Dr. Robert K. MinnitiDBA, CPA, CFE, Cr.FA, CVA, CFF, MAFF, CGMA, PI
President, Minniti CPA, LLC
Cybersecurity Basics forAccountants & Tax Community
Dr. Robert K. Minniti
DBA – Doctor of Business AdministrationCPA - Certified Public AccountantCFE – Certified Fraud ExaminerCrFA – Certified Forensic AccountantCFF – Certified in Financial ForensicsCVA – Certified Valuation AnalystMAFF – Master Analyst in Financial ForensicsCGMA – Charted Global Management AccountantPI – Licensed Private Investigator
Objectives
Upon completing this class you will be able to:
Identify cybersecurity risksIdentify internal controls for cybersecurity
Cybersecurity Terminology
Threat
An event with the potential to adversely affect an organization
Unauthorized access to systems or data
Destruction of systems or data
Disclosure of data
Modifications or changes to data
Denial of service (DoS)
Cybersecurity Terminology
Adversary
An individual or entity with the intent to harm an organization by conducting cyber attacks
Attacker
An individual or entity attempting to harm an organization by conducting cyber attacks
Cybersecurity Terminology
Authorization
Access privileges granted to users or applications
Authentication
Verifying the identity of a user, software application or device before granting access
Cybersecurity Terminology
Encryption
Converting data to another format that cannot be read or viewed until it is decrypted.
An average desktop computer is estimated to take around 6.4 quadrillion years to crack an RSA 2048 encryption key.
Cybersecurity Terminology
Hacker
An individual or entity trying to gain access to an IT system to steal or compromise data
Black Hat HackerWhite Hat HackerGray Hat Hacker
Polling Question #1
True or False
A black hat hacker is usually considered a criminal
Hackers
Hackers have different motivations for their actions
Hacktivists
Cyber Criminals
Insiders
Competitors
Nation States
Joyriders
Upset customers
Law Enforcement
Cybersecurity Terminology
Weakness
A vulnerability in the IT systemSoftware bugs
Hardware issues
Security issues
EXAMPLES OF VULNERABILITIES
"Meltdown" (CVE-2017-5754) is a flaw that lets ordinary applications cross the security boundaries enforced at chip level to protect access to the private contents of kernel memory in Intel chips produced over the last decade.
"Spectre" (CVE-2017-5753 and CVE-2017-5715), are more insidious and widespread, having been found in chips from AMD and ARM as well as Intel. Spectre could enable an attacker to bypass isolation among different applications.
https://www.knowbe4.com/
Cybersecurity Terminology
Exfiltration
The unauthorized theft or transfer of data
Exposure
The time period in which a vulnerability can be exploited
Polling Question #2
True or False
Exfiltration is the unauthorized theft or transfer of data
Backdoors
A backdoor is a route into a computer that circumvents the user authentication process and allows hackers open access to the system once it is installed.
Computer Virus
A computer virus is usually hidden in a computer program and performs functions such as copying or deleting data files. A computer virus creates copies of itself that it inserts in data files or other programs.
Trojan Horse
A Trojan horse is a malware program that is disguised as something else. Users assume it is a beneficial program when it fact it is not. Trojans horses are often used to insert spyware onto computers.
Computer Worms
A computer worm is a type of malware that transmits itself over networks and the internet to infect more computers with the malware.
Polling Question #3
True or False
A computer virus attacks software already on your computer
Internet of Things (IoT)
Devices with access to an IT system or to the internet.Cameras
Microphones
Cars
Thermostats
Appliances
Copiers & office equipment
Cloud Computing
Using the internet to connect with remote servers to access software or data.
INTERNET STRUCTURE
www.cybertraining365.com
Cybersecurity Risks
Civil litigation
Fines
Damage to reputation
Loss of customers
Government settlement – long term audits
Business disruption
Ransom payments
Cybersecurity Risk Factors
Employees
Don’t understand the risksLack of cybersecurity trainingOverride internal controlsInattentionWorking remotelyData & file sharingUsing personal devices
Cybersecurity Risk Factors
IT Systems
Complex IT systemsOlder technologyBring your own device (BYOD)Lack of internal controlsIneffective cybersecurity measuresUndertrained IT personnelFile SharingCloud Computing
https://amp-cnn-com.cdn.ampproject.org/c/s/amp.cnn.com/cnn/2020/04/14/politics/coronavirus-scams-and-rip-offs/index.html
CYBERSECURITY RISKS
Phishing
Used to gain personal or business information, such as usernames, passwords, Social Security numbers, and credit card numbers, etc.
Often accomplished by using fraudulent e-mail messages that appear to come from legitimate businesses or government agencies.
Phishing Example
Phishing Example
Phishing Example
Phishing Example
Phishing Example
IRS Vishing
Computer generated voice:
Hello. This call is officially a final notice from the IRS, Internal Revenue Service. The reason of this call is to inform you that IRS is filing lawsuit against you. To get more information about this case file, please call immediately on our department number 202-492-8816. I repeat 202-492-8816. Thank you.
VISHING
Vishing is similar to phishing but it occurs over the phone rather than over the internet.
Criminals try to obtain information or try to load malware on the victim’s computer.
VISHING
DISGUISING A VOICE
When criminals want to disguise their voices over the phone it is easy to do because there are numerous “Apps for that”
Smishing Examples
SPOOFING A PHONE NUMBER
https://www.spoofcard.com/apps
Polling Question #4
True or False
Criminals use phishing emails to obtain information or to load malware on a victim’s computer
Denial of Service Attacks
This cybercrime occurs when the criminals use botnets or networks of infected computers to bring down a website by overloading the server.
Oftentimes criminals follow up with an attempt to hack the system and put malware on the server when the victim is busy repairing the damage
Malware
Malware is placed on computers or cell phones to hijack the computers, steal data, or encrypt the data for ransom.
Ransomware
Ransomware is placed on computers to encrypt your data until a ransom is paid for the decryption key
CryptoLocker is one example of ransomware.
CryptoWall 2.0 is one of the newer versions
The FBI estimates that ransomware is a $1 Billion a year fraud
http://money.cnn.com/2016/04/15/technology/ransomware-cyber-security/index.html?section=money_technology
RANSOMWARE
Scareware (Pop-ups)
PC Cyborg (1998)
TeslaCrypt (Gamers)
Locky (Email)
Wannacry (Windows flaw)
https://www.knowbe4.com/
CryptoLocker
Ransomware
RANSOMWARE ATTACKS EMAIL
https://www.knowbe4.com/
Cell Phone Spyware
Popular versions of spyware for cell phones
• HighsterMobile• Spyera• Spyrix• FlexiSpy• Mobile Spy• MobiStealth• mSpy
Cell Phone Spyware
Criminals use charging stations in public places to load malware onto mobile devices.
Always use an electric plug or USB condom when charging your mobile device
Other Spyware
Popular versions of other types of spyware
• Keylogger
• Win-Spy
• Spytech Spy Agent
• SpectorSoft
• 007 Spy Software
Polling Question #5
True or False
One type of ransomware encrypts data on your computer
Data Breaches
Stealing data from computer systems belonging to companies, governmental units, and even not-for-profit organizations.
Large amounts of information are stolen in a short amount of time.
Data Breaches in 2016
2017 Cost of Data Breach Study: Global Analysis, Benchmark research sponsored by IBM, Independently conducted by Ponemon Institute LLC
Sockpuppets
Computer Generated Photos
https://petapixel.com/2018/12/17/these-portraits-were-made-by-ai-none-of-these-people-exist/
Polling Question #6
True or False
Lack of adequate internal controls is one cybersecurity risk
Cybersecurity Risk Management
Managing IT assetsEmployee awareness & trainingBusiness continuationChange managementIT configuration managementData securityDisaster recovery planIncident response plans & teams
Cybersecurity Risk Management
Access controlMonitoring issuesSending alertsManaging media & dataPhysical securityEnvironmental considerationsHardware & software maintenance
Cybersecurity Risk Management
Vendor managementEmployee trainingAssessing new hardware & softwareMobile devicesWork-at-home employeesCustomer accessLegal & regulatory requirementsBacking up data
Cybersecurity Frameworks
COSO Framework for Internal ControlCOBITISO 27001NISTCIS Critical Security ControlsHITRUST
COSO Framework for Internal Controls
The COSO Framework for Internal Controls has five components
Control EnvironmentControl ActivitiesRisk AssessmentInformation & CommunicationMonitoring
2013, Committee of Sponsoring Organizations of the Treadway Commission (COSO)
COSO Requirements for IT
Select and Develop General Controls over Technology
Determines Dependency between the Use of Technology in Business Processes and Technology General Controls
Establishes Relevant Technology Infrastructure Control Activities
Establishes Relevant Security Management Process Control Activities
Establishes Relevant Technology Acquisition, Development, and Maintenance Process Control Activities
2013, Committee of Sponsoring Organizations of the Treadway Commission (COSO)
COBIT
Created and published by the ISACA
Used in conjunction with the COSO Framework
Often adopted by public companies
A best-practices framework
Four main domains Plan & organize
Acquire & implement
Deliver & support
Monitor & evaluate
ISO 27001
Created and published by International Organization for Standardization (ISO)
Most well known cybersecurity standard
Most commonly used outside the U.S.
Focuses on technology and assets
Concentrates on risk mitigation
NIST
Created and published by the National Institute of Standards and Technology (NIST)
Used for implementing the Federal Information Security Act of 2002 (FISMA)
Developed & used by government agencies and contractors
Sets minimum requirements for IT security
CIS Critical Security Controls
Recommended cybersecurity controls
Provides specific ways to stop attacks
Prioritizes actions with high payoff results
HITRUST
A risk & compliance framework
Mostly used in the US healthcare industry
Designed to protect personal health information (PHI)
Easily modified for flexibility of scale (Size, type, etc.)
Easily updated as regulations change
Defines a set of internal controls
Polling Question #7
True or False
The HITRUST framework is predominately used in the US healthcare industry
Basic Internal Controls
Router & Switch
Firewall (Hardware & Software)
Virtual Private Network (VPN)
Encryption
Proxies
Network Intrusion Prevention System (NIPS)
Network Intrusion Detection System (NIDS)
Security Information and Event Management (SIEM)
Basic Internal Controls
Limit access with user IDs and passwordsRequire complex passphrases
A minimum of 24 characters
Require password changes ever 90 days
Reset the default local administrator password
Spam filters
SOC for Cybersecurity (Vendors & others with access)
Basic Internal Controls
Conduct a background check before hiring an employee who will have access to IT systems.
Conduct regular training for employees on how to protect company information.
Enroll in a back-up or wiping program that backs up smartphones and will allow you to remotely erase the information on a lost or stolen phone.
Basic Internal Controls
Install a good anti-virus program on your computer and keep it up-to-date.
Encrypt your office wireless networks using WPA2.
Do not send company information over public WiFi networks.
Basic Internal Controls
Do not reply to e-mails or click on links in e-mails from unknown sources.
Use a separate computer for bank and financial transactions
Monitor user activity on your IT system
Cyber Insurance
Basic Internal Controls
Have real time monitoring of security events on your IT system
Update all software when vendor updates are made available
Use multi-factor authentication or biometrics
Conduct regular penetration & phishing tests
Polling Question #8
True or False
Internal controls over a company’s IT system and data are essential
Any Questions?