CURRENT STATUS OF CYBERCRIME  Security is the fastest growing service in IT  Cyber Crime Costs $750 Billion annually  70% of threats arrive via  100 Billion spam s / DAY!  40% of attacks are against small business  Professional criminals  Federal Gov’t - $14 billion on Cyber Security  Cyber Attacks are bought and sold too

MORE PEOPLE HAVE HAD THEIR INFORMATION COMPROMISED THAN ACTUALLY LIVE IN THE UNITED STATES.

WHY?  #1 Money!  Credit cards are nice but only worth a buck  Single-Use  Time-limited  Complete identities go for $1,000 or more  Access other financial information  Access accounts  Open new credit facilities  #2 Disruption of Service  Botnets  Attack  spam  #3 Theft of intellectual property or intelligence

WHO ARE THESE PEOPLE?  Eastern European, Russian, Chinese  Organized criminals  Organized espionage (CIA, PLA)  30 criminal groups estimated to have nation- state capabilities  “Hacktivists”  Highly competent technicians

EMERGING TREND  Smaller businesses are being individually targeted  Lack of IT resources  Don’t understand the threats  Think they are too small  Threat is large enough that DHS, FBI and Secret Service are engaged.

THINK ABOUT WHAT IS HERE  Personally identifiable information  Enough to build a complete profile  Customer credit cards  Customer contact information  This Company’s financial / banking information  Trade Secrets  Employee payroll information  Average cost of data breach is $3,800,000

Us PRIMARY ATTACK VECTOR?

KINDS OF ATTACKS  Phishing  Spear Phishing  Denial of Service (DOS)  Drive-by Downloading  Social Engineering  Advanced Persistent Threats 67% of incidents that comprise Cyber- Espionage have featured phishing.

ANATOMY OF AN ATTACK - SPEARPHISHING

SIMPLE GOOGLE SEARCH

SPECIALLY CRAFTED That link doesn’t go where you think it goes…. 11% of users still click on attachments in s they did not expect.

WHAT HAPPENS NOW?  Immediate attack  Cryptolocker / ransomware  Advanced Persistent Threat <- deadliest of all  Installs software silently  Harvests information (bank info, etc.)  Botnet  Control software installed  Phones home for instructions  Used to send spam or attack other networks

SIMPLER ATTACKS  Send out a million s from a randomly named bank  Only have to be right once  Someone is going to click on a link they shouldn’t  It is cheap to send out spam  “Drive by” attack  User is directed to a hijacked website  Web browser is attacked

WHAT TO DO?

GENERAL IT SECURITY  Use common sense. Anyone ever offered to give you $10 million before? (If they have, send them to me!)  Find a random USB drive? Pitch it.  Never do work or banking related things on open Wi-Fi  Do not install software you get from the Internet.  Nobody from “Microsoft Tech support” is calling for your password.  Call Matrix if you are unsure about any request you get via phone or .

SECURITY  Most common attack vector  70% of successful attacks are via  Do not click on links in s  For bank s, go login to your account  Same with FedEx, UPS  Nobody from Nigeria is sending you a million bucks  Seasonal s are very effective (FedEx, UPS during holidays)  Treat every as a threat

WEB SECURITY  Browse only reputable sites  If you get an unexpected pop-up, stop work and call us  Do not install software from the Internet  If browser starts behaving oddly – you end up at websites that you didn’t expect, please open a helpdesk ticket ASAP

PASSWORD SECURITY  Do not give out your password  Use complex passwords  “drowssap” = bad  = Good  Do not use the same password everywhere  Have different work / personal passwords  Change passwords regularly

QUESTIONS?