstream insights

Full Spectrum of Threats Active ing Domains Non-Sending Domains Defensively Registered Domains

Full Spectrum of Threats Unaffiliated Domain Threats Direct Domain Threats Look-a-like Domains Subdomains of Another Domain Different Brands’ Domains Unaffiliated Domains Generic Domains Active ing Domains Non-Sending Domains Defensively Registered Domains

3D Vision 3 dimensions of threats: Nature of threat Size of attack Efficacy Combinations determine impact All data points available upstream Nature of threat Size of attack Efficacy

1 st Dimension: Nature of Threat Phishing (Direct Domain Threat) 419 (Unaffiliated Domain Threat)

1 st Dimension: Nature of Threat Malware (Direct or Unaffiliated Domain Threat?) Malware (Direct Domain Threat)

1 st Dimension: Nature of Threat Credit score spam (Direct Domain Threat) Pharma spam (Unaffiliated Domain Threat)

Different scams will concern different departments Prioritise based on impact to organisation Different threats have different remedies 1 st Dimension: Why Differentiate?

2 nd Dimension: Attack Size Getting upstream enables us to see how many s were sent in a given attack

Quantify risks Prioritise risks Justify the right investments Measure ROI 2 nd Dimension: Why Measure Attack Size?

3 rd Dimension: Efficacy Users decide what is good and what is bad, but don’t always get it right… ISPs decide what is good and what is bad, but don’t always get it right… Phishing Legitimate Phishing

3 rd Dimension: Efficacy Lots of inbox noise on a daily basis What happens today will affect what happens tomorrow

Quantify impact Prioritise risks Justify the right investments Measure ROI 3 rd Dimension: Why Measure Efficacy?

The Benefits of 3D Vision Upstream data enables accurate risk assessment Downstream metrics are inadequate: No visibility into size of attack No visibility into efficacy Upstream data enables us to see true impact Nature of threat Size of attack Efficacy

Fraud losses Call centre support Remediation: Site shutdown Reset accounts Credential recovery Investigation & reporting Malware  secondary losses Negative publicity Impact of Attack: Security Perspective

Impact of Attack: Reduced ROI of Program Attack start Attack end 90% average 58% low 32% drop

The pay-off

Addressing -borne threats

Traditional Approach to Phishing Prevention Impact Time Phishing Campaign Deployed Phish Site Takedown Phish Site

Phishing Prevention With Return Path Impact Time Phishing Campaign Deployed Phish Site Detected Phish Site Advanced Detection: Provides enhanced visibility into emerging threats. Proactive Blocking: Drives down the negative impact of phishing. Data Integration: Real-time URI data feeds facilitate faster takedown of malicious sites.

What can you do …

Build partnership plan between Security and Marketing Gain visibility into full spectrum of threats Leverage latest technologies to: Develop a holistic view of detection Proactively block fraudulent messages Increase the ROI on existing solutions 3-Step Plan to Effectively Manage Risk

Conclusions …

Old metrics are inadequate and incomplete New technologies offer “3D vision” It is not just a security concern … it must be enterprise-wide New technologies: Reduce fraud Improve performance of programs Conclusions

Ken Takahashi General Manager, Anti-Phishing Solutions Return Path Thank you