1/7/2019 More Connected, More at Risk Addressing Cybersecurity Concerns for Tribal Organizations January 10, 2019 To Receive CPE Credit › Individuals • Participate in entire webinar • Answer polls when they are provided › Groups • Group leader is the person who registered & logged on to the webinar • Answer polls when they are provided • Complete group attendance form • Group leader sign bottom of form • Submit group attendance form to [email protected] within 24 hours of webinar › If all eligibility requirements are met, each participant will be emailed their CPE certificate within 15 business days of webinar 1 1/7/2019 Presenter Rex Johnson Director [email protected] Introductions Rex Johnson, CISSP®, CISA®, CIPT, PMP®, PCIP™ Director Health Care, Financial Services, Not-for-Profit, Government, Education, Telecommunications & Manufacturing Industries 2 1/7/2019 Breaches Are Continuing … Reported Breaches by Year 1579 2017 totals: • 1,579 breaches total 1600 • 178,955,069 records exposed 1400 1091 1200 2018 update through Dec. 5, 2018: • 1,138 breaches 1000 783 780 614 • 561,782,485 records 800 471 421 600 400 200 0 2011 2012 2013 2014 2015 2016 2017 Source: ID Theft Center https://www.idtheftcenter.org 2018 – Data Breach Category Y-T-D Summary (12/5/2018) Incident vs. Breaches Incident Breach › Security event that › Incident that results in compromises integrity, the confirmed confidentiality or disclosure—not just availability of an potential exposure—of information asset data to an unauthorized party Source: Verizon 2018 Data Breach Investigations Report 3 1/7/2019 Breaches Are Costing More & More Average cost per Likelihood of a Average total cost Companies that lost or stolen recurring breach of a data breach record within two years contained a breach in $3.86 million $148 27.9% less than 30 days saved more than $1 Up from $3.62 million 2017 was $141 27.7% last year million vs. those that took more than 30 days Average cost Mean time to Mean time to savings with an to resolve identify a breach contain IR team 197 days 69 day $14/record Source: Ponemon Institute 2018 Cost of Data Breach Study What Are Some of the Cybersecurity Challenges for Tribal Organizations? › Managing two types of business • Federal government • Hospitality › Shadow IT › Mobile devices › Need for more skilled people › Regulatory (such as GDPR) 4 1/7/2019 Tribal Organizations Manage Two Industry Types Industry Count Percent 500 30.00% Health Care 471 26.69% 450 25.00% Financial Services 219 12.41% 400 Retail 199 11.27% 350 20.00% Education 199 11.27% 300 Government 193 10.93% 250 15.00% Technology 130 7.37% 200 Professional Services 92 5.21% 10.00% Other Industries 68 3.85% 150 100 Industrial 60 3.40% 5.00% Entertainment 46 2.61% 50 Hospitality 36 2.04% 0 0.00% Insurance 22 1.25% Nonprofit 21 1.19% Social Media 9 0.51% Source: https://www.breachlevelindex.com/ Shadow IT › Shadow IT refers to IT devices, software & services outside the ownership or control of IT organizations › Departments will often do this to • Circumvent bottlenecks • Avoid slow processes • Rely on familiar software • Compatible with mobile devices • Work with legacy applications that are no longer supported › It is easy to attain software as a service (SaaS) solutions Source: Gartner IT Glossary, https://www.gartner.com/it-glossary/shadow 5 1/7/2019 Risks of Shadow IT › Rutter Networking identified • Increased risk of data loss • Increased risk of data breach • Inefficiencies • Cybersecurity risks › Since acquired outside of IT procurement channels, security is often overlooked › Gartner predicts that by 2020, a third of all successful attacks will be against their shadow IT resources Source: https://www.rutter-net.com/blog/4-security-risks-of-shadow-it Cherokee Nation Pete Self, CISSP, MBA, CCISO Director IT Security 6 1/7/2019 Cybercrime Is Still #1 & Growing Motivations Behind Attacks 2018 through Q3 2016 3.4% 2017 2.4% 4.3% 4.7% 2.5% 14.2% 14.5% 12.7% 9.2% 72.1% 77.4% 82.4% Source: Hackmageddon, https://www.hackmageddon.com/2018-master-table Cybercrime: What Happens? › Use is dependent on the type of information stolen › Most stolen information is sold in underground markets • Criminals steal information from organizations & dump them on the dark web in a variety of forums • Vast networks with various services/goods/crimeware for sale • In many less developed nations, hacking is lucrative in comparison to other jobs available › Ransomware also a profitable means 14 14 7 1/7/2019 The Dark Web What It Is & What It Isn’t What Is This “Dark Web?” Less than › Less than 10% of the internet is accessible 10% of internet through typical search engines › The deep web is a part of the web that contains the most sensitive information › The dark web is the part of the deep web that is intentionally hidden • Requiring an anonymizer to access, e.g., Tor • Uses .onion link; links often shift • Tor – the onion router Source: CISO Platform, • The black market of the internet! http://www.cisoplatform.com/profiles/blogs/surface-web- deep-web-and-dark-web-are-they-different 8 1/7/2019 What Can I Find on the Dark Web? 17 Types of Sites on the Dark Web Paste Sites Forums Marketplace Large data dumps that Discussion forums that cover Anything is for sale are never removed information that could be • Drugs useful to a hacker • Stolen credit cards • Common vulnerabilities • Personal identities • Information about • Passports organizations • Driver’s licenses • Health insurance cards • Other compromised Social Media/Chat Search Engines information Rooms Just like regular search • Dates A place for hackers to sites, but for the dark share information more web privately 9 1/7/2019 Midpoint Question › How much could I get for your credit card on the dark web? About $1 Joker’s Stash is the most Carding Forum popular “carding” forum on the dark web. Credit cards, just $1 each! 10 1/7/2019 Health Insurance Card for Sale Health insurance card sold for just over $62 Health Insurance Card for Sale 11 1/7/2019 Hackers for Hire How Do I Know What a Hacker Would Take? 12 1/7/2019 Types of Cybersecurity Assessments › Penetration testing: assesses the external &/or internal network to search for vulnerabilities. Does not collect data › Social engineering: focuses on the human element of security (phishing, tailgating, etc.) › Physical security: considers the physical aspects of your cybersecurity. Includes secured rooms, entry & exit points, clean desk, etc. Red Team Assessments › An attack simulation that mimics the real activities a hacker would take in your environment › Still provides the network penetration testing results › Collects data & information a hacker would want › Ability to place notional malware & threats › Also known as purple team or digital attack simulations 13 1/7/2019 Breach Life Cycle › Attacks are generally carried out in four stages › These four stages are often referred to as the “breach life cycle” › The further the progression, the greater the risks Infiltration • Infiltration: breaking in & establishing foothold Propagation Exfiltration • Propagation: in the network & moving around • Aggregation: collecting data & critical information Aggregation • Exfiltration: taking the information outside of the organization Breach Life Cycle in Action MINIMAL MAXIMUM IMPACT IMPACT TIME TO DETECTION & RESPONSE 1 2 3 4 1. Infiltration 2. Propagation 3. Aggregation 4. Exfiltration 14 1/7/2019 How the Red Team Works Leadership engages red team Red team hackers break in (infiltrate) Red team propagates & aggregates Once detected, red team shows exfiltration data Provides feedback to security team Publishes the report Red Team Benefits › Simulated attack scenarios from real-world threats › Demonstrates true offensive techniques to organizations › Identify return on investment for cybersecurity solutions › True ‘quantitative’ risk analysis › Focuses on what’s valuable, data & assets › Designed to improve a security team › Still get the penetration test report plus more 15 1/7/2019 Mitigation Steps Recommendations – Basics › Know your inventory • What do you want to protect? • Who do you want to protect it from? • How likely is it that you will need to protect it? • How bad are the consequences if you fail? • Classification of inventory 32 16 1/7/2019 Recommendations – Basics › Educate your team • Technology is no substitute for employee education • Include the board, executives & vendors • Knowledge is power • Do not discourage false-positive reporting • Document & distribute security policies • Develop & rehearse a robust incident response program 33 Recommendations – Basics › Patch your systems • Applications • Databases • Operating systems – servers, workstations, etc. • Anti-virus/anti-malware – engines & signatures • Third-party applications 34 17 1/7/2019 Recommendations – Basics › Limit access • Control use of administrative privileges • Limit access based on need-to-know (least privilege) • Limit & control remote access • Do not share credentials • Consider multifactor authentication • Limit the use of portable media • Don’t forget physical security • Encryption is key, especially when data leaves your organization 35 Recommendation – Basics › Limit access • Human factor is still the weakest link • Remember physical security & limiting access when the following arrive › UPS › Coming in from corporate IT › Service people or technicians › Exterminator › Flower delivery 18 1/7/2019 Recommendations – Basics › Plan, prevent & prepare • Lock your laptop whenever you are away from your workstation