1. The information in this presentation is marked as:
29/12/2018
The information in this presentation is marked as:
Protection level
eu-LISA PUBLIC
04/04/17 • IEBN Business Network Event

2. Ransomware The human factor 29/12/2018
04/04/17 • IEBN Business Network Event
Protection level
eu-LISA PUBLIC

3. 29/12/2018
Digital extortion

4. Anatomy of the digital extortion
29/12/2018
Anatomy of the digital extortion
Different families of ransomware
Lifecycle includes: infection, installation, handshake with C², encryption
Infections through the web or s
Might require the active participation of the victims

5. Phishing is the tool Use of the emotion (fear, curiosity, greediness)
29/12/2018
Phishing is the tool
Use of the emotion (fear, curiosity, greediness)
it can affect our ability to think critically
Impact the decision making process
Force you to click

6. 29/12/2018
Coinbase phishing

7. 29/12/2018
UPS Phishing

8. 29/12/2018
RSA phishing

9. Awareness in eu-LISA Technology alone cannot keep you safe
29/12/2018
Awareness in eu-LISA
Technology alone cannot keep you safe
Systematic security briefing for the personnel (the weakest link)
Security is a shared responsibility
Keep company and employees safe
Phishing is a real threat

10. Awareness in eu-LISA Critical thinking Is the sender someone I know?
29/12/2018
Awareness in eu-LISA
Critical thinking
Is the sender someone I know?
Was the awaited?
Are the requests reasonable?
Does it trigger any emotion?
Does it request to take an (immediate) action?

11. Hover links through emails
29/12/2018
Awareness in eu-LISA
Hover links through s
Move the mouse over the link
But DO NOT CLICK!
Reveals where the link wants you to go
Make sure it is a legitimate address

12. Awareness in eu-LISA URL Deciphering
29/12/2018
Awareness in eu-LISA
URL Deciphering
Attackers may buy domains that resemble the real domain
“–” instead of a “.” as a subdomain separator
Trusted- … secure- … is a different domain!

13. OhMyGod: I have clicked…
29/12/2018
Awareness in eu-LISA
OhMyGod: I have clicked…

14. Awareness in eu-LISA Report it using the designated channel
29/12/2018
Awareness in eu-LISA
Report it using the designated channel
Thank you approach (no blame)
Do not:
Forward the suspected
Copy and paste links
Delete the malicious

15. Policy and procedures Encourage safe behavior
29/12/2018
Policy and procedures
Encourage safe behavior
Use of corporate address
Where to store relevant information
Good, old, offline backups
Convenient way to report incidents

16. Liaise with relevant authorities
29/12/2018
Liaise with relevant authorities
CERTs
Law enforcement
Eu Agencies

17. 29/12/2018
The Hamletic doubt
A loud no!
But…

18. The Hamletic doubt A loud no (in principle)
29/12/2018
The Hamletic doubt
A loud no (in principle)
The answer can be more complicated…

19. The Hamletic doubt Why do not:
29/12/2018
The Hamletic doubt
Why do not:
No guarantee that you will have your files back
You would support the organised crime
You would encourage perpetrators do continue
As a good payer, you will be targeted soon again

20. The Hamletic doubt But that is not how the world works!
29/12/2018
The Hamletic doubt
But that is not how the world works!
What if restoring costs more that the ransom?
Life or death matter (medical systems)
Business critical systems
Btw, how do we buy bitcoins?

21. 29/12/2018
Conclusions
Malware is not pastime for youngsters, it’s a real business!
Phishing/malware is going to continue to be a problem
Phishing/malware education in the security awareness program
Develop a response program

22. Conclusions Understand regulatory reporting requirement
29/12/2018
Conclusions
Understand regulatory reporting requirement
Have a ransom strategy
Exercise it!
Whatever is the ransom strategy, plan ahead!

23. 29/12/2018
QUESTIONS?