Presented by: Mike Morris and Jim Rumph

Presented by: Mike Morris and Jim Rumph

Introduction MICHAEL MORRIS, CISA Systems Partner JIM RUMPH, CISA Systems Manager

Objectives To understand how layered security assists in securing your network Learn how different layers of controls can stop attacks at various points Better recognize how layered security helps mitigate your organization s risks (compliance, reputation, operational, etc.)

What is Layered Security? According to the FFIEC, "Layered security is characterized by the use of different controls at different points in a transaction process so that a weakness in one control is generally compensated for by the strength of a different control."

What is Layered Security?

Policies, Procedures, Awareness Training/awareness Social engineering Suspicious emails Internet surfing Wireless Internet Unique/strong passwords for each system or multifactor authentication Security policies

Perimeter Physical security Firewalls Intrusion detection and prevention ( IDS/IPS ) Multifactor authentication Access control lists Attack surface reduction Web content filtering Monitoring

Internal Network Network performance monitoring Monitoring of security logs Passwords Segregated domains File integrity checking/audit rules Least privileged access Screen saver passwords Administrative access reviews

Host Host level accounts Limited administrative rights Strong passwords Host level intrusion detection and prevention Multifactor authentication Up to date anti-virus/anti-spyware Patching Time out controls Administrative access reviews Attack surface reduction

Application Strong passwords Application patching Least privileged access Account timeout features Account lockout User activity logs Administrative access reviews

Data Encryption of non-public data Endpoint security Secure paths of communication Data leakage procedures

Authentication Guidance Supplement to authentication in an Internet banking environment Prompted by fraud in corporate cash management Trying to combat advanced persistent threats

Authentication Guidance What are your controls? Fraud detection and monitoring systems that include consideration of customer history and behavior and enable a timely and effective institution response Jack Henry Yellowhammer Dual customer authorization through different access devices Two people authenticating through separate devices Out-of-band verification for transactions Verification using a separate means of communication (such as fax, SMS text message, etc.) "Positive pay," debit blocks, and other techniques to appropriately limit the transactional use of the account Enhanced controls over account activities; such as transaction value thresholds, payment recipients, number of transactions allowed per day, and allowable payment windows [e.g., days and times]

Authentication Guidance What are your controls? Internet protocol [IP] reputation-based tools to block connection to banking servers from IP addresses known or suspected to be associated with fraudulent activities Blocking specific IP addresses or ranges (ex. China) Prompting security questions if IP address is different that what is expected Policies and practices for addressing customer devices identified as potentially compromised and customers who may be facilitating fraud Enhanced control over changes to account maintenance activities performed by customers either online or through customer service channels Call back procedures Multi factor authentication Enhanced customer education to increase awareness of the fraud risk and effective techniques customers can use to mitigate the risk

Case Study: Department of Revenue Hack Resulted in: 44 systems compromised 33 unique pieces of malicious software being installed including a backdoor At least four valid user accounts being compromised Approximately 74.7 GB of data was stolen, including 3.6 million SSNs and 387K credit and debit card numbers

Case Study: Department of Revenue Hack Timeline of events: A malicious (phishing) email was sent to multiple Department of Revenue employees. At least one user clicked on the embedded link, unwittingly executed malware, and became compromised. What could have prevented this: Better training Email filtering Social engineering testing End point security Restriction of local administrator access

Case Study: Department of Revenue Hack Timeline of events continued: The attacker logged into the remote access service using legitimate Department of Revenue user credentials. The credentials used belonged to one of the users who had received and opened the malicious email. What could have prevented this: Multi-factor authentication for remote access Restriction of remote access based upon specific job needs

Case Study: Department of Revenue Hack Timeline of events continued: The attacker executed utilities designed to obtain user account passwords on six servers. The attacker executed a utility to obtain user account passwords for all Windows user accounts. The attacker installed malicious software ("backdoor") on one server. What could have prevented this: Host level IPS Internal network monitoring End point security APT monitoring software

Case Study: Department of Revenue Hack Timeline of events continued: The attacker interacted with multiple systems and conducted reconnaissance activities. What could have prevented this Internal network monitoring Host based IPS (behavioral) Host level security Internal network hardening (attack surface reduction)

Case Study: Department of Revenue Hack Timeline of events continued: The attacker copied databases and moved them to a staging directory and then sent them to the internet. The attacker then deleted the copied databases. What could have prevented this: Encryption of data Adequate user access controls to the database Database logging Network performance monitoring Data leakage prevention

Other Data Breaches California Department of Social Services Information compromised: Payroll information of over 700,000 individuals due to microfiche lost in mail Lessons learned: Physical security remains vital Wisconsin Department of Revenue Information compromised: Sensitive information on 110,000 people accidently put on website Lessons learned: We rely on knowledgeable employees, but human error is still a risk

Other Data Breaches NASA Information compromised: 10,000 employees sensitive data was on a stolen laptop which was unencrypted Lessons learned: Encrypt your data!

Summary There are threats that can potentially bypass your controls Risk mitigation needs to factor in compensating controls A layered security approach will help to minimize the ever-increasing threats from the outside

Mike Morris mmorris@pkm.com 404-420-5669 Jim Rumph jrumph@pkm.com 404-420-5639