lessons learned from bangladesh bank … and maintain project plan build use case. identify internal...

An independent member of UHY International© UHY Advisors, Inc. 2016 All Rights Reserved

LESSONS LEARNED FROM BANGLADESH BANK HEISTISACA GEEK WEEK 2016


WHAT’S GOING ON?


Victim

WHAT’S GOING ON?


WHAT’S GOING ON?

Criminal


MAIA SANTOS DEGUITO

Rizal Bank Manager with Attorneys


THE BANGLADESH HEIST


$150MM USE CASE


THREAT ACTORS

Insider

Project Managers

Hackers

Social Engineer

BackerThreat Actors


BANGLADESH HEIST TIMELINE


SWIFT SYSTEMS MALWARE ACTIVITY


THE PLAN

Develop and Maintain Project Plan

Build use caseIdentify internal resourcesIdentify tools Define milestonesMonetize the effort

Exploit People & Processes

Use Bank of Bangladesh credentials to request transfersUse FRB to authorize transfersExploit holiday and weekend schedulesWithdraw funds with Rizal bank manager approval

Exploit Technologies

Bank of Bangladesh Systems*SWIFT SystemConfirmation message monitoringAudit logging


INITIAL VECTORS OF ATTACK


TARGETED SAMPLES


TARGETED SAMPLES (CONT)


COMMON HACKER PLAYBOOK

Acquire Targets Data Collection

Exploit People

InfiltrateCorporate Systems

Exploit Systems Permeate

•Locate affiliated groups

•Identify individual targets

- Colleagues- Spouse- Children- Parents

•Use collected data to deploy malware to targeted individuals

•Use malware-collected data to ‘passively’ authenticate to corporate systems

•Install system exploits and deteriorate logging

•Exfiltrate corporate data

•Place trapdoors throughout environment

Characteristics of cyber threats are no longer "infect as many machines as possible". Today’s attacks only need to compromise one targeted machine to be successful.


NO “HACKERS” REQUIRED!


EBAY


SOPHISTICATED DISCIPLINED


THE HACKER PERSONA


THE REAL “HACKERS”


THE HUMAN FIREWALL


HUMAN FIREWALL FAILURE


THE PARTY IS OVER


MANAGING RISK & COMPLIANCE


COMPLIANCE VS RISK MANAGEMENTBeing ‘Compliant’ does not equate to being ‘Secure’. It is easy to lose sight of the risk management drivers behind the Internal Audit Function.

Internal Audit Program

COSO

SOXPCI

Internal Priorities

Self-defined

risk matrix

Customer Expectations

NIST

COSO

Regulatory Obligations

SOX PCI

Shouldn’t Compliance be positioned as the byproduct of a mature information security and internal audit program, by ‘doing the right things’ and ‘proving it’?

Compliance Risk Management


QUESTIONS?

lessons learned from bangladesh bank … and maintain project plan build use case. identify internal...

Documents