This document discusses organizational security and cybercrime. It provides statistics showing that cybercrime is now a $3 trillion industry, larger than the illegal drug trade. Common cybercrimes discussed include hacking for financial gain, cybercrime marketplaces, spyware, botnets, denial of service attacks, ransomware, and phishing. The document also examines root causes of security incidents like poor passwords, vulnerabilities, and lack of monitoring. It emphasizes that the human element, like human error or lack of security awareness, is frequently the weak link that enables over 95% of breaches. It provides recommendations for organizations to identify key assets, establish security policies, encrypt data, conduct security awareness training, keep systems patched, use anti-virus software

1. Organisational Security

2. “Total Global Impact of
CyberCrime US$ 3 Trillion, making
it more profitable than the global
trade in marijuana, cocaine and
heroin combined.”
Europol Serious & Organised Threat
Assessment 2013

6. Why Would Someone Want to Hack Me?

7. “Because that's
where
the money is.”
Willie Sutton
Courtesy Dermot Casey

8. Cybercrime Marketplace
$1-$6 US Credit card number
$2-$12 UK Credit card number
$5-$50 Medical ID card
$6-$18 Basic identity information
$7 PayPal account with credentials
$50-$500 PayPal verified with balance
$20 DDoS attack from bot army (per hour)
$30 Passwords to consumer credit reports
$50 to $60 Health/medical record
$140 10 million email addresses
$200 Malicious Software Toolkit
$500 20 million SPAMs sent from bot army
$100-$2000 Malware as a Service (MaaS)
$1000-$5000 Online banking accounts with a balance
$10000 0-Day Exploit

9. SpyWare
Malicious Code That
Resides on PC
Monitors All Keystrokes
and Mouse Clicks
Periodically Take Screen
Shots
Detect SSL/HTTPS
Connections
Record Details
Send Details to Attacker

10. BotNet

11. Denial Of Service

12. Ransomware - Your Money or Your Bytes

16. Phishing
 Advanced form of Social
Engineering
 Emails Crafted to
Appear to Come From
Trusted Source
 Bank, Ebay, Paypal
 Link to Duplicate
Website
 Used to Harvest Login
Credentials
 Install Malware
 Spear Phishing

17. €50,000

19. 69%
22%
9%
Detected by 3rd Party
Detected by Org
Detected by Customer
Breach Detection

20. 78%
22%
Not Difficult
Moderate to Difficult
Difficulty

22. 2013 - Incidents

23. 2014 - Incidents

24. 2014 - Incidents
Phishing Hosted
19%
Phishing Victim
0%
Malware
43%
Hack Attack
2%
Denial of Service
10%
Botnet C&C Servers
3%
DDOS Outbound
23%

25. 2014 - Incidents
Org Crime,
75%
Other, 25%

26. Root Cause of Incidents
Poor Passwords
Missing Patches
Vulnerabilities
Web Platforms
Out of Date Anti-Virus Software
Lack of Monitoring
Poor/Lack of Security Awareness

27. 95% of Breaches Were Due to “Human Error”
- IBM
90% of Malware Requires Human Interaction
- Symantec
100% of Successful Attacks Compromised The
Human
- Mandiant
64% of Orgs See Security Awareness As a
Challenge
- E&Y 2010
3 times as many breaches are caused by
accidental insider activity than malicious intent
- Open Security Foundation
The Human Element

28. How To Protect

29. Identify & Value Key Assets

31. Establish Policies

32. Encrypt Data

33. Security
Awareness
Training

34. Keep Systems Patched

35. Anti-Virus Software

36. Monitor & Respond

37. @BrianHonan