TSX Webinar - Social Engineering

TSX Webinar: Social Engineering May 4, 2017

Presenter & Panelist

Grant Patten Digital Media & User Experience Specialist, CSIO

Ana Alberto National Professional Liability Practice Leader & Owner ALIGNED Insurance Inc.

Today’s Agenda • Definition and stats • Social engineering tactics • Discussion of Social Engineering Fraud Coverage • Case studies • Prevention tips • Resources & Questions

Definition: What Is Social Engineering?

Social engineering, also known as “human hacking�, takes advantage of common human behaviour to trick employees into downloading malicious code onto company computers or divulging sensitive information.

Remember, it is much easier to trick someone into giving up a password than to invest the effort to crack into a computer system.

Social Engineering By The Numbers ● Humans, or users, account for 90% of security incidents. (Verizon) ● 156 million phishing emails are sent globally every day. (PCI Security Standards Council)

● Of over 200 security leaders surveyed, 60% say their organizations were, or may have been, victim of at least one targeted social engineering attack in 2016. (Agari) ● 49% rated the effectiveness of the current controls they deploy to defend against social engineering attacks as average or below.

Phishing ● The most common form of social engineering ● Phishing is on the rise – in fact, 23% of recipients open phishing emails and 11% click on attachments (Verizon)

Spear Phishing â—? More sophisticated, targeted form of phishing because the emails ostensibly come from a known or trusted sender â—? The data breach at Yahoo! which compromised over 500 million user accounts was done using spear phishing

Ransomware

Ransomware – email phishing example

Ransomware – email phishing example “Enable macro if data encoding is incorrect” is a social engineering technique:

How to counteract phishing ● Only 7% of American organizations do phishing education (Chris Hadnagy, CEO of security consulting firm Social-Engineer) ● Be more discerning when reading and clicking through emails ● Red flags: does the email look impersonal, come from an unfamiliar organization, contain typos, or include a .ZIP file attachment?

How to counteract phishing

How to counteract spear phishing

Vishing (voice solicitation) â—? Social engineering over the phone to gain access to private personal and financial information from the public for the purpose of financial reward

https://youtu.be/lc7scxvKQOo

Vishing (voice solicitation)

How to counteract vishing ● Be wary of “false sense of urgency” – this sense of urgency will almost always be fabricated by social engineers ● Insist that you must verify their identity before giving them any information. If they can’t verify, simply hang up the phone or ignore the message ● Be suspicious. Never bypass established security procedures/policies

Smishing (SMS phishing) ● SMS phishing uses cell phone text messages to deliver the bait to induce people to divulge their personal information ● March 2017, UK: three Santander (British bank) customers lost a total of £36,000. Attackers used number spoofing, which makes the text message appear on an existing thread of genuine messages from the bank to make them look more convincing

How to counteract smishing ● Never share personal or security details such as your PIN or full password ● Don’t immediately assume an email/text is genuine – even if it looks really official ● Don’t feel pressured into responding back – if it’s a genuine organization, they will let you take your time ● Only call/text a number that you know is genuine (the bank’s number can be found on the back of your card)

Baiting â—? Baiting is another form of social engineering that plays on our natural human curiosity. An attacker will leave a malware-laden device, such as a USB key, in an open area where someone will likely find it

How to counteract baiting â—? Develop strict policies regarding devices brought in from outside the company; block unknown USBs by default

Tailgating â—? Tailgating occurs when an attacker attempts to gain unauthorized access to company premises by following closely behind an employee entering a facility

How to counteract tailgating â—? Have strict policies/employee training on displaying security badges and other credentials and making sure all guests are escorted â—? Would be advisable to use a waste management service that has dumpsters with locks on them

Poll Question

What do you think is the most dangerous social engineering threat to organizations?

2 Types of Social Engineering Coverages Social Engineering Fraud – covered under a Crime Policy Social Engineering Cyber – covered under a Cyber Liability Policy

Social Engineering Fraud – Crime Coverage • This coverage is fairly new, introduced by various insurers in the last couple years • Coverage is added by endorsement to a Crime policy with limits varying from $10,000 to $250,000 • Coverage definition: When an employee is intentionally misled into sending money or diverting a payment based on fraudulent information that is provided to them in a written or verbal communication such as an email, fax, letter or even a phone call • If Social Engineering Fraud is not specifically added by endorsement it would be excluded from the Crime policy as you have knowingly given or surrendered money, securities or other property to a third party

Social Engineering Fraud – Callback Provision • Some insurers will include “Callback Provision” within the endorsement • “Callback Provision” means:

Requirement that a ”Transfer Verification” be performed if there are any changes to the recorded instructions prior to the release of funds to the Vendor or Client or Employee in question. Transfer Verification means a verbal conversation with a purported Vendor, Client or Employee using a Verification Method, to verify the identity of the Vendor, Client or Employee and the authenticity of a Communication.

Social Engineering – Cyber Liability Cyber liability coverage helps to protect companies from: • Data breaches, including costs for customer notification, some legal costs and credit monitoring for those affected • Damages to third-party systems, if, for example, an infected email from your servers crashes the system of a customer or vendor • Data or code loss due to a natural disaster or malicious activity.

• Cyber extortion, including ransomware, which is malicious code installed into a computer on your network that prevents you from accessing it until a ransom is paid

Case Studies - RSA Security LLC

Case Studies - RSA Security LLC

Case Studies - @N Twitter hack

https://medium.com/@N

Case Studies - @N Twitter hack

Case Studies - Stuxnet

Case Studies - Stuxnet

Case Studies - Stuxnet

Social Engineering Prevention Tips – 2FA ● Use two-factor authentication (2FA) wherever possible BUT know that it isn’t foolproof. 2FA adds an extra step to the basic login procedure, e.g., Twitter’s 2FA verifies logins by sending an SMS text with a code to the user’s phone

Social Engineering Prevention Tips – 2FA ● Two-factor authentication (2FA) smishing scam:

Social Engineering Prevention Tips – 2FA ● Google Authenticator app

Social Engineering Prevention Tips ● Implement an internal information security awareness and training program, which includes a module on social engineering ● Never release sensitive information to someone you don’t know or who doesn’t have a valid reason for having it – even if the person identifies themselves as a co-worker ● Consider simulating a social engineering attack. This type of test depends on the information that can be obtained from the public domain about the organization

Social Engineering Attack Simulation ● Arm your employees to beat modern social engineering attacks by going through a simulation ● Phishing simulations can be conducted by your IT team

● Advantage of using a cybersecurity contractor to do the simulation would be a more detached, neutral stance ● Debrief conversation should be about remediation and education, rather than blame and sanctions

Social Engineering Incident Response Plan ● What was or is being attacked, and how ● Which resources are threatened or compromised ● How to shut down an ongoing attack with the least amount of disruption to the business ● How to recover from the attack ● How to implement protections against similar attacks

Learn More at CSIO.com

Members Section gives access to: • CSIO Forms

• TSX Webinars (accredited)

Educational Resources: •Infosheets, Articles, White papers •Videos •Twitter: @CSIO •Email: info@csio.com

CSIO Infosheets & Video Series