Headline Verdana Bold Cybersecurity Threat Landscape Emerging Threats

Headline Verdana Bold Cybersecurity – Threat Landscape, Emerging Threats Teodor Cimpoesu, Senior Manager, Deloitte Chisinau, Moldova, 22 Nov 2017

Agenda 1. Threat Landscape 2. Challenges for Incident & Crisis Management 2

1. Threat Landscape understanding risks 3

Threat Profiles Relevant for any company / institution Cybercrime Targeted / Non-targeted Nation State • Nation State - depending on company profile can be espionage, intellectual property theft, sabotage Threats Insider Threat • Cybercrime - Most common, main goal is monetization • Insider Threat – monetization, sabotage / revenge • Hacktivism – indirect target for a political / social statement Hacktivism 4

Advanced threat actors Sources: Deloitte Threat Intelligence & Analysis program LEVEL OF CONCERN motivated by various causes, are targeting financial services with complex cyber attacks, combining cyber, human & physical elements Payments & trade fraud Phishing Weaponised Macro’s Critical infrastructure attacked Nation state entity Ransomware Malware targeting mobile devices & financial applications Exploit kits ER H IG H nt te In ER ER W LO W ct pa Im y ER W LO ER t ili ce Script kiddie LO ER H H ct ab ap pa Researcher/ journalist C en ER ER H r ur cc E R TU FU W Lone-wolf cyber criminals IG Spam O g in g er LO Hacktivist Data breaches ER IG Physical actions H H Em Biometrics for security, but also as a data goldmine Insider Cyber espionage POS Malware Web Application Attacks IG T EN R R Commercialized EMV exploits / “shimmers” go mainstream Corporate espionage groups H Disruption of Communications (DDOS) H U C Subverted blockchains impacts services On demand malware or automated misinformation Organized crime groups ‘Just Access’ Botnets Social engineering Im A. I. applications for offensive & defensive use cases Malware W Attacks against financial “big” data LO Geopolitical hacking focussing on espionage or disruption LOW TOP ADVERSARY GROUPS TOP ATTACK VECTORS TOP THREAT SCENARIOS MED HIGH NOTABLE CYBER SECURITY EVENTS KEY TAKEAWAYS • Specialized crime groups target SWIFT systems of banks • Major financial institutions and regulators face data breaches • Ransomware and crimeware disrupts businesses globally. Threat actors develop capabilities and change their attack vectors to take the least difficult approach into your network. For FSI we observed, however, more complex attacks, combining various attack vectors to achieve economic, political or competitive gain. Tracking industry trends can assist in understanding attack vector changes and form protective mitigation strategies. 5

Payment Incidents The SWIFT Heist • 2017 Oct - Far Eastern International Bank in Taiwan saw a transfer attempt of $60 m to banks in the US, Cambodia, and Sri Lanka. • 2016 Sep – SWIFT announced that three more banks had been attacked (without loss. ) • 2016 Jun – ISACA UA reports hackers stole $10 million from an unnamed Ukrainian bank through a SWIFT loophole. • 2016 Feb – Bangladesh central bank hit for $81 million. The attackers were able to compel the Federal Reserve Bank of New York to move money to accounts in the Philippines and Sri Lanka. • 2015 Jan - Ecuador's Banco del Austro (BDA) hit for $12 million. BDA instructed Wells Fargo (SF) and Citibank (NY) to transfer money to Hong Kong. BDA sued on the basis that the U. S. bank should have flagged the transactions as suspicious. Wells Fargo countered that security lapses in BDA’s own operations caused the Ecuadorean bank’s losses. The attack started from a stolen credentials. • 2015 – Failed attempt to steal from Vietnam’s Tien Phong Bank • 2013 – Dark. Seoul attack against South Korea banks, insurers, TV networks – Linux/Windows destructive wiper malware The European Banking Authority (2016 May) said domestic authorities should stress test banks for cyber risks. The SWIFT board defined five pillars of a cyber security program: information sharing, enhancing SWIFT tools, support transaction pattern detection and support for 3 rd party providers. 6

Ransomware Long tail damage • The Global cost for organizations will reach $5 billion by the end of 2017, 400% increase from 2016 • Ransomware’s aftermath can be more costly than the ransom itself • Maersk – est. $300 million n lost revenues • Global manufacturer from France reported the same attack would drain about $290 million in sales this year. Financial services: • 55% list ransomware as the biggest cyberattack threat vector • one third of them also say they have lost between $100, 000 and $500, 000 due to ransomware attacks 7 Source: “The aftermath of ransomware”, Deloitte

Cybercrime Gang Crime Group Crime Organization Syndicate Cartel Source: RAND Corporation, Markets for Cybercrime Tools and Stolen Data (2014), www. rand. org Consortium 8

Cybercrime Source: Dissecting the Costs of Cybercriminal Operations, Recorded Future 9

Cyber Resilience Perspective NIS Directive – to bring cybersecurity capabilities the same level of development in EU NIS Authority, CSIRT teams ECB initiative - “European Red Team Testing Framework” (in mgmt track) Sector resilience – efficient sharing of CTI Response and recovery in a safe and efficient manner are key Source: ECB, Cybercrime: from fiction to reality, IN FOCUS issue #2, 2017 10

EU Cybersecurity Initiatives EU Cybersecurity Strategy (2013) – includes increasing cyber resilience and reducing cybercrime European Agenda on Security (2015) – includes harmonizing collaboration on criminal investigations on cybercrime Digital Single Market Strategy (2015) - includes a public-private partnership (PPP) on cybersecurity signed on Jul’ 16 by the Commission and the European Cyber Security Organization (ECSO) Communication on Strengthening Europe’s Cyber Resilience System and Fostering a Competitive and Innovative Cybersecurity Industry (2016) - includes a set of measures aiming at Supporting the emerging single market for cybersecurity products and services in the EU European Commission proposal on a Regulation of the European Parliament and of the Council on the future of ENISA (2017) - the “Cybersecurity Act” enables the Agency to better support the Member States in implementing the NIS Directive and to counter particular threats more actively by becoming a centre of expertise on cybersecurity certification 11

GDPR Context Requirements • Enhanced Notification - The Data Protection Authority (DPA) must be informed within 72 hours of the discovery of a ‘serious’ incident, affected consumers must also be notified without delay • Detailed Reporting - Companies are required to document all aspects of data breach – what happened, what steps they took to fix it, remediation strategies “In light of the tight timescales for reporting a breach - it is important to have robust breach detection, investigation and internal reporting procedures in place” -- UK INFORMATION COMMISSIONERS OFFICE Preparing for the GDPR, 12 steps to take now, 14/3/2016 https: //ico. org. uk/for-organisations/data-protection- reform/overview-of-the-gdpr/breachnotification/

GDPR Context Challenges with Breach Notification § Lack of preparation ü Cross-functional planning and preparedness is key to success ü What processes can improve an organization's cyber resilience? § Lack of proven response – Audit and Accountability ü Tracking of critical data throughout the lifecycle of an incident ü Clear ownership & responsibility § Slow disclosure times – Time to notification ü Recognizing a ‘critical’ incident ü Building agile, responsive incident plans

2. Challenges for Incident & Crisis Management 14

Incident Impact - Real Cyberattack impact factors: § Technical investigation § Customer breach notification § Regulatory compliance § Attorney fees and litigation § Post-breach customer protection § Public relations § Cybersecurity improvements But also: § Insurance premium increases § Increased costs to raise debt § Impact of operational disruption 95% § Value of lost contract revenue § Devaluation of trade name § Loss of intellectual property § Lost value of customer relationship Source: Beneath the surface of a cyberattack (Deloitte, 2016)

Intelligence Driven Defense Bullet Dash Sub-bullet Prevent & Prepare Follow-up / TI Integration Identify & Scope Shared TI Contain – Gather TI Recovery Eradicate & Remediate TI – Threat Intelligence

CERT at a Glance A CERT is a core element of a strategy to protect critical infrastructure vital to national security Achieve Strategic Goals § Detect, respond and prevent threats § Manage cyber incidents § Establish Shared Situational Awareness CERT § Coordinate incident management process § Act as focal point for national and international discussions Consolidate Activities Provide Enablers § Provide specific technical competence and skills § Develop trusted mechanism for information dissemination TYPICAL CERT MISSION § § Act as a reliable and trusted, single point of contact for emergencies Facilitate communication among Constituency, other CERTs and experts working to solve security problems Maintain close ties with research activities and conduct research to improve the security of existing systems Initiate proactive measures to increase awareness on information security and computer security issues

CERT at a Glance CERT’s mission and role might be significantly different according to the Constituency Corporate CERT Primary Mission Sectorial CERT National CERT • Prevention and cyber incident response • Prevention and Incident Response coordination • Prevention and coordination of critical cyber incidents • Corporate Situational Awareness • Sectorial Shared Situational Awareness • National Shared Situational Awareness • Point of Contact for Cyber Incidents and Crisis • Point of Contact for Industry/Sector cyber incidents • Point of Contact at National level • Users and customers belong to organizations in the same sector/industry • Citizens and organizations (mainly private) Constituency • Employees, customers and third parties Authority on Incident Response • Distributed or Centralized • No or limited authority (only coordination and structured information sharing) • Depending on national strategy (typically limited) Relationship focus • Internal / external • External • Phone, secure corporate mail / secure mail, web portal, Instant Messaging • Phone, secure mail / web portal • Phone, secure mail, web portal Primary communication tools Source: ENISA, Esri, De. Lorme Publishing, Intellium Deloitte Analysis

The differences between an incident and a crisis An information security incident is an unwanted or unexpected information security event that has a significant probability of compromising business operations and threatening information security. (as referred from ISO 27000: 2016) What is an incident? • Clear parameters • Can be dealt with existing resources • Pre-defines operational procedures • Confined to process or segment involved • Unlikely to impact the entire organization A crisis is a badly managed incident. (Crisis management wisdom) 19

The differences between an incident and a crisis What is a crisis? • Complex, uncertain and diffuse situation (or perception) • Beyond the scope of everyday business • Threatens the operation, safety and reputation of the company • Likely to impact the whole organization, stakeholders and / or society at large © 2016 Deloitte The Netherlands 20 20

Cyber Risk Advisory, Deloitte Moldova & Romania Andrei Ionescu Partner, Deloitte Romania Mobil: +40 728 315 E-Mail: aionescu@deloittece. com Teodor Cimpoesu Senior Manager, Deloitte Romania Mobil: +40 733 003 903 E-Mail: tcimpoesu@deloittece. com 21 21

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see www. deloitte. com/ro/about for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries and territories, Deloitte brings world-class capabilities and high-quality service to clients, delivering the insights they need to address their most complex business challenges. Deloitte’s approximately 225, 000 professionals are committed to making an impact that matters. © 2017 Deloitte Romania

Defense fundamentals – Critical Security Controls Source: Center for Internet Security – Critical Security Controls 23

Security Operations – Continuous Monitoring 24 Source: HP Security

Framework for Attack Resilience Gap Analysis