Cyber Security and Michigan Businesses February 7, 2019 Agenda US - - PowerPoint PPT Presentation
Cyber Security and Michigan Businesses February 7, 2019 Agenda US Secret Service Jordan Johnston Special Agent with Detroit Field Office Fraud & Cybercrimes Division Member of Electronic Crimes Taskforce Member of Dark
February 7, 2019
U.S. Department of Homeland Security
United States Secret Service
Jordan Johnston Special Agent U.S. Secret Service Detroit Field Office
U.S. Department of Homeland Security
United States Secret Service
“The mission of the United States Secret Service is to safeguard the nation’s financial infrastructure and payment systems to preserve the integrity of the economy, and To protect national leaders, visiting heads of government, designated sites and National Special Security Events.”
U.S. Department of Homeland Security
United States Secret Service
▪ Identity Theft ▪ Access Device Fraud ▪ Network Intrusions
U.S. Department of Homeland Security
United States Secret Service
Received 298,728 cyber crime and fraud complaints Reported losses in excess of $1.4 billion BEC was the #1 cause of loss BEC global exposure, 2013-2016: Over $5 billion (reported) $5,302,890,449 Number of victims: 40,203 (the math)--$131,902.85/victim BEC from January 2016 - June 2017: Attempted $222.9 million Returned/Frozen $74,831,206 (34%) Unrecovered $148.1 million(66%)
U.S. Department of Homeland Security
United States Secret Service
PII (personally identifiable information) – any data that either on its
specific individual, e.g., name, SSN, DL, and DOB.
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
“Dumped” Card Information is Transmitted Overseas and Sold
U.S. Department of Homeland Security
United States Secret Service
Sophisticated Botnets Point of Sale Malware Fraudulent Payment Methods Business Email Compromise Distributed Denial of Service Mobile Payment
U.S. Department of Homeland Security
United States Secret Service
Point Of Sale Network Intrusions
(malware/keyloggers/sniffers)
Data Flow
U.S. Department of Homeland Security
United States Secret Service
authentication login
games, and check Facebook
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
suppliers and/or businesses that regularly perform wire transfer payments
techniques
What is a Business Email Compromise?
scam, the BEC was renamed to focus on the business angle of this scam
U.S. Department of Homeland Security
United States Secret Service
1. Vector is stolen credentials and/or malware, or email from a spoofed or similar domain 2. Compromised systems monitored and/or files scanned for invoices/accounts payable 3. Snooping or surveillance conducted on executives and/or their staff 4. Impersonation of executives executed by way of email, voice, call-forwarding, and/or fax
U.S. Department of Homeland Security
United States Secret Service
“Money Mule”—A witting or unwitting individual directed to open bank accounts to receive fraudulent money transfers, and then transfer funds to other (fraudulent) bank accounts
U.S. Department of Homeland Security
United States Secret Service
Often acquired online through social engineering and fake job postings on:
—Money Mules are a Challenge—
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
▪ Southern University contracted with a company for construction work at the university. ▪ D.M., the Assistant Director of Payment Services for Southern University, received an email directing him to change Company’s ACH payment account ▪ Email extension read “accts.receivable@companyinc.com” ▪ The email extension for (actual) Company should be “@company.com”
U.S. Department of Homeland Security
United States Secret Service
▪ Attached to the fraudulent email was a blank Citibank check purportedly from Company Inc.—with a routing number, account number, and check number—and an Authorization Agreement for Automatic Deposit of Vendor Checks purportedly from “Company Inc.” and signed by a person purportedly named “Tim Stallings.” ▪ The next day, Southern University made three payments via wire transfer, totaling $1.3 million, to “Company Inc.” ▪ (Actual) Company Inc. never received payment from Southern University. ▪ Investigators reviewed the fraudulent account and discovered a $20,000 wire transfer into the bank account of “West Coast Designs,” belonging to Linda Lee.
U.S. Department of Homeland Security
United States Secret Service
▪ Linda Lee explains she co-owns the business with her fiancée, Dennis Rand, whom she has never met. Rand directed Lee to open three bank accounts. ▪ Lee states business is booming, with a recent $1.3 million design deal in Texas. ▪ Lee states Rand asked her to occasionally move money from one account into another. ▪ Investigators explained to Lee the $1.3 million was illegally obtained from Southern University, not a design deal. ▪ Lee agreed to forfeit the remaining money in the account and provided a detailed ledger of account activity. ▪ Investigators tracked the funds transferred Southern University's transaction to an account owned by Sam Smith.
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
U.S. Department of Homeland Security
United States Secret Service
Experian.com/small business/mailing lists InfoUSA.com DatabaseUSA.com ReferYes.com Dark Web Marketplaces eGrabber.com—“Capture leads & prospects from any webpage, find & add any missing field (email/phone/...), update, de-dupe, merge & segment any prospect list”
U.S. Department of Homeland Security
United States Secret Service
– Change in payment type or location – Speedy or secret transfers
U.S. Department of Homeland Security
United States Secret Service
– Existing invoices – Bank deposit information and/or contact information
email requests for payments or personnel records transfers
U.S. Department of Homeland Security
United States Secret Service
current with industry trends
are protecting your organization from cyber attacks
U.S. Department of Homeland Security
United States Secret Service
could let BEC/EAC scammers know when executives are out-of-reach
about friends, family, and business deals
U.S. Department of Homeland Security
United States Secret Service
employees to use for personal email and web activity
U.S. Department of Homeland Security
United States Secret Service
– Immediately change your password and log out of all – Check for new “rules” within your account
and provides you the ability to log out others
U.S. Department of Homeland Security
United States Secret Service
account
U.S. Department of Homeland Security
United States Secret Service
Internet Crime Complaint Center www.ic3.gov Electronic Crimes Task Force www.secretservice.gov/investigation /#field
U.S. Department of Homeland Security
United States Secret Service
Jordan Johnston Special Agent Detroit Field Office 313-226-6400 Jordan.johnston@usss.dhs.gov
39
CloudSAFE Luncheon w/ Mimecast| February 7, 2019
40
1 2 3 4
Dynamic global threat landscape. Cybersecurity skills gap. Persistent human error. Complex IT environments.
41
allow block bad good
people places things
42
* Verizon DBIR 2018 Report ** IBM 2014, Willis Watson 2017 *** Mimecast 2018
43
44
45
intelligence
infrastructure
46
Advanced Intelligence
Visibility
Rapid Evolution
47
Email Security & Mailbox Continuity Archive & Data Protection Web Security Awareness Training
48
49
Secure Email Gateway Targeted Threat Protection
URL Protect Attachment Protect Impersonation Protect Internal Email Protect
Data Leak Protection & Content Control
Expanded Security Options
Email Continuity Sync & Recover Large File Send Secure Messaging
50
Web Security
Web Security Agent
Malicious URLs File Downloads Appropriate Access
51
Awareness Training Engaging Training
Phish Testing Risk Scoring Targeted Remediation
Awareness Training Introduction
52
Cloud Archive
E-Discovery Compliance End User Search Expanded Archiving Options
Supervision Sync & Recover Long Term Retention
53
URL Protect
June October
Graymail Control Australia Datacenter
July November
Attachment Protect
May
Impersonation Protect Internal Email Protect
February November
Integration
for static file analysis GDPR Compliance
February
Ataata Acquisition
July August
Acquisition
Launched Web Security Product
September February
Continuity Event Management
2014
Sync & Recover
July
Launch Cyber Resilience Coalition
August
Data logging API and Splunk application
October September
Mimecaster Central Customer Portal Gartner Magic Quadrant Leader
November June
German Datacenter
2015 2016 2017 2018
HIPAA Compliance Assessment
April
54
70+ CUSTOMER INTEGRATIONS ALLIANCES API ALLIANCES
Integrations are limited only by your imagination
55
A New Approach to Information Security is Needed You must:
CloudSAFE Confidential 57
desktop inside a virtual machine that lives on a server in the datacenter
virtualization
user
centralized management
Application Security
from employee-owned devices
denial of service attacks
Contextual Access
Ensure appropriate levels of access for every individual – inside & outside your
Data Security
the endpoint
via containerization & encryption
Network Security
desktops
performance
Analytics and Insights
audits
Cyber Resilience for Email
keep sensitive data off the endpoint
compromising the endpoint
measures including containerization, encryption, blacklists and whitelists, and device compliance checks
encrypted data with a secure and robust data backup and disaster recovery solution
Browsers
Publish virtualized, sandboxed and hardened browsers
Publish a virtualized, sandboxed, and hardened email client
Mobile
Protect mobile devices against attack with containerization
Collaboration
Provide a secure and robust content collaboration platform
Virtual Desktops and Workspaces - Dynamically created from compliant copies of
for regulatory compliance
signs of an infection
Virtualized Desktops help lower the costs of disaster recovery and business continuity
the event of a flu outbreak
Sensitive data remains in the data center where security can protect against leaks
inspect
the screen so the need for endpoint data protection is lessened
Virtual workspaces secure remote user access to the network by isolating VPN clients and browsers on the endpoint
home computer
against threats like keystroke loggers and memory mappers, application and operating system infections, and end-user reconfiguration of security settings
Resource Centralization
in the data center
managed Windows apps and desktops
Policy-based Access Control
determine appropriate user access
delivering the right level of access for:
Any-device Access
every employee, contractor or partner from any personal or corporate-owned device they choose to use
administrator-defined criteria
Built-in Data Compliance
Unique User Identifier Each authorized user is allocated a unique user identifier which they must use whenever logging in Identifier is centrally issued, so that admins have the ability to PIN- lock the user´s access to data if necessary Automatic Log Offs An essential security feature for many compliance standards Ensures that if a device is left unattended, the user will be disconnected to prevent unauthorized access
Take Action to Protect Yourself
Educate and Support your Most Vulnerable Point of Entry
End Users
Prevent Threats and Mistakes
Safeguard
Ensure Recovery if an Attack Does Get Through
Recover
617-393-7198 rharvey@mimecast.com