Name: Brainstorm Finance 2019: How Financial Institutions Fight Cybercrime
Uploaded: 2019-06-19
Duration: 18 min 32 s
Description: Today the financial industry faces a diverse array of threats from nation states to cybercriminals. With limited resources and heightened risks, how can financial institutions protect themselves?

Hey everybody. So I'm here with Amy Chang who deals in cyber security at America's biggest bank and Nikki Cosgrave, who does cyber security strategy for proof point, the world's premier email security company. And actually just two hours ago, I got an email from the editor in chief Fortune magazine. And it asked me if I could attend to a an important task. Cliff did you send this email to me? [ UNKNOWN ] Okay, I looked at the email address and it was from somebody called Zoonyjah99 @ zero. net. So Nikki, what does Zoo Nyjah want with me? You know what, it's almost what they want with. Every company that's getting a phishing email out there they want your money, they want your organisation's money and I think if we look at the threat landscape targeting financial service organisation today it's all about the bottom line. How can we trick someone into clicking on something giving up the username and password. They obviously have financial motivation to try to get user information, things like that. But from if you're talking about from the JP Morgan side, they might wanna get access to intellectual property they might wanna get access to financial decisions that people have may be making business deals, things like that. So it could also be espionage and reconnaissance on what The financial sector is doing as well. JPMorgan Chase spends more on cybersecurity than just about any company in the world it spends, I think its budget is something like $ 600 million. Right. What are you spending all that money on? We spend it a lot on defending our technology and ensuring that the people. At the firm understand and are protected so and it also helps us to invest into our corporate brands and things like that. So there's a lot of investment across the firm into like identity and access management to ensure that the wrong people are not getting access to our sensitive financial information. Like. [ UNKNOWN ] Yeah, exactly. [ LAUGH ] And also a lot of technologies that help us defend the firm. Okay, the spending on cyber security, as my colleague Jeff said at the outset of this is going through the roof. It's accelerating. I think it's at 120 billion dollars per year, the total globally. If we're spending all this money on cyber security, why are there still so many breaches [ BLANK_AUDIO ] Well, I guess I could start with that. You look at the data from most of the analysts, companies you look at Gartner research, for example, and they're tracking security spend and what security teams are spending their money on. And the vast majority of that spend is on network security. No longer exists, but we're spending 60 % of our budget on protecting that perimeter. But then you look at the threat landscape and where the threats are coming from and over 90 % of the threats come via the email channel. And they require somebody to do something. To click, to download malware to install something. Fundamentally, we're protecting the network when the criminals have pivoted because it's a lot harder for them to hack Microsoft or to hack Amazon because they put so many layers in place. They're targeting our people. And I think that's why we're seeing an increase in spend. And an increase in breaches because we're not investing in the places where potentially, criminals are targeting us from. So, that's amazing. 90 % are coming through email, that's a huge amount. Your company, not too long ago, bought a phishing training company called, Wombat. The thing about phishing is that you can train people all you want, it only takes one person to mess up and all of a sudden all bets are off, the attacker's inside your business. So how do you deal with that issue? Yeah, I think it's a later approach, right? A lot of again, security professionals and businesses have focused on implementing technical controls. We need technology to block as much as possible from reaching the organization and. Absolutely you need to invest in technology. But again, if the criminals are targeting our people, we have to make sure that our people are aware of the threats that are targeting them. And that's why we believe training and awareness is important because not only do you need to raise awareness, you also need to change those risky behaviors. Should you really be clicking on that link? Should you be giving up your username and password. To a website that looks like its Microsoft Office 365 when in reality it isn't. And there are little clues and checks that people can leverage to identify something's malicious. So it's a late approach, it's technology, you have to train your people, but you also have to implement process controls. Huge loses of revenue. What if you were to have over, go please ->> Well, I would say that to add on to that though. I think we're noticing a trend as well as they're adopting to th changing landscape as well. They know that these types are like proof points are in place to To prevent people from clicking on links and things like that. And the training is going across the industry to be able to train these people, but they're becoming more sophisticated. I think we had an event last year, not JP Morgan but another financial institution, Where they were vished as in there was a phone call. Vished? Yeah, vished. What does Vished mean? As in like 'hi I'm from this particular organization and I would like to get. I'm just trying to make sure you're an employee here. What's your user ID? Voice vishing? That's correct, yeah. And basically Guiding this person through, okay, I'm gonna send you this email, and then you're gonna click it, engaging them and to try to bind their trust. And then still getting them to be able to click on the link, and get access to that financial institution. So the evolution is definitely happening and they're incorporating a lot of new techniques So Nikki, have you ever had a situation now where like you're trying to teach an employee that they shouldn't click on these phishing emails, but somebody who's just unteachable, they won't learn. They keep doing the same thing. They keep opening the file. What do you do with that employee, you fire them? Like, Yeah, there's that debate that's going on right now. And I think especially in financial institutions or organizations that are highly regulated and Should we fire people that are risk to the business potentially right? Because that behavior is now risky. But let's do a poll How many people think that we should fire people who who are unteachable when it comes to fishing? Wow. [ LAUGH ] Merciless. Yeah. You know what I think I think it's too early to be at the point where we say we fire people, right because again, We've been so focused on technical controls, and not really invested in training our people and you know, doing a one hour video once a year is not training that's raising awareness, having those teachable prompts. Every time you do a simulated phishing attack that sent from the company, you identify the people that click. And you send them to dedicated training, but it's short, it's digestible, it's repeatable, it's something they can practice, doing that on an on- going basis is then, starting to change behavior. But I think the situation right now is, we're only doing annual training programs, and it's not fair to. Fire someone who's trying to do their job fundamentally. Annie, has anybody at JP Morgan and Chase lost their job because they continue to click fishing emails? Not at our organization, [ LAUGH ] Okay, wello, how do you limit the liability on an employee such that if they were to click on one of these emails that it doesn't totally wreck the organization? But it kind of contains the damage. I think what Nikki was talking a little bit about earlier in terms of having layers of controls in place. Not only do we have like perimeter protection so like preventing malicious emails from coming in but also preventing from malicious traffic from going out as well. And then additional controls and monitoring rules in place where if we know that a specific email address or a specific IP address is trying to like connect to our organization that we're able to kind of block that. And prevent that from even occurring or ending up in someone's inbox. So rank, for me, the threats that are facing the financial industry right now. What is at the top of the list and what's at the bottom of the list? [ BLANK_AUDIO ] I would say that, [ BLANK_AUDIO ] They nation states are ranking up there in terms of their potential for for leveraging the financial sector as a potential, you know, target for as a result of geopolitical action. your background is actually in studying Chinese military security related issues. Is that applicable? It is and it isn't. I would say that, you know, in any sort of nation states sense when you're looking at. A country's intelligence apparatus. Obviously the more information that they can get on their adversaries, and that applies for the United States looking outside as well as other adversaries looking into the United States as well. That's definitely a consideration for them, and I wouldn't say that there are, Laying implants or all the stuffs that's happening in the news with Russia and the United States. America is apparently putting backdoors all over Russia's energy grid, I think was the story in the New York Times recently. Right, but that's definitely a consideration for us. In terms of other priorities for us is also the proliferation of destructive malware, so the amount of malware that's proliferating across the internet now, and the ability for your. Average cyber criminal to be able to get that commodity malware and then buy and try to implement it. Not that it necessarily would affect a firm like JP Morgan. But if we have clients or customers who get affected by this, there could be some downstream effects. You cited some of the geopolitical tensions that are going on right now. There's the trade war with China. A lot of messiness going on with Iran. Are you seeing upticks or flare ups with respect to any particular nation. I think that whenever you do see a major geopolitical event between the United States and another country we expect there to be elevated behavior. And so every time that something major happens in foreign policy. We always make sure that we have people aware and watching, to make sure that nothing happens. So I'm gonna open up the floor in just a moment, but I've got one last question for Nikki. Which is that proof points of business has been about email security for a long time, but there are so many other social channels open now and people's communications preferences are changing. How is Proofpoint adapting to these new threats? Yeah, so actually Proofpoint is a cyber security company. Email is one of the channels that we protect an email fundamentally because that's where the vast majority of threats are coming from. So for financial services specifically, we did some analysis Over 100 organizations, financial organizations globally. And we identified a 69 percent increase, year on year from q4 2017 to q4 2018. of what we call business email compromise attacks. Again, those are pure social engineering attacks. There's no malware, there's no payload, there's nothing to analyze. It's an email pretending to be someone that's. It's trusted whether it's a third party or an executive internally, that email sent to someone junior in the organisation asking them to do something whether it's send the data or send the money. 69 % increase and that's 69 % increase in that threat and that's via the email channel. However some of the othe threats that we're seeing is via cloud applications. That's not email at all, but as we do business more leveraging these client applications, innovating and working with different partners, criminals are trying to get access to our credentials, that's the username and password to get access to those cloud applications to fundamentally download the data, sell it in the black market and make money that way as well. Over here. Hi .>> Please introduce yourself. Brad Garlinghouse from Ripple. I'm curious to hear you guys' thoughts about SIM hijacking, I'm kinda surprised it hasn't come up and in particular, I'm curious if you have recommendations on how people can protect themselves, and if and how, we as a community, can hold carriers accountable for their culpability in the problem. This is a great question. So that was Brad Garlinghouse CEO of Ripple asking how we can defend against sim hijacking attacks, which is basically where somebody steals your phone number. Which allows them to get into your email account and do a whole bunch of other insidious things, either. So I think it's down to authentication as well. Especially in this room, right? As we're leveraging mobile wallets, as we're leveraging new applications and trying to do more on a mobile device, we're seeing organizations using the device to try to authenticate. And so the criminals are trying to get access to those mobile devices, to the SIMs To bypass some of the authentication processes or to leverage the device for authentication. So I think the interesting thing might be, you know, identifying how we authenticate with the amount of information that we have. When we talk about two factor, do we want to send an SMS to a phone, or is there a different way that we can authenticate our customers and consumers? We haven't really seen two much in terms of SIM hijacking and SIM threats. But again, I think the example that we've seen is criminals trying to get access to money by leveraging those multi factor authentication processes. And also to Brad's point, you know, he was asking if we should be holding the telecommunications companies feet to the fire more. A lot of people blame companies like At & t for allowing this sort of stuff to happen. Is there anything that we can- well everybody's held accountable, right? It's about trust. It's about trust. It's about privacy. Several people this morning or this afternoon already mentioned trust. Competition drives that as well. If it's easier for me to change career, if it's easier for me to work with another company and I don't trust you or there's a breach, we've seen examples that consumers will actually move elsewhere. Do we have any other questions in the audience? One right over here. Please introduce yourself. Michael Wrightbut from Florida. Do you see finantial institutions cooperate with each other to prevent attacks together? Because one of the biggest advantages attacker have is they'll do the same thing to a thousand banks, five will hit and they'll just move on, do another thing to a thousand banks. There are a few pretty good information sharing mechanisms that financial institutions use to share information, whether it be indicators of compromise, like a malicious email or a malicious ip that the email is trying to connect to and things like that. There's the FS- ISAC, the Information Sharing and Analysis Center Then you have another one called the AFOsack which was established I think 2016 which was supposed to look at how the main, I think it's like 15 member firms that are including JP Morgan who come together to look at systemic threats to the financial sector. So I would say like, if North Korea didn't wanna just take down JP Morgan but they wanted to take down the entire financial sector We have those mechanisms in place to be able to kind of share that information and to look at it from a holistic viewpoint so that not any one of us are caught off guard. We've got just a minute left. I'm going to ask one final question, which is would either you'd be able to provide our audience with some tips they can take home to secure themselves or their businesses or their employees. To be able to help you defend your firms. And then the second one being that I understanding the geopolitical landscape and how the evolution of threat actors and, and and geopolitics kind of interact together to be able to influence what you see affecting your firm from from a cyber perspective. Yeah and and for us with the data that we've seen, and with some of the incidents and threats and breaches in most cases, the criminals understood and knew the business better than the organization did. So they targeted someone in a small department that's based in the middle of nowhere, but that has high access So I think it's important for all of us to understand our businesses. Who are our people? What do they have access to? Who's responsible for processing payments? Who's responsible for accessing customer data? Based on that insight, we can then implement appropriate controls to protect the data, and to protect, ultimately, our revenue bottom line from, ultimately, getting into the wrong hands. Excellent. Well, that's all we've got time for. I've got to go wire a bunch of money to Eastern Europe. So thank you all for joining us. Thank you. [ APPLAUSE ] [ BLANK_AUDIO ]

Brainstorm Finance 2019: How Financial Institutions Fight Cybercrime

Finance

Today the financial industry faces a diverse array of threats from nation states to cybercriminals. With limited resources and heightened risks, how can financial institutions protect themselves?