Cybersecurity, Phishing, and MFA for VPN Irwin Gaines Report to UEC Dec 7 2018
“Rebranding” of former computer security team We are now the Cybersecurity team All communication to cybersecurity@fnal.gov (including incident reports, phishing reports or questions, other cybersecurity questions, etc.) new web page at http://securityawareness.fnal.gov Emphasis on partnership between cybersecurity team, management, and employees 2 1/14/2019 Phishing Report - Irwin Gaines
3 1/14/2019 Phishing Report - Irwin Gaines
Outline • Cybersecurity is everyone’s responsibility • Phishing: Forged email trying to induce the recipient to click on a link which will either download malicious software to their computer (or mobile device) or take the user to a seemingly legitimate website to “phish” for user credentials or other personal information. – Why phishing exercises – What were the exercises – Results of the exercises – Consequences: moving forward (Proofpoint) • MFA and VTC – MFA already in use at Fermi but primarily for privileged access to enterprise systems and any access to business and HR systems; scientists and user community not impacted – New threats require additional use, in particular VPN which will impact scientists and users 4 1/14/2019 Phishing Report - Irwin Gaines
Why phishing exercises • Statistically, phishing remains as one of the primary means to compromise an individual or company – According to a study done by Google, phishing poses the biggest threat to your online security [1] – 91% of cyber attacks (from 2015 to 2016) start with a phishing email [2] – Notable compromises have been accomplished via phishing – a handful of examples include: PNNL/ORNL [3], Sony [4], and DNC [5]. – Phishing combined with password reuse leads to further possible compromises via credential stuffing • Fermilab has implemented anti-phishing training and incorporated phishing assessment as part of its security awareness training – There previously hasn’t existed means to actually test the effectiveness of this training 5 1/14/2019 Phishing Report - Irwin Gaines
Why phishing exercises (2) • We have not done phishing exercises in the past, partly because of my (now proved to be mistaken) belief that our employees and users would not click on malicious links in email • But with the increasing prevalence of phishing and with the frequent breaches of government systems because of responses to phishing, the government and DOE are requiring such exercises • Seeing the handwriting on the wall, we began regular exercises last summer (shortly before we were told to do them) 6 1/14/2019 Phishing Report - Irwin Gaines
Initial Flood of Phishing Reports • On Tuesday, June 26, 2018 (starting at 8:50am), a flood of reports (over 40) came into Fermi’s Incident Response (FIR) Team • Link was blocked within five minutes by FIR • Looking into the email, it appeared that the sender’s account was compromised 7 1/14/2019 Art Lee | User Compromise Involving Lab Director Phishing Emails
Phishing exercise details • A number of different campaigns have been run – these were all based on real- world scenarios and had different goals to assess awareness with Fermi users (those with mailboxes). All had a variety of clues indicating they were not legitimate • July 2017 – The first campaign was a package delivery phish which simulated a UPS delivery notification – its intent was to look slightly “genuine” – The second campaign was a password reset phish which was based on a real password reset email – its intent was to see the response rate for garden variety phishing • Aug 2017 – The first campaign was a password reset phish modeled after a real email reported to CST last month • This included a link to a website (hosted on by the testing provider) that simulated a web- based password reset form – The second campaign was a scam phish requesting a user to send money as an investment to receive more money • This was based on real (and frequent) scam emails, however has been modified for context 8 1/14/2019 Phishing Report - Irwin Gaines
Phishing exercise details (2) • Sep 2017 – The first campaign was a Facebook deactivation confirmation phish • This was based on real phishing emails not generally received by Fermi users; however these are very common – The second campaign was a scam phish impersonating a Charles Schwab email requesting a user to receive money • This was based on a real phishing email received by Fermi users • Oct 2017 – The first campaign was a FedEx delivery notification phis • This was based off a real FedEx delivery email. This is a followup to the UPS delivery notification phish from July of this year. – The second campaign was a scam phish noting that a foreign email address was added to a user’s Paypal account • This was based on a real phishing scheme – however this has not been reported to us from Fermi users. 9 1/14/2019 Phishing Report - Irwin Gaines
Phishing exercise details (3) • Nov 2017 – The first campaign was a Netflix billing campaign • This was based off a real Netflix phishing scam. It was designed to trick users into thinking that their Netflix payment was not validated, resulting in a suspension of the account. – The second campaign was a USPS phish noting the delivery status of the shipment. • This was targeted specifically to repeat offenders that clicked on both the past UPS and FedEx package delivery phish campaigns. • Feb 2018 – The first campaign was a Microsoft security alert • This is an email from “Microsoft” stating that someone else may have accessed his/her account. If the user clicks the link to verify the account, a fake login page will be shown. The user may enter his/her credentials into this form. – The second campaign was a DropBox sharing notification • This is an email from “DropBox” stating that a person has shared a PDF regarding neutrinos with the user 10 1/14/2019 Phishing Report - Irwin Gaines
UPS Quantum View campaign 11 1/14/2019 Phishing Report - Irwin Gaines
ICT Service Desk campaign 12 1/14/2019 Phishing Report - Irwin Gaines
Please reset your password campaign (1 of 2) 13 1/14/2019 Phishing Report - Irwin Gaines
Please reset your password campaign (2 of 2) 14 1/14/2019 Phishing Report - Irwin Gaines
LETTER FROM HOSPITAL campaign 15 1/14/2019 Phishing Report - Irwin Gaines
Sorry to see you leave Facebook! campaign 16 1/14/2019 Phishing Report - Irwin Gaines
Your Schwab Brokerage Deposit campaign 17 1/14/2019 Phishing Report - Irwin Gaines
FedEx Tracking Email campaign 18 1/14/2019 Phishing Report - Irwin Gaines
Paypal email address campaign 19 1/14/2019 Phishing Report - Irwin Gaines
Netflix Billing Campaign 20 1/14/2019 Phishing Report - Irwin Gaines
USPS Delivery Status 21 1/14/2019 Phishing Report - Irwin Gaines
Microsoft Security Alert 22 1/14/2019 Phishing Report - Irwin Gaines
Microsoft Security Alert 23 1/14/2019 Phishing Report - Irwin Gaines
DropBox Sharing 24 1/14/2019 Phishing Report - Irwin Gaines
Phish landing page 25 1/14/2019 Phishing Report - Irwin Gaines
Phish landing page 26 1/14/2019 Phishing Report - Irwin Gaines
Campaign # clicks % clicks # reports # repeats Results of Phishing Exercises UPS delivery 753 27% 38 ICT service desk 177 7% 52 Reset password 327/199 12%/8% 62 Letter from hospital 7 0.3% 25 Facebook deactivation 159 5.8% 54 Schwab brokerage 37 1.3% 44 FedEx tracking 345 13% 110 293 Paypal email addr 227 8% 122 206 Netflix 115 4% 84 164 USPS (only 137 users) 50 36% 1 50 Microsoft alert 57/10 2%/0.4% 166 96 Dropbox 115 4% 50 179 27 1/14/2019 Phishing Report - Irwin Gaines
Overall lessons learned • Click rates are still higher than we would like, but overall performance is improving • Repeat offenders be a problem, considering 137 users fell for both the UPS and the FedEx shipping phishes, and 50 still fell for the USPS phish • Users reporting phishes has gone way up • Many users read the phish email from mobile devices and/or from outside of Fermilab (and so will not be protected by web blocks at the lab) – Note that first report of a new phish will have the landing site for that phish blocked in our web proxies, providing protection for anyone who is on site when they click 28 1/14/2019 Phishing Report - Irwin Gaines
Going forward • Regular phishing campaigns will continue to be implemented – some will use varied attack vectors • There will be consequences to users when they repeatedly “fail” a phishing exercise – Currently 43 3-time offenders have had Remedial Phishing Training added to their ITPs • URL “defanging” service being implemented from ProofPoint – This will prepend links to ProofPoint’s servers to verify if a link is legitimate or not – Unlike controls like the proxy servers, this can mitigate risks outside of the lab – This can also mitigate risks regardless of platform (Windows, MacOS, iOS, Android, etc.) – Whitelisting and blacklisting will be possible for versatility • Still need to raise ongoing awareness with users – securityawareness.fnal.gov 29 1/14/2019 Phishing Report - Irwin Gaines
30 1/14/2019 Phishing Report - Irwin Gaines
Recommend
More recommend
