IT Security Recent Data Breaches, Lessons Learned and Best Practices
|
|
- Chrystal Claribel McCormick
- 8 years ago
- Views:
Transcription
1 2014 CliftonLarsonAllen LLP IT Security Recent Data Breaches, Lessons Learned and Best Practices CLAconnect.com
2 Goals Review recent data breaches Highlight lessons learned 9 patterns of attacks Best practices
3 Recent Data Breaches 2014 CliftonLarsonAllen LLP
4 Recent Data Breaches Target 40 million debit and credit cards undetected for 3 weeks Home Depot possibly ~60 million debit and credit cards undetected for 5 months Community Health Systems - ~4.5 million patients data JP Morgan - 76 million households and 7 million small businesses Easy to share large volumes of data!
5 Recent Data Breaches Healthcare Aventura Hospital and Medical Center an employee improperly accessed 82,601 patient records Central Utah Clinic notifying 30,000+ patients of a potential data breach after discovering hacker s had accessed on of the clinic s servers Duke University Health System notified patients due to a stolen thumb drive that contained unencrypted patient names and physician names Memorial Hermann Health Systems notifying 10,000+ of a security breach due to an employee accessing unauthorized patient information St. Elizabeth s Medical Center notified patients of a potential data breach after a laptop and thumb drive were stolen from a physician s home Cedars-Sinai Medical Center in Los Angeles notified 500+ patients that their protected health information may have been compromised due to an unencrypted laptop being stolen from an employees home Beth Israel Deaconess Medical Center to pay $100K to settle data breach Beckers Health IT & CIO Report - Sept. 19, 2014
6 Recent Data Breaches Healthcare Notes 29.3 million - the number of patient health records compromised in a HIPAA data breach since 2009 Out of the 90,000+ HIPAA breach cases OCR has received since % have resulted in fines HHS Office for Civil Rights Director indicates that most HIPAA-covered entities fail to perform a comprehensive, thorough risk analysis and fail to apply the results of that analysis Healthcare IT News February 6, 2014 article HIPAA data breaches climb 138 percent
7 Recent Data Breaches General Costs 2014 Ponemon Institute Research Report Total Average Cost paid by organizations increased from $5.4M to $5.9M Average # of breached records is 29,087 Per Norton/Symantec Corp Cost of global cybercrime: $388 billion; Global black market in marijuana, cocaine and heroin: $288 billion Lost customers costs $$ to replace Lost reputation costs $$ to re-build brand 2014 Cost of Breach Studies: United States - Ponemon Research Institute: Norton Symantec Corp
8 Recent Data Breaches OCR Penalties New York and Presbyterian Hospital agreed to pay OCR $3,300,000 to settle potential violations by failing to secure thousands of patient s electronic protected health information (ephi) held on their network. Columbia University paid $1,500,000 for their part in the joint breach Parkview Health System has agreed to pay $800,000 and adopt a corrective action plan to correct deficiencies in its HIPAA compliance program in medical records dumping case Concentra Health Services agreed to pay $1,725,220 to settle potential violations after unencrypted laptop was stolen from one of its facilities. Concentra had taken steps to begin encryption but the efforts were incomplete and inconsistent over time 2014 HIPAA Enforcement Case Examples
9 Recent Data Breaches Health Hazards ECRI 2015 Top 10 Health Technology Hazards 2. Data integrity: Incorrect or missing data in electronic health records and other health IT systems 9. Cybersecurity: Insufficient protections for medical devices and systems ECRI Institute web-site press release - Technology-Hazards-for-2015.aspx
10 Recent Data Breaches - Target Target On December 19, 2013, Target publicly confirmed that 40 million credit and debit card accounts were exposed in a breach of its network Thieves were able to sell information from these cards via online black market forums known as card shops. These websites list card information including the card type, expiration date, track data (account information stored on a card s magnetic stripe), country of origin, issuing bank, and successful use rate for card batches over time COMMITTEE ON SCIENCE, COMMERCE AND TRANSPORTATION, MAJORITY STAFF REPORT FOR CHAIRMAN ROCKEFELLER, MARCH 26, 2014
11 Recent Data Breaches - Target Target Malware new variant of BlackPOS (a.k.a. Kaptoxa ), a malware strain designed to siphon data from cards when they are swiped at infected point-of-sale systems running Microsoft Windows KrebsonSecurity September 18, 2014
12 Recent Data Breaches - Target COMMITTEE ON SCIENCE, COMMERCE AND TRANSPORTATION, MAJORITY STAFF REPORT FOR CHAIRMAN ROCKEFELLER, MARCH 26, 2014 ; Krebs on Security Article Feb. 2014
13 Recent Data Breaches - Sony Day 1 - Nov 24 th All Sony computers receive a picture with an image of a skeleton with stylized long fingers and a message that indicates that the hackers have obtained all of their data and issues demands. Sony announces hack, global electronic operations are shut down. Hacker s have obtained 100 terabytes of Sony data Day 4 - Nov 27 th - Five Sony films, including four that had yet to be released, are dumped onto online file-sharing hubs. One was downloaded a million times Day 8 Dec 1 st Pre-bonus salaries of the top 17 Sony executives are leaked and 6000 current and former Sony employees are leaked Day 12 Dec 5 th Hackers threaten Sony employees Sign objection or you and your family will be in danger Day 22 Dec 16 Cyberterrorists threaten to attack movie theaters that show The Interview Deadline web-site -December 22,2014 article
14 Recent Data Breaches Physical Impact Cyber Attack Caused Damage at German Steel Mill (January 8, 2015) A report released in mid-december disclosed that a cyber attack on a German steel mill caused damage to the facility. The attackers disrupted the plant's control system to make it impossible to shut down a blast furnace properly. The damage was described as "massive," but no details were provided. This is the second documented case of a cyber attack causing physical damage - the first was Stuxnet. The report said that the attackers gained initial foothold in the system through the corporate network and worked their way from there to the production systems Wired Magazine Jan. 8 article A Cyber Attack has caused confirmed physical damage for the Second Time Ever by Kim Zetter via Jan. 13 SANS Institute NewsBite
15 Lessons Learned 2014 CliftonLarsonAllen LLP
16 How do hackers and fraudsters break in? Healthcare Social Engineering Phishing Spear Phishing Verizon Threat Landscape Healthcare Research Report4
17 How do hackers and fraudsters break in? Social Engineering Phishing Spear Phishing
18 The Fine Art of People Hacking Social Engineering uses non-technical attacks to gain information or access to technical systems: Pre-text telephone calls Hi, this is Randy from Comcast. I am working with Mike, and I need your help Building penetration Seeding attacks
19 Physical (Facility) Security Compromise the site: Hi, Joe said he would let you know I was coming to fix the printers Plant devices: Keystroke loggers Wireless access point Thumb drives ( Switch Blade ) Examples -Sumitomo Bank (2005) - -Barclays Bank (2013) -
20 Phishing attacks Phishing mostly used in espionage attacks targeting executives inevitability of the click 3 s to get a click!! Ands User needs to take action and Need a vulnerability and Software needs to be quietly installed and Needs a communication path back to attacker Verizon Data Breach Investigations Report (DBIR) 2013
21 Spear Phishing Second Generation phishing Goal is to root the network Install malware Log system activity to harvest passwords Use automated tools to execute fraudulent payments Trick users into supplying credentials (passwords)
22
23 3 Primary Motives for Attacks Financial Gain Organized-crime/worldwide Espionage/Intellectual Property (IP) China Hacktivism/activism Verizon Data Breach Investigation Report (DBIR) 2013
24 TrustWave Intrusion Analysis Report Top Methods of Entry Included: Top Methods of Entry Included: Remote Access Applications [45%] Default vendor supplied or weak passwords [90%] 3 rd Party Connections [42%] MPLS, ATM, frame relay SQL Injection [6%] Web application compromises [90%] Exposed Services [4%]
25 Attackers learning faster than Defenders In most cases, attackers needs hours to compromise (more then 75% of the cases) where the defenders rarely discover the compromise in less then months (only about 25% of the breaches are detected in days or less) More importantly, the attackers are getting better faster than the defenders are improving their skills and capabilities Verizon Data Breach Investigations Report (DBIR) 2014
26 NIST Authentication Factors Single-Factor Authentication something you know - - password Two-Factor Authentication something you physically have (i.e., a secure ID token or cell phone for Phone Factor authentication) Three-Factor Authentication something you are biometric authentication (retina, palm veins) 2 Factor is any 2 of the above NIST Special Special Publication Electronic Authentication December 2011
27 9 Key Patterns of Attacks Point-of-sale (POS) Intrusions Web App Attacks Insider Misuse Physical Theft/Loss Miscellaneous Errors Crimeware Card Skimmers DoS Attacks Cyber-espionage Verizon Data Breach Investigations Report (DBIR) 2014
28 9 Key Patterns of Attacks Physical Theft/Loss and Insider Misuse 46% of healthcare industry incidents are due to theft/loss 15% insider misuse 12% miscellaneous errors Verizon Data Breach Investigations Report (DBIR) 2014
29 9 Key Patterns of Attacks Point-of-sale (POS) Intrusions Brute force, 53% industry-wide; 9% healthcare Use of stolen vendor credentials, 38% Organized crime - Eastern Europe Verizon Data Breach Investigations Report (DBIR) 2014
30 Lessons Learned Boston Children s Hospital In reflecting on the Anonymous attack, the BCH CIO noted: Distributed Denial of Service (DDoS) countermeasures are crucial. BCH shut down all web-sites and . Staff communicated using a secure text messaging application the hospital had recently deployed. Know which systems depend on external Internet access. In BCH s event, the EHR system was spared, but the e-prescribing system wasn't Make no excuses when pushing security initiatives. Children's had to shut down , e-prescribing and external-facing websites quickly. Secure your teleconferences. Send your conference passcode securely, not in the body of your calendar invite. Separate signals from noise. CIO.com article Sep. 14,2014 How Boston Children s Hospital Hit Back at Anonymous
31 Lessons Learned Organizations need to increase their visibility into what's happening in their enterprises and focus on eliminating those cybersecurity blind spots," says Jason Mical, vice president of cybersecurity for AccessData. Many organizations simply don't have enough tech and security staff to notice these breaches when they occur Information Week Dark Reading Blog June 30, 2014
32 Risk Mitigation Best Practices 2014 CliftonLarsonAllen LLP
33 Overall Approach - TK 2 Train your people - Users and Executives who are knowledgeable and savvy Know your network Make your networks resistant to malware Segment your network Make it visible to Executive management Know your data - data first approach minimum necessary access are you a target
34 Kill Chain Method of Defense For Targeted Attacks Instead of installing static defense tools and waiting for the next attack, network defenders should continuously monitor their systems for evidence that attackers are trying to gain access to their systems. Defenders can use the intelligence they gather about an attacker s playbook to anticipate and mitigate future intrusions based on knowledge of the threat. When a defender analyzes the actions of attackers, finds patterns, and musters resources to address capability gaps, it raises the costs an adversary must expend to achieve their objectives... [and] such aggressors have no inherent advantage over defenders. Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains, Lockheed Martin (2011) (online at Paper-Intel-Driven-Defense.pdf)
35 Ten Keys to Mitigate Risks 1. Strong policies and training use, strong password requirements 2. Defined user roles and permissions minimum necessary 3. Hardened internal systems change default passwords, media limitations (CD, USB devices), disallow local admin rights on workstations
36 Ten Keys to Mitigate Risks 4. Encryption strategy mobile 5. Vulnerability management process patch and test 6. Well defined perimeter security layers: Know Your Network
37 Ten Keys to Mitigate Risks 7. Data classification strategies Know Your Data 8. Defined incident response plan and procedures 9. Centralized audit logging, analysis, and automated alerting capabilities 10. Test, Test, Test
38 Questions? Hang on, it s going to be a wild ride!! Kyle Conn, Manager Information Security Services Group kyle.conn@claconnect.com *** (704)
IT Security Risks & Trends
IT Security Risks & Trends Key Threats to All Businesses 1 1 What do the following have in common? Catholic church parish Hospice Collection agency Main Street newspaper stand Electrical contractor Health
More informationCybersecurity: Protecting Your Business. March 11, 2015
Cybersecurity: Protecting Your Business March 11, 2015 Grant Thornton. All LLP. rights All reserved. rights reserved. Agenda Introductions Presenters Cybersecurity Cybersecurity Trends Cybersecurity Attacks
More informationDefending Against Data Beaches: Internal Controls for Cybersecurity
Defending Against Data Beaches: Internal Controls for Cybersecurity Presented by: Michael Walter, Managing Director and Chris Manning, Associate Director Protiviti Atlanta Office Agenda Defining Cybersecurity
More informationInformation Security Addressing Your Advanced Threats
Information Security Addressing Your Advanced Threats Where We are Going Information Security Landscape The Threats You Face How To Protect Yourself This Will Not Be Boring What Is Information Security?
More informationData Breach Response Planning: Laying the Right Foundation
Data Breach Response Planning: Laying the Right Foundation September 16, 2015 Presented by Paige M. Boshell and Amy S. Leopard babc.com ALABAMA I DISTRICT OF COLUMBIA I FLORIDA I MISSISSIPPI I NORTH CAROLINA
More informationCybersecurity Governance Update on New FFIEC Requirements
Cybersecurity Governance Update on New FFIEC Requirements cliftonlarsonallen.com Our perspective CliftonLarsonAllen Started in 1953 with a goal of total client service Today, Professional Services Firm
More informationWhat s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
More information10 Smart Ideas for. Keeping Data Safe. From Hackers
0100101001001010010001010010101001010101001000000100101001010101010010101010010100 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000 0100101001001010010001010010101001010101001000000100101001010101010010101010010100000
More informationInformation Security and Risk Management
Information Security and Risk Management COSO and COBIT Standards and Requirements Page 1 Topics Information Security Industry Standards and COBIT Framework Relation to COSO Internal Control Risk Management
More informationIncident Response. Proactive Incident Management. Sean Curran Director
Incident Response Proactive Incident Management Sean Curran Director Agenda Incident Response Overview 3 Drivers for Incident Response 5 Incident Response Approach 11 Proactive Incident Response 17 2 2013
More informationI ve been breached! Now what?
I ve been breached! Now what? THE AFTERMATH OF A BREACH & STEPS TO REDUCE RISK The number of data breaches in the United States in 2014 hit a record high. And 2015 is not looking any better. There have
More informationPractice Good Enterprise Security Management. Presented by Laurence CHAN, MTR Corporation Limited
Practice Good Enterprise Security Management Presented by Laurence CHAN, MTR Corporation Limited About Me Manager Information Security o o o o Policy formulation and governance Incident response Incident
More informationProactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID
Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation By Marc Ostryniec, vice president, CSID The increase in volume, severity, publicity and fallout of recent data breaches
More informationSeptember 20, 2013 Senior IT Examiner Gene Lilienthal
Cyber Crime September 20, 2013 Senior IT Examiner Gene Lilienthal The following presentation are views and opinions of the speaker and does not necessarily reflect the views of the Federal Reserve Bank
More informationData Breach Lessons Learned. June 11, 2015
Data Breach Lessons Learned June 11, 2015 Introduction John Adams, CISM, CISA, CISSP Associate Director Security & Privacy 410.707.2829 john.adams@protiviti.com Powerful Insights. Proven Delivery. Kevin
More informationPresented by Evan Sylvester, CISSP
Presented by Evan Sylvester, CISSP Who Am I? Evan Sylvester FAST Information Security Officer MBA, Texas State University BBA in Management Information Systems at the University of Texas Certified Information
More informationCyber - Security and Investigations. Ingrid Beierly August 18, 2008
Cyber - Security and Investigations Ingrid Beierly August 18, 2008 Agenda Visa Cyber - Security and Investigations Today s Targets Recent Attack Patterns Hacking Statistics (removed) Top Merchant Vulnerabilities
More informationCybercrime and Regulatory Priorities for Cybersecurity
NRS Technology and Communication Compliance Forum Cybercrime and Regulatory Priorities for Cybersecurity Copyright 2014 by K&L Gates LLP. All rights reserved. Sean P. Mahoney sean.mahoney@klgates.com K&L
More informationBy: Gerald Gagne. Community Bank Auditors Group Cybersecurity What you need to do now. June 9, 2015
Community Bank Auditors Group Cybersecurity What you need to do now June 9, 2015 By: Gerald Gagne MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2015 Wolf & Company, P.C. Cybersecurity
More informationCybersecurity Issues for Community Banks
Eastern Massachusetts Compliance Network Cybersecurity Issues for Community Banks Copyright 2014 by K&L Gates LLP. All rights reserved. Sean P. Mahoney sean.mahoney@klgates.com K&L Gates LLP State Street
More informationAn New Approach to Security. Chris Ellis McAfee Senior System Engineer Chris_Ellis@McAfee.com
An New Approach to Security Chris Ellis McAfee Senior System Engineer Chris_Ellis@McAfee.com Advanced Targeted Attack Challenges Criminal Theft Sabotage Espionage After the Fact Expensive Public Uncertainty
More informationEndpoint & Server Protection. Brent Biernat First Vice President Network Services May 13, 2014
Endpoint & Server Protection Brent Biernat First Vice President Network Services May 13, 2014 The Evolution of Cyber Crime 1878 Bell Telephone Teenage Switchboard Operator Disconnected calls, eavesdropped,
More informationDissecting the Recent Cyber Security Breaches. Yu Cai School of Technology Michigan Technological University
Dissecting the Recent Cyber Security Breaches Yu Cai School of Technology Michigan Technological University Disclaimers Most information in this presentation was collected from various sources on the Internet.
More information2012 Data Breach Investigations Report
2012 Data Breach Investigations Report A study conducted by the Verizon RISK Team with cooperation from the Australian Federal Police, Dutch National High Tech Crime Unit, Irish Reporting & Information
More informationBuilding The Human Firewall. Andy Sawyer, CISM, C CISO Director of Security Locke Lord
Building The Human Firewall Andy Sawyer, CISM, C CISO Director of Security Locke Lord Confidentiality, Integrity, Availability Benchmarks of Cybersecurity: Confidentiality Information is protected against
More informationPerspectives on Cybersecurity in Healthcare June 2015
SPONSORED BY Perspectives on Cybersecurity in Healthcare June 2015 Workgroup for Electronic Data Interchange 1984 Isaac Newton Square, Suite 304, Reston, VA. 20190 T: 202-618-8792/F: 202-684-7794 Copyright
More informationDocument Imaging Solutions. The secure exchange of protected health information.
The secure exchange of protected health information. 2 Table of contents 3 Executive summary 3 The high cost of protected health information being at risk 4 The compliance officer s dilemma: keeping PHI
More informationTarget Security Breach
Target Security Breach Lessons Learned for Retailers and Consumers 2014 Pointe Solutions, Inc. PO Box 41, Exton, PA 19341 USA +1 610 524 1230 Background In the aftermath of the Target breach that affected
More informationSummary of the State of Security
Summary of the State of Security Tram Jewett, CISA CliftonLarsonAllen LLP Virginia GFOA Annual Spring Conference, 2016 1 1 Summary of the State of Security Tram Jewett, MS., CISA, 11 years IT audit and
More information1. Ask what your financial institution knows or has personally experienced with regard to internal and external data breaches.
Part 1: Internal & External Data Breach Vulnerabilities Presented on: Thursday, February 12, 2 3 ET Co presented by: Ann Davidson VP of Risk Consulting at Allied Solutions Joe Majka CSO at Verifone 1 Breakdown
More informationDATA SECURITY HACKS, HIPAA AND HUMAN RISKS
DATA SECURITY HACKS, HIPAA AND HUMAN RISKS MSCPA HEALTH CARE SERVICES SEMINAR Ken Miller, CPA, CIA, CRMA, CHC, CISA Senior Manager, Healthcare HORNE LLP September 25, 2015 AGENDA 2015 The Year of the Healthcare
More informationAnalyzing Security for Retailers An analysis of what retailers can do to improve their network security
Analyzing Security for Retailers An analysis of what retailers can do to improve their network security Clone Systems Business Security Intelligence Properly Secure Every Business Network Executive Summary
More informationCybersecurity Risks, Regulation, Remorse, and Ruin
Financial Planning Association of Michigan 2014 Fall Symposium Cybersecurity Risks, Regulation, Remorse, and Ruin Shane B. Hansen shansen@wnj.com (616) 752-2145 October 23, 2014 Copyright 2014 Warner Norcross
More informationHow To Stop A Cybercriminal From Stealing A Credit Card Data From A Business Network
2012 Payment Card Threat Report The second annual study of unencrypted payment card storage Automated Attacks and Card Data Handling In 2011, data breaches increased 42% and as such, last year was reported
More information2012 NCSA / Symantec. National Small Business Study
2012 NCSA / Symantec National Small Business Study National Cyber Security Alliance Symantec JZ Analytics October 2012 Methodology and Sample Characteristics JZ Analytics was commissioned by the National
More informationReal World Healthcare Security Exposures. Brian Selfridge, Partner, Meditology Services
Real World Healthcare Security Exposures Brian Selfridge, Partner, Meditology Services 2 Agenda Introduction Background and Industry Context Anatomy of a Pen Test Top 10 Healthcare Security Exposures Lessons
More informationSecurity of Payment Card Data on Cloud-Based Mobile Payment Platforms
Security of Payment Card Data on Cloud-Based Mobile Payment Platforms Randy Gainer ACI Forum on Emerging Payment Systems San Francisco March 22, 2013 Topics to be covered Cloud-based mobile payment solutions
More informationINVESTIGATIONS REPORT
2014 DATA BREACH INVESTIGATIONS REPORT Executive Summary INSIDER MISUSE DOS ATTACKS MISCELLANEOUS ERRORS PHYSICAL THEFT AND LOSS CYBER-ESPIONAGE CRIMEWARE PAYMENT CARD SKIMMERS WEB APP ATTACKS 92 % THE
More information2015 DATA BREACH INVESTIGATIONS REPORT
2015 DATA BREACH INVESTIGATIONS REPORT $400 MILLION The financial loss from 700 million compromised records shows the true impact of data breaches and the importance to manage risk. Conducted by Verizon
More informationInfoGard Healthcare Services. 2015 InfoGard Laboratories Inc.
InfoGard Healthcare Services 10 Steps To Protect My Covered Entity From Breach Your Presenters Alan Martin Account Manger Marvin Byrd Security Engineer Test and Certification Laboratory Healthcare Payment
More informationWHITE PAPER KEEPING CLIENT AND EMPLOYEE DATA SECURE DRIVES REVENUE AND BUILDS TRUST PROTECTING THE PROTECTOR
KEEPING CLIENT AND EMPLOYEE DATA SECURE DRIVES REVENUE AND BUILDS TRUST Protecting Identities. Enhancing Reputations. IDT911 1 DATA BREACHES AND SUBSEQUENT IDENTITY THEFT AND FRAUD THREATEN YOUR ORGANIZATION
More informationThe Evolution of Data Breaches
The Evolution of Data Breaches 2015 Data Privacy & Security Summit June 29, 2015 Mark Shelhart Incident Response & Forensics Retail Data Security recent victims The Largest Cyber Risks to your Organization
More informationSecurity Management. Keeping the IT Security Administrator Busy
Security Management Keeping the IT Security Administrator Busy Dr. Jane LeClair Chief Operating Officer National Cybersecurity Institute, Excelsior College James L. Antonakos SUNY Distinguished Teaching
More informationRetail Security: Enabling Retail Business Innovation with Threat-Centric Security.
Retail Security: Enabling Retail Business Innovation with Threat-Centric Security. 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco public information. (1110R) 1 In the past
More informationPayment Card Industry Data Security Standard Training. Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc.
Payment Card Industry Data Security Standard Training Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc. March 27, 2012 Agenda Check-In 9:00-9:30 PCI Intro and History
More informationPresentation for : The New England Board of Higher Education. Hot Topics in IT Security and Data Privacy
Presentation for : The New England Board of Higher Education Hot Topics in IT Security and Data Privacy October 22, 2010 Rocco Grillo, CISSP Managing Director Protiviti Inc. Quote of the Day "It takes
More informationINDUSTRY OVERVIEW: RETAIL
ii IBM MSS INDUSTRY OVERVIEW: RETAIL RESEARCH AND INTELLIGENCE REPORT RELEASE DATE: JANUARY 5, 215 BY: DAVID MCMILLEN, SENIOR THREAT RESEARCHER Copyright IBM Corporation 214. All rights reserved. IBM and
More informationCyber Security 2014 SECURE BANKING SOLUTIONS, LLC
Cyber Security CHAD KNUTSON SECURE BANKING SOLUTIONS 2014 SECURE BANKING SOLUTIONS, LLC Presenter Chad Knutson Senior Information Security Consultant Masters in Information Assurance CISSP (Certified Information
More informationInternet threats: steps to security for your small business
Internet threats: 7 steps to security for your small business Proactive solutions for small businesses A restaurant offers free WiFi to its patrons. The controller of an accounting firm receives a confidential
More informationCOMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION. A Kill Chain Analysis of the 2013 Target Data Breach
COMMITTEE ON COMMERCE, SCIENCE, AND TRANSPORTATION A Kill Chain Analysis of the 2013 Target Data Breach MAJORITY STAFF REPORT FOR CHAIRMAN ROCKEFELLER MARCH 26, 2014 Executive Summary In November and December
More informationFranchise Data Compromise Trends and Cardholder. December, 2010
Franchise Data Compromise Trends and Cardholder Security Best Practices December, 2010 Franchise Data Security Agenda Cardholder Data Compromise Overview Breach Commonalities Hacking Techniques Franchisee
More informationCommon Data Breach Threats Facing Financial Institutions
Last Updated: February 25, 2015 Common Data Breach Threats Facing Financial s Although exact figures are elusive, there is no question that the number of data security breaches both reported and unreported
More informationSESSION 507 Thursday, March 26, 11:15 AM - 12:15 PM Track: Desktop Support
SESSION 507 Thursday, March 26, 11:15 AM - 12:15 PM Track: Desktop Support Desktop Support and Data Breaches: The Unknown Dangers Bryan Hood Senior Solutions Engineer, Bomgar bhood@bomgar.com Session Description
More informationSound Business Practices for Businesses to Mitigate Corporate Account Takeover
Sound Business Practices for Businesses to Mitigate Corporate Account Takeover This white paper provides sound business practices for companies to implement to safeguard against Corporate Account Takeover.
More informationTop Five Data Security Trends Impacting Franchise Operators. Payment System Risk September 29, 2009
Top Five Data Security Trends Impacting Franchise Operators Payment System Risk September 29, 2009 Top Five Data Security Trends Agenda Data Security Environment Compromise Overview and Attack Methods
More informationChecklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security
Checklist for HIPAA/HITECH Compliance Best Practices for Healthcare Information Security Ali Pabrai, MSEE, CISSP (ISSMP, ISSAP) For Daily Compliance & Security Tips, Follow ecfirst @ Agenda Review the
More informationNetwork Security & Privacy Landscape
Network Security & Privacy Landscape Presented By: Greg Garijanian Senior Underwriter Professional Liability 1 Agenda Network Security Overview -Latest Threats - Exposure Trends - Regulations Case Studies
More informationGUIDE TO IMPROVING INFORMATION SECURITY IDENTIFYING WEAKNESSES & STRENGTHENING SECURITY
Penetration Testing: What You Need to Know Now GUIDE TO IMPROVING INFORMATION SECURITY IDENTIFYING WEAKNESSES & STRENGTHENING SECURITY PENETRATION TESTING: GUIDE TO IMPROVING INFORMATION SECURITY Contact
More informationImpact of Data Breaches
Research Note Impact of Data Breaches By: Divya Yadav Copyright 2014, ASA Institute for Risk & Innovation Applicable Sectors: IT, Retail Keywords: Hacking, Cyber security, Data breach, Malware Abstract:
More informationTime Is Not On Our Side!
An audit sets the baseline. Restricting The next steps Authenticating help prevent, Tracking detect, and User Access? respond. It is rare for a few days to pass without news of a security breach affecting
More informationTen Questions Your Board Should be asking about Cyber Security. Eric M. Wright, Shareholder
Ten Questions Your Board Should be asking about Cyber Security Eric M. Wright, Shareholder Eric Wright, CPA, CITP Started my career with Schneider Downs in 1983. Responsible for all IT audit and system
More informationKEY STEPS FOLLOWING A DATA BREACH
KEY STEPS FOLLOWING A DATA BREACH Introduction This document provides key recommended steps to be taken following the discovery of a data breach. The document does not constitute an exhaustive guideline,
More informationDATA BREACHES: WHEN COMPLIANCE IS NOT ENOUGH
DATA BREACHES: WHEN COMPLIANCE IS NOT ENOUGH Andy Watson Grant Thornton LLP. All rights reserved. CYBERSECURITY 2 SURVEY OF CHIEF AUDIT EXECUTIVES (CAEs) GRANT THORNTON'S 2014 CAE SURVEY Data privacy and
More informationCyber Essentials KAMI VANIEA 2
Cyber Essentials DR. KAMI VANIEA KAMI VANIEA 2 First, the news Office of Personnel Management http://www.usatoday.com/story/news/politics/2015/06/23/op m-hack-senate-archuleta-hearing/29153773/ KAMI VANIEA
More informationSeven Strategies to Defend ICSs
INTRODUCTION Cyber intrusions into US Critical Infrastructure systems are happening with increased frequency. For many industrial control systems (ICSs), it s not a matter of if an intrusion will take
More informationINDUSTRY OVERVIEW: FINANCIAL
ii IBM MSS INDUSTRY OVERVIEW: FINANCIAL RESEARCH AND INTELLIGENCE REPORT RELEASE DATE: NOVEMBER 5, 2014 BY: JOHN KUHN, SENIOR THREAT RESEARCHER iii TABLE OF CONTENTS EXECUTIVE OVERVIEW... 1 MAJOR FINANCIAL
More information2012 Bit9 Cyber Security Research Report
2012 Bit9 Cyber Security Research Report Table of Contents Executive Summary Survey Participants Conclusion Appendix 3 4 10 11 Executive Summary According to the results of a recent survey conducted by
More information2011 2012 Aug. Sept. Oct. Nov. Dec. Jan. Feb. March April May-Dec.
The OCR Auditors are coming - Are you next? What to Expect and How to Prepare On June 10, 2011, the U.S. Department of Health and Human Services Office for Civil Rights ( OCR ) awarded KPMG a $9.2 million
More information90% of health insurers surveyed have had a data breach 3. 72% increase in cyberattacks against healthcare companies occurred between 2013 and 2014 4
Health Savings Account (HSA) Data security and employee benefits providers by Elon Ginzburg, Information Security Officer, Wells Fargo Wholesale Banking Information security is a critical corporate responsibility.
More informationPresentation to ACC Charlotte. Data Security & Privacy. November 2, 2011. Presented by: William J. Cook C. Andrew Konia Mark J.
Presentation to ACC Charlotte Data Security & Privacy Presented by: November 2, 2011 William J. Cook C. Andrew Konia Mark J. Maier www.mcguirewoods.com Agenda Identifying the Issues/Concerns Current State/Impact
More informationThe Onslaught of Cyber Security Threats and What that Means to You
The Onslaught of Cyber Security Threats and What that Means to You No End in Sight for Cyber Crime Growth Number of mobile devices affected IBM Number of accounts hacked CNN Money Number of malware samples
More informationE-Virus in Six Cisco Routers
Name of the Project: e.g. Organization Development By Roland Cheung @HKCERT Agenda Malware Trend Security Risk on Industry Sector Case Study Security Mitigations Malware Trend Reason Fun Profit Direct
More informationCyber Security Management
Cyber Security Management Focusing on managing your IT Security effectively. By Anthony Goodeill With the news cycles regularly announcing a recurrently theme of targets of hacker attacks and companies
More informationIIABSC 2015 - Spring Conference
IIABSC 2015 - Spring Conference Cyber Security With enough time, anyone can be hacked. There is no solution that will completely protect you from hackers. March 11, 2015 Chris Joye, Security + 1 2 Cyber
More informationCurrent Trends in Cyber Crime & Payments Fraud cliftonlarsonallen.com
Current Trends in Cyber Crime & Payments Fraud cliftonlarsonallen.com Our perspective CliftonLarsonAllen Started in 1953 with a goal of total client service Today, industry specialized CPA and Advisory
More informationHoneywell Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Honeywell Process Solutions (HPS) June 4, 2014
Industrial Cyber Security Overview and Managed Industrial Cyber Security Services Process Solutions (HPS) June 4, Industrial Cyber Security Industrial Cyber Security is the leading provider of cyber security
More informationWho Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
More informationCYBERSECURITY HOT TOPICS
1 CYBERSECURITY HOT TOPICS Secure Banking Solutions 2 Presenter Chad Knutson VP SBS Institute Senior Information Security Consultant Masters in Information Assurance CISSP, CISA, CRISC www.protectmybank.com
More informationOutline. Outline. What is HIPAA? I. HIPAA Compliance II. Why Should You Care? III. What Should You Do Now?
Outline MOR-OF Education and Medical Expo August 23, 2014 Tatiana Melnik Melnik Legal PLLC tatiana@melniklegal.com 734-358-4201 Tampa, FL I. HIPAA Compliance II. Why Should You Care? A. Market Pressure
More informationData Breaches and Cyber Risks
Data Breaches and Cyber Risks Carolinas Credit Union League Leadership Conference Presented by: Ken Otsuka Business Protection Risk Management CUNA Mutual Group CUNA Mutual Group Proprietary Reproduction,
More informationNetwork/Cyber Security
Network/Cyber Security SCAMPS Annual Meeting 2015 Joe Howland,VC3 Source: http://www.information-age.com/technology/security/123458891/how-7-year-old-girl-hacked-public-wi-fi-network-10-minutes Security
More informationPayment Fraud Trends
2013 CliftonLarsonAllen LLP Payment Fraud Trends How to Protect my Business Customers from Payment and Corporate Account Take Over CLAconnect.com CliftonLarsonAllen Started in 1953 with a goal of total
More informationLessons Learned from Recent HIPAA and Big Data Breaches. Briar Andresen Katie Ilten Ann Ladd
Lessons Learned from Recent HIPAA and Big Data Breaches Briar Andresen Katie Ilten Ann Ladd Recent health care breaches Breach reports to OCR as of February 2015 1,144 breaches involving 500 or more individual
More informationTop Signs You re Prime for a Data Breach in 2014
Hacking Into Your Healthcare Systems Series Top Signs You re Prime for a Data Breach in 2014 PRESENTED BY: IronBox Data Protection Website: www.goironbox.com Email: contactus@goironbox.com About IronBox
More informationHow are we keeping Hackers away from our UCD networks and computer systems?
How are we keeping Hackers away from our UCD networks and computer systems? Cybercrime Sony's Hacking Scandal Could Cost The Company $100 Million - http://www.businessinsider.com/sonys-hacking-scandal-could-cost-the-company-100-million-2014-12
More informationMatthew Howes Senior Vice President, Strategic Services inventiv Digital+Innovation Matthew.Howes@inVentivHealth.com
WHITE PAPER Global Digital Security: The Human Element March 2014 Written by: Matthew Howes Senior Vice President, Strategic Services inventiv Digital+Innovation Matthew.Howes@inVentivHealth.com TABLE
More informationNine Network Considerations in the New HIPAA Landscape
Guide Nine Network Considerations in the New HIPAA Landscape The Health Insurance Portability and Accountability Act of 1996 (HIPAA) Omnibus Final Rule, released January 2013, introduced some significant
More informationNationwide Review of CMS s HIPAA Oversight. Brian C. Johnson, CPA, CISA. Wednesday, January 19, 2011
Nationwide Review of CMS s HIPAA Oversight Brian C. Johnson, CPA, CISA Wednesday, January 19, 2011 1 WHAT I DO Manage Region IV IT Audit and Advance Audit Technique Staff (AATS) IT Audit consists of 8
More information2014: A Year of Mega Breaches
2014: A Year of Mega Breaches Sponsored by Identity Finder Independently conducted by Ponemon Institute LLC Publication Date: January 2015 Ponemon Institute Research Report Part 1. Introduction 2014: A
More informationSECURITY TERMS: Advisory Backdoor - Blended Threat Blind Worm Bootstrapped Worm Bot Coordinated Scanning
SECURITY TERMS: Advisory - A formal notice to the public on the nature of security vulnerability. When security researchers discover vulnerabilities in software, they usually notify the affected vendor
More informationCyber- Attacks: The New Frontier for Fraudsters. Daniel Wanjohi, Technology Security Specialist
Cyber- Attacks: The New Frontier for Fraudsters Daniel Wanjohi, Technology Security Specialist What is it All about The Cyber Security Agenda ; Protecting computers, networks, programs and data from unintended
More informationData Security for the Hospitality
M&T Bank and SecurityMetrics Present: Data Security for the Hospitality Industry Featuring Lee Pierce, SecurityMetricsStrategicStrategic Accounts Dave Ellis, SecurityMetrics Forensic Investigator Doug
More informationPresented by: Mike Morris and Jim Rumph
Presented by: Mike Morris and Jim Rumph Introduction MICHAEL MORRIS, CISA Systems Partner JIM RUMPH, CISA Systems Manager Objectives To understand how layered security assists in securing your network
More informationDon t Fall Victim to Cybercrime:
Don t Fall Victim to Cybercrime: Best Practices to Safeguard Your Business Agenda Cybercrime Overview Corporate Account Takeover Computer Hacking, Phishing, Malware Breach Statistics Internet Security
More informationExternal Supplier Control Requirements
External Supplier Control s Cyber Security For Suppliers Categorised as Low Cyber Risk 1. Asset Protection and System Configuration Barclays Data and the assets or systems storing or processing it must
More informationSecurity & Compliance, Sikich LLP
Mark Shelhart, CFI, CISSP, QSA Security & Compliance, Sikich LLP 1. Credit card breaches 2. Disgruntled IT, bad leaver 3. Personal records breach 4. Vendor network connections (and contracts) 5. Everything
More informationSmall Firm Focus: A Practical Approach to Cybersecurity Friday, May 29 9:00 a.m. 10:15 a.m.
Small Firm Focus: A Practical Approach to Cybersecurity Friday, May 29 9:00 a.m. 10:15 a.m. Topics: Explain why it is important for firms of all sizes to address cybersecurity risk. Demonstrate awareness
More informationTop Fraud Trends Facing Financial Institutions
Top Fraud Trends Facing Financial Institutions Presented on: October 7, 2015, 2-3 ET Presented by: Ann Davidson - VP of Risk Consulting at Allied Solutions Webinar Agenda 1. Fraud trends in 2015 and beyond
More informationPractical Steps To Securing Process Control Networks
Practical Steps To Securing Process Control Networks Villanova University Seminar Rich Mahler Director, Commercial Cyber Solutions Lockheed Martin Lockheed Martin Corporation 2014. All Rights Reserved.
More informationCybercrime: risks, penalties and prevention
Cybercrime: risks, penalties and prevention Cyber attacks have been appearing in the news with increased frequency and recent victims of cybercrime have included well-known companies such as Sony, LinkedIn,
More information