Downloaded 22 times
Uploaded byBizLibrary
Lessons Learned from the Top Four Cyber Security Breaches & How Your Company Can Apply Them Now
Geoff Hancock discusses significant data breaches, including those involving Sony Pictures, Target, and JP Morgan, emphasizing the methods used by attackers such as phishing and social engineering. The breaches resulted in millions of stolen records and substantial financial impacts on the organizations involved. Recommendations for enhancing cybersecurity include improved cyber hygiene, technical measures, and awareness of insider threats.
More Related Content
Similar to Lessons Learned from the Top Four Cyber Security Breaches & How Your Company Can Apply Them Now
Lessons Learned from the Top Four Cyber Security Breaches & How Your Company Can Apply Them Now
- 2. Presenting Today Geoff Hancock CEO AdvancedCyber Security Group @GeoffHanCyber Follow along on Twitter: #BizWebinar @BizLibrary Erin Boettge Content Marketing Manager, BizLibrary eboettge@bizlibrary.com
- 3. • Removed 100gigs of data • Included personal information about Sony Pictures employees and their families, e-mails between employees, information about executive salaries, and copies of then-unreleased Sony films • Gained access to the network through phishing and an employee selling her administrator credentials • Stole and destroyed the data Sony
- 4.
- 5. Target • 110 millionrecords stolen • Associated costs topped $200 million • Target says it committed $10m to update technology • Target CEO Gregg Steinhafel resigned
- 6. Target • Stole thecredentials of Target's HVAC vendor, Fazio Mechanical Services • Infected the vendor with general-purpose malware Citadel through an email phishing campaign • Had to slow down to do reconnaissance
- 7. JP Morgan • Stole83m customers' personal information • Obtained list of applications and programs running on JP Morgan’s computers • Gained information to target specific people—and extra insight into the stock market
- 8. JP Morgan • Stolethe login credentials of an employee • Able to do so because: • Did not have double (two-factor, second one-time password) authentication scheme • Security team apparently neglected to upgrade one network server
- 9. Office of PersonalManagement (OPM) • Stole 22.5 million records • Accessed poorly configured, outdated systems • Gained access via an administrator’s info Contractors breached: USIS Keypoint Government Solutions
- 10. Office Of PersonalManagement Malware was found, but insertion was identified as 10 months prior to the first breach (2013). IMPACT • SF86 forms stolen • Classified information stolen
- 11. Attackers’ Process • Investigatevictim • Determine most effective malware • Determine and execute insertion technique • Secure beachhead and establish access • Move across system • Identify valuable data • Exfiltrate information
- 12. How The AttackersGet In • Phishing • Social engineering • Known vulnerabilities • USB sticks • Ransomware • IT Configurations • Distributed Denial of Service (DDoS) • Passwords
- 13.
- 14.
- 15. Humans in theLoop: Cyber Hygiene • Use email securely • Identify phishing • Change passwords (make them complex) • Practice wireless security • Understand social engineering • Use social media judiciously • Be alert to insider threats • Secure the supply chain
- 16. Technical Cyber Hygiene •Change IT configurations • Utilize Defense in Depth • Put in place firewalls and endpoint monitoring • Use encryption • Look up the SMB list For more information see CISecurity.org
- 17. A Tale ofTwo Breaches Video Series • PCI DSS Compliance for Restaurant Employees • A Tale of Two Breaches • Cybersecurity and Social Media • Protecting Against Insider Threats • Protecting Personal Data • Protecting Against Malware • Social Engineering • Wireless Security • Mobile Device Security • Phishing • Password Security • Using Email Securely
- 18. Computing Securely inthe Cloud The best assessment of your leadership comes from those you lead. Has a new day dawned where Cloud Computing and security are in perfect alignment? Well, for now, let's just say we're closer to that lofty goal than we had been. With broad acceptance, and the adoption of Cloud platforms by more and more organizations, it seems we've reached a point where we may be feeling a bit better about Cloud security. That being said, as we're all aware, there's still much to learn and still a need to proceed cautiously with Cloud ventures.
- 19. Try out thesevideo lessons and more! Let us know through the poll if you’d like a free trial of BizLibrary’s online course collection. www.bizlibrary.com/free-trial