Like to take a few minutes to tell you more about Mimecast.
Outline the issues we help customers tackle.
Explain why our approach is different from others.
Share some detail on our services.
I’m not going to start today with a presentation about features and benefits, products and add-ons.
Instead, for the next 10 or 15mins I’m going to be talking about the threat landscape. My aim is to try and highlight some of the risks to your customers, and some of the misconceptions they might have about the way they’ve protected themselves, their users and their data.
You may notice on the screen we have a timer counting down – it started at 1min 22.
No, that’s not how long it takes me to tie my tie or do up my shoe laces, or how long it will take you to close your first deal after this session (although let’s hope for that).
In the time its taken me to complete this introduction and let the clock run down – your business has been compromised by a phishing attack.
Number one is the fact that email remains the number one attack vector for hackers. This is backed by key stats from the 2017 Verizon Data Breach Investigation Report which indicates:
91% of attacks started with a phishing email.
There was a 55% increase in spear-phishing attacks
1300% increase in impersonation attack losses and
400% increase in ransomware attacks.
So who’s doing the dirty work here and sending malicious emails?
Sometimes it can be just for fun – the guys that hacked TalkTalk said they did it just to see if they could. But often it is a lot more sinister.
There are a number of examples of attacks thought to be state sponsored…North Korea for example are said to have sponsored the attack on Sony Pictures in 2014 in response to the movie The Interview!
Anyone who watches the news is likely to have heard of Russian “meddling” in the US election – with CNBC reporting that 39 states were targeted by Russian hackers during the election campaign.
https://www.cnbc.com/2017/06/13/russias-cyber-attack-on-39-states-could-jeopardize-future-us-elections.html
Bet Clinton wishes she was a bit more careful!
And email and cyber attacks are now often part of the important groundwork for organised criminals – often opening the door and breaking down defences that allow traditional physical crimes to occur.
Think disabling a security system to rob a bank – might sound quite Oceans 11 but a perfectly reasonable and realistic way to cripple an organisation…especially if you only need to send a few emails to do it!
Finally, it might be Joe, or Fred, or Sarah…or any of the people sitting in your offices or in this room. A compromised or malicious insider is in a unique and powerful position to cause damage to an organisation.
Many traditional security solutions are only interested about what comes in from the outside – but mayhem could just as easily be caused by the chap sitting next to you.
Liam, what kinds of techniques are these nasty people using?
And what methods are these people using?
Tor, the Onion Router, the dark web – whichever name you want to give it – allows you to browse and communicate anonymously, making illegal cyber activity easy and difficult to trace.
Bulletproof hosting sites – good destinations for phishing links
And its easy to find Bulletproof hosting sites – services that give compute, storage, bandwidth, management and say “we don’t care what you host, that’s your business!”
And then we have bitcoins…the ultimate anonymous currency – each time it changes hands the encryption becomes more sophisticated as the exchange lengthens the key.
Attackers don’t have to know how to code, they don’t even have to be smart.
Ransomware as a Service has almost become an industry, with tools like TOX which allow attackers to track how many folks have been infected and track the ransom paid
If you’re an attacker and can code but don’t know how to evade sandbox detection, that’s not a problem there’s an online service that can help that too!
FUD- fully undetectable decrypting services use obfuscation, encryption and code manipulation.
Many of your targets wont have the technical knowledge to setup, purchase, transfer crypto-currency or use the decryption keys – for a fee you can have a multi-lingual call centre ensure that your victims are able to pay you and get their data back.
But the biggest problem for any organisation is this – Social Engineering – the easiest way to penetrate an organisations defences…exploiting their users!
There is loads of literature available on Social Engineering if you’d like to become an expert (not that we’d endorse that kind of behaviour)
But for now, let’s go through a step by step guide for co-ordinating a simple but devastating email attack.
It is very easy to identify the key stakeholders in a business, who’s important, who’s not, and who reports into who. A simple “about us” page often hands hackers an exec list on a plate…
What better way to entice a user to open an email than having it look like it’s from the CEO, the CFO or some other senior leader?
When we know the key stakeholders LinkedIn can help us do some more digging and build a strategy…
Very quickly I can identify who reports into who, who’s responsible for what, and tailor my attack to their position in the organisation
…and all through your homepage and a fake LinkedIn account – simples!
Once we’ve got this far, its simple – send some targeted emails to the people we’ve researched with a call to action.
For example, send a CV embedded with ransomware to the HR Manager we spoke to on LinkedIn
Or send somebody in the warehouse an email confirming their delivery…with a malicious URL to “track their parcel”
Even better…pretend to be the CEO and ask the new guy in accounts to action an urgent wire transfer
Simples!
So what do we need to do to stop this?
Our MEME IS THIS
You think your security looks like this.
But it actually looks like this.
IMAGE FROM DOOMSDAY PREPPERS.
The issue here is the risk profile is all wrong.
Snipers rifle.
Magazine’s clipped in.
Can’t climb the stairs without getting out of breath.
WE’RE SPENDING TOO MUCH MONEY ON THE WRONG THINGS
So what do we need to do differently? We need to build layers.
The first layer is of course the technology – a combination of traditional and advanced, targeted threat protection to mitigate the risks in todays threat landscape.
But the second layer is just as important – the human firewall.
Its the on-going education of the weakest links in our business – the users – to minimise their risk to us. That might mean pentesting, dynamic user awareness technologies, even just regular emails.
Both layers are just as important as each other – its prevent and improve now, not just prevent.
And that brings us nicely to the concept I mentioned in the title.
Cyber resilience definition from Wikipedia.
It demonstrates that protecting our customers today involves more than just cyber security.
PROTECT It is more than just protection before an attack….what about during and after an attack. If you cannot answer three questions….then you are not using a cyber resilience strategy.
Users (security)
Data (multi-purpose archiving / backup)
Productivity (operations continuity)
FROM
Malicious intent (internal and external)
Human error
Technological failure
BY
Preventing incidents (before)
Recovering and mitigating (during)
Improving and analyzing (after)
If you want to build a proper cyber resilience plan that protects your organisation and its end users, we can help you to address these four key points.
Prepare – enable your users to look out for these kinds of emails, and have solutions in place that protect you, your data, and to be compliant
Prevent an attack, with a layered approach to security – with traditional filtering services overlapped with targeted threat protection for phishing, whaling and ransomware
Detect – reporting is more important than ever, so deploy SIEM, systematic alerting and regular reporting to give you visibility of what’s happening in your network
And finally, Respond to an incident with immediate recovery, instant remediation, and on-going targeted education to prevent a future incident…and you’ll notice we’ve looped back around.
So as you sit in the sessions today on security, continuity and archiving – think about how you can knit these themes together and start having a conversation with your customer about cyber resiliency.