How not to be the "Target"

This presentation is about Target data breach.

Transcript

1. How Not To Be The “Target” Presented to OWASP Christchurch chapter Salinda Lekamge
2. Facts and Statistics Nearly 50% people open email and click on a phishing link within the first hour In 60% of cases, attackers are able to compromise an organisation within minutes 99.9% of the exploited vulnerabilities were compromised more than a year after the CVE was published 95% of malware types showed up for less than a month, and 80% didn’t last beyond a week Most affected industries: Financial services and Retail Source: Verizon 2015 Data Breach Investigation Report
3. Security Incidents Estimated cost of breach - $200 million  Date of breach: May 2014  230 million user accounts hacked, 145 million are active users
4. Security Incidents Estimated cost of breach - $1 billion  Date of breach: July 2014  76 million household accounts compromised
5. Security Incidents Estimated cost of breach - $80 million  Date of breach: September 2014  56 million debit and credit cards
6. Security Incidents Estimated cost of breach - $300 million  Date of breach: November 2014  100 Terabyte of data containing movies yet to be released, scripts, employee records, emails and corporate documents
7. Security Incidents Estimated cost of breach - $100 million  Date of breach: February 2015  78.8 million personal information
8. Security Incidents  Date of breach: June 2015  21 million personal information of current and former employees compromised  5.6 million fingerprints compromised
9. Security Incidents  Date of breach: July 2015  400 Gb of internal data including emails, source codes and zero- day exploits
10. Security Incidents  Date of breach: July 2015  25 Gb of company data and user details exposed
11. Case: Target Data Breach
12. Attack steps Step 1: steal credentials from who have access
13. Attack steps Step 2: connect suing stolen credentials
14. Attack steps Step 3: Exploit web application vulnerability
15. Attack steps Step 4: Search for relevant targets for propagation
16. Attack steps Step 5: Steal access tokens from domain admins
17. Attack steps Step 6: Create new domain admin account
18. Attack steps Step 7: Propagate the attack
19. Attack steps Step 8: Steal data
20. Attack steps Step 9: Install malware on Point of Sale
21. Attack steps Step 10: Transfer the data
22. Target Data Breach
23. How and Why  How easy to steel username and password?  How does hackers know whom to attack?  How hackers can plant a malware in the web application?  Why didn't Target notice this activity for 6 months?  Why Target doesn’t have security systems in-place?
24. Aftermath and Recovery  40 million credit and debit cards plus 70 million customer records stolen  CIO, Beth Jacobs resigned immediately and CEO, Gregg Steinhafel resign after 6 months  Estimated cost of security breach is $1 billion which includes $162 million for lawsuits and 100 million to upgrade systems  475 layoffs from head office and total 700 positioned unfilled
25. Aftermath and Recovery  Establish new CISO and Chief Compliance Officer positions  Enhance monitoring capabilities  Install application whitelisting for POS systems  Review network segmentation  Review all vendor accesses  Enhance security of user accounts
26. How not to be the “Target”  Technology isn’t security, and technology shall use appropriately.  Cautious when allowing access to 3rd parties, ensure appropriate security controls in-place. Consider security over convenience.  Temporary means temporary, disable temporary logins after expiration.  Do periodic security checks, specially on public facing web applications.  Be vigilant, set notifications when creating new privilege user accounts.  Consider security at design, proper isolation of networks and access controls.  Be prepared, security incidents can happen any time
27. Security Incident Response  Define Security Incident Response Policy  Define what is security incident for the company  Identify incident categories  Develop incident response procedures  Preparation, Identification, Containment, Eradication, Recovery and Wrap-up  Identify Security Incident Response Team (SIRT) members  A cross-functional team representing all business units  Define and communicate roles and responsibilities  Communicate to rest of the organization  Conduct regular tests and drills
28. Questions?