NASA Cyber Security Webinar: Phishing Detection Strategies
•Download as PPTX, PDF•
5 likes•540 views
This was a cyber security webinar for NASA on Phishing Detection Strategies. It was done on 27 July 2017 by Hoala Greevy, Founder CEO of Paubox, Inc.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to NASA Cyber Security Webinar: Phishing Detection Strategies
Similar to NASA Cyber Security Webinar: Phishing Detection Strategies (20)
More from Paubox, Inc.
More from Paubox, Inc. (7)
Recently uploaded
Recently uploaded (20)
NASA Cyber Security Webinar: Phishing Detection Strategies
- 1. Phishing Detection Strategies For: NASA 27 July 2017 @pauboxhq
- 2. Hoala Greevy Founder CEO, Paubox, Inc. - HIPAA Compliant Email Made Easy. 18 years’ experience in email security & encryption. Phishing & Fishing expert. =) @PAUBOXHQ
- 3. I. What is Phishing Today? II. Threat Landscape III. Best Practices IV. Looking Ahead Agenda
- 4. I. What is Phishing Today? Overconfidence Dilemma Display Name Spoofs Ransomware stealing thunder
- 5. I. What is Phishing Today? It’s always been about the $$$.
- 6. I. What is Phishing Today? In some cases it’s about data theft.
- 7. I. What is Phishing Today? And now it’s about Politics too.
- 8. I. What is Phishing Today? Source: Fortune
- 9. Overconfidence Dilemma 2017 phishing study University of Texas at San Antonio Source: Science Daily
- 10. Overconfidence Dilemma Fatal Flaw: Most people believe they are smarter than the criminals perpetrating them. Source: Science Daily
- 11. Display Name Spoofs 91% of phishing attacks Highly targeted Impersonates someone familiar to the recipient (usually C-Level)
- 13. Top Phishing Subject Lines 2017 Source: Fortune Free online phishing test April – June 2017 6.6M phishing emails 2M inboxes
- 14. Source: Fortune
- 15. Breakdown The Subject Line is Important. Urgent / Alert / Immediately
- 16. NASA Phishing Attack (2015) Source: IT Security Threat: Phishing Email – NASA HQ
- 17. NASA Phishing Attack (2015) Source: IT Security Threat: Phishing Email – NASA HQ Display name spoof (System Admin) No spelling errors Most likely trying to gain access to mailboxes
- 19. Google Docs Phish Shut down quickly. Yet millions affected. Named the app Google Docs Source: Wired
- 20. Ransomware 2015: 1K daily attacks 2016: 4K daily attacks 2017: ?
- 21. WannaCry at a Glance Stolen NSA tools North Korea GDP 150 countries At least 230K infected
- 22. Big Tech Companies Get Hit Too
- 23. Facebook & Google Phished Each paid nearly $100M in fake invoices Impersonated Quanta Computer Most funds recovered Source: The Guardian
- 24. Insider Threat
- 25. Office 365 Accounts Hacked Wire transfer request sent from actual HR employee mailboxes 18,000 accounts affected (why so many?) Source: SC Magazine
- 26. Politics
- 28. The Perfect Weapon* Cheap Hard to see coming Hard to trace * NY Times
- 29. Let’s Dive In
- 30. Domain Name Shell Game http://shop.radioactivegamingeu.com Resolves to: 104.31.65.24 104.31.64.24
- 31. Who owns these IPs? 104.31.65.24 104.31.64.24
- 33. III. Best Practices Google Safe Browsing Macro Policy Level Up User Training (hold contests) Nuclear Option: Macs only?
- 34. Google Safe Browsing It’s Free & Constantly Updated Lots of data sources (over 1B users) Used in Chrome, Firefox & Safari Can be used in Email too Source: Google Safe Browsing
- 35. Macro Policy Re: allowing macros via attachments Does the business downside now outweigh the upside? Blog post: We’re Clamping Down on Deadly Macros and Ransomware
- 36. Arthur Ream CISO, Cambridge Health Alliance Steak Dinner phishing bounty Source: HIMSS Privacy and Security Forum in Boston
- 37. Nuclear Option: Macs only? Something to think about
- 38. IV. Looking Ahead 2FA by default Clamp down on Domain Registrars Google Safe Browsing API
- 39. 2FA by Default Two Factor Authentication Something you know -and- Something you have
- 40. Domain Registrars It’s too easy to register a domain name No checks on identity Why is it automated?
- 41. Google Safe Browsing API Huge Dataset Constantly updated Very accurate
- 42. IV. Looking Ahead Machine Learning FTW Death of the Appliance (Cloud will win) Port-based Geographic Segmentation
- 44. Death of the Appliance Cloud will win Nearly zero access to Machine Learning
- 45. Port-based Geographic Segmentation Do NASA users check email from Russia?