1. Emerging Trends: Cyber Threats Bryan Sheppard Cyber Security Defense Center

2. Overview  Industry Threat Data  Understanding an Attack  Recent Data Breaches  Sony  Anthem  White House

3. The U.S intelligence community regards cyber as the top threat facing the country, ahead of terrorism and weapons of mass destruction. - Financial Services Roundtable, citing James Clapper, Director of National Intelligence

4. Emerging Trends: 2015 Verizon Breach Report  Demographics  Public  Technology/Information  Financial Services  Secondary Victim  Less time to compromise than to discover the compromise  Information Sharing is Critical  Few Attack Patterns  Phishing  Vulnerabilities

5. Understanding an Attack: Setting the Stage  You work for a large financial services company, Jackson Financial, that has billions of dollars in assets and hundreds of employees.  The Black Knight has the motive to put your assets at risk, but are you safe?  In order to protect yourself, you need to understand the risks.

6. Vulnerability Impact Risk Threat Understanding an Attack: What Is My Risk

7. Understanding an Attack: Motivation ATTACK

8. Understanding an Attack: Reconnaissance The following information from all of these searches/ queries stands out to the Black Knight: - Jackson Financials web site is: www.jacksonfinancial.com - Two email addresses seem interesting:  JJames@jacksonfinancial.com  JJefferson@jacksonfinancial.com - After checking LinkedIn we know that John James is a developer and that Jill Jefferson is a finance manager at Jackson Financial - John James has posted several questions on a developer web site using his JJames@jacksonfinancial.com email address. Some of these questions include source code. - Including the following line, jdbc:mysql://wopr:3306/ - CEO, Austin Millbarge - amillbarge@jacksonfinancial.com - CTO, Carl Spackler - cspackler@jacksonfinancial.com

9. Understanding an Attack: Catching the Phish

10. Understanding an Attack: Catch of the Day Someone must be very unhappy with their job! One of the users must have attempted to open the attached Google Jobs.pdf. After only 30 minutes from sending the Phish our Black Knight gets a remote shell to a workstation!

11. Understanding an Attack: Going After the Big Phish

12. Understanding An Attack: Setting the Hook

13. Understanding an Attack: Reeling Them In Connects to https://vpn.jacksonfinancial.com User id: cspackler@jacksonfina ncinal.com cspackler@jacksonfina ncinal.com Password: Caddy_Shack Uses Score!

14. Understanding an Attack: Jackpot

15. Recent Data Breaches: Sony  What: Stolen company data and emails  Company systems rendered useless  How: Phishing  Insider  Malware: Wiper  Who: Guardians of Peace (North Korea)  Why: The Interview (a really bad movie)  Costs: $100 Million ($35 Million in IT repairs)

16. Recent Data Breaches: White House  What: Data breach of unclassified network  Sensitive Data was stolen  President’s schedule  How: Phishing  Not Hillary Clinton’s secret email  Who: Russia  Why: Putin doesn’t like us  Could their be other data?  Linked to Chase?  NATO Hack  Costs: Nothing monetary has been revealed, but what’s next?

17. Recent Data Breaches: Anthem  What: Data breach of up to 80 Million customer records  How: Phishing  The attacker hacked a public facing administrative website and obtained admin credentials.  The attacker queried the customer records database to download all its PII information, including SSNs, names, addresses etc.  The attacker then exfiltrated all of this sensitive data by uploading a file to a personal cloud storage service account.  Who: China?  Why: Not sure. Some of the data has been linked to tax fraud.  Identity theft  Costs: Still growing – Could it pass $100 Million?  Class action lawsuits in 3 states

18. Takeaways  Most Breaches are Preventable  Attacks continue to increase  Understand the Risks  Be Aware  Think Before You Click  Know Where Your Data Is  Google yourself  When in Doubt Don’t

19. Questions? Bryan Sheppard bryan.sheppard.hn4n@statefarm.com Twitter: @sithlordshep Cyber Security Defense Center