1. Fiaaz Walji Sr. Director Websense Canada

2. Shift in attacks = shift in Defense 2 2012 began with a report from IDC stating Signature-based tools (anti-virus, firewalls and intrusion prevention) are only effective against 30% – 50% of current security threats Much of this can be attributed to how attacks have evolved to specifically counter those defenses Websense® Security Labs team produced report on the key threats and trends

3. Behind the 2013 Threat Report 3 Data Collection Threat Analysis Expert Interpretation

4. 4 ThreatSeeker Network Largest Security Intelligence Network Up to 5 billion requests per day 900 million global end points Largest Security Intelligence Network Up to 5 billion requests per day 900 million global end points 400+ million sites per day 1 billion pieces of content per day 10+ million emails per hour 2.5 billion URLs per day

5. # Viruses undetected by Top 5 AV Engines 5

6. Areas Covered in this Report 6

7. Victims are Everywhere 7

8. 8

9. 9

10. 10 Social Media Email Mobile Attack Vectors Web Victims are funneled to the Web Redirects Malware Recon XSS Dropper Files CnCCnC Exploit Kits Phishing

11. © 2012 Websense, Inc. Proprietary and Confidential Lure Redirect Exploit Kit Dropper File Call Home Data Theft Victims are funneled to the Web Recon CYBER KILL CHAIN

12. Web Threats 12

13. 13 Web traffic To FIs SOURCE: COMSCORE

14. Top 5 most popular types of sites compromised 14

15. Key Take Away 15 The web is both an attack vector AND support for other attack vectors.

16. 16

17. Social Media Adoption in Canada 17 Source: Comscore

18. 18 Social Media Threats Presidents Family Emails, Photos Apparently Hacked ow.ly/hxY2a of malicious links in social media used shortened web links 32% 8. CANADA

19. KEY TAKE AWAY 19 As social media use increased in the workplace, so did the exposure of sensitive information

20. 20

21. Mobile Phone Penetration by country 21

22. 22 Source: Comscore ; Dec 2011 British Columbia ranks #1 in Canada in smartphone/capita 43% of Canadian smartpho ne subscribe rs own a connecte d device

23. 23 of Canadians with Smartphones would consider using them like credit cards. CIBC poll by Harris/Decima Jul 2012 47%

24. 24 More Canadians are accessing online banking through their smartphones SOURCE: COMSCORE

25. 25 Method of Access SOURCE: COMSCORE

26. 26 1 Billion Apps were downloaded in the last week of 2012 Source: Flurry

27. Social Media: #2 use of Smartphones Lost Device Malicious URLs Exploitable technologies App Stores 27 Mobile Threats

28. SMS abused by 82 percent of malicious apps –SEND_SMS –RECEIVE_SMS –READ_SMS –WRITE_SMS 1 in 8: RECEIVE_WAP_PUSH 1 in 10: INSTALL_PACKAGES 28 Mobile Apps Malicious "Top 20"Android Permission Type Legitimate "Top 20" 1INTERNET1 2READ_PHONE_STATE3 3SEND_SMSX 4WRITE_EXTERNAL_STORAGE4 5ACCESS_NETWORK_STATE2 6RECEIVE_SMSX 7READ_SMSX 8RECEIVE_BOOT_COMPLETED11 9CALL_PHONE17 10WAKE_LOCK9 11ACCESS_COARSE_LOCATION6 12VIBRATE8 13RECEIVE_WAP_PUSHX 14ACCESS_FINE_LOCATION7 15WRITE_SMSX 16ACCESS_WIFI_STATE5 17GET_TASKS10 18SET_WALLPAPER14 19READ_CONTACTS15 20INSTALL_PACKAGESX Malicious "Top 20"Android Permission Type Legitimate "Top 20" 1INTERNET1 2READ_PHONE_STATE3 3SEND_SMSX 4WRITE_EXTERNAL_STORAGE4 5ACCESS_NETWORK_STATE2 6RECEIVE_SMSX 7READ_SMSX 8RECEIVE_BOOT_COMPLETED11 9CALL_PHONE17 10WAKE_LOCK9 11ACCESS_COARSE_LOCATION6 12VIBRATE8 13RECEIVE_WAP_PUSHX 14ACCESS_FINE_LOCATION7 15WRITE_SMSX 16ACCESS_WIFI_STATE5 17GET_TASKS10 18SET_WALLPAPER14 19READ_CONTACTS15 20INSTALL_PACKAGESX

29. KEY TAKE AWAY 29 Data stored on and accessed through a mobile device are at risk minimal control of web, email and social media traffic and access. Lost devices are also a risk.

30. 30

31. Only 1 in 5 emails were safe and legitimate 31 Email Threats Email Breakdown by Content & URLs Email Breakdown by Content Only

32. 92% of Spam emails contain URLs Spam distribution rate: 250,000 per hour 32 Spam Top 5 Malicious Web Links in Spam Email 1Potentially Damaging ContentSuspicious sites with little or no useful content. 2Web and Email Spam Sites used in unsolicited commercial email. 3Malicious WebsitesSites containing malicious code. 4Phishing and Other FraudsSites that counterfeit legitimate sites to elicit information. 5Malicious Embedded iFrameSites infected with a malicious iframe.

33. Increasingly focused on Commercial & Govt 69% sent on Mondays & Fridays More Targeted –Regionalized –Spear phishing on the rise Phishing 33 Top 5 Countries Hosting Phishing

34. KEY TAKE AWAYS 34 Email-based threats evolved significantly to circumvent keyword, reputation and other traditional defenses. Increased spear-phishing. Cybercriminals added a time-delay to some targeted attacks, >50% of users accessed email from outside the corporate network.

35. 35

36. Top 10 Countries Hosting Malware 36 United States Russian Federation Germany China Moldova Czech Republic United Kingdom France Netherlands Canada Organizations can no longer dismiss malware threats as solely an English-language or American phenomenon.

37. More aggressive –15% connected in first 60 sec. –90% requested information –50% accessed dropper files 37 Malware

38. 38 Top 10 Countries Hosting CnC Servers

39. KEY TAKE AWAY 39 Todays malware is more dynamic and agile, adapting to an infected system within minutes. Half of web-connected malware downloaded additional executables in the first 60s The remainder proceeded more cautiously often a calculated response to bypass short- term sandbox defenses

40. 40

41. Data Theft 41 Planned data theft attacks through cyberspace grew last year, targeting high value intellectual property (IP) and using all available vectors PII value/target remained flat

42. KEY TAKE AWAY 42 Remove temptation ; mitigate accidental loss through security improvements address growing SSL/TLS usage, provide an integrated approach to monitoring and controlling both inbound and outbound content

43. © 2012 Websense, Inc. Proprietary and Confidential Lure Redirect Exploit Kit Dropper File Call Home Data Theft Real World Example: Boston Tragedy Recon Shocking news lures in email & SEO leading to the web redirect. Video page of the drama with a hidden malicious iFrame Redkit exploit kit leverages CVE-2013- 0422, an Oracle Java 7 known vulnerability. Two known bot infection files allowing remote control of infected system. Two known botnet families registers newly infected systems &opens to commands Cyber criminals now control infected systems and targeted data topical or event-based campaigns, attempts to propagate as widely as possible, rather than being directed at specific individuals or organizations.

44. Conclusion 44 Primary attack foundation was the Web –Threats increased across all vectors –Attacks grew more: Aggressive ; Dynamic ; Multi-staged ; Multi-vector Defenses must adapt : –Real-time point-of-click ; Inbound & outbound ; Content & Context inspection MDM capabilities must be augmented –defenses to control mobile access ; perform real-time analysis of potentially malicious content across all vectors. Email security requires real-time threat analysis –Must be coordinated with web, mobile and other defenses. Malware defenses need to monitor both inbound and outbound –HTTP and HTTPS traffic to prevent infection and detect CnC communications

45. 45 Thank You www.websense.com/2013predictions