4. Mitigating a Cyber Attack
- 1. Mitigating a Cyber Attack The New Era of Cyber Security University of Piraeus 8/12/2014 Γιάννης Κυπραίος CISSP, CISM, ISO-27005 CIRM Υποδιεύθυνση Ασφάλειας Πληροφοριακών Συστημάτων Διεύθυνση Διακυβέρνησης Πληροφορικής Ομίλου ΕΤΕ
- 2. Agenda • Cyber Attack Definition • Cyber Attack Targets • Cyber Criminals Profile • Crime-as-a-Service • Type of Cyber Attacks • Critical Controls for effective Cyber Defense • Cyber Attack Detection • Reaction to a Cyber Attack
- 3. Cyber Attack Definition Wikipedia Cyber-attack is any type of offensive maneuver employed by individuals or whole organizations that targets computer information systems, infrastructures, computer networks, and/or personal computer devices by various means of malicious acts usually originating from an anonymous source that either steals, alters, or destroys a specified target by hacking into a susceptible system. Yale Law School A Cyber-attack consists of any action taken to undermine the functions of a computer network for a political or national security purpose. Yale: The Law of Cyber Attack
- 6. Cyber Attack Targets • Control Systems • Energy • Finance • Telecommunication • Transportation • Water
- 7. Cyber Attack Targets • Stealing Information • Wiping Data, Blocking Infrastructure • Stealing money • Damaging Company Reputation • Financial Losses
- 8. Cyber Criminal Profiles • The Hacktivist • Nation States • Cyber Criminals • Insiders
- 9. Motives Europol: Internet Organized Crime Threat Assessment 2014
- 10. Motives Europol: Internet Organized Crime Threat Assessment 2014
- 11. Crime-as-a-Service • Underground forums • Criminal Services – Infrastructure-as-a-Service – DDoS-as-a-Service – Data-as-a-Service – Pay-per-install Services – Hacking-as-a-Service – Malware-as-a-Service – Translation Services – Money Laundering-as-a-Service
- 12. Critical Controls for Effective Cyber Defense Critical Security Controls - Version 5 1. Inventory of Authorized and Unauthorized Devices 2. Inventory of Authorized and Unauthorized Software 3. Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4. Continuous Vulnerability Assessment and Remediation 5. Malware Defenses 6. Application Software Security https://www.sans.org/critical-security-controls/
- 13. Critical Controls for Effective Cyber Defense Critical Security Controls - Version 5 7. Wireless Access Control 8. Data Recovery Capability 9. Security Skills Assessment and Appropriate Training to Fill Gaps 10.Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 11.Limitation and Control of Network Ports, Protocols, and Services 12.Controlled Use of Administrative Privileges 13.Boundary Defense https://www.sans.org/critical-security-controls/
- 14. Critical Controls for Effective Cyber Defense Critical Security Controls - Version 5 14.Maintenance, Monitoring and Analysis of Audit Logs 15.Controlled Access Based on the Need to Know 16.Account Monitoring and Control 17.Data Protection 18.Incident Response and Management 19.Secure Network Engineering 20.Penetration Tests and Red Team Exercises https://www.sans.org/critical-security-controls/
- 15. Cyber Attack Detection There is no ”if”; only “when”! • “I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they are converging into one category: companies that have been hacked and will be hacked again.” R.S. Mueller III, Director of FBI • “There are two types of law firms: those that know they’ve been hacked and those that do not;” Attorney V. Polley
- 16. Cyber Attack Detection (Logs) • Network Firewalls • AntiVirus • Data Base Firewalls • Web Application Firewalls • Intrusion Prevention Systems • Security Logs Security Information & Event Management
- 17. Cyber Attack Detection (Behavior) • Slow Internet • Slow LAN • Inaccessible Web Sites • Computer Behavior Changes • Unknown Services • Unknown Connections DoS / DDoS Malware
- 18. Reaction to a Cyber Attack Be Prepared • Response Team • Reporting • Initial Response • Investigation • Recovery and follow-up • Public Relations • Law Enforcement
- 19. Mitigating a Cyber Attack The New Era of Cyber Security University of Piraeus 8/12/2014 Ioannis Kypraios CISSP, CISM, ISO-27005 CIRM [email protected]