This presentation looks at the top 10 security issues facing NZ Enterprises and more importantly, the ways each of these issues can be addressed.

1. 10 Security issues facing
NZ Enterprises

2. Agenda
● Introduction
● Ten Issues
● Questions

3. Introduction
● This presentation is a rapid (15-20 minute) summary of security issues
facing NZ enterprises
● The list of issues has been created from both research (such as the
Verizon Data Breach Investigation Report/DBIR) as well as my own
personal experience
● For each issue, I will explain:
○ The core concept of the issue
○ Ways that the issue can be mitigated

4. 10 Security issues facing
NZ Enterprises
Phishing & Whaling Ransomware
3rd Parties / Suppliers Customer Data Privacy
Theft of your customer Advanced Persistent Threats
Mobile Workforce Application Layer Attacks
Incident Response Internet of Things (IoT)

5. Issue#1:
Phishing & Whaling
“Phishing” is a problem that nearly all New Zealand businesses face.
Despite good awareness - it’s still successful!
“Whaling” is a specifc type of spear-phishing that is targeted at the
executive level. The aim of the attack is often to get funds transferred
“urgently” or to get confidential data.
Ways to mitigate
- Raise awareness of both its frequency and motivation
- Don’t rely on electronic requests (phone/talk to people when concerned)
- Enable Multi-factor authentication

6. Issue#2: Ransomware
Ransomware is becoming increasingly common in New Zealand.
It is becoming increasingly popular because of it’s success (ie
people are paying up), with the currency requested being Bitcoins
because they are difficult to trace.
Ways to mitigate
Patch OS & applications
Backup regularly - and test backups!
Minimize privileges (avoids escalation or horizontal movement)
Deploy Host Intrusion Detection services

7. Issue#3: 3rd Parties / Suppliers
Systems in 2016 are often made up of services from 3rd parties.
This means that an organisations “attack surface” is greater than
when all components of a system were “in-house”.
Ways to mitigate
* Establish multiple layers of protection to minimize risk
* Understand what systems make up your systems/solutions
* Establish a 3rd party vendor assessment questionnaire
* Create a Service Level Agreement (SLA) with a minimum
requirement that the 3rd party adheres to your security policies

8. Issue#4: Customer Data Privacy
With the large number of customer data breaches in the news,
Customers are demanding high levels of privacy around their
data.
Ways to mitigate
* Only collect data that you actually need
* Keep data only as long as you need it
* Ensure you keep data secure in all locations (even internally)
* Encrypt data in MOTION and at REST

9. Issue#5: Theft of your customer
It’s not just the customer data you need to be concerned about.
Often it’s your actual customer that the attacker is after - and your site
(which could even be a marketing site) is the way to that customer. Your
site’s popularity - and the clientele that it attracts - might just be what the
attacker is looking for!
Ways to mitigate
* Establish minimum security standards across all websites
* Monitor the reputation of your domains
* Scan your systems (Dynamic/DAST, Vulnerability, Anti-Malware) and then
mitigate or remediate issues. YOU CANNOT SCAN YOURSELF SAFE

10. Issue#6: Advanced Persistent Threats
Advanced Persistent Threats (APT’s) have moved from something you
see in the movies (or in a US election) to a very real threat.
Why? Simple. It’s easier & safer than traditional crimes.
Ways to mitigate
* Log everything - and monitor the logs
* Look (and ALERT) for key activities such as account creation or
privilege escalation
* Install “Learning” Host Intrusion Detection Systems
* Limit cached credentials (which enables “pass the hash” attacks)

11. Issue#7: Mobile workforce
Modern business does not require staff to be tethered to their office desk.
But with this increased freedom comes additional risk.
Ways to mitigate
* Enable disk encryption
* Require 2/Multi-Factor authentication
* Provide security tools (anti-virus/malware) for both work + personal
equipment
* Enable device policies where possible
* Educate employees of risks, including physical theft when travelling

12. Issue#8: Application Layer Attacks
The 2016 Verizon Data Breach Investigation Report (DBIR) reports that
more than 50% of all attacks now target the application layer.
Yet according to SANS, fewer than 10% of enterprises test all of their
business-critical applications. We need to change where we look.
Ways to mitigate
* Use Dynamic Analysis scanning tools (WhiteHat, Veracode)
* Use Static Analysis scanning tools
* Use application penetration testing to identify business logic issues

13. Issue#9: Incident Response
While preventative steps to avoid a security incident are important, it’s
also critical that enterprises have a documented incident response
plan.
For the plan to be effective, an organisation must regularly update the
plan as well as have “fire drills”.
Ways to mitigate
* Develop an incident response plan (before it’s too late)
* Conduct “Table Top” exercises, using likely breach scenarios
* Use the exercises to identify gaps and update the plan

14. Issue#10: Internet of Things (IoT)
Recent attacks such as the Mirai IoT botnet showed the world that
insecure devices can be used in evil ways.
The devices were used to create a Distributed Denial of Service
(DDoS) attack on a primary DNS service, resulting in the outage of
several major services on the internet.
Ways to mitigate
* Include all devices in your scope for patching (not just servers!)
* Change default passwords
* Re-flash firmware before putting devices into production (even
new devices)

15. 10 Security issues facing
NZ Enterprises
Phishing & Whaling Ransomware
3rd Parties / Suppliers Customer Data Privacy
Theft of your customer Advanced Persistent Threats
Mobile Workforce Application Layer Attacks
Incident Response Internet of Things (IoT)

16. Questions?
?
Please send questions to nigel @ cybersecurity.nz