E-Crime & Cybersecurity Benelux 2018
Total Page：16
File Type：pdf, Size：1020Kb
6th December 2018 Amsterdam, The Netherlands Transparency plus transformation: the cybersecurity rubicon Welcome to e-Crime th 6 December 2018 & Cybersecurity Novotel Amsterdam City Benelux 2018 s business moves increasingly to digital 3 Security resilience in the face of evolving channels across Europe, fraud attempts and attacker tradecraft Aother cyber-enabled economic crime are rising Stories from the cyber battlefield. sharply. And recent research has shown that as well CrowdStrike as increasing volumes, there has been an evolution from short, isolated peaks of fraud attacks to more 5 Weighing your threat intelligence options sustained, high-volume attacks across a number of If your organisation is looking to make an days or even weeks. investment in threat intelligence, you’ll need to evaluate what different vendors deliver, how In addition, digital transformation is moving they align with your objectives, and the increasingly to mobile, rather than desktop online, advantage they’ll bring to your security strategy. channels. In Europe, 58% of all transactions now Recorded Future come from mobile devices and growth is accelerating. 7 To understand phishing, look at crimes of These trends pose a huge challenge for business and the past for cybersecurity professionals. Businesses need to Phishing is a modern problem but its roots go go digital and to make digital channels as seamless back hundreds of years. as possible for their customers. But they also need to Cofense keep those transactions, and their customers’ personal data, secure. Cybersecurity is therefore a 11 Voice and the future of personal identification strategic business imperative. Despite the more general upward trend of data breaches and sophisticated cross-channel attacks, It is these topics, and more, that we will be discussing businesses have mostly remained stagnant when th at our 8 annual e-Crime & Cybersecurity Benelux as approaching phone channel security. well as hearing about the latest technologies from Pindrop some of the key providers. But one of the main aims of our events is to facilitate conversation and dialogue. 13 Healthcare beware: crypto-mining, So please, enjoy your event, and take the opportunity malware, and IoT attacks to mingle with colleagues and solution providers. If The healthcare industry is increasingly being you have any questions, please do not hesitate to ask targeted by advanced cyber-attacks. any member of the team. Darktrace Simon Brady | Editor 16 Global financial firm reduces risk of third- party breach with BitSight Security Ratings A leader in commercial banking, this global financial @eCrime_Congress #ecrime18 services firm is no stranger to security risk. BitSight Technologies Editor and Publisher: Forum organiser: Booklet printed by: Simon Brady AKJ Associates Ltd Method UK Ltd e: [email protected] 27 John Street Baird House London WC1N 2BX 15–17 St Cross Street Design and Production: t: +44 (0) 20 7242 7498 London EC1N 8UN Julie Foster e: [email protected] e: [email protected] e: [email protected] © AKJ Associates Ltd 2018. All rights reserved. Reproduction in whole or part without written permission is strictly prohibited. Articles published in this magazine are not necessarily the views of AKJ Associates Ltd. The publishers and authors of this magazine do not bear any responsibility for errors contained within this publication, or for any omissions. This magazine does not purport to offer investment, legal or any other type of advice, and should not be read as if it does. Those organisations sponsoring or supporting e-Crime & Cybersecurity Benelux bear no responsibility, either singularly or collectively, for the content of this magazine. Neither can those organisations sponsoring or supporting e-Crime & Cybersecurity Benelux, either singularly or collectively, take responsibility for any use that may be made of the content contained inside the magazine. e-Crime & Cybersecurity Benelux 2018 1 CONTENTS 19 Sponsors and exhibitors 40 Harness the power of global shared Who they are and what they do. intelligence with the ThreatMetrix Digital Identity Network 24 Agenda Distinguish fraudsters from genuine customers What is happening and when. in real time, throughout the customer journey. ThreatMetrix 28 Education seminars Throughout the day a series of education seminars 42 GDPR needs you to know where your will take place as part of the main agenda. sensitive data is. Do you? Do you know where all your sensitive data is? 31 Speakers and panellists Ground Labs Names and biographies. 45 Why nothing less than complete visibility is 36 A new dawn for data loss prevention enough when the worst happens For more than 10 years, Digital Guardian The surety of knowing precisely what happened, has enabled data-rich organisations to protect how, and what was affected – and knowing it their most valuable assets with a SaaS quickly – is invaluable. deployment model or an outsourced managed Endace security programme. Digital Guardian 47 Duo has the solution The first article discusses restricting users so 38 Threat modelling: The challenge in that they can only enter into an area that is managing risk to both structural and approved & relevant to their duties. The second technical vulnerabilities focusses on Duo’s authentication solution Traditional vulnerability scanning lacks the ability characterised by its simplicity in implementation to see the bigger picture. and operation. foreseeti Duo Security 2 e-Crime & Cybersecurity Benelux 2018 Security resilience in the face of evolving attacker tradecraft Stories from the cyber battlefield. he impact left in the wake of a successful Situational analysis CrowdStrike intrusion can be massive when customer data A commercial services organisation contacted reports Tor other confidential information is stolen, CrowdStrike Services after being hit by the SamSam exposed, changed or deleted. It’s an inescapable ransomware variant, which is commonly associated certainty that where valuable digital assets exist, with xDedic, a Russian-operated darknet forum. The threat actors follow. From the global WannaCry e-crime operators of xDedic have been implicated in a ransomware attack to the destructive stealth number of nation-state attacks against public sector propagation techniques of NotPetya malware, threat organisations (you can read more about them at: actors are continuously adopting new means to https://www.crowdstrike.com/blog/education-darknet- achieve their objectives. hackers-profit-data/ ).3 To keep pace, security stakeholders from CISOs and xDedic operates a market for the selling and buying SOC managers to incident responders must evolve of crimeware and compromised credentials used for their security strategies and ensure resilience in the accessing RDP servers. After xDedic sells access to face of new attacks. Below is real-world case study these compromised RDP servers, they are then used featured in the CrowdStrike Cyber Intrusion Services in attacks against government agencies and other Casebook, 2017. This much anticipated publication commercial targets. offers detailed accounts of some of the cases the CrowdStrike Services incident response (IR) team has Although the organisation had already paid the investigated over the past year, and provides expert, ransom when they contacted CrowdStrike, they real-world analysis and practical guidance that can sought help to prevent the ransomware from further your organisation’s progress toward that goal. spreading to other systems and to determine the original point of entry by the attackers. Drawn from real-life engagements, the Casebook provides valuable insights into the evolving tactics, The CrowdStrike Services team first verified the techniques, and procedures (TTPs) used by today’s exact ransomware variant used in the attack. Notably, most sophisticated adversaries. It also describes the the variant involved automatically encrypts files on strategies the CrowdStrike Services team used to the victim’s network – a common ransomware tactic quickly investigate, identify and effectively remove – however, it doesn’t give the attacker the ability to dangerous threats from victims’ networks. access, acquire or exfiltrate data from the network. One key trend the CrowdStrike team observed is that The team observed that the adversary used Sticky the lines between nation-state sponsored attack Keys to launch brute-force attacks and gain RDP login groups and e-crime threat actors continue to blur. As credentials so they could move about the victim’s part of this trend, the increase in criminal hackers environment freely. Sticky Keys is a Windows Ease of using fileless attacks and ‘living off the land’ Access feature that enables keyboard shortcuts. techniques has been especially pronounced. This Once compromised, it can provide an adversary uptick in fileless attacks is also documented and system-level access without needing to authenticate independently verified in a recent report and provided the attackers with an effective from Ponemon Research .1 Fileless attacks include persistence mechanism. exploiting processes that are native to the Windows operating system such as PowerShell and Windows Other fileless or ‘living off the land’ TTPs tied to Management Instrumentation (WMI). ‘Living off the xDedic that the investigators found included land’ describes how adversaries move within the compromised privileged accounts and network login victim’s environment once they gain access, often brute-force