© Copyright 2015 EMC Corporation. All rights reserved. 1 RSA FRAUDACTION DANIEL COHEN * FRAUDACTION ANTI-FRAUD SERVICES.

© Copyright 2015 EMC Corporation. All rights reserved. FRAUDACTION: EVOLUTION 2004 200620072008 2011 2012 201320142015 Anti-Phishing Service Established the AFCC and launched the industry’s first Anti-Phishing solution. Anti-Phishing Service Established the AFCC and launched the industry’s first Anti-Phishing solution. FraudAction Intelligence Intelligence operations launched in the deep web to monitor and report on cybercrime activities. FraudAction Intelligence Intelligence operations launched in the deep web to monitor and report on cybercrime activities. Cybercrime Intelligence Leveraging our expertise in malware and intelligence, CCI provides Threat Intelligence to help protect enterprises. Cybercrime Intelligence Leveraging our expertise in malware and intelligence, CCI provides Threat Intelligence to help protect enterprises. Anti-Trojan Service With the growing malware threat, RSA establishes the FraudAction Malware Research Lab and launches the Anti-Trojan Service Anti-Trojan Service With the growing malware threat, RSA establishes the FraudAction Malware Research Lab and launches the Anti-Trojan Service Anti-Rogue App Service Launched to mitigate the growing threat of rogue mobile apps. Anti-Rogue App Service Launched to mitigate the growing threat of rogue mobile apps. FraudAction 360 A single, holistic external threat management service. FraudAction 360 A single, holistic external threat management service. Advanced Fraud Intelligence Actionable and insightful Fraud Intelligence to help protect your customers. Advanced Fraud Intelligence Actionable and insightful Fraud Intelligence to help protect your customers. 2 © Copyright 2015 EMC Corporation. All rights reserved.

3 Over 120 analysts and malware researchers globally Multi-lingual cybercrime intelligence operation 100s millions of URLs scanned and qualified per day Over 400,000 malware samples analyzed per week Take-down between 30K-60K attacks per month 100s millions of compromised credentials recovered to date FRAUDACTION: OPERATION

© Copyright 2015 EMC Corporation. All rights reserved. mouseOverIntel VB place holder *do not delete* mouseOutIntel VB place holder *do not delete* mouseOver360 VB place holder *do not delete* mouseOut360 VB place holder *do not delete* FRAUDACTION: SERVICES

© Copyright 2015 EMC Corporation. All rights reserved. time ► Click a box above for more info… FRAUDACTION 360: TAKING ACTION! Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. ◄ Back to FA Services

© Copyright 2015 EMC Corporation. All rights reserved. Global detection network comprising mail hosts, spam filters, social networks, honeypots and more Proprietary technology to identify rogue mobile apps Machine-driven static and dynamic analysis, and human qualification 100s millions of URLs scanned per day; 10s thousands of malware samples analyzed per day FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Attacks are sent to our global network immediately upon detection Our blocking network includes Microsoft, Google and other major Internet entities Blocking takes place on browsers (including mobile), spam filters, network gateways and more FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services View Sample Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Upon detection, attack notifications are sent to a pre-defined contact list The attack evidence is then documented including screen captures and basic forensic information All information and attack status is updated in real-time on our online dashboard API access is also available FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services View Dashboard Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Once the immediate actions have been taken, our analysts work to gain deeper forensic visibility Forensic work includes: phishing kit analysis, malware analysis, app analysis Forensic data such as malware configuration files and compromised credentials are updated on the dashboard FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. The AFCC maintains relationships with over 17,000 Internet entities around the world including CERT’s, ISPs, Web hosts and others Our shutdown times are amongst the fastest in the industry After shutdown, attack activity is monitored and you will be alerted if the attack re-launches FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Reports, including: ThreatReports, Trojan analysis and periodical newsletters Data feeds, including: Bad IPs, mule accounts, item drops, credit cards, recovered credentials and more FRAUDACTION 360: TAKING ACTION! time ► ◄ Back to FA Services Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. mouseOverFraud VB place holder *do not delete* mouseOutFraud VB place holder *do not delete* mouseOverThreat VB place holder *do not delete* mouseOutThreat VB place holder *do not delete* CYBER INTELLIGENCE INSIGHTFUL AND ACTIONABLE VISIBILITY INTO THE THREAT LANDSCAPE …protecting your customers Advanced Fraud Intelligence …protecting your organization Cybercrime Threat Intelligence ◄ Back to FA Services

© Copyright 2015 EMC Corporation. All rights reserved. “Bad” IPs Compromised Payment Cards Compromised Emails (consumer) Compromised Bank Accounts Payment Card “Previews” Mules and Drops Attribution TTPs ADVANCED FRAUD INTELLIGENCE: PHILOSOPHY * “Pyramid of Pain” concept originally by David BiancoDavid Bianco THE FRAUD “PYRAMID OF PAIN” * ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: OVERVIEW phishing malware HUMINT OSINT HUMINT OSINT Consolidate Correlate Contextualize Threat Clusters Threat Vectors Threat Actors ThreatTracker ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: CLUSTERS Threat Clusters link attacks together to provide a clearer view of the threat Threat Clusters can help prioritize and focus mitigation efforts How do we cluster? ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: VECTORS Threat Vectors analyze data elements harvested from attacks to predict fraud methods Threat Vectors can help identify weak channels and focus mitigation How are vectors analyzed? ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: ACTORS Threat Actors provides information on the individual(s) behind the attacks Threat Actors is based on in-depth analysis of attacks as well as active HUMINT operations ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: SUMMARY A powerful tool that can allow your organization, at a glance, to better understand the threats it faces, assess them, and plan mitigation accordingly. Click to view a sample ◄ Skip to Service Components

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Click a box above for more info… TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Reports on intelligence findings that relate specifically to your brand. Alerts are sent out immediately and provide as much actionable intelligence as possible. Sources include closed-source underground venues, OSINT and HUMINT. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds View the Underground

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Machine-readable feeds that provide intelligence that is associated with your organization. Feeds include “CC Previews”, compromised accounts, mule accounts and more. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services With the continued strain placed on security teams, the ability to carry out research requests and investigations is limited. Targeted Research provides you with the ability to request research and investigations into different indicators - on demand. It also provides you with an actionable conduit into the underground. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Provides information on Threat Clusters, Threat Vectors, and Threat Actors. Based on correlated data from phishing attacks, malware attacks and underground intelligence. Can help assess risk and identify methods used by fraudsters to defraud your customers. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds ThreatTracker Sample

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Include information about general emerging threats, or interesting trends. May be actionable at times. Reports may include methods discussed by fraudsters, malware operations and more. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds

© Copyright 2015 EMC Corporation. All rights reserved. ADVANCED FRAUD INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Machine-readable feeds that provide intelligence that is either associated with your organization or is general by nature. Feeds include: Bad IPs, mule accounts, item drops, credit cards and more TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds

© Copyright 2015 EMC Corporation. All rights reserved. CYBERCRIME INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Identify corporate resources that have been compromised or are at risk of compromise. Our data sources include: malware operations, OSINT (including social media), closed-source underground venues, “paste sites” and more. Findings include: corporate credentials, infected corporate machines, abused corporate machines, compromised corporate email accounts and others. Threat Intelligence Blacklists See Examples

© Copyright 2015 EMC Corporation. All rights reserved. CYBERCRIME INTELLIGENCE: COMPONENTS ◄ Back to Intelligence Services Blacklists further help identify infected machines within the organization. They can also be used to prevent communication from/to malicious points. Blacklists are machine consumable data feeds and include: malicious hosts, potential malicious hosts and malware communication patterns. Threat Intelligence Blacklists

EMC, RSA, the EMC logo and the RSA logo are trademarks of EMC Corporation in the U.S. and other countries.

© Copyright 2015 EMC Corporation. All rights reserved. Attacks are sent to our global network immediately upon detection Our blocking network includes Microsoft, Google and other major Internet entities Blocking takes place on browsers (including mobile), spam filters, network gateways and more FRAUDACTION 360: TAKING ACTION! time ► Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Upon detection, attack notifications are sent to a pre-defined contact list The attack evidence is then documented including screen captures and basic forensic information All information and attack status is updated in real-time on our online dashboard API access is also available FRAUDACTION 360: TAKING ACTION! time ► Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Detection & Qualification Proactive detection of phishing, malware and rogue app incidents, leveraging numerous detection sources. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Blocking Our global blocking network prevents further vend-users from falling victim by preventing access to malicious content. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Documenting & Reporting Access to attack information and status is provided by our online dashboard or via API access. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Forensics & Analysis In depth analysis of phishing kits, malware samples and mobile apps. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Shutdown Our strong ties in the industry, cultivated by over a decade of operations, enable us to shutdown attacks quickly. Deliverables Service deliverables include reports, data feeds, and recovered compromised data. Deliverables Service deliverables include reports, data feeds, and recovered compromised data.

© Copyright 2015 EMC Corporation. All rights reserved. Reports on intelligence findings that relate specifically to your brand. Alerts are sent out immediately and provide as much actionable intelligence as possible. Sources include closed-source underground venues, OSINT and HUMINT. TARGETEDGENERAL IntelligenceData FeedsResearchThreatTrackerThreatReportsData Feeds ADVANCED FRAUD INTELLIGENCE: COMPONENTS

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: CLUSTERS Threat Clusters link attacks together to provide a clearer view of the threat Threat Clusters can help prioritize and focus mitigation efforts

© Copyright 2015 EMC Corporation. All rights reserved. THREATTRACKER: VECTORS Threat Vectors analyze data elements harvested from attacks to predict fraud methods Threat Vectors can help identify weak channels and focus mitigation

© Copyright 2015 EMC Corporation. All rights reserved. CYBERCRIME INTELLIGENCE: COMPONENTS Identify corporate resources that have been compromised or are at risk of compromise. Our data sources include: OSINT (including social media), closed-source underground venues, malware operations, “paste sites” and more. Findings include: corporate credentials, infected corporate machines, abused corporate machines, compromised corporate email accounts and others. Threat Intelligence Blacklists

© Copyright 2015 EMC Corporation. All rights reserved. 1 RSA FRAUDACTION DANIEL COHEN * FRAUDACTION ANTI-FRAUD SERVICES.

Similar presentations

Presentation on theme: "© Copyright 2015 EMC Corporation. All rights reserved. 1 RSA FRAUDACTION DANIEL COHEN * FRAUDACTION ANTI-FRAUD SERVICES."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

© Copyright 2015 EMC Corporation. All rights reserved. 1 RSA FRAUDACTION DANIEL COHEN * FRAUDACTION ANTI-FRAUD SERVICES.

Similar presentations

Presentation on theme: "© Copyright 2015 EMC Corporation. All rights reserved. 1 RSA FRAUDACTION DANIEL COHEN * FRAUDACTION ANTI-FRAUD SERVICES."— Presentation transcript:

Similar presentations

About project

Feedback