Nov 2015 redacted version of slides Conrad Hotel Dublin

1. Cyber Executive Briefing
Presenter: Paul C Dwyer
Date: Nov 26th 2015
REDACTED VERSION

2. Slides and Material May NOT be Distributed In Any Format Without Written Permission
Copyright Cyber Risk International Ltd – All Rights Reserved

3. Peer Group

4. Paul C Dwyer
Paul C Dwyer is an internationally recognised
information security authority with over two decades
experience.
A certified industry professional by the International Information
Systems Security Certification Consortium (ISC2) and the
Information System Audit & Control Association (ISACA) and
recently selected for the IT Governance Expert Panel.
Paul's credentials include:
• -Qualified Hacker
• -SOX (SAS70) Auditor
• -ISO 27001 Lead Auditor
• -BS25999 / BCP Expert
• -Forensic Investigator
• -PCI DSS Specialist
• -Prince2
He has worked and trained with such organisations as the US
Secret Service, Scotland Yard, FBI, National Counter Terrorism
Security Office (MI5), is approved by the National Crime Faculty
and is a member of the High Tech Crime Network (HTCN).
Paul is currently CEO of Cyber Risk International and President of
the ICTTF.

5. THE CYBER WORLD AND
THE PHYSICAL ARE INTEGRATED

6. What is Cyber Crime?
Cyber crime or computer crime as it is
generally known is a form of crime
where the Internet or computers are
used as a medium or method to
commit crime which includes hacking,
copyright infringement, scams, denial
of service attacks, web defacement
and fraud.

7. Cybercrime Drivers
It’s a business with an excellent economic model.
Other reasons, you name it:
• Technology
• Internet
• Recession
• “A safe crime”
• It’s easy to get involved
• Part of Something

8. Crimeware Toolkits
Criminal gangs are creating fake banking apps
Traditional Banking Trojan kits are attacking:
mTAN (Transaction Authentication Number)
• Zeus MITMO
• Spitmo (SpyEye)
• Citmo (Carberp)
• Tattanga
New generic mobile kits are being developed independently
of PC kits for Zeus, Ice IX, SpyEye, Citadel, Carberp.
Increasingly industrialized, new distribution channels
Legit apps used with stolen credentials

9. Underground Stock Exchange
• Categories
– Carding Forums
– Dump Vendors
– Non Carding Forums

10. “actions by a nation-state to penetrate another nation's computers or
networks for the purposes of causing damage or disruption.”
• “Digital Infrastructure….Strategic National Asset”
President Barack Obama
• May 2010 – Pentagon – Cybercom
• UK - a cyber-security "operations centre” (GCHQ)
• “Fifth Domain” The Economist
What is Cyber Warfare?

12. Hacktivism? Part of …..

13. Control of the Internet

14. Motivation?

15. Cyber
Crime
Cyber X
Cyber
Warfare
Cyber
Espionage
Adversary

16. Blurred Lines NOT Silos

17. APT

19. Cyber fronts in the
Ukraine!
Is it War?

21. Reconnaissance Weaponisation Delivery Exploitation C2
Lateral
Movement
Exfiltration Maintenance
Gathers Intelligence About
Employee and Assets
Targets Individual (Asset)Bad Guy
Exploit Run – Comms
Established – Command &
Control Server
Move Laterally Across Network
Chooses Weapon from
underground forum
Exfiltrate Data
Protection – Maint Mode

22. What do they Want?
22

23. Unit 61398

24. Surface Web
Deep Web 90%+

25. Old Stuff – New Way

26. Psych(BI)ology of Cyber

27. The Devil – Really?

28. Three Clicks is Now One Click!

29. Cybercriminals are Business People!

30. I’m not joking!
Hack the Human!

32. Reality?

33. Cyber Case Study
Extended Presentation Material

34. Cyber Heist Uncovered

35. Tue Feb 19th 2013 4.31 PM

36. Military Precision – 24 Countries
36,000 Withdrawal's
Totaling - $45,000,000

37. Prepaid Debit Cards – Bank Muskat –
Oman
Hackers cancelled withdrawal limits –
“Hacked Payment Processor”
Card Numbers – Sent to foot soldiers
around the world – “Unlimited Operation”
“Cashing Crews” Imprinted Data on Cards
“Flash Mob” Using Secure IM Sites
What Happened?

38. Cybercriminal
Mastermind
Hacker
Money Mule
Manager
Money
Mules
Mule
Mule
Manager

39. Dominican – Yonkers – North of Manhattan
Entire crew within streets of “Strattan Street”
Dry run – Dec 2012 – Rak Bank
Nearly $400,000 - 700 Withdrawals

40. Why Trust a Criminal?
Copyright - Paul C Dwyer Ltd - All Rights Reserved

45. Cybercrime Has
Consequences

47. Some Recommendations
• Prepare for the Strategic Challenge
• Build Cyber resilience and detection within your organisation
• Develop Strategy and Governance
• Develop Incident Management Capability
• Secure your Supply Chain
• Learn from the “Bad Guys”
• Access Relevant Actionable Cyber Threat Intelligence
• Don’t Forget the Basics
• Make Everyone Responsible and “Cyber Loyal”
• Look Ahead

48. It’s a IT Cyber Security Problem, Right?

49. 49
Legally It’s a Challenge for the Board!
NO

50. Government and Regulators
• Governments have a role
• They expect organisations
to do their part
• Regulations can not keep
pace with technology
• Nobody can protect and
organisation better than
the organisation

51. Resilience
51
Recognise:
Interdependence
Leadership Role Responsibility
Integrating Cyber Risk Management
Leverage Relationships and Encourage Suppliers

52. Security Industry Evolved
?
Defence in Depth Breaches are Inevitable

54. Cyber Risks for You
• Tangible Costs
– Loss of funds
– Damage to Systems
– Regulatory Fines
– Legal Damages
– Financial Compensation
• Intangible Costs
– Loss of competitive advantage (Stolen IP)
– Loss of customer and/or partner trust
– Loss of integrity (compromised digital assets)
– Damage to reputation and brand
Quantitative vs. Qualitative
46% Reduction in Profits Following Breach

55. Regulatory and Legal
EU Data Privacy Directive
EU Network
Information
Security
Directive
European Convention on
Cybercrime
400+ Others
– 10,000+
Controls –
175 Legal
Jurisdictions
Your
Organisation

56. Responsibility – Convention Cybercrime
All organisations need to be aware of the Convention’s
provisions in article 12, paragraph 2:
‘ensure that a legal person can be held liable where the
lack of supervision or control by a natural person…has
made possible the commission of a criminal offence
established in accordance with this Convention’.
Now Sit Forward!

57. It can get even worse

58. Automatic Governance Event
Fundamental
Uncertainty
Board
Accountability
Are you already compromised?

59. Operational
Level
Strategic Level
Technical Level
Cyber is a Strategic Issue
59
Macro Security
Micro Security
How do cyber attacks affect, policies,
industry, business decisions?
What kind of policies, procedures and
business models do we need?
How can we solve our security
problems with technology?

60. •Loss of market share and reputation
•Legal ExposureCEO
•Audit Failure
•Fines and Criminal Charges
•Financial Loss
CFO/COO
•Loss of data confidentiality, integrity and/or availability
CIO
•Violation of employee privacy
CHRO
•Loss of customer trust
•Loss of brand reputationCMO
Board Room Discussion
Increasingly companies are appointing CRO’s and CISO’s with a direct line to the audit committee.

61. Corporate
Governance
Project
Governance
Risk
Management
Cyber
Governance
Risk
Management
Cyber Governance
Cyber Risk
Legal &
Compliance Operational Technical

63. Case Study – How Can CRI Help?

70. It’s About Maturity

71. What’s The Next Step?

73. The Real CISO Challenge
• What cyber controls are in place?
• Are They Appropriate?
• What Maturity Level?
• Why?
• Prove they Are In Place
• Prove they are Appropriate (Inherent Risk)
• How to you deal with dynamic threat landscape?
• How do you deal with interdependence?
• Show metrics and evidence (Level 4)
• How do you align with business?

74. CISO Why?
Business
Alignment
(Management)
ICT
(Technology)
Business Cyber

75. CISO How?
CISO
Office
SOC
RISK
IT
Security
Change
Control

76. Inherent Risk - Metrics
Key To Success on Every Level

77. CISO Framework
Starts with Assessment

78. 5 Domains

79. Assessment Factors

80. Risk / Maturity Relationship
• As inherent risk rises, an institution’s maturity levels should also increase
• Inherent risk profile and maturity levels will change over time
• Consider reevaluating inherent risk profile and cybersecurity maturity
periodically

81. Delivers
• CISO Framework
• Independent Cyber Security Assessment
• Roadmap
• Metrics of Cyber Risk Status
• Cyber Strategy

82. Q&A

83. Thank You – Stay Connected
www.paulcdwyer.com
youtube.com/paulcdwyer
mail@paulcdwyer.com
+353-(0)85 888 1364
@paulcdwyer
WE IDENTIFY, MITIGATE AND MANAGE CYBER RISKS
Cyber Risk International
Broadmeadow Hall– Applewood Village -Swords – Co Dublin – Ireland
+353-(0)1- 905 3260 xxxxxx
mail@cyberriskinternational.com
www.cyberriskinternational.com