Presentation by Eamonn Keane at The Cyber Academy

1. Investigating Cybercrime in the UK
Sex, Lies & Cybercrime- A pragmatic perspective.
DI Eamonn Keane.
Cybercrime Specialist Crime Division

2. Agenda
Scottish , UK & Global Perspective!
The current threat landscape!
Incident Planning & Response!.
Prevention.
Scotland’s future.
Signposting.

3. Key questions that all CEOs and CISOs should
be asking this week?
• "Are we vulnerable to SQL injection, ransomware or
DDoS based attacks?“
• "What assurance activity have we done to confirm that
we are not vulnerable?“
• "If we were compromised, would an attacker be able to
gain access to unencrypted sensitive data?“
• "What assurance activity have we done to confirm this
position?"
• “What is our company posture on security?”

5. Cybercrime Cost

7. Cyber Regional Organised Crime Units

8. Cybercrime!

9. Stalking
Bullying
Cyber Fraud
SOCG
Sexual Offenders
Indecent
images of
children
Cyber
dependent
crimes e.g.
hacking,
malware,
DDoS
Anti-socialbehaviour
CyberTerrorism

11. Your Title Here
1980’s Policing

12. “I can do more damage on my laptop
in my pyjamas, before my first cup of
Earl Grey, than you can do in a year
in the field.”
Q - Skyfall

14. Cyber Attacks are on the rise

18. Ransomware - Glasgow Hairdressers

20. ORGANISED CRIME

21. The skillsets

26. Five key cyber crime threats
• Malware targeting businesses & individual users for fraud.
APT’s, RATS,
• Network intrusion ('hacking') DDoS, XSS. Spear-phishing.
• Enablers of cyber dependent crime (e.g. money laundering /
digital currencies / anonymisation).
• Cyber crime 'as a service‘
• Targeted disruption of access to UK networked systems and
services (e.g. DDOS / Ransomware)

27. Old bugs come home to roost… SHELLSHOCK
– HEARTBLEED – DRIDEX – CRYPTOWALL -
POODLE… LOCKY

29. 5 Stages of Crypto-Ransomware

30. Virtual Currencies

31. http://www.mcafee.com/uk/resources/white-papers/wp-
Cybercrime-as-a-Service

33. Darknet

34. Insider Threat

35. Cyber Resilience is thorough Preparation
Overarching Cyber Security Strategy!
Pre-planned Exercise.
Incident Management & Response Plan.
Communications Strategy.
Investigative Strategy.
Incident Manager & Team
Gold, Silver, Bronze.
Mitigation & Recovery Strategy.
Logistics - Contingency

37. Reporting of Cyber Incidents
• Incident evaluation and early reporting.
• Police Scotland 101 – Incident No. & Action Fraud.
• Business continuity and impact our prime consideration.
• ICT response and mitigation. Scene preservation?
• Where possible preserve original copies of emails, attachments,
device images and logs.
• Is there a mandatory obligation to report?
• Report to Cert UK / GovCert UK .
• Report to Scottish Government if appropriate.
• Identify point of contact for law enforcement to facilitate enquiries
and evidence gathering.
• Submit attack details to CISP platform if appropriate share.cisp.org.uk
(can assist with mitigation and fix)

39. Cyber Essentials &
Cyber Essential Plus
Cyber Essentials concentrates on five key controls.
These are:
1. Boundary firewalls and internet gateways
2. Secure configuration
3. Access control
4. Malware protection
5. Patch management

40. Cyber Essentials is not a silver bullet.
However, it will prevent 80% of cyber
attacks.
• Having effective anti-malware means using more than
“signature based” detection. The news reports all state this
ransomware variant was too new for AV signatures. This means
that they were not using heuristics….
• Most, if not all, ransomware relies on systems missing critical
patches.
• In a nutshell, Cyber Essentials would have saved the Council
here. The worst that ransomware should do is a few hours
downtime for one user while you restore from backups.
Everything else means you’ve made major mistakes.

43. Scotland’s Response
• Cyber Policing Structure – NCCU - Regional Hubs
• Police Scotland Cybercrime Strategy
• European & Global Co-operation EC3
• Safer Virtual Communities
• Education
– The Cyber Academy - DFET
– SQA National Progression Awards
– SBRC – Supporting SMEs.

45. Example – Tovar: Protect
• International operation targeting GameOverZeus and Cryptolocker
malware variants.
• These malware variants are estimated to have cost the UK £500
million in losses.
• Coordinated activity across 10 countries led to the botnet behind
the malware being taken offline for two weeks, allowing the public
to take steps to protect themselves (e.g. update anti-virus).
• Combined with extensive global media coverage
• 32% drop in GameOverZeus infections, estimated £100 million in
losses prevented

46. Example – Dermic: Pursue & Prevent
• UK investigation targeting the users of Blackshades, a Remote Access Tool
able to access users’ webcams.
• FBI intel - over 1100 UK-based purchases on Blackshades.
• NCCU coordinated a week of arrests, involving ROCUs, MPS & Police
Scotland, targeting 50+ individuals for Pursue action.
• 20 arrests across 10 Regions.
• Remaining individuals subject to Prevent activity – cease & desist letters,
visits by ROCU & NCA officers, media coverage
• Linked to a global day of action with over 100 arrests in the US, Australia,
Asia & Europe.
• An important test of coordination of UK law enforcement.

51. Operation Mouse - Police Scotland Website

53. Our priorities

55. WE
NEED
YOU

56. Thank you for listening
Any Questions?
Eamonn.keane2@scotland.pnn.police.uk