1. 2014: the year so far in cyber security
Brian Markham, Director Compliance and Risk Services
Division of IT
10/8/2014

2. 2013: What a year Snowden/NSA Revelations
Target/Neiman Marcus breaches
Security in the news!

3. Some things to keep in mind
Clicks are king
Consider the source
Hack vs. breach vs. something else
Hat color

4. Nothing is ever 100% secure!

5. Home Depot

6. What happened? April 2014 - September 2014
Malware was variant of BlackPOS used in Target attack

7. What was the impact? 56M credit and debit cards compromised
Largest credit card breach in history
Credit monitoring for all customers between April and September!

8. What did we learn?
Home Depot’s security program could have been better
Compliance ≠ Security
Data breaches have a material impact on a company’s finances and reputation

9. iCloud Photo “Hack”

10. What happened?
Apple’s iCloud service was exploitable through a common access control flaw
Credentials were guessed, accounts accessed
Personal photos and videos were leaked
Apple corrected the flaw, improved overall iCloud security

11. What was the impact? Discussion of cloud security
Discussion of cloud privacy
Victim shaming
Apple publicly defends their commitment to security and piracy

12. What did we learn? Use two-factor authentication
Security questions = Insecurity questions
Victims are victims

13. Heartbleed

14. What happened?
A vulnerability was found in the OpenSSL cryptographic software library
Exploited the heartbeat extension of OpenSSL’s TLS/DTLS
Exploitation was not detectable
CVE

15. What was the impact?

16. What was the impact?

17. What was the impact?
Websites using OpenSSL f are vulnerable and needed to be upgraded to 1.0.1g
Up to 66% of the web sites exposed (Apache and nginx)
New certificates issued
Panic!

18. What did we learn?
Open source software has many benefits; perfect security not one of them!
OSS needs support and resources, especially when widely used
Asset management is important

19. Shellshock

20. What happened Bash is the default shell for Linux and Mac OS X
CVE

21. What was the impact?

22. What did we learn?

23. University of Maryland

24. What happened? Attacker used pivot points to explore the UMD network
Found something good
Reset user credentials for administrators
Smash and grab

25. What was the impact?
287,580 records of faculty, staff, students and affiliated personnel
Five years of free credit monitoring
100,000 X $20 = $2M
Total costs ~$10M

26. What did we learn?
Educational institutions will continue to be a “soft” target for attackers
Rapid response is key
Know your data!

27. Content Management Systems (CMS)

28. What happened
Vulnerabilities in popular content management systems Drupal, Joomla, and Wordpress

29. What was the impact?

30. What did we learn?

31. Summary Security is in the news now more than ever
These are complicated, difficult problems; very different from traditional crime and security

32. Any Questions?