Downloaded 17 times
Cybercrime Risks Eu
- 1. Risks of Cybercrimein Europe Prof. Manel Medina Head of Unit CERT Operational support at ENISA Manel.medina@enisa.europa.eu 1
- 2. Content Overall ENISA Activities CybersecurityRisk Environment Organisation/Attacker Risk pattern What is your Favourite Threat? Specific ENISA contribution Fight against cybercrime: • Cooperation barriers • Best practices Workshops and training: Toolkits New EU Directive 2
- 3.
- 4. WS1: ENISA asFacilitator for improving Cooperation • Breach notification guidelines for article 13.a: • development of min security requirements for ISPs & Telcos • First breach notification received by ENISA in September. • Cyber Exercises: • planning and managing the EU–US exercise • planning Cyber Europe 2012 • Seminars on national CIIP exercises (9 done, 4 more) • Good practice guide on National contingency plans (2012Q1) • The EU Institutional CERT support (CERT EU) – On Track • Workshops & meetings organized: 18 done + 8 planned • 27 deliverables 16/8/2012 4
- 5. WS2: ENISA asCompetence Center for Securing Current & Future Technologies • Secure smartphone • Good Practices and Guidelines for ICS and SCADA: smart-grids, maritime, eco systems. • Supply Chain Integrity (SCI) • Browser Security paper as input to W3C process • Cloud procurement security • Study on use of advanced cryptographic techniques (12 MS, >50% EU citizens) • Contribution in the Expert Group on the Internet of Things • Early warning for NIS preliminary results • 6 WS and meetings organised • 19 Deliverables 16/8/2012 5
- 6. WS3: ENISA asPromoter of Privacy & Trust • Economics of Security community established • Launched activities: • Economic Efficiency of Security Breach Notification Schemes • Monetising privacy pilot • Trust and reputation models activity • Minimum disclosure activity • Security Month: • Inventory on recent awareness security events across Europe & USA • Security awareness video clips supplied to DHS. • EU-US Expert Sub-Group on Awareness raising • 5 expert groups meetings and WS organised • 10 Deliverables 16/8/2012 6
- 7. Stakeholder Relations & Project Support Activities Stakeholder Relations: • Increased information sharing with several EU bodies: JRC, CEN, Europol, EDA, CEPOL, EMSA, … • Inventory of CERTs in EU (Nat./Governmental & others) • Country Reports validated by the NLOs and published • Formal requests management process activated Project Management & Support Activities: • NIS in Education • Horizontal Risk management methodology: EMSA, life-log … 16/8/2012 7
- 8. Extra Activities • Continueto support the CERT EU pre-configuration team as a support for the EU institutions CERT • Present preliminary results at 8th EFMS (EC/A3 Request) • EP3R: • engagement of public and private stakeholders in EP3R • engagement of national PPPs in EP3R • 5 deliverables & 3 WS • EU-US Exercise: • defining public affairs strategy, evaluation, monitoring, training • 2 Deliverables & 4 WS • EU-US sub group on PPPs (ICS/SCADA) • 4 Deliverables & 4 WS • Supply Chain Integrity (SCI) 16/8/2012 8
- 9.
- 10. Risk Patterns Categories ofattacks: Organisation view Economic Espionage Cybercrime Military/Governmental Espionage Cyber warfare Diverse players Amateurs, petty criminals Organized crime National security services Others…
- 11.
- 12. Anonymous 12
- 13. Cyber attacks: areal risk Attacker Risk Analysis: Economic cost/benefit balance Organisation/Institutional/Social Support: • jail risk Return of Investment Full-fledged economy Credit-card numbers, passwords, mules DIY virus-kits with money back guarantee 13
- 14.
- 15. What’s your favouriteThreat? Attacker: few loss & high benefit Defender: High loss & High costs Defender Approach: Identify attacker pattern (motivation, many?) Choose defense policy: People (Authentication), (Personal) Data, (malicious) SW, (consumerisation) HW Get external support (LEA, n/g CERT, Cloud) 18
- 16.
- 17. Stuxnet 22
- 18. Night dragon 23
- 19. Wikileaks 24
- 20.
- 21.
- 22.
- 23.
- 24.
- 25. The Fight againstCybercrime (1/7) Cybercrime project 2011 Cooperation between CERTs and Law Enforcement Agencies in the fight against cybercrime A first collection of practices Operational, legal and cooperation aspects Informal expert group Surveys 6th ENISA Workshop CERTs in Europe 30
- 26. The Fight againstCybercrime (2/7) Cybercrime project 2011 Conclusions: Collaboration between CERTs and LEAs needs to be bilateral Integrating teams (internship, secondment, …) Use of both formal and informal communications Increase opportunities for CERTs and LEAs to meet National legislation should be made clearer and exceptions should be made for CERTs. … 31
- 27. The Fight againstCybercrime (3/7) Legal aspects project 2011 A flair for sharing – encouraging information exchange between CERTs A study into the legal and regulatory aspects of information sharing and cross-border collaboration of n/g CERTs in Europe Informal expert group to support the review of the study 32
- 28. National/Governmental CERTs A nationalCERT: Is Concerned with incidents at the national level, mostly those affecting the CII Can act as international contact point for incident management A governmental CERT: Is responsible of NIS of governmental institutions, usually linked to intelligence units Most EU MS have them, sometimes delegated to Academic CERT. 33
- 29. n/g CERTs inEurope 34
- 30. The Fight againstCybercrime (4/7) Legal aspects project 2011 Conclusions: A number of relevant legal framework identified Definitions of computer and network misuse Privacy and data protection legislation Criminal procedure Intellectual property rights Determining applicable law Some recommendations to policy makers & CERTs Greater info. on differences and clarity between relevant laws Putting n/gCERTs on a specific legal footing Providing tools and guidance for CERTs to share information whilst respecting legal obligations Gather specific advice (e.g. on interpretation of Data Protect) 35
- 31. The Fight againstCybercrime (5/7) http://www.enisa.europa.eu/activities/cert/support 36
- 32. The Fight againstCybercrime (6/7) Cybercrime projects 2012 Good practice guide on operational NIS aspects of the fight against cybercrime; and Good practice guide on legal/regulatory aspects of cybercrime. 7th Cybercrime workshop at EUROPOL 37
- 33. The Fight againstCybercrime (7/7) Cybercrime projects 2012 Main goals: Define key concepts Describe the technical and legal/regulatory aspects of the fight against cybercrime Compile an inventory of operational, legal/regulatory and procedural barriers and challenges and possible ways to overcome these challenges Collect existing good and best practices (technologies to use, information to interchange, etc.) Develop recommendations 38
- 34. Zeus trojan 39
- 35. CERT toolkits ENISA clearinghouse for incident handling tools (CHIHT): Types of tools available on our website, that can be used for cybercrime investigation: For more tools see link below: https://www.enisa.europa.eu/activities/cert/support/chiht 40
- 36. Annual CERT Workshops(1/2) 6th annual ENISA Workshop CERTs in Europe Prague, Czech Republic, 3-4 October 2011 Supported by the Czech Republic national CERT (CSIRT.CZ) Jointly organised with EUROPOL Closed meeting – by invitation only - speakers from MS national CERTs, Police/cybercrime PoCs, Europol, … Cybercrime topic 41
- 37. Annual CERT Workshops(1/2) 7th annual ENISA Workshop CERTs in Europe This year split in two parts Hands-on technical training workshop Mid-June 2012 Support from Team Cymru Hosted by University of Malta Co-located with FIRST event Workshop focusing on cybercrime Autumn 2012 Jointly organised with Europol Closed meeting - by invitation only 42
- 38. Proposal Directive onattacks against information system (1/2) Aim: To deal more efficiently with growing number of large-scale and highly sophisticated cyber attacks Will replace current Framework Decision (2005) on attacks against information systems Novelty: criminalisation of use, production and sale of tools (known as "botnets") to commit large scale attacks
- 39. Proposal Directive onattacks against information system (2/2) Proposal put forward by the European Commission in 2010 Negotiations in the Council (common approach agreed at the 2011 Council) Deliberations in the European Parliament started (LIBE is the Committee responsible) and indicative plenary sitting date 02/07/2012 European Parliament asked ENISA to share its objective expertise in the field This Directive might be adopted already this year http://www.europarl.europa.eu/oeil/popups/ficheprocedure. do?reference=2010/0273(COD)&lg=en#technicalInformation
- 40. Conclusions Hard to evaluaterisk Hard to detect attacks Many zero day threats still unknown Need to follow “normal” crime approaches: All criminals use computers to store/transfer data Need for collaboration: LEA/CERT PPP (EP3R) CIIP/CERT 47
Editor's Notes
- #7 The work of Working Group has proceeded and the meeting with (10) experts took place. A study on “Economic Efficiency of Security Notification Schemes” has been initiatedIn the topic of Security moth an AS-IS analysis has been finalized. The road map has been discussed with COM and is being currently prepared
- #12 Also hacking for fun: defence agencies, police, etc.They explain how they did it, how easy it was, and they show proofs of the intrussion.Some attacks were automated.
- #13 Anonymous go to the Media, but real hackers don’t, so we don’t know…
- #14 Mb Monetary benefit for the attackerPb Psychological benefit for the attackerOcp Cost of commiting the crimeOcm Monetary cost of conviction for the attackerPa Probability of being apprehended and arrestedPc Probability of conviction for the attackerMb+ Pb > Ocp + OcmPaPc- Clark and Davis 1995Bootnet kit 4K€. Renting 1K€/day/millions of nodes
- #15 Could be China federal agency, started in 2006 and reported in 2011.EmailAPT tools improve RoI thanks to easy targeting organisations from many economical sectors.
- #16 Bootnet kit 4K€. Renting 1K€/day/millions of nodes
- #22 Cyber attackers exploited vulnerabilities in Internet explorer. MI5 warned UK businesses about electronic espionage attacks (from Chinese hackers) in 2007. 2010: Operation aurora: Aimed at Adobe, Juniper networks, Rackspace, and accordingly Yahoo, Symantec,Morgan Stanley, etc.Operation Aurora was a coordinated attack which included a piece of computer code that exploits the Microsoft Internet Explorer vulnerability to gain access to computer systems. This exploit is then extended to download and activate malware within the systems. The attack, which was initiated surreptitiously when targeted users accessed a malicious web page (likely because they believed it to be reputable), ultimately connected those computer systems to a remote server. That connection was used to steal company intellectual property and, according to Google, additionally gain access to user accounts.
- #23 Stuxnet2010, shows another advanced persistent attack. Uses USB sticks to infect other machines. Uses zero-day exploits (old zero-day exploits), similar to Conficker. Not the first attack on industrial control systems. But the first to attract attention, because it targeted nuclear plants.
- #24 Another attack on ‘critical infrastructure’: Clumsy attacks on global oil, gas, and petrochemical firms, as well as individuals and executives in Kazakhstan, Taiwan, Greece, and the United States – allegedly the goal was to acquire proprietary and highly confidential information. Night Dragon attacks leverage coordinated, covert, and targeted cyber-attacks involving: social engineering, spear phishing, vulnerability exploits in the Windows operating system, Active Directory compromises, and Remote Administration Tools (RATs). The attack sequence is as follows:Public-facing web servers are compromised via SQL injection; malware and RATs (Remote Admin. Tools) are installed.The compromised web servers are used to stage attacks on internal targets.Spear phishing attacks on mobile, VPN-connected workers are used to gain additional internal access.Attackers use password stealing tools to access other systems - installing RATs and malware as they go.Systems belonging to executives are targeted for email and files that are captured by the attackers.
- #25 Wikileaks: threecybersecurity incidents 1. an alleged insider attack, 2. banning wikileaks from amazon, paypal and mastercard, 3. retaliation by the Anonymous hackers. (One diplomatic cable cites a Chinese source saying that the Chinese politburo organized the aurora attacks.)(Another diplomatic cable states that an German expert on Iran advised the US to covertly sabotage nuclear facilities).
- #26 Attacks on the French government preceding the G20. A trojan horse was used (in an email with a pdf document). Some time later, attacks on the EC preceding the Libya summit. Again malware in an email.
- #27 Then just as 2011 started: Attacks on the EU Carbon Emissions trading scheme (ETS). First (in 2010) simple phishing for passwords. The member states started using PKI certificates.In 2011 companies were attacked by the Nimkeytrojan, using an internet explorer exploit (the Nimkeytrojan) to steal PKI certificates. Millions of emisions certificates were traded away.
- #28 Another advanced persistent attack: Social engineering (Recruitment Plan.xls) combined with a software vulnerability (in Adobe’s flashplayer). Attack resulted in loss of sensitive data of about 40 million RSA SecureID tokens. Lockheed Martin (and other defense contractors) have apparently been targeted using the data about the secureid tokens.
- #29 It started with a lawsuit against geohot. Then a DDoS attack. Investigation revealed an ongoing APT, stealing data of 77 million accounts (unencrypted passwords). Allegedly, SPN used outdated version of wordpress, vulnerable to SQL injection.
- #32 Concluded also:Cooperation between ENISA and Europol…CERT-EU: Recommend early contact with LEA, to avoid destruction of clues/evidences.
- #33 Expert group with members from CERT and DPA (data protection) & COM, reviewed the study prepared by the contractor.Explain n/g CERTs
- #34 20 national / governmental CERTs set up in the EUConcerned with incidents at the national level, affecting the ‘critical information infrastructure’Can act as a contact point for incident managementOften sit within a network of peers of other CERTs (e.g. CERTs within banking or telecommunications)Significant variation across Europe: some are distinct entities but a common model is also a university CERT delegated to be a national/governmental CERT
- #36 The law says what to do and what not to do, but needs interpretation and this interpretation needs guidance.Law don’t have to create barriers for interchange of information relevant to investigations, between n/g CERTs and others.
- #38 Addressed to CERTs and Policy makers.Guidance for international collaboration.
- #40 Half of the malware is Zeus. Even amateurs are using it. Majority of infections with Zeus occur on systems with up-to-date antivirus systems. The effectiveness of antivirus against Zeus is 23% (source Trusteer). Forrester reports that 88% of Fortune500 companies show Zeus botnet activity. UK government was targeted with Zeus in the beginning of 2011.
- #43 Ask Jo the exact subjects of the hands-on in Malta.End September probably.
- #45 Legal observatory, look at it for thelastplenarysessionchanges.http://www.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2010/0273(COD)&lg=en#technicalInformation
- #46 Ask Victoria Baines and John Lyon ICSPA president.ICSPA membership was proposed, but EINSA declined due to mandate restrictions.* Mention also the presentations of Marco and Silvia.
- #47 high profile attacks, they are all either a software exploit or social engineering or combination.About phishing: This is a ppt I once gave at a staff meeting. It is an awareness activity to protect from phishing Attach malware to mail, or file with embedded contaminated file or just a link.