Class 8 The State of Cybercrime Today- Threads & Solutions

Webinars on State of Cybercrime Today The top trends in Cybercrime today & how they are manifesting themselves in different market sectors Where cybercrime is coming from The business impact of cybercrime and the primary concerns Why these criminals are so successful What is wrong with various aspects of security today (people, process, technology, etc.) Effective solutions to combat cybercrime

Cybercrime continues to grow in scope and scale, with losses to consumers and businesses across numerous sectors in many countries. Speakers: Brent Conran, CISA, CISM, CCSE, CISSP, CSO, McAfee Lisa O’Connor, Senior Executive, Accenture Security Practice Eddie Schwartz, CISA, CISM, PMP, CISSP, ISSEP, VP and CISO, RSA Cybercrime-Today-Threats-and-Solutions.aspx

Discussion Q & A New cyber security trend in mobility. How does mobility affect cyber security? What is the projected # of malware application on android & IOS models? What is Hacktivism? What is Ransomware- Account takeover of high value accounts (blitzkrieg, Citadel ) – Criminals are leveraging big data to increase effectiveness of attacks & sophistication of analytics in data minding Why does Cybercrime pays today? – There is no justice system in place today to prosecute. No threat to prosecution What is weaponization? – Stuknet, Saudi Arabia Ramco (80% sys down). What industry are more of a target? – Critical infrastructure, intellectual property, banking, healthcare, manufacturing, etc. What is the business impact? – Risk to brand, reputation, intellectual property loss, nationalize infrastructure due to cyber security issue The questions is not WHO but WHEN will you going to be attack

What are the biggest obstacles to security? – Privacy and education, need M2M communication as appose to P2P communication. P2P is too slow to react to crime. Enterprise do security & not enough compliance How do Security folks get Executive’s attention to give resources to prevent Cyber crime? – Communication skills, put a valuation on program effectiveness, have a plan ready to get the $, deconstruct bits/bite to understandable business language, use of visualizations to show the impact (tableau tool) Should Security be outside of IT? No! What are some of the technology failures today? Why are the criminals winning? – Over focus on compliance vs security – Security on-clays- identify intellectual property moving it deeper in the infrastructure (defense-in-depth) – You Can’t security everything. There needs to be degrees of risks & security applied to inventoried assets ( classifications) – Current environment don’t have an identity broker across the internet-De- facto way to authenticate across the network. – Security basics are not prevalent everywhere

What are End user concerns such as spear fishing attracts? – End user don’t care or may care but there is Persistent Advance Threats (PAT)to try to put bad stuff on the devices to then taking info off the devices. – Adaptive authentication ( where U coming from, bio metric) “People are the new perimeter” – Training users to be more sensitive to security. Feedback to end-users real-time – (context sensitive training) – Use tools to check-in your device for the right security posture What is the Holy Grail of Security? – Internal Controls Who has this responsibility – Everybody is responsible. Business leaders needs to partner with Security to make it work-collaborative approach – Integrate security control into the key business process. – Seek help from the expert on security when you are a small firm

What can you do to be secure? – Training – Get the experts to help set the right security posture – Have a strategy for mobility & cloud – Subnet the architecture (defense-in-depth) – Data classifications (protect high-value assets) What is the approach for the Cloud? – Define the type of cloud you use (IAS, ASS, etc.) – Have an internal cloud. Migration of virtualization to internal cloud to hybrid cloud. Sm org. will go all cloud – Have an EXIT strategy for when you need to bring intellectual property back in-house – Understand the services you are getting- have an SLA. – Carefully select what you want to put on cloud – Understand risks and what is covered & not in the cloud