Transcript
8/14/2019 Deloitte - Cyber Crime - 2010
1/16
8/14/2019 Deloitte - Cyber Crime - 2010
2/16
Contents
3 Introduction
5 Cyber crime update
7 Deloittes view o the cyber crime scene
8 Deloittes interpretation o survey ndings
10 The ocus obscures the view
11 Shiting the basic approach
12 Developing actionable cyber threat intelligence
14 Benets o a risk-based approach
15 Summing up the cyber crime dilemma
8/14/2019 Deloitte - Cyber Crime - 2010
3/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 3
Introduction
As used in this document, Deloitte means Deloitte & Touche LLP, a subsidiary o Deloitte LLP.
Please see www.deloitte.com/us/about or a detailed description o the legal structure o Deloitte LLP and its subsidiaries.
Threats posed to organizations by cyber crimes have
increased aster than potential victimsor cyber security
proessionalscan cope with them, placing targeted
organizations at signicant risk. This is the key nding o
Deloitte s review o the results o the 2010 CSO
CyberSecurity Watch Survey, sponsored by Deloitte and
conducted in collaboration with CSO Magazine, the U.S.
Secret Service, and the CERT Coordination Center at
Carnegie Mellon (see sidebar on page 4).
This whitepaper reports several key results o this survey
and Deloittes interpretation o key survey results. By its
nature, interpretation goes beyond simple reporting o
results (which is not our goal here) and may prompt
disagreement or even controversy. Deloitte believes
however, that some o the ndings point to signicant
incongruities between the views o many survey
respondents and the current reality o cyber crime. Given
that the survey respondents include mainly executives and
proessionals responsible or the security o their
organizations IT environments, such incongruities are
worth examining.
Our view is that the growth o the threat o cyber crime
has outpaced that o other cyber security threats. From
our perspective, the 2010 CSO CyberSecurity Watch
Survey, viewed in the light o our experience, indicates that
cyber crime constitutes a signicantly more common and
larger threat than respondents recognize. Indeed, driven
by the prospect o signicant prots, cyber crime
innovation and techniques have outpaced traditional
security models and many current signature-based
detection technologies.
Todays cyber criminals are increasingly adept at gaining
undetected access and maintaining a persistent,
low-prole, long-term presence in IT environments.
Meanwhile, many organizations may be leaving themselves
vulnerable to cyber crime based on a alse sense o
security, perhaps even complacency, driven by non-agile
security tools and processes. Many are ailing to recognize
cyber crimes in their IT environments and misallocating
limited resources to lesser threats. For example, manyorganizations ocus heavily on oiling hackers and blocking
pornography while potentialand actualcyber crimes
may be going undetected and unaddressed. This has
generated signicant risk exposure, including exposure to
nancial losses, regulatory issues, data breach liabilities,
damage to brand, and loss o client and public condence.
8/14/2019 Deloitte - Cyber Crime - 2010
4/16
4
Major threats and risks to data, inormation, assets, and
transactions are continually evolving, and typical approaches
to cyber security are not nearly keeping pace. Current security
models are minimally eective against cyber criminals and
organizations remain unaware o that act.
Cyber criminals seem to be reinvesting portions o theirsignicant prots in developing new capabilities or
circumventing todays security technologies. Indeed, even
major antivirus vendors nd it dicult to keep up with the
amount o new malware in the wild. Cyber criminals
routinely exploit the resulting vulnerabilities. Moreover,
they can now target the weakest link in most security
modelsthe end userthrough the Internet by means o
social engineering techniques. (The latter reer to scams
and ruses criminals use to make a user believe they are
co-workers, customers, or other legitimate parties.) Stealth
techniques enable cyber criminals to act without ear o
timely detection, let alone capture and successul
prosecution. It is among some o the most insidiousand
protableo crimes, and can be conducted rom a
well-equipped workstation, perhaps within your own
organization.
This whitepaper shows how Deloittes view o the threat
o cyber crime diers rom the perceptions indicated by
responses to the 2010 CSO CyberSecurity Watch Survey.
It discusses the ways in which cyber security threats and
risks have changed in recent years, how to more accurately
assess them, and how to more eectively combat them.
More broadly, this paper is designed to:
soundanalarmregardingnewcybersecuritypriorities
describetheformandmagnitudeofthethreatsposed
by cyber crime
suggestusefulresponsestomitigatethesethreats
This paper is directed toward senior leaders including CIOs,
CSOs, CROs, operational risk managers, government
agency budgeting and procurement proessionals, and
other executives and proessionals with decision-making
roles in the security o their organizations IT environment
and o the assets within that environment.
About the 2010 CSO CyberSecurity Watch Survey
The 2010 CSO CyberSecurity Watch Survey was sponsored by Deloitte and conducted in 2009 in collaboration
with CSO Magazine, the U.S. Secret Service, and the CERT Coordination Center at Carnegie Mellon. Survey
respondents contributed a broad and valuable set o perspectives.
The 523 respondents primarily included directors or managers o IT or security (33 percent), and C-suite executives,
such as CEOs, CFOs, CIOs, and CSOs and executive vice presidents (32 percent). Also included were law enorcement
proessionals (11 percent), various staers (13 percent), and consultants (8 percent).
Respondents came rom the private sector (69 percent) and public sector (31 percent). Among the private-sector
respondents, 86 percent were rom or-prot enterprises and 14 percent were rom non-prots. Among the
public-sector respondents, 29 percent were rom the ederal government and 79 percent rom state and local
government.
Stealth techniques enable cyber criminals toact without ear o timely detection, let alonecapture and successul prosecution. It isamong some o the most insidiousand
proftableo crimes, and can be conductedrom a well-equipped workstation, perhapswithin your own organization.
8/14/2019 Deloitte - Cyber Crime - 2010
5/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 5
An increasing number o criminals and criminally minded
enterprises have hired, purchased, or otherwise acquired
the ability to inltrate systems with new penetration
techniques while developing a criminal e-business network.
Concurrently, an increasing number o hackers have turned
proessional. Some who once attacked IT systems or the
intellectual challenge and to match wits with (or to
aggravate) others in their eld have discovered strong
nancial rewards in online crime.
Trends that demand a bold response
In addition, the ollowing key cyber crime trends have
emerged, and they demand a strong, bold, near-term
response:
Cyberattacksandsecuritybreachesareincreasingin
requency and sophistication, with discovery usually
occurring only ater the act, i at all.
Cybercriminalsaretargetingorganizationsand
individuals with malware and anonymization techniques
that can evade current security controls.
Currentperimeter-intrusiondetection,signature-based
malware, and anti-virus solutions are providing littledeense and are rapidly becoming obsoleteor
instance, cyber criminals now use encryption technology
to avoid detection.
Cybercriminalsareleveraginginnovationatapace
which many target organizations and security vendors
cannot possibly match.
Effectivedeterrentstocybercrimearenotknown,available,
or accessible to many practitioners, many o whom
underestimate the scope and severity o the problem.
Thereisalikelynexusbetweencybercrimeandavariety
o other threats including terrorism, industrial espionage,
and oreign intelligence services.
Future indicators
Here is real cause or alarm: most indicators point to uturecyber crime attacks being more severe, more complex, and
more dicult to prevent, detect, and address than current
ones, which are bad enough. An underground economy
has evolved around stealing, packaging, and reselling
inormation. Malware authors and other cyber criminals or
hire provide skills, capabilities, products, and outsourced
services to cyber criminals. These include data acquisition
and storage, stealthy access to systems, identity collection
and thet, misdirection o communications, keystroke
identication, identity authentication, and botnets, among
others. Meanwhile, todays security model is primarily
reactive, and cyber criminals are exploiting that weakness.
As a result o such developments, data breaches have
occurred in many organizations which appear to have
deployed traditional security controls, processes, and
leading practice architectures, including the ollowing
representative instances in 2008 and 2009:
Atamajoronlineserviceprovider,morethanone-half
million credit card accounts were put at risk by malware,
to be discovered our months later.
Atamajoronlinepaymentfacilitator,overonehundred
million credit card accounts were put at risk by malware
over an unknown period beore discovery.
Malwareonanonlinebookingsystemexposedsome
eight million personal records to risk.
Malicioussoftwareoncashregisterterminalsata
regional restaurant chain compromised thousands o
credit and debit card accounts and, separately at a major
supermarket chain, over our million credit card accounts.
Websiteintrusioncompromisedtensofthousandsof
customer records at an auto repair chain.
Cyber crime update
Todays stunning cyber-crime trendsdemand a strong, bold, near-term response.
8/14/2019 Deloitte - Cyber Crime - 2010
6/16
6
Cyber criminals now operate undetected within the very
walls erected to keep hackers out. Their technologies
include rogue devices plugged into corporate networks,
polymorphic malware, and keyloggers that capture
credentials and give criminals privileged access while evading
detection. These technologies are a reason why so many
breaches are detected only ater signicant exposure has
occurred. An unknown number o such cases are likely never
detected, particularly when a cyber criminal skims a ew cents
o millions or tens o millions o transactions or exltrates
data hiding in the noise o legitimate outbound trac.
Several additional developments have heightened the
current cyber crime wave:
Socialnetworkingandconstantonlinecommunication
and the prolieration o communication devices,networks, and usershave generated new vulnerabilities
that create more cyber crime opportunities.
Onlinebanking,investing,retailandwholesaletrade,
and intellectual property distribution present countless
opportunities or thet, raud, misdirection, misappro-
priation, and other cyber crimes.
Foreignroguegovernments,terroristorganizations,and
related actors sometimes exploit cyber vulnerabilities to
help und their espionage, warare, and terror campaigns.
Organizedcrimehasextendeditsreachintocyberspace,
adding cyber crime to its portolio o businesses.
Economichardshipsspawnedbythe2008-09recession
may generate resentment and nancial motivations thatcan drive internal parties or ormer employees to crime.
In act, wire mule may be a new job oppor tunity in the
emerging new economy.
This is a picture developed over the past several years o
working with a diverse portolio o clients on a broad range
o risk management and security challenges. We drew upon
that experience in reviewing the responses to the 2010 CSO
CyberSecurity Watch Survey, and developed an interpreta-
tion that led to what may be viewed as counterintuitive or
even contradictory conclusions about the current state o
cyber crime and organizations.
8/14/2019 Deloitte - Cyber Crime - 2010
7/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 7
Deloittes view o thecyber crime scene
Awareness or complacency
Deloitte believes the survey responses reveal a serious lack
o awareness and a degree o complacency on the part o
IT organizations, and perhaps security ocers, vis--vis the
threat o cyber crime. Much o this belie is predicated on
the notion that cyber crime technologies and techniques
are so eective at eluding detection that the actual extent
o the problem may be grossly underestimated. Although
we cannot quantiy the nancial impact o cyber criminalactivity, we would like to highlight a comment made last
year to help establish some potential statistics. Last year,
the White House issued the Cyber Security Policy Review,
which proled the systemic loss o U.S. economic value
rom intellectual property and data thet in 2008 as high
as $1 trillion.1
In this section, we will rst summarize our view and
then examine areas o divergence with selected survey
responses. Some o our views will not surprise security and
IT proessionals in industries characterized by high
vulnerability or organizations that have experienced some
degree o cyber crime. Other readers may nd our view othe seriousness o cyber crime surprising. Our purpose here
is to provide an updated, broad, but well-supported view o
the cyber crime threats that we perceive as most serious
and to present potentially more eective ways o
addressing these threats.
Essentially our view is that:
1. Cyber crime is now serious, widespread, aggressive,
growing, and increasingly sophisticated, and poses
major implications or national and economic securit y.
2. Many industries and institutions and public- and
private-sector organizations (particularly those within
the critical inrastructure) are at signicant risk.
3. Relatively ew organizations have recognized organized
cyber criminal networks, rather than hackers, as their
greatest potential cyber security threat; even ewer are
prepared to address this threat.
4. Organizations tend to employ security-based,
wall-and-ortress approaches to address the threat o
cyber crime, but this is not enough to mitigate the risk.
5. Risk-based approachesand approaches that ocus on
what is leaving the IT environment as well as on what is
entering ithold potentially greater value than
traditional security-based, wall-and-ortress
approaches.
6. Organizations should understand how they are viewed
by cyber criminals in terms o attack vectors, systems ointerest, and process vulnerabilities, so they can better
protect themselves rom attack.
1 White House Cyber Policy Review: Assuring a Trusted and Resilient Inormation and Communications Inrastructure, May 29, 2009,
http://www.whitehouse.gov/cyberreview/
Given this view, Deloitte suggests most organizations
should consider a continued risk-based approach to
cyber security along with a renewed ocus on deeper
analysis o their inbound and outbound network
trac. Such an approach incorporates the potential
vulnerability to and impact o cyber crime, along with
other, perhaps more amiliar and measurable risks,
such as unauthorized trades and oreign currency
risk. We suggest specic methods or detecting andaddressing cyber criminal activity later in this paper.
8/14/2019 Deloitte - Cyber Crime - 2010
8/16
8
Deloittes interpretation osurvey fndings
A number o the responses in the 2010 CSO CyberSecurity
Watch Survey tend to contradict the experience o Deloitte in
the eld, and point to potential misunderstanding o cyber
threats and risks and o optimal approaches to cyber security.
Specically, we interpret the ollowing results in the
ollowing ways:
8
Situational Awareness:Hackers were rated thegreatest cyber threat, over insiders, criminal
organizations, and oreign entities. Given that 69
percent o respondents were private sector, thats
understandable. However, organized crime and
oreign entities were rated lower than Deloittes
assessment would indicate as warranted. This may
point to a misunderstanding o the external
operating and threat environments. Organizations
may ocus on unsophisticated attacks rom hackers
because they are the noisiest and easiest to detect.
Yet that ocus can overlook stealthier attacks that
can produce more serious systemic and monetary
impacts. Attackers rom nation states and organized
crime syndicates deploy more sophisticated
techniques which may go undiscovered.
Implication: Organizations can develop situational
awareness in various ways, and thus detect and
recognize threats and damages that now go
undetected and unrecognized. Attention to behavioral
indicators tied to raudulent activities is a must.
Preparedness: The vast majority o respondents
over 75 percentreported that monetary losses rom
cyber security events either remained the same (in
comparison to the previous year) or they werent
sure. In addition, over 70 percent o respondents
reported that their organization was not specically
targeted by cyber criminals or other actors but just
happened to be impacted by non-specic or
incidental attacks. In our view, respondents appearto underestimate the threats and to have relatively
little situational awareness, yet 58 percent also rate
themselves as more prepared to deal with threats.
This may refect lack o knowledge regarding the
type o inltration and damage that is occurring
within the environment. Typically, there is an inverse
correlation between situational awareness and
perception o preparedness, and cyber criminals are
counting on this disconnect.
Implication: Organizations that are unprepared or
under-prepared oten ail to recognize that act. A
shit in perspective away rom a wall-and-ortress,
authorization-driven approach toward one ocused
more on what is leaving the internal environment
and on what happens to it ater it leavescan help
remedy this situation.
8/14/2019 Deloitte - Cyber Crime - 2010
9/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 9
Organizations would also do well to understand the
security priorities and systems o their key vendors, business
partners, and suppliers, and to share such inormation about
their organizations with these parties. Cyber security is
ordinarily enhanced by a multilateral, team approach.
In act, some organizations may be misinterpreting the
nature o the breaches they experience. The 2010 CSO
CyberSecurity Watch Survey ound that o the organizations
that experienced cyber security events that caused nancial
loss or cost during the preceding 12 months, only 28
percent ound the events to be specically aimed at them.
Thats up rom 22 percent in the previous (2007) survey, but
it still strikes us as low. It seems to us that a substantially
larger percentage o the incidents may have actually
targeted the organizations, particularly since they involved
nancial loss or costs. These statistics may refect the
insidious nature o cyber crime attacks, in that victims otendont know they were the intended victims.
In the 2009 survey, only 6 percent o respondents cite
organized crime as the greatest security threat to their
organizations. That slightly outranks the percentage who see
the greatest threat as emanating rom oreign entities
(5 percent), current service providers and contractors (4
percent), customers (3 percent), and competitors (3 percent).
Yet it ranks ar below the percentage who see the greatest
threat emanating rom hackers (26 percent) and current
employees (19 percent).
The denition o hacker and or that matter organized
crime may vary rom respondent to respondent. Hackers can
morph into criminals, organized and otherwise. Also, organized
crime is not limited to many peoples denition o the term,
which oten includes only the drug smuggling cartels and other
operations covered regularly in the media. And what about
the myriad o skilled initials and hacker groups who may
establish inormal alliances with terrorist organizations, oreign
intelligence services, and even traditional organized crime
entities specically or the purpose o selling their services?
The problem may be even worse than imagined.
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 9
Spending does not equal security: A large number o
respondents (47%) indicated a signicant level o
spending on IT security last year ($100,000 or more).
Higher spending does not necessarily yield greater
security. We see many organizations allocate
signicant resources to technological security
measures, but neglect simple, inexpensive measures
such as patch management, log analysis, privilege
restrictions, password expiration, and termination oormer employees access through a robust
deprovisioning process.
Implication: Many organizations can implement easy,
inexpensive, but oten overlooked xes that increase
security. Oten these measures can help mitigate
threats with potentially serious consequences.
However, even these measures alone may not be
sucient to signicantly improve security against the
evolving cybercrime threat. Methods such as the
risk-based approaches suggested below would likely
be necessary in most organizations.
8/14/2019 Deloitte - Cyber Crime - 2010
10/16
10
The ocus obscures the view
Users as mules
Most cyber security ocuses on preventing attacks and
unauthorized usage. It is this very ocus that can allow and
even enable cyber criminals to employ legitimate users as
unwitting accomplices. Authorized users can access and
travel throughout a system, remove or change data in the
system, and conduct transactions. When cyber criminals
employ such users as unwitting accomplices or money
mules, they can operate as i they were users. They can
acquire the same, or even greater, ability to navigate
pathways, copy data, execute transactions, and monitor
keystrokes.
It is that kind o activity that must be detected, prevented,
and addressed. O course, practices designed to secure the
environment and data and to detect traditional breaches
must remain in place. But sophisticated cyber criminals
have studied the methods organizations use to both wall
o and grant access to their networks and data. This
positions criminals to conduct activities that can go
undetected or months, or to commit a single, major,
extremely protable and damaging crime, such as wiretranser raud. In many cases cyber criminals have obtained
credentials and accessed systems as i they were actual
employees and customers. Thus, the integrity o the
endpoint that is being granted access to the organizations
systems and data must be a primary concern.
The public sector is as exposed as the private sector. There
have been cases in which state-level government agencies
in the United States have lost measurable monetary sums.
For example, the July 2, 2009 entry on Washington Post
reporter Brian Krebs blog stated that Ukrainian cyber
criminals had stolen $415,000 rom a county by means o
unauthorized wire transers rom the countys bank. Thecriminals were aided by more than two dozen co-
conspirators in the United States.
Krebs reported that his source, an investigator on the case,
noted that the criminals used a custom variant o a
keystroke logging Trojan that promptly sent stolen
credentials to the attackers by instant messenger. This
malware also enabled the attackers to log into the victims
bank account by using the victims own Internet connection.
Similarly, $480,000 was stolen rom a bank account o a
county Redevelopment Authority by means o Trojan
malware. Threats rom cyber crime at ederal agencies could
extend to matters o national security.
8/14/2019 Deloitte - Cyber Crime - 2010
11/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 11
Shiting the basic approach
One o the more ruitul approaches to consider in
addressing the threat o cyber cr ime involves moving rom
a primarily security-based approach to a more risk-based
approach. Blocking what is coming into the environment
the strength o the security-based approachis useul and
necessary. However, that can oten be accomplished less
expensively and perhaps more selectively.
Shiting the ocus to include monitoring and identiyingdata that leaves the environment can detect activities
enabled by techniques and technologies that mimic,
exploit, or piggyback on the access o authorized users.
Relevant items may include user credentials, personally
identiable inormation, nancial data, and vulnerability
details. Current security wall, access control, and identity
authentication approaches typically wont identiy criminal
activity geared to capturing that data and inormation.
With their current methods, cyber criminals can even
inltrate systems o organizations that hire white hat
hackers to test their deenses. Cyber criminals view a
system rom a process perspective with the goal o gainingaccess as an actual user would. They then ocus on
acquiring the access and authentication tools that an actual
user would have. Once inside a system, cyber criminals can
use it in ways that the organization did not, and cannot,
anticipate or deend against. While security personnel are
intently watching their Security Inormation Manager
screens, the cyber criminals are already inside.
A risk-based approach to cyber security
A risk-based approach can start with the assumption that
an unauthorized user can gain access to the system, and
then design responses based on the value o the data that
could thus be compromised. This calls or prioritizing data
and inormation based on value to the organization or
other useul criteria. The organization can then decide
which data to ocus which resources on, how much to
spend, and which tools to use to protect data.
This approach can help the enterprise shit away rom
building a great wall against all threats, toward
identiying and addressing the most signicant ones. This
entails prioritizing risks on the basis o their likelihood,
impact, and potential interactions with other risks, then
allocating resources accordingly. It takes eort, expense,
training, and resources to develop a system o
categorization by value and to track data ater it leaves the
organization, but it pays o in eciency and eectiveness.
It is also possible to risk-rank data by type, value, and
impact i it were to be compromised.
Relatively ew organizations have developed categories based
on value or risk. However, identiying which data is most and
least valuable enables cyber security proessionals to ocus on
the highest priorities. The most valuable data, such as product
ormulations and sensitive nancial and legal inormation, can
be tagged and monitored so that the organization knows
where it is, where it is going, where it has gone, and on
whose authority. Resources can then be shited away rom
less valuable data, such as Website activity and routine email
content, which can be treated accordingly.
entails prioritizing risks on the basis o their likelihood, impact, andpotential interactions with other risks, then allocating resources accordingly.It takes eort, expense, training, and resources to develop a system ocategorization by value and to track data ater it leaves the organization
8/14/2019 Deloitte - Cyber Crime - 2010
12/16
12
Developing actionablecyber threat intelligence
Combating cyber crime requires commitment rom senior
executives and board members. Yes, their plates are ull.
However, addressing cyber crime alls within risk
management, an item already on their plate. Cyber crime
is best addressed in the context o the organizations
overall risk management approach. That way, it becomes
an item in the IT, security, and risk management budgets
and on the agenda at management and board meetings.
Once the commitment is made, several specic steps can
improve cyber security and, incidentally, protection against
other threats. These steps within Deloittes approach ocus
rst on intelligence gathering and analysis, then on
assessment. The overall process is summarized in Exhibit 1.
In practice, this process is best applied to specic
areasactivities, data sets, delivery channels, and aspects
o the IT inrastructure.
Identiying these areas takes time and resources, but they
can be identied in the context o an overall risk
management system. I a detailed enterprise-wide risk
assessment has already been conducted, so much thebetter. That assessment will have identied critical
processes, activities, data, delivery channels, and other
resources, which can be employed in this eort.
Exhibit 1. Cyber intelligence acquisition and analysis
External CyberThreat
Intelligence
Feeds
Internal ThreatIntelligence
Feeds
RiskAssessment
Process
ThreatIntelligence
ReportingProactive
Surveillance
Risk AcceptanceProcess
RiskMitigation
RiskRemediation
Line of BusinessTeams
Security, Fraudand Operational
Risk Teams
3rd Parties,Subsidiaries
Cyber Threat IntelligenceCollection Research, and
Analysis Process
ApplicationLogs
InfrastructureLogs
TechnologyConfiguration
Data
Commercial Feeds Law Enforcement Industry Associations Security Researchers
Underground Forums Hash databases GEOIP data
Honeynets Malware Forensics
Brand monitoring P2P monitoring DNS monitoring Watchlist monitoring
Fraud investigations Security event data Abuse mailbox info Vulnerability data Sandboxes Human intelligence
Urgent securitycontrol updates
8/14/2019 Deloitte - Cyber Crime - 2010
13/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 13
Intelligence gathering
Gathering intelligence is a continuous activity. For our
purposes here, it involves choosing promontories rom
which to scan the external environment and monitor the
internal environment. Another way to think o them would
be as channels (akin to radio or television channels)
through which you can monitor these environments.
Promontories or channels include those that constituteexternal cyber threat intelligence eeds and internal cyber
threat intelligence eeds, as listed in Exhibit 2.
Exhibit 2. Cyber threat intelligence sources
While it pays to cast a wide net, there is always the actor
o cost and the danger o sacricing depth or breadth. So
pick and choose your eeds given your industry, needs,
and capabilities. Not every source will be useul to every
organization, and some will be more useul than others to a
given enterprise.
Proactive surveillance rounds out the intelligence gathering
eort. Resources here include honeynets, malware
orensics, brand monitoring, P2P (peer to peer) monitoring,
DNS monitoring, and watchlist monitoring.
A ew o the specic technologies on which to ocus threat
research include the ollowing:
Internet applications:online transactions, HR systems,
wire systems, Websites
Mobile computing:Blackberries, Smart phones, cellular
networks, text messaging services
Personal computers:operating systems, third-party
applications, USB storage devices
Banking devices:ATMs, kiosks, RFID enabled smartcards
Intranets:intranet portals, collaboration tools,
authentication systems
Telephony:voice response units, VoIP phones and PBXs,
voicemail
Identity management and authentication:log-on,
password, user code, and other IdM technologies
Another potential source o intelligence would be theresources that potential adversaries use. Again, the goal
should be to ocus on devices and applications that expose
the organizations most valuable data, processes, activi ties,
and inrastructure to the most risk. Once a rich mix o
intelligence is being acquired, eorts turn to analysis.
Intelligence analysis
The amount o data derived rom broad-based intelligence
gathering can be staggering. Thereore, analysis includes
statistical techniques or parsing, normalizing, and
correlating ndings, as well as human review.
Six questions should drive this analysis: Howcanweimproveourvisibilityintotheenvironment?
Whatnewtechnologiesdoweneedtowatchforand
monitor?
Dowehavevulnerabletechnologiesanddata?
Towhatextentwillourexistingcontrolsprotectus?
Whichindustriesarecybercriminalstargetingandwhich
techniques are they using and planning to use?
Howcanweidentifyactionableinformation?
This analysis should be conducted within a risk
management process built around well-dened risk
identication, prevention, detection, communication, and
mitigation activities. We wont delineate that process here,
because most readers will be amiliar with it. A cyber risk
management process prioritizes threats, analyzes threats,
detects a threat beore, during, or ater actual occurrence,
and species the proper response. The latter may consist o
remediation, control updates, vendor or partner
notication, or other actions. Analys is, such as ailure
modes and eects analysis, provides a eedback
mechanism, such as lessons learned, to constantly improve
the eectiveness o the analytics being perormed.
External intelligence feeds Internal intelligence feeds
Publications Fraudinvestigations
Lawenforcementsources Securityeventdata
Industryassociations&ISACs Abusemailboxinformation
S ecur it yve ndo rs Vuln er ab ilit yd at a
U nd erg ro un dfor um s S an db ox es
Hashdatabas es Humanintelligence
GEOIPdata
8/14/2019 Deloitte - Cyber Crime - 2010
14/16
8/14/2019 Deloitte - Cyber Crime - 2010
15/16
Cyber crime: A clear and present danger Combating the astest growing cyber security threat 15
Summing up thecyber crime dilemma
Data is more valuable than money. Once spent, money is
gone, but data can be used and reused to produce more
money. The ability to reuse data to access on-line banking
applications, authorize and activate credit cards, or access
organization networks has enabled cyber criminals to
create an extensive archive o data or ongoing illicit
activities. The world has not changed much since the early
1900s when Willie Sutton was asked why he robbed
banks. He said, Thats where the money is. Today, cybercriminals go where the data is because it gives them
repeated access to the money, wherever it is.
Cyber crimes may pose the most potentially damaging
threat to IT-related activities, transactions, and assets.
We see this threat as under-recognized and under-rated
among the risks that organizations ace, and thus believe
that many organizations are unprepared to detect,
address, or protect themselves rom these threats.
A vigorous, rapidly growing underground economy
supports cyber crime activities. That economy includes
organized crime, hackers or hire, disgruntled current andormer employees, and other insiders (meaning people
who have or had authorized access), and terrorists and
their supporters. Cyber crimes include thievery, raud,
misdirection o communication, identity thet, intellectual
property thet, corporate espionage, system sabotage,
data destruction, money laundering, and terrorism,
among others.
Some organizations lack o preparedness stems rom
their traditional wall-and-ortress approaches to cyber
threats. These approaches rest on access control and
authorization technologies and techniques. However,
cyber criminals can now not only circumvent many o
these approaches but use them to gain the access that
authorized users enjoy. Cyber criminals also have
technologies that enable them to take advantage o that
access in a matter o seconds.
Organizations can take several steps to protect
themselves. The rst step is to comprehend the
seriousness o cyber crime threats to valuable data,
processes, and assets. The second is to shit rom a
security-based approach to more o a risk-based
approach to cyber security. Spend your budget and apply
your resources to mitigate the highest ranking risks to
your enterprise. The third step is to knock down the walls
associated with siloed approaches o dealing with cyber
threats. Sharing and combining data across theorganization, or instance on raud, loss prevention,
inormation security, and human resources, while
combining it with external sources strengthens the ability
to perorm value-added analysis.
At that point the organization can prioritize the risks,
incorporate them into business decision-making
processes, and manage them accordingly, with resources
allocated more eciently and eectively. Eorts then
turn to inormation gathering and analysis, with an eye
toward identiying cyber crime methods and threats and
to monitoring assets as they are accessed and as they
leave and ater they leave the IT environment.
We do not suggest that cyber security proessionals
consider a change in ocus and additional duties lightly.
However, we do suggest that organizations consider their
exposures to cyber crime and their current detection,
prevention, and mitigation capabilities. Given the prots
and current conditions, cyber crime may well be coming
to your neighborhoodi it has not already moved in.
More importantly, how would you know?
Data is more valuable than money. Oncespent, money is gone, but data can be usedand reused to produce more money. Theability to reuse data to access on-line banking
applications, authorize and activate creditcards, or access organization networks hasenabled cyber criminals to create an extensivearchive o data or ongoing illicit activities.
8/14/2019 Deloitte - Cyber Crime - 2010
16/16
Ted DeZabala
National Managing Principal
Center or Security & Privacy Solutions
Deloitte & Touche LLP+1 212 436 2957
tdezabala@deloitte.com
Rich Baich
Principal
Deloitte & Touche LLP
+1 704 887 1563jbaich@deloitte.com
For current inormation on Center research, thought leadership, security events, or videos, please visit us online at
www.deloitte.com/securitysolutions. Find our Center content on YouTube, or to subscribe to updates on our programs
and solutions, register here www.deloitte.com/us/securityandprivacysolutions.
For more inofrmation
This publication contains general inormation only and Deloitte is not, by means o this publication, rendering
accounting, business, nancial, investment, legal, tax, or other proessional advice or services. This publication
is not a substitute or such proessional advice or services, nor should it be used as a basis or any decision or
action that may aect your business. Beore making any decision or taking any action that may aect your
business, you should consult a qualied proessional advisor.
In addition, this publication contains the results o a survey sponsored, in part, by Deloitte. The inormation
obtained during the survey was taken as is and was not validated or conrmed by Deloitte.
Deloitte, its aliates, and related entities shall not be responsible or any loss sustained by any person who
relies on this publication.
Copyright 2010 Deloitte Development LLC. All rights reserved.
Member o Deloitte Touche Tohmatsu
top related