Welcome

Safeguard Iowa Partnership is a voluntary coalion of the state's business and government leaders, who share a commitment to strengthen the capacity of the state to prevent, prepare for, respond to, and recover from disasters through public-private collaboraon. § All parcipant lines are muted § Submit a queson – use the Quesons feature § Webinar is being recorded and will be posted on our website along with presenter slides § Technical ps: ú Ulize a USB headset ú Use a wired connecon vs. wireless ú Close any applicaons on your computer which require large bandwidth OVERVIEW OF CURRENT CYBER THREATS

Division of Criminal Investigation SA Nathan Teigland FBI Omaha Cyber Task Force Overview • FBI Cyber Task Force Mission • Computer Intrusion Definitions • Cyber Threats • Criminal • Counterintelligence • Cyber Terrorism • Incident Response and Recommendations

FBI Priorities 1. Protect the United States from Terrorist Attack. 2. Protect the United States against foreign intelligence operations and espionage. 3. Protect the United States against cyber based attacks and high technology crimes.

UNCLASSIFIED

Cyber Task Force (CTF) § Douglas County Sheriff’s Office § Omaha Police Department § Nebraska State Patrol § Sarpy County Sheriff’s Office § Iowa Division of Criminal Invesgaon

UNCLASSIFIED What is a Computer Intrusion?

Criminal National Security

Goal § Prosecution § Intelligence gathering § Title 18 United States Code § § Sharing of intel with trusted USIC 1030 – Fraud and Related Activity partners in Connection with Computers § Protection of critical infrastructure

Evidence “Discoverable” by the defendant § Typically CLASSIFIED at SECRET level or above § Not released to public

Publicity § Court documents will eventually § Cases do not go to court be unsealed § ID of asset owner will NEVER be § The FBI will not proactively released by FBI divulge information to the media UNCLASSIFIED Exploitation of Trust § Trusted Email ú Inbound e-mail trusted, exploited by “Spear Phishing” § Trusted Internet Websites ú Cross site scripting, remote code execution § Trusted Applications ú Un-patched program vulnerabilities, e.g. PDF, Word, Excel exploits ú Unauthorized software, e.g. media players

§ Trusted Business Relationships ú Subcontractors and/or peer connections ú Mergers, business partnerships, etc. § Trust of Internal Networks ú Authentication performed externally ú “Internal” users assumed to be § Use of ‘Valid’ Credentials

UNCLASSIFIED Criminal - RBS WorldPay

• 15,730 attempted transactions worth $10.2M • 14,544 successful transactions worth $9.7M • $9.4M (97%) was withdrawn on Nov 8 2008 • 2,136 ATM terminals were accessed in over 28 countries Criminal - Phishing Scams Criminal – and Exploit Kits • Used for DoS attacks • Identity Theft • Keyloggers • Common Botnets: Zeus variants, Torpig, Coreflood, Mariposa, Cutwail • Common Exploits Kit: BlackHole, CEK, Styx

Criminal – Cryptolocker CryptoLocker – File Types § Encryption ú Target’s users or company’s personal files:

ú Encrypts files located on local drives, shared drives, and networked drives

CryptoLocker - Payment CryptoLocker – Other Payment Methods CryptoLocker - Payment CryptoLocker - Decryption

Insider Threat – Criminal (Insiders) § Insider with access § Paid money to complete a task § Directed by foreign power § Resources § Disgruntled employee § Terminated § Disagreement with management § Policy change

UNCLASSIFIED 22 Jesse William McGraw aka “Ghost Exodus” § 26 years old. § Hospital security guard. § Leader of the Electronik Tribulation Army. § Sentenced to nine years in prison in 2011. Water Facility Criminal ()

§ Attempt to cause disruption to networks and service and loss of data. § Actions are non-violent and not aimed at individuals, but rather a company or government entity. § Retaliation. § Recent threats – financial, ICS, etc. Criminal (Hacktivism) Criminal (Hacktivism) Cyber Threats – Criminal (Hacktivism) How is ICS (Industrial Control Systems) being attacked? § #1 attack vector - SPEARPHISHING § SHODAN website ú Increased publication of ICS vulnerabilities. ú Shodan is the world's first computer search engine that lets you search the Internet for computers. Find devices based on city, country, latitude/longitude, hostname, operating system and IP. Counterintelligence • Espionage • Today our adversaries can sit on the other side of the globe and have access to an entire network at their fingertips. • Who are they? • Nation-State Actors • Mercenaries for Hire • Rogue • Transnational Criminal Syndicates

Counterintelligence

• What are they after? • Technology • Policies • Intellectual Property • Military Weapons • Military Strategy • They have everything to gain; we have a great deal to lose. New Chinese J20 stealth jet built with stolen F-35 component designs?

“The viciousness, and just the volume of aacks, not only by the Chinese but Russians and others trying to get the blueprints of our most sensive material is just breathtaking – and they’re geng beer.” Rep. Mike Rogers Chairman of the House Intelligence Commiee Cyber Terrorism

§ Growing presence of terrorist organizations on the Internet – recruit and radicalize.

Terrorism – Oil and Gas • • Saudi Aramco • Infected 30,00 computers and rendered them useless. • One of the most destructive infections in a business. • RASGAS - Qatar • Also infected but details are sketchy Terrorism - Financial • US Banking • Coordinated DDOS attack against 30+ banks • Millions of dollars spent responding to attacks • Online banking affected for multiple days • Large institutions request assistance from NSA Terrorism – Electrical Grid

• Energy Sector • A power generation and electric utility facility located in the United States infected by in 2012 • Power company down for three weeks • USB drive initiated infection • Malware was sophisticated in nature Terrorism –

• SEA Objectives: • Propaganda tool • Anti-American • Backed by Government • Identify and track activists • Cause economic damage Intrusion Vectors – What Can You Do?

• Educate, Educate, Educate – First line of defense • “Out of the Box” solutions • Termination Policies • Key assets - what do I need to protect the most? • Monitor (within corporate policy) • Cyber Incident Policy – NIST, SANS, US-CERT Incident Response: § What does law enforcement want to collect? § Logs, logs, logs (IDS, web, server, system, etc) § Images of infected systems § IP’s, domain names, emails – investigative leads. § Highlight information of target value. § Work with IT security and admin personnel. Response What the FBI Cyber TF can do: • Investigate (when, how long, damage?) • Cyber Task Forces • National and International – Legats and Foreign LE • Combine technical skills and investigative experiences • Long-term commitment of resources • Forensics (RCFLs) • Patterns, Signatures and Link Analysis • Monitor – Trespasser/Consensual (Patriot Act) Response

What the FBI Cyber Task Force won’t do: • Place blame on the victim • Take over systems • Repair and mitigate systems • Share proprietary information with competitors. • Provide investigation-related information to the media or shareholders. • Bottom line…we will not further victimize the victim. § Information sharing and analysis effort. § Partnership between the FBI and the private sector. § Businesses, academic institutions, state and local law enforcement agencies, and other participants. § Two Infragard Chapters in Omaha and Des Moines with over 200+ members per Chapter. § www.infragard.org § NIISTFG – Nebraska Iowa ICS Scada Threat Focus Group

S/A Nathan Teigland FBI Cyber Task Force Omaha Division 712-328-4870 [email protected] Mike Chesmore

Not a representative of the:

FBI/DHS/DOJ/NSA/CIA/FSB/NRO/ DEA/DOD/Mi6/ATF/MOSSAD or the CDC

I and only I approved this message. Iowa Division of Intelligence and Fusion Center

Cyber Intelligence Analysis Fusion Centers What are they?

§ Facilitate information exchange among public safety entities. § Developed post 9/11 to address information gaps. § Encompass not only law enforcement but key public and private sector partners. § Today there are 72 designated fusion centers in the U.S. (one in each state and 22 in major urban areas). Iowa Fusion Center

§ Under the Iowa Department of Public Safety (DPS) ú The Iowa Division of Intelligence and Fusion Center has the mission of leading and coordinating intelligence and homeland security efforts that protect Iowa, while upholding the Constitution. History

§ In 2013 the State of Iowa began a pilot project to do cyber intelligence analysis in the Fusion Center. ú Assigned a senior cyber security engineer 50% to cyber intelligence analysis. ú Developed the Mission, Vision and Goals for a cyber intelligence effort. § 2014 ongoing development and clarification of roles and responsibilities. ú Still a moving target. Cyber Mission

§ Maintain Situational Awareness (SA) of the current Cyber threat environment.

§ Collect and analyze information used to reduce Cyber related risk.

§ Provide accurate, up-to-date, actionable intelligence at the strategic and tactical level. Vision

§ All areas of government and our private sector partners require a safe, stable, resilient and agile IT environment. In an increasingly interconnected world we must use intelligence based analytics to calculate and reduce Cybersecurity threats at machine speed. The Iowa Fusion Center Cyber Intelligence effort will be considered successful when it provides customers and consumers with the information required to thwart Cyber attacks prior to their becoming victims. Goals

§ Promote an understanding of Cyber security threats.

§ Collect Cyber information and perform Cyber Intelligence analysis.

§ Share analytical information with trusted partners.

§ Manage the flow of Cyber Intelligence for the Iowa Fusion Center. Activities

Produce a monthly block list Create Cyber Intelligence products • A list of known “bad” IP addresses • Alerts • Over 18,000 IP addresses to • Bulletins date • Informational papers • A list of known bad “URL’s” • Over 250,000 URL’s to date • Distribute to over 40 state, city, county and private sector organizations Limited monitoring of social media for Outreach • Iowa.gov related hacking and event • Partner with Safeguard Iowa using specific posts their reach into the private sector • Monitor “scoreboard” sites to raise threat awareness for Iowa references

Activities

Brief the State of Iowa Information Liaison to FBI and Department of Security Office, CISO Homeland Security • Weekly update the State CISO • Monitor classified FBI and DHS about Fusion Center activities information systems • Pass relevant information to the State of Iowa Information Security Office

Interpret technical Cyber threat information into non-technical speak Out of Scope

Incident Response Vendor Recommendations Penetration Testing Computer Forensics

Contact

Mike Chesmore [email protected] [email protected] Join Safeguard Iowa Partnership www.safeguardiowa.org/application Thank You! Thank You!