Ransomware Threat: Keeping Your Network secure Cyber Security Risks and Mitigation Strategies Investment advisory services are offered through CliftonLarsonAllen Wealth Advisors, LLC, an SEC‐registered investment advisor. | ©2016 CliftonLarsonAllen LLP WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING LLP 2017 National Cyber Security Trends CliftonLarsonAllen ©2016 •Over 4 billion data records were stolen in 2016 ◊ http://www.zdnet.com/article/over‐four‐billion‐data‐records‐were‐stolen‐in‐2016/ • 312 data breaches as of March 14, 2017 ◊ https://www.scmagazine.com/report‐finds‐more‐than‐312‐data‐breaches‐this‐year/article/644421/ • Cyberattacks cost small to medium business approximately $86K per incident and larger organizations ten times that amount ◊ http://blogs.rsa.com/best‐advice‐digital‐citizens‐stop‐think‐connect/ •Today’s cyber‐criminals prefer to target data, rather that to steal dollars WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 2 LLP A Few Company Breaches reported in 2017 CliftonLarsonAllen • 21st Century Oncology •Madison Square Garden ©2016 •Blue Shield • MedStar Health • Cellebrite • Neiman Marcus •Dun & Bradstreet •Quest Diagnotics •E‐Sports Entertainment Association • Radiology Regional Center (ESEA) •University of Central Florida •HEI Hotels •Verity Health •Highmark BlueCross BlueShield of •Verizon Enterprise Solutions Delaware •VTech • Holiday Inn • WellCare Health Plans Inc. of • Horizon Blue Cross Florida • Landry's restaurants •Yahoo • Little Red Door Cancer Services of East Central Indiana WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 3 LLPLLP CliftonLarsonAllen CliftonLarsonAllen ©2016©2015 The Threat Landscape Know your enemy 4 LLP Overview –Threat Landscape CliftonLarsonAllen ©2016 • Information Security Risks –Data loss –Data corruption –Data leakage –Data access –Loss of network privacy –Loss of network security –Loss of computing equipment •How do we secure systems? WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 5 LLP Definition of a Secure System CliftonLarsonAllen ©2016 “A secure system is one we can depend on to behave as we expect.” Source: “Web Security and Commerce” by Simson Garfinkel with Gene Spafford What we expect –Confidentiality –Integrity –Availability WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 6 LLP Why are we attacked? CliftonLarsonAllen ©2016 WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 7 LLP Cybercrime Industry CliftonLarsonAllen ©2016 • Suppliers •Markets •Service providers (“cybercrime as a service”) • Trading systems • Proliferation of business models WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 8 LLP Cybercrime CliftonLarsonAllen ©2016 •Hackers have “monetized” their activity –More sophisticated hacking –More “hands‐on” effort –Black market economy – 89% of breaches has a financial or espionage motive ◊ Verizon 2016 Data Breach Investigations Report (DBIR) •Phishing is a root cause behind the majority of cyber fraud and hacking attacks including ransomware WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 9 LLP Cybercrime Motivation CliftonLarsonAllen ©2016 WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 10 LLP How do attackers get in? CliftonLarsonAllen ©2016 • Email Phishing –“Spear Phishing” • Malware – targeted – ransomware • Poor Configuration •Social Engineering • Employees WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 11 LLP How do attackers get in ‐ Protecting Yourself CliftonLarsonAllen ©2016 • Most breaches or malware infections start from one of two scenarios –Phishing email – Browsing to a compromised/malicious website •It is important to learn how to identify if the email message or the website are legitimate and safe WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 12 LLP Statics CliftonLarsonAllen ©2016 Dataset contained approximately 100,000 incidents of which 3,141 were confirmed data breaches Number of security incidents by victim industry and organization size. 2016 Verizon DBIR WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 13 LLP Statics CliftonLarsonAllen ©2016 Dataset contained approximately 100,000 incidents of which 3,141 were confirmed data breaches Number of security incidents with confirmed data loss by victim industry and organization size 2016 Verizon DBIR WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 14 LLPLLP CliftonLarsonAllen CliftonLarsonAllen ©2016©2015 EMAIL PHISHING Know the primary attack 15 LLP What is Email Phishing? CliftonLarsonAllen ©2016 •Simply put: – Convince someone to perform an action that will benefit the attacker •What is that action? – Visit a malicious website – Download and open a malicious file –Provide confidential information ◊ (Password, Account Number, etc.) WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 16 LLP Email Phishing Attack CliftonLarsonAllen ©2016 •Traditional Attack (Spamming) – Attacker targets a large amount of users • Spear Phishing –A custom message is built for a specific target • Whaling –“C‐level” executives or management is specifically targeted WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 17 LLP Spotting a Malicious Link CliftonLarsonAllen ©2016 The link requests the user to visit a website to perform account maintenance. WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 18 LLP Uncovering a Malicious Link 1. Hovering over a link with your mouse will show the true path of an email link. CliftonLarsonAllen ©2016 2. This link appears to go to Amazon but is actually going to a malicious site. WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 19 LLP Phishing Example CliftonLarsonAllen ©2016 WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 20 LLP Spoofed Internal Source CliftonLarsonAllen ©2016 •Hackers are becoming more sophisticated with their email phishing attacks everyday. •It is becoming more common for an email phishing message to appear to come from a trusted internal source. WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 21 The Ransomware next great threat? 22 ©2016©2015 CliftonLarsonAllen LLP LLP Ransomware Impact CliftonLarsonAllen • Ransomware Damages Predicted to Reach $1 Billion Annually ©2016 in 2017 • Ransomware spiked 752% in new families in 2016 • Ransomware attacks hit over 700,000 users in one year • Ransomware threat on the rise as 'almost 40% of businesses attacked’ •The FBI says it received 2,453 complaints about ransomware hold‐ups last year, costing the victims more than $24 million dollars WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 23 LLP Ransomware ‐ Threat Landscape CliftonLarsonAllen ©2016 http://www.trendmicro.com/vinfo/us/security/research‐and‐analysis/threat‐reports/roundup WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 24 LLP Ransomware ‐ Threat Landscape CliftonLarsonAllen ©2016 http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/ISTR2016_Rans omware_and_Businesses.pdf WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 25 LLP What is Ransomware? CliftonLarsonAllen ©2016 A type of malicious software designed to block access to a system until a sum of money is paid. •Low Grade ◊ Fake antivirus tools pretend to detect malware issues and demand payment to fix them. • Middle Grade ◊ Law enforcement scams use fake FBI or U.S. Department of Justice messages to claim they've detected illegal activity on your computer for which you need to pay a fine. • Most Dangerous ◊ Pop‐up messages say your files are encrypted and demand ransom money be paid by a deadline in order to return them. WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 26 LLP What is Ransomware? CliftonLarsonAllen ©2016 •Many variants and constant evolution – CryptoWall, CryptoLocker, Mamba, etc. ◊ Well over 400 and counting – Encrypt all data, hold it “ransom” for $$ ◊ Data on local machine and on network ◊ Payments are often in Bitcoin •Not just Windows operating systems, also Apple •Some strains have custom ransomware web pages that are customized to their victim • Attack on the Availability of network data WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 27 LLP What is Ransomware? CliftonLarsonAllen ©2016 • Easier to do than exfiltration of the data • Cyber criminals attempt to delete host and network backups • User credentials are used for network access •FBI has told victims to pay the ransom if they cannot recover from backups •FBI stated they have started seeing instances where victim is not provided decryption key after paying • Traditionally delivered through email phishing WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 28 LLP Ransomware –Email Phishing Attack CliftonLarsonAllen ©2016 https://www.rsa.com/content/dam/rsa/PDF/2016/08/infographic‐detecting‐and‐responding‐to‐a‐ransomware‐ attack.pdf?linkId=28575248 WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 29 LLP Ransomware – Attack CliftonLarsonAllen ©2016 • Malware encrypts everything it can interact with WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 30 Ransomware Attacks 31 ©2016 CliftonLarsonAllen LLP LLP Ransomware –Case Studies CliftonLarsonAllen Pennsylvania Senate Democrats ©2016 •March 3, 2017 ‐ working with Microsoft to restore the system https://www.aol.com/article/news/2017/03/03/pennsylvania‐senate‐democrats‐fall‐victim‐to‐ransomware‐attack/21873178/ WEALTH ADVISORY | OUTSOURCING | AUDIT, TAX, AND CONSULTING 32 LLP Ransomware –Case Studies CliftonLarsonAllen Ransomware Hackers Blackmail