Originally presented at ITx 2016: https://itx.nz/Programme/68/All-aboard-the-Cyber-Security-Rollercoaster Not a day goes by where we don't hear of a website being hacked, a few hundred thousand user details being exposed, or another organisation scammed out of a pretty penny. The world of cyber security is hurtling along at break neck pace. Nick Malcolm will push the pause button and look back at the highs and lows of the last year's major security incidents, and see what we can learn from them. He will look at our current position, and in to the future. What are the threat trends and emerging risks we face awaiting us around the bend? He will then show some of technologies and innovations which are helping to keep the web secure, educate the public, and empower IT professionals. It's a rollercoaster, but it doesn't have to be scary - climb aboard and learn how to enjoy the ride!

1. ALL ABOARD!
THE CYBER SECURITY
ROLLERCOASTER

2. NICK MALCOLM
Co-Founder & CTO at ThisData

3. A LOOK AT THE
PAST YEAR &
WHAT DOES IT
MEAN?
THE FUTURE

4. TALK ABOUT IT MORE.

5. TALK ABOUT IT MORE.
HELP EACH OTHER.

6. TALK ABOUT IT MORE.
HELP EACH OTHER.
BE NICE.

7. ALL ABOARD!

8. OPM
JUNE ‘15

9. OPM HACK
Office of Personnel Management
Does SECRET and TOP SECRET checks
20 million federal employees,
relations, contractors

10. OPM HACK
Sexual activity, and preferences
Drug and Alcohol use
Debts
Who you hang out with
Political leanings

11. OPM HACK
5.6 million fingerprints
How do you change a fingerprint?

12. MORE, AND SMARTER
FACTORS OF
AUTHENTICATION

13. SOCIAL
NETWORK
CREDS

14. SOCIAL NETWORK CREDENTIALS
MySpace: 360m in May
LinkedIn: 164m in May
Tumblr: 65m in May
VK.com: 100m in June
Ashely Madison: 30m in July ‘15

15. EVERY “NORMAL”
PERSON REUSES
PASSWORDS.
WE PROBABLY CAN’T
CHANGE THAT.

16. VOTER
DATABASES

17. VOTER DATABASE LEAKS
Mexico: 93.4m in April (everyone)
Phillipines: 55m in March
(everyone + 15.8m fingerprints)

18. VOTER DATABASE LEAKS
USA: 191m records in December
56m in January, and 154m in Jun
Turkey: 49.6m in April
Russia: 24k, included their vote

19. PHISHERS HAVE
PRECISION AMMO
CRIMS CAN FIND
YOU EASIER

20. DISCLOSURE IS
HARD

21. RANSOMWARE

22. RANSOMWARE
Hollywood Presbyterian Medical Centre
$17,000 in February
University of Calgary in Canada
$20,000 in May
Whanganui DHB: $0 in February

23. RANSOMWARE
Android “kiddy porn” ransomware
Smart TVs
Home PCs

24. 93% OF PHISHING EMAILS
CONTAIN RANSOMWARE
INCREASED 5.5X IN THE
YEAR TO MARCH
LESS EFFORT, EASIER
MONEY.

25. 45% of US households avoided online
activity due to privacy and security
fears
NTIA, US Department of Commerce
2015 survey of 41,000 households

26. SWIFT
HEISTS

27. SWIFT
HEISTS

28. SWIFT HEISTS
Ukraine $10m in Jun ‘16
Bangladesh $81m in Feb ‘16
Vietnam $1.2m in Dec ‘15
Ecuador $12m in Jan ’15
New Zealand $? in ?
& more …

29. SWIFT HEISTS
Extensive analysis in advance
Learnt internal processes
Learnt normal transactions
Rinse and repeat, and repeat,
and repeat, and repeat

31. STRICTER VETTING
OF THIRD PARTIES
MORE THAN JUST
TICKING BOXES

32. THAT’S THE PAST
AND PRESENT.

33. WHAT’S NEXT?

34. MORE BREACHES

35. Computer-enabled crime accounted
for 53% of all UK crime in 2015, and is
becoming more aggressive and
technically proficient
United Kingdom’s National Crime Agency

36. SCARCITY OF TALENT

37. Global cybersecurity workforce
demand is expected to rise to 6 million
by 2019, with a shortfall of 1.5 million
Michael Brown, CEO at Symantec

38. CONTINUED APATHY

40. BUT

41. GOVERNMENTS ARE
STEPPING UP

42. NZ CERT coming in 2017
The Brits have budgeted £1.9B
USA wants to budget $19B
US DoD ran a Bug Bounty
(so you have no excuse not to run one too!)

43. BUSINESSES ARE
STEPPING UP
And cloud-based security services allow
more complete security, sooner.

44. Cyber security spending will hit
$101 billion in 2018
Gartner

45. Bug Bounties
HackerOne, Bugcrowd
Phishing as a Service
Phish5, PhishMe
Cloud Monitoring
CloudLock, SkyHigh, Elastica, Adallom (acq. MS), NetSkope

46. DevOpsSec
Security-as-good-PR
Google’s “BeyondCorp” Framework

47. Smarter Authentication
Google, Microsoft, Facebook, Xero,
PingID, Steam, CloudFlare, Twitter, TeamViewer, …
Authy, Duo ThisData, Castle, Sift Science

48. THE WORST THING
YOU CAN DO IS
NOTHING

50. TALK ABOUT IT MORE.

51. TALK ABOUT IT MORE.
HELP EACH OTHER.

52. TALK ABOUT IT MORE.
HELP EACH OTHER.
BE NICE.

53. Life is a rollercoaster,
just gotta ride it
Ronan Keating

54. THANKS!
QUESTIONS?
@nickmalcolm
Login Anomaly Detection