Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom •...

36
Real - world Cybersecurity for Lubricant Manufacturers Bryce Austin April 13, 2019 www.tcestrategy.com Twitter: @ brycea LinkedIn: linkedin.com/in/ bryceaustin /

Transcript of Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom •...

Page 1: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Real-world Cybersecurityfor Lubricant Manufacturers

Bryce AustinApril 13, 2019

www.tcestrategy.comTwitter: @bryceaLinkedIn: linkedin.com/in/bryceaustin/

Page 2: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

2

Prices falling for Cybercriminal Supplies Fred Williams | November 27, 2013 | Protecting Yourself

$4

Page 3: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 4: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/

https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/
Page 5: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 6: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 7: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Risk Responses

• Quantify existing risk and accept it• Mitigate existing risk to an acceptable level• Transfer risk to a 3rd party

Page 8: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 9: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

How can you make yourself difficult to attack?

Page 10: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

vs.

Page 11: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Competitive Advantage #1

Understand your Opponent

Page 12: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Nation States

Summary of Actors

Agenda driven. Sophisticated and well-funded. Least likely to perform

untargeted attacks. Highly likelihood for advanced persistent threats.

Risks include IP theft, compromised systems. Likely possesses zero-day

vulnerabilities.

Organized

Crime

Financially driven. Moderate-to-high sophistication. May possess zero-

day exploits, likely botnets. Tactics include phishing (including spear

phishing), ransomware.

HacktivistsAgenda driven. Low-to-moderate sophistication. Reliance on botnets,

known vulnerabilities exploited in unpatched systems. Tactics include

business disruption, leaking data.

EmployeesMotives and capacities vary widely. May be intentional or

unintentional. Appropriate policies and controls will limit damages.

Responses can be rapid and comprehensive.

Individual

HackersEgo driven. Threat profile comparable to low/moderate-capacity

Hacktivist/Organized Crime categories. Diminishing demographic.

Page 13: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Competitive Advantage #2

Understand Cybercriminal Behavior

Page 14: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Breach Methodology:• Phishing• Hopping• Scraping• Aggregating• Exfiltrating

Page 15: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Cyber Kill-Chain

stop any step = stop the breach

Page 16: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 17: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 18: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 19: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 20: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 21: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Cyber Kill-Chain

stop any step = stop the breach

Page 22: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Competitive Advantage #3

Understand your Opponent’s Motivation

Page 23: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

RANSOMWARE• SF Muni – $73k ransom• City of Atlanta – $52k ransom• Anchorage, AK (Mat-Su) – $400k ransom• Valdez, AK – Paid $27k ransom• Jackson County, Georgia – Paid $400k ransom

Page 24: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Ransomware Penetration:• Phishing – need MFA on your O365 accounts• Port 3389 – CLOSE IT!• Pass the Hash – TOXIC Domain Admin accts• MFA on your VPN – is it not optional• Identical local admin accts on all PCs – LAPS• Unpatched PC’s / users as local admins – TOXIC

Page 25: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 26: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Ransomware Defenses:• OFFLINE backups. TESTED, MONITORED backups• Tested restore procedures

• Offline restore methodology• Workstation reimages• Server full rebuilds

• Pre-negotiated incident response team contract• Geofiltering of all Internet traffic• 35% free drive space on all network drives

Page 27: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

https://www.infosecurity-magazine.com/news/zurich-refuses-to-pay-out-for/

Regarding Cybersecurity Insurance…

https://www.infosecurity-magazine.com/news/zurich-refuses-to-pay-out-for/
Page 28: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Shifting gears…

Competitive Advantage #4

Catch them in the Act

Page 29: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 30: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 31: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 32: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 33: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 34: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Proactive detection beats a great response,

every time

Page 35: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,
Page 36: Real-world Cybersecurity for Lubricant Manufacturers...RANSOMWARE • SF Muni –$73k ransom • City of Atlanta –$52k ransom • Anchorage, AK (Mat-Su) –$400k ransom • Valdez,

Bryce AustinCEO, TCE Strategy

Twitter: @bryceaLinkedIn: linkedin.com/in/bryceaustin/

http://linkedin.com/in/bryceaustin/

Our lady ransom prospectus

Our lady ransom prospectus

Sp-164 Rev K Parts List - PRIMAAX EX / FIREMAAX EX ... · SP-164 5 Selection Guide Sub HeadLongitudinal t orque rod assembly page 12 page 14 priMaaX eX 26K• 52K • 78K 26K T •52K

Sp-164 Rev K Parts List - PRIMAAX EX / FIREMAAX EX ... · SP-164 5 Selection Guide Sub HeadLongitudinal t orque rod assembly page 12 page 14 priMaaX eX 26K• 52K • 78K 26K T •52K

Ransom Oaks Who-to-Call Summer Insert Available …ransomoaks.com/wp-content/uploads/newsletter/2015/1508...A1 Ransom Oaks: Resident’s Insert Thank You! In This Issue Ransom Oaks

Ransom Oaks Who-to-Call Summer Insert Available …ransomoaks.com/wp-content/uploads/newsletter/2015/1508...A1 Ransom Oaks: Resident’s Insert Thank You! In This Issue Ransom Oaks

Ransom Notes: Lesson and Assignment · - Traditional ransom notes are disguised so the victim doesn't know who the ransom note came from – for example, changing your handwriting,

Ransom Notes: Lesson and Assignment · - Traditional ransom notes are disguised so the victim doesn't know who the ransom note came from – for example, changing your handwriting,

Austria - by Toni Ransom

Austria - by Toni Ransom

Ransom Oaks All Ransom Oaks Pools Who-to-Call Openransomoaks.com/wp-content/uploads/newsletter/1908... · RANSOM OAKS NEWS 2 Ransom Oaks Board of Directors RANSOM OAKS is a planned

Ransom Oaks All Ransom Oaks Pools Who-to-Call Openransomoaks.com/wp-content/uploads/newsletter/1908... · RANSOM OAKS NEWS 2 Ransom Oaks Board of Directors RANSOM OAKS is a planned

Barbara Ransom, PhD

Barbara Ransom, PhD

Ransom Oaks Community Corporation . 101 Ransom Oaks Drive ...ransomoaks.com/wp-content/uploads/newsletter/2014... · Ransom Oaks Community Corporation . 101 Ransom Oaks Drive . East

Ransom Oaks Community Corporation . 101 Ransom Oaks Drive ...ransomoaks.com/wp-content/uploads/newsletter/2014... · Ransom Oaks Community Corporation . 101 Ransom Oaks Drive . East

A Ransom for ALL

A Ransom for ALL

a great place to live. Issue - Ransom Oaksransomoaks.com/wp-content/uploads/newsletter/2013/1312... · 2013-11-22 · RANSOM OAKS NEWS 2 Ransom Oaks Board of Directors RANSOM OAKS

a great place to live. Issue - Ransom Oaksransomoaks.com/wp-content/uploads/newsletter/2013/1312... · 2013-11-22 · RANSOM OAKS NEWS 2 Ransom Oaks Board of Directors RANSOM OAKS

The Ransom Project

The Ransom Project

J. Ransom Gift Guide

J. Ransom Gift Guide

Ransom Letter PDF

Ransom Letter PDF

The Ransom of Red Chief - borger1.files.wordpress.com€¦ · The Ransom of Red Chief byO.HENRY Connect to Your Life Hold for Ransom Have you ever read about a ransom or heard about

The Ransom of Red Chief - borger1.files.wordpress.com€¦ · The Ransom of Red Chief byO.HENRY Connect to Your Life Hold for Ransom Have you ever read about a ransom or heard about

Kidnap, Ransom, and Extortion Broker Playbook - aig.com · PDF fileKidnap, Ransom, and Extortion Broker Playbook. ... locations like Nigeria, Somalia, Iraq, ... Kidnap and Ransom insurance

Kidnap, Ransom, and Extortion Broker Playbook - aig.com · PDF fileKidnap, Ransom, and Extortion Broker Playbook. ... locations like Nigeria, Somalia, Iraq, ... Kidnap and Ransom insurance

Text Response: Ransom

Text Response: Ransom

R Rear Suspension - HENDRICKSON...a 21140-034L R 48K • 52K, for 5¾" Bushing b 21140-033L R 52K, for 6" Bushing 20 End Bushing 4 29878-001L R 48K, 5¾" Length 45407-000L R 52K, 6"

R Rear Suspension - HENDRICKSON...a 21140-034L R 48K • 52K, for 5¾" Bushing b 21140-033L R 52K, for 6" Bushing 20 End Bushing 4 29878-001L R 48K, 5¾" Length 45407-000L R 52K, 6"

Mixed MediaNEEDS RANSOM

Mixed MediaNEEDS RANSOM

Ransom - dot.nd.gov · Title: Ransom Created Date: 4/27/2017 9:05:39 AM

Ransom - dot.nd.gov · Title: Ransom Created Date: 4/27/2017 9:05:39 AM

How to turn 50 k into 73k in 9 days with options trading

How to turn 50 k into 73k in 9 days with options trading