Cyber Horizon Whats Next. E.J. Hilbert Managing Director Decmeber 2014

Transcription

1 Cyber Horizon Whats Next E.J. Hilbert Managing Director Decmeber 2014

2 About the Speaker Managing Director Kroll Advisory Solutions- Head of Cyber Investigations for EMEA President of Online Intelligence- A cyber security and investigative firm specializing in social media and online advertising schemes, scams and crimes. Director of Security Enforcement for MySpace Responsible for addressing all security concerns related to MySpace, its systems and its users. FBI Special Agent- Specialized in White Collar Crime, Cyber Crime and Counter- Terrorism. Notable cases are Treason charges against Adam Gadahn aka Azzam Al Amriki, FBI.gov intrusion, Carderplanet takedown/cardkeeper, and Invita/Flyhook: the Alexey Ivanov case. High school Teacher and Coach- History, Science, Baseball, Basketball and Cross Country Got my first computer at 12yrs old, a Commodore 64, upgraded later to an Apple IIe Consultant on TV shows, movies and books, various media coverage including MSNBC, BBC, ITV, CNN, Financial Times, Rolling Stone, WSJ, Wired, Gizmodo and others

3 What is Cyber? Cyber is defined as: - relating to or characteristic of the culture of computers, information technology, and virtual reality - relating to electronic communications networks and virtual reality REALLY?!? Truth is, cyber is marketing term. The issue is protecting the information you have. Cyber is anything involving a computer, data, mobile device or Internet Cyber is Data and its Processing» Data is power and all data is valuable to someone» Stopping the flow equals stopping business Cyber is the people and equipment for data processing» These are the real world components Cyber is Life» There is no part of life that does not have a cyber component.

4 What are Cyber/Digital Risks? Cyber risks can be broken into four sub categories: Cyber Crime- Computer-enabled attacks for profit or gain Cyber Espionage- Long term data spying for various reasons Cyber Warfare- Destruction of Critical Infrastructure Activism Attacks to embarrass or discredit

5 Which Of Those Affect You? Crime What data do you have and what is it worth on the market? Internal vs External fraud What about your supply chain/contractors Can your systems be used against others Espionage Who wants what you know Disruption Indication of a slow bleed? Do you have contracts others might want to exploit? Warfare What is the effect of taking you offline What is your BC/DR plan Resiliency technical, commercial and reputation Activism Who are you haters Why Do you have data that can be used against others What is your company s social profile

6 Initial Thoughts EMEA is 3-5 yrs. behind the US in threat awareness and 5-7 yrs. behind the bad guys 93% of UK companies were attacked in 2013 Most hacks are compromises of user accounts not hacking into the system 85% of people use the same password on all accounts- Passwords are a keyring Top victim is professional services firm Top scam is the Fake CEO/Fake Invoice from a compromised account User data privacy is the biggest consumer concern and they want transparency of uses

7 What does the future hold? Legislation Mandates with little business understanding Managed Services Companies offering to do it all Attacks Less Tech more Social

8 Legislation 2015 EU Data Protection Act» Requires disclosure» Penalty up to 2% worldwide turnover Spain requires cyber security policy for all companies» Italy and Germany to follow suit German law wants to break up Google» Fear of data collection and use US new cyber security standard UK CERT and BofE cyber rules Who is advising? Practitioners, Business Users or Policy Writers

9 Business Approach Cyber Security is the largest growth industry All companies are looking for the magic pill their woes» Hardware» Software» People» In House or Outsource Product and Services Line» Creating a one-stop shop

10 Attacks Harden systems equal weaker people Personal Attacks on Corporate clients Recent Examples-» CNBC, Forbes, NHL, etc» Ebay» Apple icloud Data is the commodity

11 How to prepare Proactive Assessments» What do you have» Where is it» Who has access» Is it monitored Education» Crime methodology» Crime Avoidance» Then Company Policy

12 Questions you need to be able to answer Who specifically is responsible for information security within your company and your supply chain? What company data is the most valuable, who has access to it and why? Who decides who has access to what information within your company? Can you see what is coming into AND out of your system? Do you have a cyber incident response, management, remediation and resiliency plan? Does your company have a threat awareness program for employees, management and day-to-day operations? Who is responsible for monitoring social media and the internet for threats and attack information? When was the last cyber security audit conducted, by whom and where is the report? Do you do Information Security Due Diligence on your suppliers?

13 Questions? E.J. Hilbert Managing Director Head of Cyber Security and Investigations in EMEA Kroll