Scott Charney Cybercrime and Risk Management PwC

Scott CharneyScott Charney

Cybercrime and Risk Management

Cybercrime and Risk Management

PwC

PwC

Understanding Risks:Computer As Target Understanding Risks:Computer As Target

Confidentiality

– The Cuckoo’s Egg

Integrity

– Seattle Sentencing

– Pac Bell Intrusion

Availability

– Morris Worm

– Infrastructure Protection

– Cascading Effects

Confidentiality

– The Cuckoo’s Egg

Integrity

– Seattle Sentencing

– Pac Bell Intrusion

Availability

– Morris Worm

– Infrastructure Protection

– Cascading Effects

2

PwC3

Understanding Risks:Computer As Tool

Understanding Risks:Computer As Tool

Frauds

– Internal: The Airline Scam

– External: Phony e-businesses

Distribution Offenses

– Copyrighted Software

– Inappropriate Material

Frauds

– Internal: The Airline Scam

– External: Phony e-businesses

Distribution Offenses

– Copyrighted Software

– Inappropriate Material

PwC4

Understanding Risks:Computer As Storage Device

Understanding Risks:Computer As Storage Device

Large Volume of Data

Duplicated and Distributed

Recoverable

Large Volume of Data

Duplicated and Distributed

Recoverable

PwC

Future - What’s to come?Future - What’s to come?

Start with the Charney Theorem

+ Add anonymity

+ Add global connectivity

+ Add critical infrastructures

+ Add evidentiary issues

= Lifetime Employment for Law Enforcement and Computer Security Professionals

Start with the Charney Theorem

+ Add anonymity

+ Add global connectivity

+ Add critical infrastructures

+ Add evidentiary issues

= Lifetime Employment for Law Enforcement and Computer Security Professionals

5

PwC

And It’s Probably Worse Than We Think...

And It’s Probably Worse Than We Think...

DoD Controlled Study

– Machines Attacked: 38,000

– Machine Penetrated: 24,700 (65%)

– Attacks Detected: 988 (4%)

– Attacks Reported: 267 (27%)

DoD Controlled Study

– Machines Attacked: 38,000

– Machine Penetrated: 24,700 (65%)

– Attacks Detected: 988 (4%)

– Attacks Reported: 267 (27%)

6

PwC

What to Do: Manage Risk -- Implement Comprehensive Security!

What to Do: Manage Risk -- Implement Comprehensive Security!

Be Prepared To Prevent and Respond to Computer Incidents

Considering Physical, Personnel and Technical Security

Be Prepared To Prevent and Respond to Computer Incidents

Considering Physical, Personnel and Technical Security

PwC

PreventionPrevention

Identify Assets (Computer Resources and Data)

Assess Internal and External Threats to Those Assets– Insider Threats: employees, contractors, JVs– Outsider Threats: hackers, hackivists, thieves, competitors,

terrorists, nation-states

Develop Core Business Policies to Protect Assets– Access Control Policies (watch remote access!)– Retention and destruction policies– Appropriate computer use– Workplace Monitoring?

Educate Users and TEST COMPLIANCE

Identify Assets (Computer Resources and Data)

Assess Internal and External Threats to Those Assets– Insider Threats: employees, contractors, JVs– Outsider Threats: hackers, hackivists, thieves, competitors,

terrorists, nation-states

Develop Core Business Policies to Protect Assets– Access Control Policies (watch remote access!)– Retention and destruction policies– Appropriate computer use– Workplace Monitoring?

Educate Users and TEST COMPLIANCE

PwC

PreventionPrevention

Technical Approaches

– Map the Network

– Test Existing Security (Attack and Penetration)

• Application Defaults

• Bad Configurations - Known Vulnerabilities

• Password Management

– Install Defenses

• Firewalls

• IDS and CADS

• Encryption (VPNS, PKIs)

Technical Approaches

– Map the Network

– Test Existing Security (Attack and Penetration)

• Application Defaults

• Bad Configurations - Known Vulnerabilities

• Password Management

– Install Defenses

• Firewalls

• IDS and CADS

• Encryption (VPNS, PKIs)

PwC

ResponseResponse

Develop response plan

– Identify Key Personnel for Response

– Identify Response Objectives

• Remediation vs. Investigation– Institute Response Procedures

• Audit Trails, Caller-ID

• Evidence Retention and Preservation

• Notifications (e.g., internal, downstream, law enforcement, regulatory authorities)

Develop response plan

– Identify Key Personnel for Response

– Identify Response Objectives

• Remediation vs. Investigation– Institute Response Procedures

• Audit Trails, Caller-ID

• Evidence Retention and Preservation

• Notifications (e.g., internal, downstream, law enforcement, regulatory authorities)

Cybercrime and Risk Management

Cybercrime and Risk Management

Scott Charney(202) 822-4349

scott.charney@us.pwcglobal.com

Scott Charney(202) 822-4349

scott.charney@us.pwcglobal.com

PwC