Intro Fun. S#ck- figure strip humor sourced and courtesy of h8p://xkcd.com and is provided for informa#ve use only.
|
|
|
- Susanna Thompson
- 8 years ago
- Views:
Transcription
1 Intro Fun S#ck- figure strip humor sourced and courtesy of h8p://xkcd.com and is provided for informa#ve use only.
2 Security & Trust Trends on security and trust within the Internet A focus on Phishing trends and some solu#ons The concept and details set out herein are preliminary and informative in nature only. Detailed analysis and validation of specific corporate proposals are ongoing. Implementation of any initiatives will be done in accordance with applicable contractual and legal obligations. Copyright 2011 Edgemount Solutions, LLC. All rights reserved. All other names and data where referenced are trademarks or property of their respective owners.
3 Background In the past several months a series of highly sophis#cated and targeted cyber a8acks has revealed a shif in the threat arena and their persistence on networks (APT buzz) A8ackers are moving beyond schemes to acquire financial data (such as credit cards and iden#ty thef) and are pursuing high- value digital assets such as intellectual property, access to cri#cal opera#ons, and other proprietary data systems We are involved with businesses in a8empt to review possible strategies and valida#on of business models that aim to offer mi#ga#on against a por#on of this space.
4 Social Engineering Most recent compromises that are reported use a technique called social engineering Defined - social engineering is using decep#on, manipula#on, and influence to convince a human who has access to a computer system to do something, such as click on an a8achment or a link in an Social- engineering schemes historically use spoofed e- mails purpor#ng to be from legi#mate businesses and agencies to lead consumers to counterfeit websites designed to trick recipients into divulging financial data such as usernames and passwords. Recent a8acks now bundle this method via spear phishing, which leads to a much more targeted a8ack; in order to access to a key person s worksta#on, data, etc.
5 Spear Phishing Phishing is a mechanism that employs both social engineering and malicious means to steal iden#ty & financial account creden#als Defined Phishing is the act of tricking someone into surrendering private informa#on over the Internet, follows the idea of actual fishing you throw out bait with the hopes that while some ignore it, others will bite. Tradi#onal a8acks mimic financial sites to collect creden#als or online shopping sites to collect credit card data A8acks most commonly come in the form of s or messages that contain viral links. Recent trends show an increase of compromises that use techniques to allow an a8acker access to a key person
6 Increased Effec<veness - Social Networking Social Networks make it easy..one can go into Twi8er, Facebook, LinkedIn, etc. to search for someone or use current events to lure recipients to react to a communica#on Online communi#es are powerful, trusted and perfect for cyber crime to leverage such rela#onships Social networking a8acks leverage a trusted link between friends, either to deliver malware or to phish for confiden#al and financial informa#on. Easier for a8ackers to spread malicious sofware through links, photos and applica#ons because those users are typically more trus#ng
7 Increased Effec<veness - Social Networking At the end of 2010, nearly 85 percent of recorded phishing a8empts used social networks as a lure, up from 8.3 percent at the start of the year Tiny URLs have also enabled be8er hiding of phishing domains from users. Phishing detec#on sofware generally looks for HTML- based content, hence some a8acks are using Flash, JavaScript and MIME type content that autocorrects to HTML in browsers for success
8 Phishing Trends Reports 2H2010 Phishing reports submi8ed to APWG during the second half 2010 Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
9 Phishing Trends Sites Detected 2H2010 Sites reported to APWG reached the highest point in September 2010 Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
10 Trends - 2H2010 Phishing Trends per APWG (member report): Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
11 Phishing Trends - Global Phishing trends saw a global increase (vs APWG member rpt) Average site up#me 73 hours (longest measurement) Age of site? (turnaround - currently reviewing) Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
12 Trends 2H Phishing A8acks by TLD: Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
13 Trends Q Phishing A8acks by TLD: Statistics sourced from APWG Global Phishing Survey 2H2010 (April 2011). Data and examples contained herein are provided for informative use only.
14 AV Solu<ons Impact or Lack Thereof Methodology generally ineffec#ve against an#virus clients given lag in detec#on rates (cat & mouse) Malware Detec#on Rates by AV Vender (2010): AV detection rates sourced from Cyveillance, Inc. analysis (August 2010) and are provided for examples and informative use only.
15 Methods of the AQack Reconnaissance to build knowledge of organiza#on/- target Social engineering and/or spear phishing to target end users Exploita#on of vulnerabili#es at end point Expand to peer rela#onships to roam the network Escala#on of privileges / rights Addi#onal spear phishing or decryp#ng Administrators passwords Compromise of internal systems Exfiltra#on of data or other Cleanup
16 Examples of the Typical AQack Earthquake (Hai# / Chile) Japan Earthquake & Tsunami Chilean miners Poland President Gulf oil spill Michael Jackson
17 Examples of the AQack Is this a video of you? <link> sent from a trusted friend to a circle of friends quickly infects new systems to propagate to the next layer of friends
18 Another Possible Example Security Ques#on Password Update: S#ck- figure strip humor sourced and courtesy of h8p://xkcd.com and is provided for informa#ve use only.
19 Recent Sophis<cated Examples Most recent sophis#cated compromises reportedly used spear phishing which allowed the a8acker access to a key person s worksta#on: IMF: Interna#onal Monetary Fund (IMF): 2011 a8ack gained access via spear phishing employee Google: Early 2010 A8ackers were able to install spyware on the resilient networks by manipula#ng key employees who had access to sensi#ve data to click on malicious links that exploited an Internet Explorer zero- day vulnerability. The a8acks were #med for the holidays when IT administra#on is thinly staffed to cover opera#ons. Q1 RSA SecurID data compromise occurred when an RSA employee clicked on a malware link in an apparent communica#on from a Human Resources department. All names, logos and company data where referenced are trademarks or property of their respective owners.
20 Ques<ons Your Organiza<on Should Ask Q: How many of our users would fall prey to a spear-phishing attack? Q: Would attackers be able to hijack admin accounts? Recent examples raise questions about important web defense strategies such as protecting remote users and office-based workers through 24/7 security
21 Do Current Efforts Make Sense? S#ck- figure strip humor sourced and courtesy of h8p://xkcd.com and is provided for informa#ve use only.
22 What Do We Do? Everything - There is no one solu#on Need to use a mix of user educa#on and layered security solu#ons to defend the networks Employees should treat s with suspicion and IT teams should leverage mul#ple resources (AV, IDS, User Restric#ons) Some other ideas: Products that send phishing s to your employees safely and easily trains your employees - immediately - when they fall for an a8ack Gathers ac#onable data to finely target future employee training and how to avoid the ever evolving threat on the Internet. Complete formal spear phishing awareness training Separate corporate and open systems create an air gap If data exfiltra#on is discovered, collect intelligence such as: What did they take, Where was the vector, How Long, Did they Leave, Where was it sent
23 Mi<ga<on Examples User Training Examples: Data and examples contained herein are produced and property of Wombat Security Technologies ( and are provided for examples and informative use only.
24 Thoughts The real issue isn't the type of mechanism being used to target victims, It's that users are simply not learning how to avoid being tricked on the Internet
25 Our Pending Solu<on Guidon Understanding that when informa#on is shared by a user the vic#m knows, a8ackers assume (generally correctly) that the a8empt will be more successful - Example 1: You see a message from a friend or a link on your Facebook news feed. You click on it only to find common scams - Example 2: You con#nue to get messages from your father/friends Edgemount Solu#ons Pending Tool Development: - Leverage historical metadata analysis for trend Global IP Country loca#on Mail Client Proxy service (known or unknown) Time of message Age of IP Domain Trend based on historical dates Various modes: Grandparent, Parent, Technical User, Kids Guidon and related intellectual property are property and trademark of Edgemount Solutions, LLC. Patent pending technology/software.
26 References & Various Resources APWG ( MAAWG ( McAfee Security Trends & Reports ( labs/threat- intelligence.aspx) Verizon / Verizon Business Security (securityblog.verizonbusiness.com) MicrosoF Security Center ( Wombat Security Technologies ( Carnegie Mellon University (cups.cs.cmu.edu/anti)
27 Other Fun S#ck- figure strip humor sourced and courtesy of h8p://xkcd.com and is provided for informa#ve use only.
Computer Security Incident Handling Detec6on and Analysis
Computer Security Incident Handling Detec6on and Analysis Jeff Roth, CISSP- ISSEP, CISA, CGEIT Senior IT Security Consultant 1 Coalfire Confiden+al Agenda 2 SECURITY INCIDENT CONTEXT TERMINOLOGY DETECTION
SECURITY REIMAGINED SPEAR PHISHING ATTACKS WHY THEY ARE SUCCESSFUL AND HOW TO STOP THEM. Why Automated Analysis Tools are not Created Equal
WHITE PAPER SPEAR PHISHING ATTACKS WHY THEY ARE SUCCESSFUL AND HOW TO STOP THEM Why Automated Analysis Tools are not Created Equal SECURITY REIMAGINED CONTENTS Executive Summary...3 Introduction: The Rise
Member Municipality Security Awareness Training. End- User Informa/on Security Awareness Training
End- User Informa/on Security Awareness Training 1 Why Awareness Training? NCLM sanc:oned mul:ple Security Risk Assessments for a broad spectrum of member municipali:es The assessments iden:fied areas
Phishing Activity Trends
Phishing Activity Trends Report for the Month of, 27 Summarization of Report Findings The number of phishing reports received by the (APWG) came to 23,61 in, a drop of over 6, from January s previous record
Spear Phishing Attacks Why They are Successful and How to Stop Them
White Paper Spear Phishing Attacks Why They are Successful and How to Stop Them Combating the Attack of Choice for Cybercriminals White Paper Contents Executive Summary 3 Introduction: The Rise of Spear
Welcome. HITRUST 2014 Conference April 22, 2014 HITRUST. Health Information Trust Alliance
Welcome HITRUST 2014 Conference April 22, 2014 HITRUST Health Information Trust Alliance The Evolving Information Security Organization Challenges and Successes Jason Taule, Chief Security and Privacy
Defending Against Cyber Attacks with SessionLevel Network Security
Defending Against Cyber Attacks with SessionLevel Network Security May 2010 PAGE 1 PAGE 1 Executive Summary Threat actors are determinedly focused on the theft / exfiltration of protected or sensitive
Cyber Security. Securing Your Mobile and Online Banking Transactions
Cyber Security Securing Your Mobile and Online Banking Transactions For additional copies or to download this document, please visit: http://msisac.cisecurity.org/resources/guides 2014 Center for Internet
Assessing BYOD with the Smarthpone Pentest Framework. Georgia Weidman
Assessing BYOD with the Smarthpone Pentest Framework Georgia Weidman BYOD Is Not New Contractor Laptop Rogue Access Point Gaming Console Tradi>onal Vulnerability Scanning The iphone in Ques>on Is
Phishing Activity Trends Report June, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
PATRIOT BANK CUSTOMERS. Corporate Account Takeover & Information Security Awareness
PATRIOT BANK CUSTOMERS Corporate Account Takeover & Information Security Awareness What will be covered! What is Corporate Account Takeover?! How does it work?! Sta9s9cs! Current Trend Examples! What can
No Cloud Allowed. Denying Service to DDOS Protection Services
No Cloud Allowed Denying Service to DDOS Protection Services Presented by: Allison Nixon Allison.Nixon@integralis.com Pentesting, Incident Response PaulDotCom host Cloud Based DDOS Protection How it works
Phishing Scams Security Update Best Practices for General User
Phishing Scams Security Update Best Practices for General User hishing refers to the malicious attack Pmethod by attackers who imitate legitimate companies in sending emails in order to entice people to
APT Advanced Persistent Threat Time to rethink?
APT Advanced Persistent Threat Time to rethink? 23 November 2012 Gergely Tóth Senior Manager, Security & Privacy Agenda APT examples How to get inside? Remote control Once we are inside Conclusion 2 APT
Fighting Advanced Threats
Fighting Advanced Threats With FortiOS 5 Introduction In recent years, cybercriminals have repeatedly demonstrated the ability to circumvent network security and cause significant damages to enterprises.
Corporate Account Takeover & Information Security Awareness
Corporate Account Takeover & Information Security Awareness The information contained in this session may contain privileged and confidential information. This presentation is for information purposes
The Cost of Phishing. Understanding the True Cost Dynamics Behind Phishing Attacks A CYVEILLANCE WHITE PAPER MAY 2015
The Cost of Phishing Understanding the True Cost Dynamics Behind Phishing Attacks A CYVEILLANCE WHITE PAPER MAY 2015 Executive Summary.... 3 The Costs... 4 How To Estimate the Cost of an Attack.... 5 Table
White paper. Phishing, Vishing and Smishing: Old Threats Present New Risks
White paper Phishing, Vishing and Smishing: Old Threats Present New Risks How much do you really know about phishing, vishing and smishing? Phishing, vishing, and smishing are not new threats. They have
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence. AIBA Quarterly Meeting September 10, 2015
Who Drives Cybersecurity in Your Business? Milan Patel, K2 Intelligence AIBA Quarterly Meeting September 10, 2015 The Answer 2 Everyone The relationship between the board, C-suite, IT, and compliance leaders
Advanced Security Methods for efraud and Messaging
Advanced Security Methods for efraud and Messaging Company Overview Offices: New York, Singapore, London, Tokyo & Sydney Specialization: Leader in the Messaging Intelligence space Market focus: Enterprise,
STOP Cybercriminals and. security attacks ControlNow TM Whitepaper
STOP Cybercriminals and security attacks ControlNow TM Whitepaper Table of Contents Introduction 3 What the headlines don t tell you 4 The malware (r)evolution 5 Spear phishing scams 5 Poisoned searches
defending against advanced persistent threats: strategies for a new era of attacks agility made possible
defending against advanced persistent threats: strategies for a new era of attacks agility made possible security threats as we know them are changing The traditional dangers IT security teams have been
Security Leadership: Preven4ng and Responding to Future Cyber A<acks. Mark Seward, Sr. Director, Security and Compliance
Security Leadership: Preven4ng and Responding to Future Cyber A
Email/Endpoint Security and More Rondi Jamison
Email/Endpoint Security and More Rondi Jamison Sr. Marke)ng Manager - Enterprise Security Strategy Agenda 1 Why Symantec? 2 Partnership 3 APS2 Packages 4 What s next Copyright 2014 Symantec Corpora)on
State of the Phish 2015
Introduction The threat is real Phishing continues to pose a growing threat to the security of industries of every kind from financial organizations to government contractors to healthcare firms. Though
How To Protect Your Online Banking From Fraud
DETECT MONITORING SERVICES AND DETECT SAFE BROWSING: Empowering Tools to Prevent Account Takeovers SUMMARY The Federal Financial Institutions Examination Council (FFIEC) is planning to update online transaction
FTC Data Security Standard
FTC Data Security Standard The FTC takes the posi6on (Being tested now in li6ga6on) that Sec6on 5 of the FTC Act requires Reasonable Security under the circumstances: that companies have reasonable controls
Anti-Phishing Best Practices for ISPs and Mailbox Providers
Anti-Phishing Best Practices for ISPs and Mailbox Providers Version 2.01, June 2015 A document jointly produced by the Messaging, Malware and Mobile Anti-Abuse Working Group (M 3 AAWG) and the Anti-Phishing
Protect Yourself. Who is asking? What information are they asking for? Why do they need it?
Protect Yourself Your home computer serves many purposes: email, shopping, social networking and more. As you surf the Internet, you should be aware of the various ways to protect yourself. Of primary
Innovations in Network Security
Innovations in Network Security Michael Singer April 18, 2012 AT&T, the AT&T logo and all other AT&T marks contained herein are trademarks of AT&T Intellectual Property and/or AT&T affiliated companies.
ONLINE RECONNAISSANCE
ONLINE RECONNAISSANCE HOW YOUR INTERNET PROFILE CAN BE USED AGAINST YOU May 2013 Most people and organisations put information about themselves on the web. Companies advertise their work and achievements
Malware & Botnets. Botnets
- 2 - Malware & Botnets The Internet is a powerful and useful tool, but in the same way that you shouldn t drive without buckling your seat belt or ride a bike without a helmet, you shouldn t venture online
Secure Your Mobile Workplace
Secure Your Mobile Workplace Sunny Leung Senior System Engineer Symantec 3th Dec, 2013 1 Agenda 1. The Threats 2. The Protection 3. Q&A 2 The Mobile Workplaces The Threats 4 Targeted Attacks up 42% in
DISCLAIMER AND NOTICES
DISCLAIMER AND NOTICES The opinions expressed in this presentation are those of the author and presenter alone. They do not represent the views of any other entity. Nothing in this presentation should
Phishing Activity Trends Report for the Month of December, 2007
Phishing Activity Trends Report for the Month of December, 2007 Summarization of December Report Findings The total number of unique phishing reports submitted to APWG in December 2007 was 25,683, a decrease
FSOEP Web Banking & Fraud: Corporate Treasury Attacks
FSOEP Web Banking & Fraud: Corporate Treasury Attacks Your Presenters Who Are We? Tim Wainwright Managing Director Chris Salerno Senior Consultant Led 200+ penetration tests Mobile security specialist
white paper Malware Security and the Bottom Line
Malware Security Report: Protecting Your BusineSS, Customers, and the Bottom Line Contents 1 Malware is crawling onto web sites everywhere 1 What is Malware? 2 The anatomy of Malware attacks 3 The Malware
Trust the Innovator to Simplify Cloud Security
Trust the Innovator to Simplify Cloud Security Contents MailGuard Pty Ltd Page 1 of 7 2 Let s get real for a moment. Your antivirus software isn t stopping fastbreak phishing and other spam attacks like
Migrating to Hosted Telephony. Your ultimate guide to migrating from on premise to hosted telephony. www.ucandc.com
Migrating to Hosted Telephony Your ultimate guide to migrating from on premise to hosted telephony Intro What is covered in this guide? A professional and reliable business telephone system is a central
Symantec Cyber Threat Analysis Program Program Overview. Symantec Cyber Threat Analysis Program Team
Symantec Cyber Threat Analysis Program Symantec Cyber Threat Analysis Program Team White Paper: Symantec Security Intelligence Services Symantec Cyber Threat Analysis Program Contents Overview...............................................................................................
Preparing for a Cyber Attack PROTECT YOUR PEOPLE AND INFORMATION WITH SYMANTEC SECURITY SOLUTIONS
Preparing for a Cyber Attack PROTECT YOUR PEOPLE AND INFORMATION WITH SYMANTEC SECURITY SOLUTIONS CONTENTS PAGE RECONNAISSANCE STAGE 4 INCURSION STAGE 5 DISCOVERY STAGE 6 CAPTURE STAGE 7 EXFILTRATION STAGE
Privileged Administra0on Best Prac0ces :: September 1, 2015
Privileged Administra0on Best Prac0ces :: September 1, 2015 Discussion Contents Privileged Access and Administra1on Best Prac1ces 1) Overview of Capabili0es Defini0on of Need 2) Preparing your PxM Program
SPEAR PHISHING AN ENTRY POINT FOR APTS
SPEAR PHISHING AN ENTRY POINT FOR APTS threattracksecurity.com 2015 ThreatTrack, Inc. All rights reserved worldwide. INTRODUCTION A number of industry and vendor studies support the fact that spear phishing
Pu?ng B2B Research to the Legal Test
With the global leader in sampling and data services Pu?ng B2B Research to the Legal Test Ashlin Quirk, SSI General Counsel 2014 Survey Sampling Interna6onal 1 2014 Survey Sampling Interna6onal Se?ng the
Don t Fall Victim to Cybercrime:
Don t Fall Victim to Cybercrime: Best Practices to Safeguard Your Business Agenda Cybercrime Overview Corporate Account Takeover Computer Hacking, Phishing, Malware Breach Statistics Internet Security
HI THIS IS URGENT PLZ FIX ASAP: Cri5cal Vulnerabili5es and Bug Bounty Programs
HI THIS IS URGENT PLZ FIX ASAP: Cri5cal Vulnerabili5es and Bug Bounty Programs Kymberlee Price Senior Director of Researcher Opera5ons Bugcrowd @Kym_Possible whoami? Senior Director of a Red Team PSIRT
Recommended Practice Case Study: Cross-Site Scripting. February 2007
Recommended Practice Case Study: Cross-Site Scripting February 2007 iii ACKNOWLEDGEMENT This document was developed for the U.S. Department of Homeland Security to provide guidance for control system cyber
March 2010 Report #39
March 2010 Report #39 Scam and phishing messages in February accounted for 19 percent of all spam, which is 2 percentage points lower than in January, but nevertheless an elevated level. Spammers continued
INFOCOMM SEC RITY. is INCOMPLETE WITHOUT. Be aware, responsible. secure!
INFOCOMM SEC RITY is INCOMPLETE WITHOUT Be aware, responsible secure! U HACKER Smack that What you can do with these five online security measures... ANTI-VIRUS SCAMS UPDATE FIREWALL PASSWORD FASTEN UP!
Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning
Spam, Spyware, Malware and You! Don't give up just yet! Presented by: Mervin Istace Provincial Library Saskatchewan Learning Lee Zelyck Network Administrator Regina Public Library Malware, Spyware, Trojans
DNS Traffic Monitoring. Dave Piscitello VP Security and ICT Coordina;on, ICANN
DNS Traffic Monitoring Dave Piscitello VP Security and ICT Coordina;on, ICANN Domain Names ICANN coordinates the administra2on of global iden2fier systems Domain names provide user friendly identification
Financial Fraud Threats & Preven3on. Mark Frank EVP, Senior Opera3ons Officer Colorado Business Bank
Financial Fraud Threats & Preven3on Mark Frank EVP, Senior Opera3ons Officer Colorado Business Bank Why Pay ACen3on to Fraud Risks? Fraud occurs everywhere, and NO organiza3on is immune Changing business
NETWORK DEVICE SECURITY AUDITING
E-SPIN PROFESSIONAL BOOK VULNERABILITY MANAGEMENT NETWORK DEVICE SECURITY AUDITING ALL THE PRACTICAL KNOW HOW AND HOW TO RELATED TO THE SUBJECT MATTERS. NETWORK DEVICE SECURITY, CONFIGURATION AUDITING,
Phishing Activity Trends Report. 1 st Quarter 2014. Unifying the. To Cybercrime. January March 2014
1 st Quarter 2014 Unifying the Global Response To Cybercrime January March 2014 Published June 23, 2014 , Phishing Report Scope The APWG analyzes phishing attacks reported to the APWG by its member companies,
Best Practices for Avoiding Getting Speared Like a Phish
Best Practices for Avoiding Getting Speared Like a Phish Thoughts from in-house 2016 MRIS Erik M Feig General Counsel MRIS ACC NCR Small Law Department Initiative May, 2016 Erik.feig@mris.net PANELISTS
Adventures in Bouncerland. Nicholas J. Percoco Sean Schulte Trustwave SpiderLabs
Adventures in Bouncerland Nicholas J. Percoco Sean Schulte Trustwave SpiderLabs Agenda Introduc5ons Our Mo5va5ons What We Knew About Bouncer Research Approach & Process Phase 0 Phase 1 7 Final Test What
Top Ten Cyber Threats
Top Ten Cyber Threats Margaret M. McMahon, Ph.D. ICCRTS 2014 Introduction 2 Motivation Outline How malware affects a system Top Ten (Simple to complex) Brief description Explain impacts Main takeaways
Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst
ESG Brief Addressing APTs and Modern Malware with Security Intelligence Date: September 2013 Author: Jon Oltsik, Senior Principal Analyst Abstract: APTs first came on the scene in 2010, creating a wave
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis?
Security Threat Kill Chain What log data would you need to identify an APT and perform forensic analysis? This paper presents a scenario in which an attacker attempts to hack into the internal network
Presentation Objectives
Gerry Cochran, IT Specialist Jennifer Van Tassel, Associate Examiner Office of the State Comptroller Thomas P. DiNapoli State & Local Government Accountability Andrew A. SanFilippo Executive Deputy Comptroller
Security Awareness. Top Security Issues. Office of Informa(on Technology Informa5on Security Department 2011-2012 BE CYBER SAFE
Security Awareness Office of Informa(on Technology Informa5on Security Department 2011-2012 Top Security Issues BE CYBER SAFE 1 Top Security Items for 2011-2012 Passwords Social Networking Phishing Malware,
Main Research Gaps in Cyber Security
Comprehensive Approach to cyber roadmap coordina5on and development Main Research Gaps in Cyber Security María Pilar Torres Bruna everis Aerospace and Defence Index CAMINO WP2: Iden8fica8on and Analysis
May 2011 Report #53. The following trends are highlighted in the May 2011 report:
May 2011 Report #53 The unexpected raid and resulting death of Osama Bin Laden shocked the world. As always, spammers were quick to jump on this headline, and send a variety of spam messages leveraging
Be Prepared for Java Zero-day Attacks
Threat Report Be Prepared for Java Zero-day Attacks Malware Analysis: Malicious Codes spread via cloud-based data storage services December 19, 2013 Content Overview... 3 Distributing Malicious E-mails
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
SPEAR PHISHING UNDERSTANDING THE THREAT
SPEAR PHISHING UNDERSTANDING THE THREAT SEPTEMBER 2013 Due to an organisation s reliance on email and internet connectivity, there is no guaranteed way to stop a determined intruder from accessing a business
When less is more (Spear-Phishing and Other Methods to Steal Data) Alexander Raczyński
When less is more (Spear-Phishing and Other Methods to Steal Data) Alexander Raczyński 1 Agenda Spear-Fishing the new CEO Fear How to Fight Spear-Fishing It s All About the Data Evolution of the bad guys
Malware, Phishing, and Cybercrime Dangerous Threats Facing the SMB State of Cybercrime
How to Protect Your Business from Malware, Phishing, and Cybercrime The SMB Security Series Malware, Phishing, and Cybercrime Dangerous Threats Facing the SMB State of Cybercrime sponsored by Introduction
Is security awareness a waste of time?
Is security awareness a waste of time? New York State Cyber Security Conference June 5, 2013 Scott Gréaux Vice President Product Management and Services, PhishMe, Inc. They are exploiting human vulnerabilities
Trends in Malware DRAFT OUTLINE. Wednesday, October 10, 12
Trends in Malware DRAFT OUTLINE Presentation Synopsis Security is often a game of cat and mouse as security professionals and attackers each vie to stay one step ahead of the other. In this race for dominance,
DDOS Mi'ga'on in RedIRIS. SIG- ISM. Vienna
DDOS Mi'ga'on in RedIRIS SIG- ISM. Vienna Index Evolu'on of DDOS a:acks in RedIRIS Mi'ga'on Tools Current DDOS strategy About RedIRIS Spanish Academic & research network. Universi'es, research centers,.
SIMULATED ATTACKS. Evaluate Susceptibility Using PhishGuru, SmishGuru, and USBGuru MEASURE ASSESS
SIMULATED ATTACKS Evaluate Susceptibility Using PhishGuru, SmishGuru, and USBGuru Technical safeguards like firewalls, antivirus software, and email filters are critical for defending your infrastructure,
Evaluating DMARC Effectiveness for the Financial Services Industry
Evaluating DMARC Effectiveness for the Financial Services Industry by Robert Holmes General Manager, Email Fraud Protection Return Path Executive Summary Email spoofing steadily increases annually. DMARC
Practical tips for a. Safe Christmas
Practical tips for a Safe Christmas CONTENTS 1. Online shopping 2 2. Online games 4 3. Instant messaging and mail 5 4. Practical tips for a safe digital Christmas 6 The Christmas holidays normally see
December 2010 Report #48
December 2010 Report #48 With the holidays in full gear, Symantec observed an increase of 30 percent in the product spam category as spammers try to push Christmas gifts and other products. While the increase
Protecting Your Organisation from Targeted Cyber Intrusion
Protecting Your Organisation from Targeted Cyber Intrusion How the 35 mitigations against targeted cyber intrusion published by Defence Signals Directorate can be implemented on the Microsoft technology
Securing Cloud-Based Email
White Paper Securing Cloud-Based Email A Guide for Government Agencies White Paper Contents Executive Summary 3 Introduction 3 The Risks Posed to Agencies Running Email in the Cloud 4 How FireEye Secures
Network Security. Computer Security & Forensics. Security in Compu5ng, Chapter 7. l Network Defences. l Firewalls. l Demilitarised Zones
Network Security Security in Compu5ng, Chapter 7 Topics l Network AAacks l Reconnaissance l AAacks l Spoofing l Web Site Vulnerabili5es l Denial of Service l Network Defences l Firewalls l Demilitarised
The Advanced Attack Challenge. Creating a Government Private Threat Intelligence Cloud
The Advanced Attack Challenge Creating a Government Private Threat Intelligence Cloud The Advanced Attack Challenge One of the most prominent and advanced threats to government networks is advanced delivery
UAB Cyber Security Ini1a1ve
UAB Cyber Security Ini1a1ve Purpose of the Cyber Security Ini1a1ve? To provide a secure Compu1ng Environment Individual Mechanisms Single Source for Inventory and Asset Management Current Repor1ng Environment
New York State Energy Planning Board. Cyber Security and the Energy Infrastructure
New York State Energy Planning Board Cyber Security and the Energy Infrastructure New York State Division of Homeland Security and Emergency Services Office of Cyber Security Office of Cyber Security Overview
Targeted attacks: Tools and techniques
Targeted attacks: Tools and techniques Performing «red-team» penetration tests Lessons learned Presented on 17/03/2014 For JSSI OSSIR 2014 By Renaud Feil Agenda Objective: Present tools techniques that
Malicious Websites uncover vulnerabilities (browser, plugins, webapp, server), initiate attack steal sensitive information, install malware, compromise victim s machine Malicious Websites uncover vulnerabilities
CSUF Tech Day 2015. Security Awareness Overview Dale Coddington, Information Security Office dcoddington@fullerton.edu
CSUF Tech Day 2015 Security Awareness Overview Dale Coddington, Information Security Office dcoddington@fullerton.edu Agenda Introduction Large scale data breaches: 2014 and beyond Email based attacks:
The State of Spam A Monthly Report August 2008. Generated by Symantec Messaging and Web Security
The State of Spam A Monthly Report August 2008 Generated by Symantec Messaging and Web Security Doug Bowers Executive Editor Antispam Engineering Dermot Harnett Editor Antispam Engineering Joseph Long
Phoenix Information Technology Services. Julio Cardenas
Phoenix Information Technology Services Julio Cardenas Email spam, also known as junk email or unsolicited bulk email (UBE), is a subset of electronic spam involving nearly identical messages sent to numerous
Advanced Threats: The New World Order
Advanced Threats: The New World Order Gary Lau Technology Consulting Manager Greater China gary.lau@rsa.com 1 Agenda Change of Threat Landscape and Business Impact Case Sharing Korean Incidents EMC CIRC
Detailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
IBM Security re-defines enterprise endpoint protection against advanced malware
IBM Security re-defines enterprise endpoint protection against advanced malware Break the cyber attack chain to stop advanced persistent threats and targeted attacks Highlights IBM Security Trusteer Apex
WEB ATTACKS AND COUNTERMEASURES
WEB ATTACKS AND COUNTERMEASURES February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in
Marble & MobileIron Mobile App Risk Mitigation
Marble & MobileIron Mobile App Risk Mitigation SOLUTION GUIDE Enterprise users routinely expose their employers data and threaten network security by unknowingly installing malicious mobile apps onto their
Next-Generation Penetration Testing. Benjamin Mossé, MD, Mossé Security
Next-Generation Penetration Testing Benjamin Mossé, MD, Mossé Security About Me Managing Director of Mossé Security Creator of an Mossé Cyber Security Institute - in Melbourne +30,000 machines compromised
Learning to Detect Spam and Phishing Emails Page 1 of 6
Page 1 of 6 Email provides us a powerful communication tool. Unfortunately, it also provides scammers an easy means for luring potential victims. The scams they attempt run from old-fashioned bait-and-switch
Advanced Persistent Threats
White Paper INTRODUCTION Although most business leaders and IT managers believe their security technologies adequately defend against low-level threats, instances of (APTs) have increased. APTs, which
I ve been breached! Now what?
I ve been breached! Now what? THE AFTERMATH OF A BREACH & STEPS TO REDUCE RISK The number of data breaches in the United States in 2014 hit a record high. And 2015 is not looking any better. There have
Top Cyber Threats Of 2009
Top Cyber Threats Of 2009 Who were the top 5 riskiest celebrities in 2009? Did spammers really know who killed Michael Jackson? Data from Symantec Security Response November 2009 Top 5 Riskiest Celebrities
AHS Computing. IE 7 Seminar
AHS Computing IE 7 Seminar What is IE 7? IE 7 is the new web-browser distributed by Microsoft New features with IE 7 make surfing the web easier and safer Tabbed Browsing New Favorites Center Built in
WHITEPAPER. How a DNS Firewall Helps in the Battle against Advanced Persistent Threat and Similar Malware
WHITEPAPER How a DNS Firewall Helps in the Battle against Advanced Persistent Threat and Similar Malware How a DNS Firewall Helps in the Battle against Advanced As more and more information becomes available
Course Content: Session 1. Ethics & Hacking
Course Content: Session 1 Ethics & Hacking Hacking history : How it all begin Why is security needed? What is ethical hacking? Ethical Hacker Vs Malicious hacker Types of Hackers Building an approach for