Elad Ben Meir, VP Strategic Accounts CyberInt. The Hidden Cyber- Crime Economy

Transcription

1 Elad Ben Meir, VP Strategic Accounts CyberInt The Hidden Cyber- Crime Economy

2 Daily Interactions are Changing New digital interactions alter people s experiences with, and expectations of, brands Pope Benedict Inauguration (2005) Pope Francis Inauguration (2013)

3 Online Engagements are Thriving People s daily mobile usage more than doubled!

4 Digitalisation is changing the threat landscape

5 Changing Tides in Retail Less High Street, more pure-play and omni-channel UK s face-to-face spending for 2017, fell by 3.7%, while online sales rose by 3.6% Customer-centric approach, with a distinct focus on enhanced customer experience and rapid growth Streamlining their refund process Rapid changes to online assets (websites, social media networks ) Rapid onboarding of new tech Omni channel approach Integrated supply chains

6 What are the Threats?

7 What are the Threats? Return/Refund Fraud Techniques used to return stolen, damaged or ineligible goods for replacement or refund Evolved to target online retailers with discussions, services and tutorials helping threat actors commit the fraud Threat actors learn and share details of retailers with customer-friendly return policies Social-engineering techniques widely used to coerce customer service teams into issuing refunds or replacements Tools and templates available to generate fake receipts Product identifiers, such as serials numbers, obtained from online photographs such as those on auction sites

8 What are the Threats? Data breaches In particular payment card data and PII Attacks will use a variety of methods across the cyber kill chain with the objective of acquiring payment card data Backend systems as well as PoS systems targeted PoS can be targeted by malware or physical attacks Stolen data is easily monetised GDPR

9 What are the Threats? Account Checkers & Credential Stuffing Customers reuse credentials across multiple services Threat actors use account checker tools to automate the testing of credential sets known as combos This process is known as credential stuffing and allows accounts to be later resold or abused for fraudulent activity Tools are readily available, either for free or at a low fee Well supported with a range of updated configs to target various online retailers and services Currently popular tools: Sentry MBA (the grandfather of account checkers) SNIPR (Clean and simple interface) Countless service specific tools

10 What are the Threats? Cryptojacking, the rising star of 2018 Off-the-shelf services so easy to deploy Cryptocurrency anonymity resulting in low risk to threat actor High-volume of victims delivers financial results (even if they only run the mining script for a short period) Targeting devices within your organisation potentially leading to degradation or denial of service Compromising online assets or advertisements to deliver cryptominers to your customers Typosquatting popular domains to deliver the cryptominer

11 What are the Threats? Bots, bots and some more bots Scraping bots for digital assets Inventory and price altering bots Direct operations losses The foundation to secondary markets and counterfeits (ebay, Alibaba and dedicated e-commerce sites) A new attack vector - Chatbots

12 What can you do? It s not all about flashing LEDs and threat maps! Sometimes simple measures can be effective, for example: Reduce your attack surface by disabling unused features Practice good password hygiene Logging is great, so long as it s monitored Spot attacks whilst they re small, don t wait to be told by someone else Ensure you have the necessary skills in-house, or partner with a trusted organisation, to manage detection and response Humans will continue to be exploited Consider security awareness training for employees Provide guidance to customers and suppliers WarGames 1983 MGM/United Artists

13 What can you do? Understand your risks and don t be afraid to share Understand and assess your exposure and risk Identify your critical assets (data) Prioritise based on risk/cost benefit Information sharing, internally and externally Ensure your C-levels/board understand the threats Generate and consume threat intelligence Industry groups, forums and national bodies Cooperate and learn from law enforcement

14 Digital Risk Management as a Managed Service You focus on growing your business, we ll focus on securing it! CyberInt was founded in 2009 with global offices in the US, UK, Israel and Singapore. We offer Managed Detection and Response services, focusing on protecting digital businesses. Our solutions solve a wide range of business concerns, from fraud and brand impacting cyber incidents to a fully managed SOC with global response teams. Come visit booth B165

15 Thank You.