Upload File

perma cyber threat brief

21
CYBER THREAT BRIEF ANDREW DOLAN DIRECTOR OF STAKEHOLDER ENGAGEMENT

Upload: others

Post on 28-Dec-2021

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: PERMA Cyber Threat Brief

CYBER THREAT BRIEFA N D R E W D O L A N

D I R E C T O R O F S T A K E H O L D E R

E N G A G E M E N T

Page 2: PERMA Cyber Threat Brief

The key cybersecurity resource for cyber threat prevention, protection, response and recovery for all U.S. State, Local, Tribal and

Territorial governments.

Page 3: PERMA Cyber Threat Brief

MS-ISAC Members include:üAll 56 US States and TerritoriesüAll 78 federally recognized fusion centersüMore than 1,000 local governments, public education

entities, and tribal nations

State, Local, Tribal, and TerritorialCities, counties, towns, airports, public education, police departments, ports,

transit associations, and more

WHO WE SERVE

Page 4: PERMA Cyber Threat Brief

WHY GOVERNMENT?

Criminals look for data......And governments have a lot of it!

Page 5: PERMA Cyber Threat Brief

VulnerabilitiesContent Management

Systems

Plug In’s

Server

Web Programming Language

Phishing

üWell WrittenüAppear CredibleüEnticing or

Shocking SubjectüApparent Trusted

Source

Page 6: PERMA Cyber Threat Brief

TIME-TO-PATCH

54.6%

59.2% 61.4% 62.7% 64.7% 65.6%

Week1 Week2 Week3 Week4 Week5 Week6

%ofPatchedWordPress Instances followingaWordPress RemoteCodeExecutionVulnerability

(patchreleased8/4/15)

Page 7: PERMA Cyber Threat Brief

WHO ARE BEHIND THE THREATS?

Hacktivists

Cyber Criminals

Nation States

Page 8: PERMA Cyber Threat Brief

HACKTIVISTS

Targeted

Opportunistic

Social, Political & Ideological

AgendaDDoSAttacks

DoxingSystem

Compromise

Web Defacements

Page 9: PERMA Cyber Threat Brief

From March to July 2015

Vikingdom claimed 74 DDoS attacks against

state and local government websites

in 34 states.

Serial DDoS Attacker10 Successful DDoS attacks in March 2015

Social Media BraggerTwitter, YouTube

Attacker of:Municipalities, gaming services, hospitals

Claim to Motivation:“Police abusing innocent victims”

Page 10: PERMA Cyber Threat Brief

CYBER CRIMINALS

Power &

Control

VaryingExpertise

Financial Motivation

Shifu

ZeusUpatre/Dyre

Dridex

Ransomware

Page 11: PERMA Cyber Threat Brief

Prepaid debit credit database copied onto plastic cards with magnetic strips

36,000 transactions in 10 hours

Coordinated with “Cash Crews”

Emptied ATMs ACROSS THE WORLD

Preconfigured to eliminate withdrawal limits

Discovered through flashy purchases and social media

Page 12: PERMA Cyber Threat Brief

CRYPTOWALL – CRYPTOLOCKER – TESLACRYPT

ü Phishing emailsüAttached zip file or straight executable

üOr Zeus infectionüEncrypts all personal files on local

hard drive and file shares üDemands $200-$600 for the

decryption key ü Payment must be made within

72hrs-100hrs otherwise the decryption key is destroyed

Page 13: PERMA Cyber Threat Brief

NATION STATE ACTORS/APT

IntellectualCapital

CompetitiveInsight

Political Leverage

CyberWarfare

Page 14: PERMA Cyber Threat Brief

UKRAINE’S CRITICAL INFRASTRUCTURE

Boryspil International Airport – Kiev, UkrainePower Grid Shut Down

80,000 customers lost power for 6 hoursBlackEnergy Malware IP Attributed to Russia

Page 15: PERMA Cyber Threat Brief

EVERYONE MAKES MISTAKES…….

The trick is to learn from them!

Page 16: PERMA Cyber Threat Brief

24 X 7 SECURITY OPERATIONS CENTER

24/7 Support for:ü Network Monitoring Servicesü Research and Analysis

24/7 Analysis & Monitoring of:ü Threatsü Vulnerabilitiesü Attacks

24/7 Reporting:ü Cyber Alerts & Advisories ü Web Defacementsü Account Compromisesü Hacktivist Notifications

Central location to report any cybersecurity incident

Phone: 1-866-787-4722Email: [email protected]

Page 17: PERMA Cyber Threat Brief

COMPUTER EMERGENCY RESPONSE TEAM (CERT)

ü Incident Response (includes on-site assistance)ü Network & Web Application Vulnerability

Assessmentsü Malware Analysisü Computer & Network Forensicsü Log Analysisü Statistical Data Analysisü Penetration Testing To report an incident or request assistance:

Phone: 1-866-787-4722Email: [email protected]

Any SLTT

Page 18: PERMA Cyber Threat Brief

MONITORING OF IP RANGE & DOMAIN SPACE

ü IPs connecting to monitored malicious C&C

üCompromised IPsü Indicators of compromise

from the MS-ISAC network monitoring (Albert)

üNotifications from Spamhaus

IP Monitoring Domain MonitoringüNotifications on

compromised user credentials

üVulnerability Management Program (VMP)

Any SLTT

Send domains, IP ranges, and contact info to: [email protected]

Page 19: PERMA Cyber Threat Brief

WHAT CAN YOU DO?

üPatch!üTrainingüBackupsüHarden SystemsüUpdate PoliciesüComplianceü Scan SystemsüEncrypt Mobile Devices

Page 20: PERMA Cyber Threat Brief

NEW GOVERNMENTAL PRECEDENTS BEING SET

Page 21: PERMA Cyber Threat Brief

QUESTIONS?

Andrew DolanDirector of Stakeholder

[email protected]

518-880-0699


1.Current Cyber Threat

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

The New Cyber Threat

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

Cyber Security Conference - Rethinking cyber-threat

BDO CYBER THREAT INSIGHTS

Countering the Cyber Threat

State of the Advanced Cyber Threat - Infosec Resources · State of the Advanced Cyber Threat 1 ApDev / Reverse Deception: Organized Cyber Threat Counter-Exploitation / Sean Bodmer

Iranian Threat Actor Amasses Large Cyber …...CYBER THREAT ANALYSIS Iranian Threat Actor Amasses Large Cyber Operations Infrastructure Network to Target Saudi Organizations By Insikt

Cyber Threat Intelligence

Cyber Threat Metrics

LookingGlass Cyber | Cybersecurity & Threat Intelligence€¦ · CYBER SOLUTIONS LookingGlass Cyber Solutions delivers unified threat protection against sophisticated cyber attacks

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Global Cyber Threat Intelligence

Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable

GUIDE TO CYBER THREAT MODELLING - Cyber Security Agency

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

CYBER THREAT- SCAPE REPORT - Accenture€¦ · The Cyber Threat-scape Report examines cyber- ... worldwide businesses, governments, ... CONTACTS Josh Ray

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Landscape

Cyber Threat Intelligence faculteit/Afdelingen... · Page 1 of 40 Cyber Threat Intelligence From confusion to clarity; An investigation into Cyber Threat Intelligence Daan Planqué

IBM Cyber Threat Analysis

CYBER THREAT INTELLIGENCE ESTIMATE 2017€¦ · 2017 THREAT LANDSCAPE REPORT Cyber Threat Intelligence 7 8. THREAT ACTORS When security professionals talk about threat actors, they

Health Industry Cyber Threat Information Sharing … Health Industry Cyber Threat Information Sharing and Analysis Annual Review of HITRUST Cyber Threat XChange (CTX) Summary of Findings

THREAT REPORT - Cyber€¦ · The Australian Cyber Security Centre Threat Report 2015 Foreword The cyber threat to Australian organisations is undeniable, unrelenting and continues

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

CYBER THREAT ASSESSMENT

SecBI: Cyber Threat Intelligence

NATIONAL CYBER SECURITY CENTRE CYBER THREAT REPORT …

2018 SonicWall Cyber Threat Report · 2018 SONICWALL CYBER THREAT REPORT Threat Intelligence, Industry Analysis and Cybersecurity Guidance for the Global Cyber Arms Race sonicwall.com