1. RSA Identity Protection and Verification Adaptive Authentication, Anti-eFraud Solutions David Mateju RSA Sales Consultant

2. RSA – The Big Picture information Encryption
Store, Transport
IT infrastructure
information
Access Authentication, Authorization,
Anti-fraud Solutions
DLP
Data Loss Prevention
SIEM
Security Information and Event Management

3. RSA Encryption and Key Management Suite
RSA – The Big Picture
RSA Encryption and Key Management Suite
RSA Access Manager RSA Federated Identity Manager
RSA SecurID
RSA Digital Certificate Solutions
RSA Identity Protection and Verification Suite
IT infrastructure
information
RSA Data Loss
Prevention Suite
RSA enVision Platform

4. Access
RSA Identity Protection and Verification Suite

5. What is Crimeware? Two Broad Classifications
Identity Theft Crimeware
Steals online credentials or any personal data required for identity takeover, with intent of using the stolen identity to steal funds
Examples: Keyloggers, screen-scrapers, local pharming Trojans
Funds Transfer Crimeware
Performs unauthorized online transactions to steal funds
Trojans that “hijack” online banking or other secure sessions of infected users to carry out fraudulent transactions after user has logged out
Examples: Session-hijacking Trojans, Man-in-the-Browser
Mention in user interviews, IT directors also considered applications that were not “approved” to be spyware
More restrictive definition: Any software that is installed on a PC without the approval of IT
Different from spyware which monitors a users actions without his consent

6. Why On-line? Universally accessible Little chance of being caught
Cheap (little infrastructure necessary)
Scalable
Less violent (no gangsters from Jersey to shoot you)

7. The Fraudster Supply Chain
Is it organized crime? YES. It is organized. And involves organized crime.
Insiders
ATM fraud
etc.
Universal MITM Phishing Kit

8. Crimeware Ecosystem – Organized Crime
Note: Since Uriel had gone through a deep-dive a few months ago, I’m going to skip all the stats, and just quickly refer to a related survey question from our “hot-off-the-presses” consumer survey.
Trojan developers offer guarantied replacement in case the trojan is detected by anti-virus applications

9. Future Trojan Developments (“Anti-Anti-Trojan”)
Inline Anti-Virus “tester” and “fixer” 9

10. Snatch Trojan+Rootkit = $600
Need a Piece of Crimeware?
WebMoney Trojan = $500
Snatch Trojan+Rootkit = $600
Limbo personalized $500 / $350 discounted
Limbo logs (50MB) $30
FTP Checker / Iframer $35
Dream BotBuilder $500 + $25 for updates
Pinch $30 + $5 for updates
Mpack $700 w/ support

11. Business of Trojans

12. Crimeware Ecosystem – Infection Service

13. Zeus Trojan as an example …
Tracking one variant of a very popular tool-kit
In first two weeks infected 32,000 computers
Roughly 4,000 infections a day
No effective anti-virus update available
Highly polymorphic, no consistent binary signature
To date we have recovered 60,000 compromised users and their credentials from this tool-kit alone
Zeus is also known as WSNPOEM

14. RSA Identity Protection and Verification Suite
RSA Adaptive Authentication and Transaction Monitoring (with Risk Engine)
RSA FraudAction
RSA eFraudNetwork

15. Behind the Scenes – The RSA Risk Engine
A normalized risk score is produced (between )
Statistical, Bayesian, self-learning analysis and scoring
Profiles built at the individual user level
The risk score indicates the probability of fraud in proportion to volumes per activity type. Example:
Top 0.25% of riskiest payment  score over 900
Top 3% of logins  score over 700
Keeps false positives and false negatives to minimum
Institution can know in advance
How many cases will be flagged
Estimated fraud distribution between score bands
Over 100 risk indicators (factors) are monitored
Self-learning provides immediate response to new threats

16. 3% flag rate >95% detection !! 1% flag rate >80% detection !
Impact of components on detection
3% flag rate >95% detection !!
1% flag rate >80% detection !

17. RSA eFraudNetwork The World’s Largest Online Fraud Fighting Community
The RSA eFraudNetwork is a cross-organization database of fraud patterns gleaned from RSA’s extensive network of customers, ISPs and third party contributors across the globe. When a fraud pattern is identified, the fraud data, transaction profile and device fingerprints are moved to a shared data repository. The eFraudNetwork provides direct feeds to the Risk Engine so that when a transaction or activity is attempted from a device or IP that appears in the eFraudNetwork data repository, it will be deemed high-risk and prompt a request for additional authentication. 17

18. RSA Adaptive Authentication RSA Transaction Monitoring
Fraudulent transfers down by 90%, much higher security
User authentication costs down

19. RSA FraudAction – RSA non-stop service RSA’s 24x7 Anti-Fraud Command Center

20. Anti Trojan - A Systematic Approach to Mitigation
Infection / Update
Drop Zone
Command & Control
Bot-Herder
Less than 25% of infected PCs are protected by AV applications.
Even less effectively protected against the specific threat.
RSA’s Anti-Trojan Solution
Victim’s PC

21. Anti Trojan - A Systematic Approach to Mitigation
Infection / Update
Drop Zone
Command & Control
Bot-Herder
Block (browsers, ISPs)
Shutdown
Block (firewalls, ISPs, content filtering)
Shutdown
(or)
Monitor
Block (firewalls, ISPs, content filtering)
Shutdown
(or)
Monitor

22. Additional Anti-Trojan Services
Only service on market offering these services

23. RSA – World “Web Anti-Fraud” Leader

24. RSA “Anti-Fraud” Solutions – Selected Customers
Australia:
Adelaide Bank
Canada:
Royal Bank of Canada
France:
Le Crédit Lyonnais
India:
HDFC Bank
Italy:
Banca Popolare di Sondrio
Japan:
Mizuho Bank
Nomura Securities
Sony Bank Inc.
Sumitomo Mitsui Banking Corporation
The Bank of Fukuoka
South Africa:
Standard Bank
UK:
Barclays Bank
ING Direct
USA:
Bank of America
Bank of the West
Baxter Credit Union
Century Bank
Commerce Bancorp, Inc.
E*Trade
Eglin Federal Credit Union
Finance Center Federal Credit Union
Mid America Bank
State Employees' Credit Union (SECU)
Susquehanna Bancshares
TCF Financial Corporation
Tennessee Valley Federal Credit Union