Adrian Ifrim with more than twelve years of experience in the financial, telecom and IT security sectors, currently serving as Senior Manager within the Cyber Risk Advisory team of Deloitte Romania. In addition, he is an expert in information security with focus on penetration testing services and currently holds the Offensive Security Certified Expert (OSCE), Offensive Security Certified Professional (OSCP), Offensive Security Wireless Professional (OSWP) and System Security Certified Practitioner (SSCP) certifications.​

1. Headline Verdana Bold
What you should know about your company
27/11/2019, Adrian Ifrim, Deloitte Romania

2. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
2
Adrian Ifrim – Senior Manager Cyber Risk Advisory@Deloitte
Learning constantly how computers work or not
Various certifications in relation to ethical hacking/cyber security
whoami
Hello

3. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
3
What this talk is about
Keeping it short and simple
Public information volume regarding your organization is way beyond anyone in your company think it is.
The existence of large databases of classified information on computer networks is also changing the face of domestic
and international politics.
Cyber-warfare and cyber espionage is becoming of increasing importance to the national security and strategy of nations
around the world, and it is estimated that 120 nations around the world are currently actively engaged in developing and
deploying technology for these purposes.
Your organizations may not be the main target but a pivot point for access in other organizations.
New technologies will have a huge impact on our society but organizations should have a clear realistic image of what is
doable and what is not.

4. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
4
And other tales
The birth of a company

5. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
5
“We may not acknowledge that in an electronic
medium, levels and kinds of anonymity mean, in
an important sense, no anonymity. If there are
domains in which we can be anonymous but
those domains are part of a global communication
infrastructure in which there is no anonymity at
the entry point, then it will always be possible to
trace someone’s identity.”
Deborah G. Johnson and Keith Miller’s “Anonymity, Pseudonymity, or Inescapable Identity on the Net” (1998),
Computers and Society

6. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
6
Who is mapping your organization?
Threat actors
It is important to know who means you harm, what they want, and how they plan to get it.
While there are many threat actors out there today most of them
fit into the following categories:
• State sponsored attacks
• Organized Hacking Teams
• State-sponsored hackers: hybrid armies
• Terrorist organizations
• One-man-show
• Internal disgruntled employees
• Malicious vendors – Software/Hardware implants/backdoors

7. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
7
White Hats
Also
The term "white hat" in Internet slang refers to an ethical computer hacker, or a computer security expert, who
specializes in penetration testing and in other testing methodologies that ensures the security of an
organization's information systems. Ethical hacking is a term meant to imply a broader category than just penetration
testing.
https://en.wikipedia.org/wiki/White_hat_(computer_security)

8. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
8
Why does your voice sound different on a
recording?

9. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
Organization
Physical
Locations
Human
Elements
Cyber
Third
Parties
Fourth
Party
Infra-
structure
(Web)-
applications
High Risk
Locations
Building
Access
Inadvertent
Damage
Malicious
Exfiltration
Vendors
Client specific
biz.
Client
specific
Industry
specific
Off-the-shelf
Applications
Internally
hosted
Mobile
Applications
Third party hosted
Cloud/SaaS
Connections
Personal
Computers
Databases
B2B
Connections
Remote connections
(VPN, File transfer)
Security
Measures
Security &
Monitoring
Access
Control
Geographic
location
A different point of view

10. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
10
In highly complex environments the numbers differ depending on:
• who is doing the count
• how is the count performed
• when is the count performed
• what is counted
• why it’s counted
External, Internal, Production, Decommissioned and It’s complicated
Assets

11. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
11
• Current/Past Internet Facing resources
• Social Media
• People search engines
• Leaked Credentials from data breaches
• Internet-connected devices Search Engines
• Internet search engines
• Dark Web*/TOR
Publicly available tools
Digital Footprint

12. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
12
Commercial and Open Source tools that collect public data about organizations, websites, and identities, for awareness
of social and technological presence across the Internet are available
They enable a deep dive analysis into the interrelationships online and extend the “knowability” of electronic identities
Some of them have user interfaces highly usable and interactive. Most of them are highly complex are required very
good programming and security testing skills
These tools enable explorations of emails, telephone numbers, websites, organizations, by offering access to information
that would often be “invisible” otherwise
How
Digital Footprint

13. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
13
Would anyone do that? Why a distorted image?
Why
• Lack of Cyber Security Awareness
• Speed - Fast, underbudgeted efficient solutions
• Third Party - Hosting, VPN, Maintenance
• Over Exceeding Confidence – The Excel

14. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
14
Positive Digital Footprint
Making it better
• Awareness and education
• Inventory of all cyber assets
• Cyber Security Strategy
• Continuous monitoring

15. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
15
People responsible for cybersecurity should be
encouraged to address topics such as awareness
raising about cybersecurity at board and staff
level addressing cybersecurity in the supply
chain and integrating interdependencies
cybersecurity risks in the overall cyber risk
management process.

16. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
16
United States Director of National Intelligence, James Clapper, on June 7, 2013, released a statement confirming that for
nearly six years the government of the United States had been using large internet services companies such as Facebook
to collect information on foreigners outside the United States as a defense against national security threats.
Russia's System of Operational-Investigatory Measures (SORM) requires telecommunications operators to install
hardware provided by the Federal Security Service (FSB) which allow the agency to monitor users' communications
metadata and content, including phone calls, email traffic and web browsing activity.
China has highly advanced facial recognition technology. The technology is integrated with others, such as big data and
artificial intelligence, to build a national surveillance and data sharing platform. Facial recognition technology has been
used in many different fields. In the domain of security, facial recognition technology has been installed in banks,
airports, and shopping malls to monitor crowds. In 2018, a system known as the “Electronic Police at Zebra Crossing” or
the "Smart System for Collecting Evidence of Jaywalking” was implemented in Shenzhen. The smart system is equipped
with facial recognition technology to record jaywalkers and non-motor vehicles that break traffic rules.
More
Digital Footprint

17. What you should know about your company
Copyright © 2019 Deloitte Romania. All rights reserved.
17
Q&A

18. Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member
firms, and their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as
"Deloitte Global") does not provide services to clients. Please see www.deloitte.com/ro/about to learn more about our global network of member
firms.
Deloitte provides audit, consulting, legal, financial advisory, risk advisory, tax and related services to public and private clients spanning multiple
industries. Deloitte serves four out of five Fortune Global 500® companies through a globally connected network of member firms in more than
150 countries and territories bringing world-class capabilities, insights, and high-quality service to address clients' most complex business
challenges. To learn more about how Deloitte's approximately 263,900 professionals make an impact that matters, please connect with us on
Facebook or LinkedIn.
© 2019. For information, contact Deloitte in Romania