Viruses, malware, and cyber attacks are increasingly sophisticated threats. The document discusses the history of security issues like spam and botnets. It defines common types of malware like rootkits, trojans, and ransomware. The document examines notable data breaches and the most active current malware. It profiles the adversaries behind attacks and the countries most targeted. The anatomy of a hack is outlined, and statistics about breach detection times and costs are provided. Examples show security risks for small businesses and risks of unsecured mobile devices. The document promotes managed security services and assessments to bolster protection beyond antivirus and firewalls alone.

1. By Paul Hager, CEO Information Technology Professionals

2. Your Questions Answered Today
• Who is that is writing all
these viruses?
• Why do they do it?
• I have Anti Virus and a
Firewall so my company is
safe, right?
• What do you do to keep
our company data safe?

3. Vocabulary:
– Rootkit – Virus that provides unauthorized access to a remote
system
– Trojan - a piece of software that looks like it is doing what the
user thought, but in reality it is malware designed to infect the
user's PC. It is named after the horse that the Greeks used in
the Trojan War, as detailed in Virgil's Latin epic poem The
Aeneid.
– Ransomeware – virus used to demand payment
– BOTNET – Network of infected computers used to send SPAM
or DDoS attacks
– DDoS – Denial of Service. Volumes of junk traffic to prevent
the good traffic from getting through

4. A Brief History of Security
• The first SPAM email in 1978
• Name does come from
Monty Python
• Grows in the 90’s and early
2000’s
• SPAM exists to sell:
– Adult Content
– Pharma
• Major Botnet and ISP take
downs in 2008 but they
strive on

5. A Brief History of Security
• Only stopped by….
– VISA and
MASTERCARD
• Now what?
• Viruses
• Ransomware
• BOTNETS

6. A Brief History of Security
• New Currency in a
new modern black
market Bitcoins
• Bit mining is the
new money
laundering
• The Onion Router
Network
• The Darknet

7. Where is it sold?

8. State of the State of Security
• 65 Adversaries, 36 most active
• Increase in Ransomware
• Increase in sophistication
• POS Targeting Credit Card Track Data in memory
• Phone scams on the rise
(https://www.youtube.com/watch?v=sz0cEo2h3f8)
• More Damage Than Ever
• XP EOL and Server 2003 EOL
• http://map.ipviking.com

9. Review of Recent Noteable Breaches
http://www.informationisbeautiful.net
/visualizations/worlds-biggest-data-
breaches-hacks/
• Target
• Sony
• Home Depot
• 477 million
identities/accounts
have been
compromised in the
last 12 months.

10. Sony

11. Sony Part 2
• DDoS
• Lizard Squad
• DDoS for hire for $40 take
down a competitor
• Average cost for DDoS event
defense is $40,000
• Believed to be captured

12. The Adversary

13. The Adversary
• Criminal
• Hacktivist
• State-sponsored
• Nationalist

14. Countries Most Attacked

15. Most Active Malware

16. PlugX
• Commonly delivered via a spear phishing
attack.
• Comes from zero day from last March,
CVE-2014-1761, which exploits
vulnerable Microsoft RTF or Word
documents.
• Others make use of well-worm holes like
CVE-2012-0158 in PowerPoint and Excel,
that were also used by the IceFog, Red
October, and Cloud Atlas attacks.
• While some of the groups using PlugX
have gone out of their way to register
new domains for leveraging the
malware’s C+C, many domains from the
last several years remain active

17. Cryptolocker aka Cryptowall
• First version taken down in
June of 2014 with the
ZeusBot Net going down
• No longer uses BOTNETS
uses P2P
• Polymorhpic and self
registering Domain names
• Locking Computer Screens
• AV won’t prevent it

18. Anatomy of a Hack
Footprinting
• DNS WHOIS
• Website
Scanning
• NAMP Scan
Enumeration
• Probe open
ports phish
for data
Gaining Access
• Password
Sniffing,
Penatration,
Brute Force
Escalating
privilege
• Known
Exploits
Pilfering
• Gather
information
and use it to
re-
enumerate
and steal
data
Covering
Tracks
• Delete log
files
• Hide tools
Create
Backdoors
DDoS
Steps 1-4 take less than a week on average

19. Other Security Statistics that Will
Scare You
• The Average time to detection is 271 days
• https://databreachcalculator.com
• Average is around $200 per record
Source: Crowdstrike.com

20. Just an Enterprise Problem Right?
• No
• As a percentage of revenue a single HIPPA or
PCI fine could be worse than the Target
breach for small to midsized company

21. Example: Dental Practice in Madison
• Virus Leads to Customer Database being
compromised
• Patient Information Breach
• HIPPA fines total $130,000 for a 11 person
office

22. Example: Commercial Business in
Madison
• Virus keylogged CFO’s machine for months
• Executed valid wire transfer from his PC to
offshore account
• Only stopped because of the bank

23. Example: Importance of Security With
mobile Employees
• In 2009, the FBI told Coca-Cola executives that hackers had broken
into their computer systems and spent a month "pilfering sensitive
files" about Coke's "attempted $2.4 billion acquisition of China
Huiyuan Juice Group,”
• The subject line on the email was "Save power is save money!
(from CEO)
• Gave hackers full access to Etchells's computer
• Once in control of the computer, the hackers installed various
other programs, gaining access to the company's corporate
network and using Etchells's machine as a staging point to store
and download data taken from other computers.”
http://www.networkworld.com/article/2223443/microsoft-subnet/coca-
cola-hacked-by-chinese-and-kept-it-a-secret.html

24. Firewall and AV is Not
Enough
• Need threat intelligence
• You will be breached its
how quickly you respond

25. ITP Your Outsourced CISO

26. ITP Offerings
• Yes we do Strategic, Support & Project
• We have a security practice
• Assessment
• Remediation
• Ongoing Protection

27. Solutions
• ITP Managed Security Service
Packages
• ITP Managed Security products
• Assessments
– PCI DSS
– HIPPA
– SOX
– NIST
– FISMA

28. Assessment Process (NIST)
Step 1
CATEGORIZE
Information
System
Step 2 SELECT
Security
Controls
Step 3
IMPLEMENT
Security
Controls
Step 4
ASSESS
Security
Controls
Step 5
AUTHORIZE
Information
System
Step 6
MONITOR
Security
Controls

29. Parting Personal Security Tips
• Credit monitoring for your kids
• Use DuckDuckGo.com for your search engine
• IP Vanish as a personal VPN solution if you don’t
have a corporate network
• Enable Privacy Protections on your devices and
in your browsers
• Don’t use public wifi especially when travelling

31. Contact Info
• Bill Henry, VP of Sales
• bhenry@itprosusa.com
• 414-453-7100