[AIIM18] When the C-Suite won't Talk About Cybersecurity: What I know about the Target and Equifax breaches - Bryce Austin
•
1 like•138 views
This document discusses several major cybersecurity breaches, including those that affected Target, Yahoo, Sony, and Equifax. For each breach, it summarizes what is known about how the attack occurred and who the likely attackers were. The key points made are that Target's credit card system, Yahoo users, Sony itself, and American taxpayers were the main targets of those respective attacks, which are believed to have been carried out by organized crime groups and nation-states. It concludes by emphasizing the importance of early detection over reaction in preventing major breaches.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to [AIIM18] When the C-Suite won't Talk About Cybersecurity: What I know about the Target and Equifax breaches - Bryce Austin
Similar to [AIIM18] When the C-Suite won't Talk About Cybersecurity: What I know about the Target and Equifax breaches - Bryce Austin (20)
More from AIIM International
More from AIIM International (20)
Recently uploaded
Recently uploaded (20)
[AIIM18] When the C-Suite won't Talk About Cybersecurity: What I know about the Target and Equifax breaches - Bryce Austin
- 2. 2 Prices falling for Cybercriminal Supplies Fred Williams | November 27, 2013 | Protecting Yourself $4
- 8. Risk Responses • Quantify existing risk and accept it • Mitigate existing risk to an acceptable level • Transfer risk to a 3rd party
- 11. • Who has the authority to declare a cybersecurity incident? • How large a check can that person write to begin remediation? • Who decides if/when to reach out to law enforcement for assistance? • Who can speak to the media on behalf of your company?
- 12. Nation States Summary of Actors Agenda driven. Sophisticated and well-funded. Least likely to perform untargeted attacks. Highly likelihood for advanced persistent threats. Risks include IP theft, compromised systems. Likely possesses zero-day vulnerabilities. Organized Crime Financially driven. Moderate-to-high sophistication. May possess zero- day exploits, likely botnets. Tactics include phishing (including spear phishing), ransomware. Hacktivists Agenda driven. Low-to-moderate sophistication. Reliance on botnets, known vulnerabilities exploited in unpatched systems. Tactics include business disruption, leaking data. Employees Motives and capacities vary widely. May be intentional or unintentional. Appropriate policies and controls will limit damages. Responses can be rapid and comprehensive. Individual Hackers Ego driven. Threat profile comparable to low/moderate-capacity Hacktivist/Organized Crime categories. Diminishing demographic. Capability
- 14. Methodology: • Phishing • Hopping • Scraping • Aggregating • Exfiltrating
- 21. Target Response to USA Congress • Network Segmentation • Whitelisting • Two-Factor Authentication • Chip and Pin Technology https://corporate.target.com/_media/TargetCorp/global/PDF/Target-SJC-032614.pdf
- 22. What do we know?
- 25. Which time?
- 28. What do we know?
- 31. Which time?
- 36. What do we know?
- 37. Sony was the target • They were harmed financially • They were publicly humiliated • They have yet to fully recover
- 40. Breach timeline: 1) May 13: Breach began 2) July 29: Breach was discovered internally 3) Aug 1 & 2: Three execs sell $1.78MM in shares 4) Sept. 7th: Breach was announced to public
- 45. What do we know?
- 59. What do we know?