Cybersecurity - you are being targeted -Keyven Lewis, CMIT SOLUTIONS

Editor's Notes

• #3: A recent Tech Pro Research survey showed that 61 percent of SMBs allocate less than 10 percent of overall budget to IT security. 1 of 3 (32%) security professionals lack effective intelligence to detect and respond to cyber threats. NIST (National Institute of Security for Technology) Over 260 million records containing sensitive information have been compromised in the first four months of 2018 Worldwide cyber security spending will reach $96 billion by the end of 2018
• #5: 23% of phishing emails are opened by recipients 11% that open the phishing email also click on the link or attachment in the message But the most troubling # is 43% and that's the percentage of spear phishing attacks targeting businesses with 250 or few employees. 14 Million small businesses were attacked over past 12 months 48% more SMBs experienced a breach due to employee neglect in 2017 vs. 2016
• #6: 1 in 131 emails contains a malware. This is the highest rate in about five years, and it is further expected to increase as hackers attempt to use malware like ransomware to generate money from unsuspecting people
• #7: This photo appeared in Wired Magazine in 2011 titled “How a remote town in Romania has become cybercrime central.”1 There is a supporting economy for cybercriminals. This is a city of 120,000 has a nickname: Hackerville (only a small percentage of them are actual hackers) Râmnicu Vâlcea is a town whose business is cybercrime, and business is booming. - More profitable than the global trade of all major illegal drugs combined Damage costs to hit $6 trillion annually by 2021*
• #8: Social Security number: $1 Credit or debit card (credit cards are more popular): $5-$110 With CVV number: $5 With bank info: $15 Fullz info: $30Note: Fullz info is a bundle of information that includes a “full” package for fraudsters: name, SSN, birth date, account numbers and other data that make them desirable since they can often do a lot of immediate damage. Online payment services login info (e.g. Paypal): $20-$200 Loyalty accounts: $20 Subscription services: $1-$10 Diplomas: $100-$400 Driver’s license: $20 Passports (US): $1000-$2000 Medical records: $1-$1000*
• #11: It’s become a security industry cliché that email is the number one threat vector. Here’s a recent data point. In the 2017 Threat Landscape Survey: Users on the Front Line, conducted by the SANS Analyst Program, for the Top Threat Vectors - 74% of the threats entered as an email attachment or link. https://www.sans.org/reading-room/whitepapers/threats/2017-threat-landscape-survey-users-front-line-37910 Other studies and estimates have put this percentage as high as 90% or more. Clearly email is a huge source of risk for modern organizations. Let’s take a look at some recent examples to unpack the reasons why
• #12: These threats are a constant worry for small, medium and large organizations across all industries.
• #13: How Effective is it? Very! Its been around for tens of years and still going strong! How: An email that can come from a seemingly credible institution such as a bank, ebay, facebook, paypal etc. It typically has an urgent call to action that will have you clicking on a link, attachment or embedded file. Spoofing / masking of email addresses and links play a big role so beware! Links to apparent institutional websites can be very convincing – so watch what you click. Attachments may seem to do nothing, but may have key-loggers or crawlers running in the background… or worse!
• #15: The soft tissues of your cyber self How Effective is it? Very! If only because it is a highly targeted campaign. Typically again through email but will be a lot more polished and convincing. The Social engineering element leverages the human instinct to ‘trust’ others, avoid confrontation and not question authority etc. Here attackers spend a lot more time studying their subjects – it’s worth it – the rewards can be huge! Attacks can either happen fast, or once in, attackers can ‘sleep’ in your network. Once in, they will take time to learn more about you, your company, your processes etc… whatever they need to launch a highly effective strike against you. Becuase they are so customized, tradition firewalls, web filters and the like are often rendered useless.
• #16: The soft tissues of your cyber self How Effective is it? Very! If only because it is a highly targeted campaign. Typically again through email but will be a lot more polished and convincing. The Social engineering element leverages the human instinct to ‘trust’ others, avoid confrontation and not question authority etc. Here attackers spend a lot more time studying their subjects – it’s worth it – the rewards can be huge! Attacks can either happen fast, or once in, attackers can ‘sleep’ in your network. Once in, they will take time to learn more about you, your company, your processes etc… whatever they need to launch a highly effective strike against you. Pecuase they are so customized, tradition firewalls, web filters and the like are often rendered useless.
• #18: 1 in 131 emails contains a malware. This is the highest rate in about five years, and it is further expected to increase as hackers attempt to use malware like ransomware to generate money from unsuspecting people. 54 percent of organizations experienced one or more ransomware incident in 2017
• #19: 70 percent of businesses paid to get their data back in 2016. (Source: IBM) According to Dimension Data, ransomware attacks worldwide rose 350 percent in 2017 over the previous year. In 2017, the average ransom payment grew to $3,675 per ransom.