1. The Third Wave of Hacking Cyber-Crime as a Service
Thomas Bennett
CEO, ThreatSTOP Inc.
Board Director, Dragos
Former Board Director, Cylance
Former Executive Chairman, Veracity Security
Lia 1

2. What Actually Happens Now
Gain Access. Physical AND Logical– employees, vendors, or hackers for hire.
Learn the Procedures. Eavesdrop to understand the business processes.
Gain Privileges. Keylogging, Process Hijacking, and Entitlements.
Steal. Old/static receiver accounts used, steal from correspondent accounts.
Distract Responders. Mask activities with DDOS–to obfuscate the crime(s).
Cover Their Tracks. Employ log filtering and/or wipe files or systems used.
Launder. Transfer funds through varied routes from local to remote banks.
Cash Out. Convert to cryptocurrencies, or direct transfers to payees.
Malware is a Tool
Distraction and Obfuscation are Tactics
Fraud and Theft are Techniques

3. The Evolution of Cyber Threats
“Cybercrime-for-hire business appears to be so lucrative and booming that hacker gangs can't keep their crews staffed”
-Bank Info Security, September

4. Phase of Cyber Threats PHASE 1: Business Interruption
Disrupt continuity of business (technology) for competitive (social, economic, financial) purposes; also distract from efforts to probe and penetrate networks. 
PHASE 2: APT (Advanced Persistent Threat) Activities
Gain and maintain access in order to observe, document/record, and catalog access and information as a commodity service offering. 
PHASE 3: Extortion/Fraud/Theft
Subscribe to access that others have already gained (hackers for hire or MAAS/BAAS catalog operators –aka “CAAS”) to perpetrate financial and economic crimes. Utilize technology as tools to distract investigators.

5. Phase 1
3-Phase construct and content courtesy of Dr. Shane Shook

6. Phase 2
3-Phase construct and content courtesy of Dr. Shane Shook

7. Phase 3
3-Phase construct and content courtesy of Dr. Shane Shook

8. We are well into the Third Wave…
Where’s it coming from?
Portugal, Russia, Netherlands, the U.K. and Iceland

9. Think of it as Angie’s List for hacking services

10. Think of it as Angie’s List for hacking services
This is a Growth Industry!

11. What a sophisticated CAAS attack looks like
SWIFT (Global Payment Network)
Content courtesy of Dr. Shane Shook

13. Cybersecurity Disclosure Act 0f 2017
First introduced in 2015
Requires companies to include in their SEC disclosures to investors whether anyone on the company's board is a cyber security expert.
If such an expert does not exist, the company must disclose how it plans to mitigate the lack of expertise on the board. 
Initially targeted at publicly traded companies, but…
Realities of Government Regulations
Regulations take a life of their own, and tend to be supported and given immortality by fines
Witness General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679): 2-4% Gross Revenues
Things of a certain kind flow downhill, and private companies will be in the cross-hairs

14. Thank You Thomas (Tom) Bennett e: tom@cyberdirector.org
LinkedIn:

15. NACD Texas TriCities Chapter
Thank you for attending!
To download materials from past programs, please visit
Register for our programs at utah.NACDonline.org
Chapter Administrators:
Julie Pitts, Regional Director,
Heather May, Chapter Administrator,
5/14/13 Driving and Surviving with the Next Generation at Work | Houston, Texas