Embed Size (px)
Citation preview
YOUR PRACTICE IS A TARGET FOR CYBERCRIMINALS
THE FACT IS WE ALL ARE
YOUR PRESENTER
• Peter Verlezza,
Managing Partner, SMB Networks, LLC
• Best Selling Author
• Speaker
• Movie Maker
• Podcaster
• Infraguard, FBI/Private Sector
• Board member CMGMA
• Number 1 Security Threat to your Medical Practice
• Ways to Protect Against Ransomware
• Simple Practices to Minimize Your Risk Online
• Why “free mail” Comes with a Big Cost
• What is the Dark Web?
WHAT WE WILL COVER TODAY
WHEN YOU ARE AFFECTED BY A CYBERCRIME THROUGH NO FAULT
OF YOUR OWN WILL YOUR PROVIDERS, EMPLOYEES, PATIENTS, FAMILIES, PEERS CALL YOU STUPID,
IRRESPONSIBLE OR BOTH?
• Three primary issues/risks
• Legal/Compliance
• Operational
• Reputational
CYBER CRIME ISN’T ABOUT HIPAA
WHY CYBER CRIME
Cybercrime is a 2 trillion dollar a year industry.
If you had just .1% of a slice of that pie, you’d make a cool $2 mil/year
Better question: Why not?
CYBERCRIME BUSINESS
THE EVOLUTION OF CRIME
DUH!
1. Yahoo
Date: 2013-14
Impact: 3 billion user accounts
Details: In September 2016, the once dominant Internet giant, while in negotiations to sell itself to Verizon, announced it had been the victim of the biggest data breach in history, likely by “a state-sponsored actor,” in 2014. The attack compromised the real names, email addresses, dates of birth and telephone numbers of 500 million users.
THE 5 BIGGEST DATA BREACHES OF THE 21ST CENTURY
2. Adult Friend Finder
Date: October 2016
Impact: More than 412.2 million accounts
Details: The Friend Finder Network, which included casual hookup and adult content websites like Adult Friend Finder, Penthouse.com, Cams.com, iCams.com and Stripshow.com, was breached sometime in mid-October 2016. Hackers collected 20 years of data on six databases that included names, email addresses and passwords.
3. eBay
Date: May 2014
Impact: 145 million users compromised
Details: The online auction giant reported a cyberattack in May 2014 that it said exposed names, addresses, dates of birth and encrypted passwords of all of its 145 million users. The company said hackers got into the company network using the credentials of three corporate employees, and had complete inside access for 229 days, during which time they were able to make their way to the user database.
4. Equifax
Date: July 29 2017
Impact: Personal information (including Social Security Numbers, birth dates, addresses, and in some cases drivers' license numbers) of 143 million consumers; 209,000 consumers also had their credit card data exposed.
Details: Equifax, one of the largest credit bureaus in the U.S., said on Sept. 7, 2017 that an application vulnerability on one of their websites led to a data breach that exposed about 143 million consumers. The breach was discovered on July 29, but the company says that it likely started in mid-May.
5. Heartland Payment Systems
Date: March 2008
Impact: 134 million credit cards exposed through SQL injection to install spyware on Heartland's data systems.
Details: At the time of the breach, Heartland was processing 100 million payment card transactions per month for 175,000 merchants – most small- to mid-sized retailers. It wasn’t discovered until January 2009, when Visa and MasterCard notified Heartland of suspicious transactions from accounts it had processed.
• Accepting without reading
• Downloading any infected software
• Inserting or connecting an infected disk, disc, or drive
• Visiting unknown links
• Not running the latest updates
• Pirating software, music, or movies
• No antivirus spyware
HOW DOES A COMPUTER GET INFECTED WITH A VIRUS OR SPYWARE?
E-mail As a general rule, do not open e-mail you were not expecting to receive. Computers can become infected when users open e-mail attachments that contain malicious code. Even if the message is from a co-worker, friend, or family member, always use caution before opening a link or downloading an attachment.
THE NUMBER 1 SECURITY THREAT
• In short, they provide email services for free so that they can learn more about people and show more specifically targeted ads on their other services.
WHY IS EMAIL FREE?
the fraudulent practice of sending emails purporting to be from reputable companies in order to induce individuals to reveal personal information, such as
passwords and credit card numbers.
PHISHING
139 MILLION SUBSCRIBERS
28 MILLION PACKAGES
A YEAR
67 MILLION CONSUMERS AND SMALL
BUSINESS
277 MILLION ACCOUNTS
WORLDWIDE
122 MILLION USERS
WORLDWIDE
70 MILLIONS CUSTOMERS
GLOBALLY
the fraudulent practice of sending emails ostensibly from a known or trusted sender in order to induce
targeted individuals to reveal confidential information.
SPEAR PHISHINGPHISHING BASED ON RESEARCH
RANSOMWARERANSOMWARE IS A TYPE OF MALICIOUS
SOFTWARE, OR MALWARE, DESIGNED TO DENY ACCESS TO A COMPUTER SYSTEM OR DATA UNTIL
A RANSOM IS PAID. RANSOMWARE TYPICALLY SPREADS THROUGH PHISHING EMAILS OR BY
UNKNOWINGLY VISITING AN INFECTED WEBSITE.
• On May 7th 2019, hackers seized parts of the computer systems that run Baltimore’s government. It could take months of work to get the disrupted technology back online.
• Systems Affected
• Voice Mail
• Parking Fines Database
• Water Bill Payment System
• Property Tax Payment System
• Vehicle Citation System
• More Than 1500 Homes Sales Have Been Delayed
CITY OF BALTIMORE
• The attackers are demanding 13 Bitcoins
• On the day of the attack, the ransom would have cost about $75,000. Today the attack will cost about $102,000.
• The city has not described how the attack was executed, but experts don’t believe that hackers sought the city out. It is believed it was purely an opportunistic attack.
CITY OF BALTIMORE
POPULAR SITES
• It can be estimated that 1.2 million accounts are being compromised on a daily basis.
• Social Media hacks can happen to everyone for several purposes:
• Just For fun - Not much harm can happen besides a prank that can be embarrassing.
• For forced shares - These types of hacks can be more harmful than you think.
• For forced follows - This can involve your account being hacked as part of a wider plan to hack accounts and get them to follow a specific account.
• For information - This can be your password itself so that they can steal it and use it to try and sign into accounts you have with banks and online retailers.
POPULAR SITES HACKING STATISTICS
WHY GET INTO YOUR ACCOUNT?
1. Name
2. Address
3. Phone
4. DOB
5. Education (College/High School)
6. Mother’s Maiden Name?
7. Mothers fathers name
8. Friends names
9. Children’s names
10. Children's school
11. Children's DOB
12. Pets name
13. Browsing habits (websites, services, hobbies,
likes, etc…
14. And on, and on and on…)
• Social networking services from Twitter and Foursquare to Yelp and Buzz encourage users to log in and share their location.
• Girls Around Me –Girls Around Me allowed you to identify girls who have checked into venues near your location, based on publicly available data from Facebook and Foursquare.
• Please Rob Me – ‘Please Rob Me’ aggregates and streams location check-ins into a list of ‘all those empty homes out there,’ and describes the recently-shared locations as ‘new opportunities.’
• Scene Tap – Cameras In Bars
• Facial recognition, m/f/a/counting
SOCIAL APPS AND DATA AGGREGATION
• The deep web, invisible web, or hidden web are parts of the World Wide Web whose contents are not indexed by standard search engines for any reason.
THE DEEP WEB
Organic weed from the Netherlands.
Weapons can be purchased online.
Journalists in heavily censored countries use the deep web to communicate and exchange information.
Fake identification.
Human/child trafficking
There’s no cash or check exchanged over the deep web. To exchange goods, you need to use crypto currency. BitCoin most popular.
THINGS YOU DIDN’T KNOW ABOUT THE DEEP WEB
Bitcoin is a cryptocurrency and a digital payment system. It is the most popular and largest block chain network. There are currently over 2000 cryptocurrency markets. The system is peer-to-peer, and transactions take place between users directly, without an intermediary.
WHAT IS BITCOIN
DIGITAL UNDERGROUND DATA BAZAAR
• Credit card details - $2-$90 per record
• iTunes accounts - $8
• Fedex.com, Continental.com and United.com accounts - $6
• For just $4 you can buy hacked credentials at registrar, hosting, or wireless providers like GoDaddy.com, att.com, Sprint.com, and verizonwireless.com
• Active accounts on Facebook or Twitter - $2.50
• Physical credit cards - $190 per card
• EMR Record - $50
• Also sell services for the design and publishing of fake online stores and Crimeware as a Service (CaaS)
THAT MEANS…
If criminals are going to just keep getting smarter, YOU have to
keep getting smarter.
COMMON RATIONALES
• There’s nothing a hacker would want on my PC
• I don’t store sensitive information on my PC
• I only use my computer for checking email
• BTW, why is email free from Google, Yahoo, etc?
• In short, they provide email services for free so that they can learn more about people and show more specifically targeted ads on their other services.
HOW VALUABLE IS A HACKED COMPUTER?
Email Attacks
•Webmail Spam
•Stranded Abroad
•Harvesting Email Contacts
•Harvesting Associated Accounts
•Access to Corporate Email
Web Server
•Phishing Site
•Malware Download Site
•Warez/Piracy Server
•Child Porn Server
•Spam Site
Virtual Goods
•Online Gaming Characters
•Online Gaming Goods/Currency
•PC Game License Keys
•OS License Keys
Reputation Hijacking
•Google+
Bot Activity
•Spam Zombie
•DDoS Extortion Zombie
•Click Fraud Zombie
•Anonymization Proxy
•CAPTCHA Solving Zombie
Account Credentials
•eBay/PayPal Fake Auctions
•Online Gaming Credentials
•Website FTP Credentials
•Skype/VoIP Credentials
•Client Side Encryption Certifications
Financial Credentials
•Bank Account Data
•Credit Card Data
•Stock Trading Account
•Mutual Fund/401K Account
I GIVE
UP!
I PAY FOR ANTIVIRUS. WHY DO I GET INFECTED?
• 2 million unique pieces of unique pieces of
malware identified monthly (McAfee)
• Over 250,000 new exploits discovered every
single day (Sophos)
• Think about the R&D to combat that!
HELPFUL TIP #1:
• Use Antivirus
• Plenty of free AV around
• Is there a difference between paid and free
HELPFUL TIP #2:
• Backup your Data
• Check/Test your data backups at a MINIMUM Monthly
• Assure all critical data is saved in the backed up location
• Ransomware
GETTING TO ‘STRONG PASSWORD’
• DON’T SHARE PASSWORDS
• Change Passwords at least once a year. Shoot for every 60 days if possible
• No Passwords on POST-IT Notes!
• Use a phrase or a long password with numbers and characters.
• Think: Length, Complexity, Variation, Variety
• Strong Passwords
• Try a phrase that you will remember
• My dog Spot is 5 years old! MdSi5yo!
• Abbreviate the website name to make it unique
• Amazon would be AMMdSi5yo!
• Pay Pal would be PPMdSi5yo!
HELPFUL TIP #3:
• Enable Multi Factor Authentication where you can
• User names and passwords are something you know
• MFA adds something you have or have access to
HELPFUL TIP #4:
HELPFUL TIP #5:SECURE YOUR DEVICES
• Install current antivirus software (and keep it current!)
• Enable User Account Control (UAC)
• User Account Control (UAC) can prevent unauthorized changes to your computer
• Do updates, manually
• Microsoft will be ending support for Windows 7 and Server 2008 on January 14, 2020. This means no more security patching and no
more support from Microsoft. Windows 7 will go the way of Windows XP.
WINDOWS 7/SERVER 2008
