1. EVOLVING THREATS, VULNERABILITIES AND COUNTERMEASURES
Jean-Michel Kaoukabani
Byblos Bank GROUP
NOVEMBER 2017

2. OUTLINE MAJOR SECURITY INCIDENTS IN 2017
HACKERS V/S SECURITY PROFESSIONALS
BRIEF ON SECURITY STANDARDS/GUIDELINES AND NATIONAL REGULATIONS
RECOMMENDATIONS

3. HACKERS V/S SECURITY PROFESSIONALS

4. MAJOR SECURITY INCIDENTS 2017
Financial Sector
Major Large Data leaks (ex: EQUIFAX)
Nation-state cyber weapons leaked and used by criminals (ex: ETERNAL BLUE)
Biggest ransomware to date (WannaCry)
Macro Based Downloaders continue to evolve
Cyber Criminals continue to exploit vulnerabilities in websites to drop/spread malware
Software for attacks on ATMS
Cyber Criminals have shifted their focus to the Cryptocurrency industry for "quick profit“ and anonymity.
Specialized Threat Analysis and Protection (STAP) market is challenged by new obfuscation techniques

5. HACKERS V/S SECURITY PROFESSIONALS
Hackers act very fast
Date
User Nickname: Embedi
Published POC on github: Vulnerability CVE
Few hours later: Cobalt Cybercrime Group conducted mass sending a malicious attachment
Domain names cards-cbr <dot> ru was registered 21/11/2017 (the day of sending)
Hackers are security aware and innovative
Most of financial companies have SPF, DKIM and DMARC set on their domains and use SMTP/TLS
Analysis of technical headers show that attackers avoid spoofing techniques. Instead they hack companies that are in most of the cases partners of SWIFT, Microsoft, Oracle IBM ... and send the malicious s from these hacked domains.

6. HACKERS V/S SECURITY PROFESSIONALS
Security Companies are slow
It takes long for AV or security companies to identify malware or malicious/infected Domains.
2 days after

7. HACKERS V/S SECURITY PROFESSIONALS
Security Companies lack information
We identify on a daily basis arsenals of Malicious contents available on the internet and still unknown by AV & Security Intelligence providers. We know where they are posted and their analysis allows us to understand what they do!
Forensic analysis led by Byblos Bank Forensic team
CLEAN 
BAD 

8. SECURITY STANDARDS/GUIDELINES

9. LEBANESE BANKING SECTOR REGULATIONS
Circular 123- Business Continuity Plan
Circular 69- Electronic Banking and Financial Operations
Circular 222- IT security Guidelines
Circular 272- IT Security in banks and Financial Institutions
Circular Auditors reports of Banks (Internal Control)
Memo 2012/9 - Security measures related to ATMs

10. BUT HACKERS ARE FAST AND HIGHLY SKILLED
STANDARDS, REGULATIONS, FRAMEWORKS, GUIDELINES OR BEST PRACTICES HELP US BUILD OUR DEFENSE SYSTEMS.
BUT HACKERS ARE FAST AND HIGHLY SKILLED
Everyone is vulnerable and no one is 100% safe
WHAT CAN WE DO T0 FILL THE GAP

11. RECOMMENDATIONS UNITY MAKES STRENGTH
Anti-Virus companies started to share malware info (ex: Cyber Threat Alliance)
GCC Experience: UAE UBF launched recently the ISAC
SWIFT ISAC sharing security info and IOCs with their customers
LEBANESE FINANCIAL INSTITUTIONS
National ISAC is needed
Should be moderated by an independent trustworthy party (EX: BDL or ABL)

12. THANK YOU