congresso crimes eletrônicos, 08/03/2009 - apresentação ghassan dreibi

Collaborate w i th Con f i d en c e

© 2009 Cisco Systems, Inc. All rights reserved. Cisco Conf identia l 1E mp ow ered B ra nch

Ghassan DreibiCisco Security Group

Agenda

Year in Review: 2008 T h reat s & T rend s


Rec o m m end at io ns f o r 2009

T o p C o nc erns

Current Situation

� Collaboration within and between org aniz ations is k ey to the nex t wav e of p rodu c tiv ity g rowth

� T he ag ile and u biq u itou s natu re of S of tware as a S erv ic e m ak es it a k ey enabler of Collaboration

© 2009 Cisco Systems, Inc. All rights reserved. Cisco Conf identia l 3E mp ow ered B ra nch 3

� O rg aniz ations need to s ec u rely harnes s the p ower of S aaS while m aintaining p olic y m anag em ent c ontrol

� Cis c o is ex tending E nterp ris e S ec u rity into the Clou d to enable Collaborativ e ap p lic ations


Y ear i n R ev i ew : 2 0 0 8 T h r eat s & T r ends

C rim inal s p ec ial iz at io n d riving m o re s o p h is t ic at ed at t ac k sW eb ec o s y s t em b ec o m es nu m b er o ne t h reat vec t o r


C rim inal s ex p l o it u s ers t ru s t , c h al l eng ing t rad it io nal s ec u rit y s o l u t io ns

nu m b er o ne t h reat vec t o r

L o s s o f d at a and int el l ec t u al p ro p ert y c l im b ing rap id l y

Different types of Malware Detected (by month) � Rise in Trojans, browser helper objects and spyware – m ore dang erou s and increasing ly clev er social eng ineering v ectors


Web 2.0 Abuse� Commercial tools foraccou n t creation , p ostin g ,CA P T CH A , I P rotation are read ily av ailab le

� T arg ets p op u lar sites an d b log s in clu d in g in clu d in g g mail, Y ah oo! ,M y S p ace an d Craig slist


M y S p ace an d Craig slist� E n ab les ab u se of man yserv ices in clu d in g w eb mailaccou n t creation forsp ammin g

B o t net T r ends

B et t er H id d en, M o re Ref ined , b u t H ard -W o rk ing as E ver


2 0 0 7 : B ig B otn et story w as S torm2 0 0 8 : S torm n ot d ead y et, n ow j oin ed b y K rak en / B ob ax an d A sp rox

R ising Malware B u ilds the B otnet, S teals DataU niq u e S am p l es o f M al ic io u s P ro g ram s


# of Unique Malware Samples in 2006: 972K# of Unique Malware Samples in 2007: 5 . 5 M 5 00% I nc rease in 1 2 Mont h s

N ex t G ener at i o n S p am

� G row in g in sop h isticationT a rg eted B l en d in g em a il a n d w eb

� N ew v ectors, in clu d in g S M S v ish in g

� E x ten siv e u se of


� E x ten siv e u se of social en g in eerin g

S p am b y O r i gi nat i ng C o u nt r y f o r 2 0 0 8


E m p l o y ees E ngage i n R i s k y B eh av i o r i n R egar ds t o C o r p o r at e D at aU n a uth oriz ed a ppl ica tion use: 7 0 % of I T sa y th e use of un a uth oriz ed prog ra m s resul t in a s m a n y a s h a l f of d a ta l oss in cid en ts.M isuse of corpora te com puters: 4 4 % of em pl oyees sh a re w ork d ev ices w ith oth ers w ith out superv ision . U n a uth oriz ed a ccess: 3 9 % of I T sa id th ey h a v e


U n a uth oriz ed a ccess: 3 9 % of I T sa id th ey h a v e d ea l t w ith a n em pl oyee a ccessin g un a uth oriz ed pa rts of a com pa n y’ s n etw ork or f a cil ity. R em ote w ork er security: 4 6 % of em pl oyees to tra n sf er f il es b etw een w ork a n d person a l com puters. M isuse of pa ssw ord s: 1 8 % of em pl oyees sh a re pa ssw ord s w ith co-w ork ers. T h a t ra te j um ps to 2 5 percen t in Ch in a , I n d ia , a n d I ta l y.

I t ’ s T o p C o nc er ns f o r D at a L o s sT op I T c onc ern f or how data is leak ed: 3 3 % of I T s ay U S B driv es are their top c onc ern, and 2 5 % s ay em ail is their # 1 c onc ern.T op I T c onc ern f or data los s : 3 9 % of I T s ay neg lig ent em p loy ees is their top c onc ern f or data los s . 3 0 % of I T s ay hac k ers is their top c onc ern, and 2 0 % s ay the dis g ru ntled

I T ’ s #1 C onc ern O v er H ow C orporat e D at a I s L eak ed or St olen


c onc ern, and 2 0 % s ay the dis g ru ntled em p loy ee is their top c onc ern.U nau thoriz ed u s e and data los s : 5 3 % of I T s ay the u nau thoriz ed u s e of ap p lic ations lead to ¼ of data los s inc idents . T his rate j u m p s to 7 9 % in I ndia and 7 4 % in the U . S .

Source: Cisco-com m ission ed st ud y b y I n sig h t E x p ress, 2 0 0 8

C r i m i n a l s D r i v i n g F a st er , M o r e C o v er t At t a c k s

� H ig h l y t arg et ed and s o p h is t ic at ed

� N ew vec t o rs , inc l u d ing S M S vis h ing

� E x t ens ive u s e o f

Your E q ui t a b l e B a n k

a c c o u n t i s c l o s e d , c a l l us n ow a t

8 0 2 3 5 4 4 2 5 0

Your E q ui t a b l e B a n k

a c c o u n t i s c l o s e d , c a l l us n ow a t

8 0 2 3 5 4 4 2 5 0


� E x t ens ive u s e o f s o c ial eng ineering

P r o du c t i v i t y T ec h no l o gi esO p p o r t u ni t y and V u l ner ab i l i t y

� Corporate network has ex pand ed and i s key pl atf orm f or g rowth

� A l so m ore perm eab l e:R em ote ac c es s


R em ote ac c es sW eb-bas ed toolsM obile dev ic es

� E ssenti al to tod ay ’ s workf orc e

V u lnerability and T hreat C ateg ories for 2 0 0 8


C aix as eletrô nicos sã o alv os de malwares q u e rou bam dados na E u ropa

Por IDG News Service/Reino UnidoPu b l ica da em 0 5 de j u nh o de 2 0 0 9 à s 1 6 h 2 4L ondres - C onsu l t oria descob re a t a q u e u sa ndo m a l wa re q u e reg ist ra da dos do ca rt ã o de cré dit o do cl ient e q u e t ent a sa ca r dinh eiro em ca ix a s el et rô nicos.Ca ix a s el et rô n icos a o red or d o m un d o est ã o h osp ed a n d o m a l w a res q ue p od em col et a r d et a l h es d e ca rt õ es d e cré d it os p a ra uso em f ra ud es, sit ua ç ã o q ue p od e p iora r q ua n t o m a is sof ist ica d o o m a l w a re se t orn a r, seg un d o o g rup o d e p esq uisa Sp id erL a b s d a con sul t oria T rust w a v e.O g rup o t ev e a cesso a um m a l w a re en con t ra d o em ca ix a s el et rô n icos d e um a in st it uiç ã o f in a n ceira n a E urop a , a f irm ou o v ice-p resid en t e d a Sp id erL a b s, A n d rew H en w ood . " É a p rim eira v ez q ue en con t ra m os um a p ra g a d esse t ip o" , a d m it e el e.


O m a l w a re reg ist ra a s in f orm a ç õ es d a t a rj a m a g n é t ica n a p a rt e d e t rá s d o ca rt ã o, a ssim com o seu P I N . O s d a d os p od em ser im p ressos n o rol o d e p a p el d o ca ix a el et rô n ico q ua n d o o ca rt ã o usa d o p a ra con t rol a r a m á q uin a é in serid o. A s in f orm a ç õ es roub a d a s t a m b é m p od em ser reg ist ra d a s n a t a rj a m a g n é t ica d o m esm o ca rt ã o con t rol a d or." F ica m os surp resa s com o n í v el d e sof ist ica ç ã o" , a f irm ou H en w ood . " E ssa d escob ert a n os d eix ou m uit o n erv osos" .A m a ioria d os ca ix a s el et rô n icos rod a sof t w a res d e seg ura n ç a , m a s b a n cos f oca ra m seus in v est im en t os n a seg ura n ç a d e out ros sist em a s, a f irm ou H en w ood ." Ca ix a s el et rô n icos sem p re f ora m con sid era d os b a st a n t e est á v eis" , a f irm ou. " E u d iria q ue n ã o h ouv e f oco suf icien t e n a in f ra -est rut ura d e ca ix a s el et rô n icos a t é a g ora " .O s cra ck ers resp on sá v eis p el o m a l w a re t in h a m b a st a n t e con h ecim en t o sob re a m a n eira com o ca ix a s el et rô n icos f un cion a m , ex p l ica el e. A a m ost ra t est a d a f oi en con t ra d a em ca ix a s rod a n d o o sist em a op era cion a l W in d ow s X P , d a M icrosof t .

M el h o r ex em p l o : D es env o l v i m ent o C o nf i c k er

� N ã o ag en d ad o – 2 3 O u t, fora d o “ M S P atch T u esd ay s”

Có dig o de ex p loraç ã o dis p oní v el� Classificaç ã o Crí tica

A p ó s u m b o l et im d e s eg u ranç a d a M ic ro s o f t ( M S 08-06 7 ) :


� Classificaç ã o Crí tica“Uma vulnerabilidade cuja a ex p lo raç ã o p o de p ermit ir a p ro p ag aç ã o de um w o rm na I nt ernet s em aç ã o do us uá rio . ”

� V u ln erab ilid ad e p ossib ilita ex ecu ç ã o d e có d ig o arb itrá rio com n í v el alto d e p riv ilé g io

� I mp acta os p rin cip ais S . O .

C o nf i c k er – I m p ac t o i ni c i al

2 9 / 1 1 / 0 9 “ M icrosoft n otifica ataq u e sob re W in d ow s”

2 2 / 0 1 / 0 9 “ W orm in fecta M ilh oes d e comp u tad ores ao red or d o mu n d o”

1 3 / 0 2 / 0 9 “ M icrosoft p rocu ra


2 4 / 0 3 / 0 9 “ S em p iad as n o d ia 1 o d e A b ril – N ov o W orm”

3 0 / 0 3 / 0 9 “ Con fick er d eb ate e p rocu ra sob re o criad or”

1 3 / 0 2 / 0 9 “ M icrosoft p rocu ra criad or d o W orm”

1 0 / 0 4 / 0 9 “ Con fick er simu la atu aliz aç ã o“

Aná l i s e S R I C o nf i c k er

� 1 0 . 5 M ilh õ es d e d isp ositiv os in fectad os

� D istrib u iç ã o en tre S O :1 0 , 1 8 9 , 5 5 6 W indows X P1 6 3 , 3 9 5 W indows 2 0 0 0

Cou n try T otal I n fection sCN 2 , 6 4 9 , 6 7 4B R 1 , 0 1 7 , 8 2 5R U 8 3 5 , 9 7 0I N 6 0 7 , 1 7 2A R 5 6 9 , 4 4 5


1 6 3 , 3 9 5 W indows 2 0 0 07 5 , 3 6 1 2 0 0 3 S erv er8 2 , 4 9 5 V is ta1 , 6 3 4 O ther

� U S A sã o # 1 3 , 1 . 8 % tod o total d e má q u in as in fectad as

A R 5 6 9 , 4 4 5T W 4 1 3 , 7 6 2I T 3 7 4 , 5 1 3CL 2 8 0 , 1 8 2U A 2 7 4 , 4 1 1M Y 2 1 2 , 4 7 7K R 2 0 1 , 1 0 7D E 1 9 5 , 9 2 3U S 1 9 1 , 5 3 1

F rom http : / / m tc . s ri. c om / Conf ic k er/

C o nf i c k er ( o u C o nf l ic k er, D o wnad u p , K id o , et c )� P rim eira v ers ã o detec tada 2 1 N ov

2 0 0 8� E x p lora v u lnerabilidade do boletim

M S 0 8 -0 6 7� P rop ag aç ã o tam bé m p or U S B� A té ag ora s ã o 5 v ariantes

identif ic adas ( A -E )


� I nf ec tou de 9 a 1 5 m ilhõ es de c om p u tadores� A lg u ns im p ac tos des as tros os :

• A v iõ es m ilitares f ranc es es p arados p or f alta de p lano de v ô o• S is tem a de j u s tiç a de H ou s ton, E U A p ara de tratar p roblem as m enores• H os p ital em S hef f ield, G B atende ap enas c as os em erg enc iais

� M ic ros of t of erec eu U S $ 2 5 0 . 0 0 0 p or inf orm aç õ es q u e lev em à p ris ã o e c ondenaç ã o de res p ons á v eis p elo worm

identif ic adas ( A -E )F on t e: Con f ick er W ork in g G roup – 1 A b ril 2 0 0 9

B uil d a n d M a in t a in a Secure N et w ork 1 . I n st a l l a n d m a in t a in a f irew a l l con f ig ura t ion t o

p rot ect d a t a 2 . D o n ot use v en d or-sup p l ied d ef a ul t s f or sy st em

p a ssw ord s a n d ot h er securit y p a ra m et ers P rot ect Ca rd h ol d er D a t a 3 . P rot ect st ored d a t a

4 . E n cry p t t ra n sm ission of ca rd h ol d er d a t a a n d sen sit iv e in f orm a t ion a cross p ub l ic n et w ork s

D em andas de M er c ado P C I D at a S ec u r i t y S t andar d


M a in t a in a V ul n era b il it y M a n a g em en t P rog ra m 5 . U se a n d reg ul a rl y up d a t e a n t i-v irus sof t w a re

6 . D ev el op a n d m a in t a in secure sy st em s a n d a p p l ica t ion s

I m p l em en t St ron g A ccess Con t rol M ea sures 7 . R est rict a ccess t o d a t a b y b usin ess n eed -t o-k n ow

8 . A ssig n a un iq ue I D t o ea ch p erson w it h com p ut er a ccess

9 . R est rict p h y sica l a ccess t o ca rd h ol d er d a t a R eg ul a rl y M on it or a n d T est N et w ork s 1 0 . T ra ck a n d m on it or a l l a ccess t o n et w ork resources

a n d ca rd h ol d er d a t a 1 1 . R eg ul a rl y t est securit y sy st em s a n d p rocesses

M a in t a in a n I n f orm a t ion Securit y P ol icy 1 2 . M a in t a in a p ol icy t h a t a d d resses

in f orm a t ion securit y

Collaborate w i th Con f i d en c e


S p eak er N am e 2 0 P TM a rch , 2 0 0 9

Col l ab orati on

C o l l ab o r at i o n/ S ec u r i t y / S aaS


S ec u ri ty S aaS

Networka s th e

P l a tf orm

Col l ab orati onCol l ab orati on

Ci sc o A d d ressi ng thi s M arket wi th Com b i nati on of I nnov ati on and A c q u i si ti on


S ec u ri ty S aaS

Network as the Platform

S aaSS ec u ri ty

Uniq u e C om p et it ive Dif f erent ia t or

A d d res s ing A l l A s p ec ts of Sec urity

S ec u rit y P ro d u c t s St and alone A pplianc es, Unified C lient , and I nt eg rat ed Serv ic e Mod ules

S ec u ring t he I nf rast ru c t u re H ard ened D ev ic es and P SI R T

T eam D ed ic at ed t o R esolv e V ulnerab ilit ies andSec urit y I nc id ent s


P hy sic al S ec u rit ySafet y and Sec urit y T h roug h Sec uring F ac ilit ies; P rot ec t ing

A g ainst D at a T h eft

S ec u rit y S erv ic es I nfrast ruc t ure-b ased , H ost ed ,and A d v anc ed Sec urit y Serv ic es


S AF E S ec u r i t y Ar c h i t ec t u r e S t r at egy

Policy and Device M anag em ent

S ecu rity S olu tion s� P CI� D L P� T h rea t Con t rol

N etw orkD ev ices� R out ers� Serv ers� Sw it ch es

I d en t if y H a rd en

S ecu rity D ev ices� V P N s� M on it orin g

� A d m ission Con t rol� I n t rusion P rev en t ion

� F irew a l l� E m a il F il t erin g


DataC e n te r C am p u s W A N

E d g e B r an c h I n te r n e tE d g e

E c o m m -e r c e

C i s c oV i r tu alO f f i c e

V i r tu alU s e r

P ar tn e rS i te s

I d en t if yM on it or

Correl a t e

H a rd enI sol a t e

E n f orceV is ib ilit y C ont r ol

Secu red M ob il it y , Unif ied C om m u nica t ions, Net work V irt u a l iz a t ion Net work F ou nda t ion Prot ect ion

B read th of B us ines s -E nab l ing Serv ic es

H yb r idA r ch it ect u r e

L ocalA p p liance

A ddressing N eedsC isco S ecu rity S olu tions

© 2009 Cisco Systems, Inc. All rights reserved. Cisco Conf identia l 27E mp ow ered B ra nch 27

I nt eg r at edN et w or k F eat u r e

S er vice


R ec o m m endat i o ns

� S tay focu sed –p rioritiz e strateg ically� A d op t h olistic ap p roach to secu rity - p eop le, p rocess an d tech n olog y

� T h in k b ey on d comp lian ce� U se u n d erstan d ab le lan g u ag e


� U se u n d erstan d ab le lan g u ag e� W e can d o it tog eth er:

I n d ustry/ v en d or col l a b ora tionU ser ed uca tion a n d a w a ren ess

Network World, “ T op 2 0 M ost U sefu l I T S ecu rity S ites”� Cisco S ecu rity Cen ter w w w . cisco. com/ secu rity� S en d erB ase w w w . sen d erb ase. org

F o r M o r e I nf o r m at i o n

T he Ci sc o 2 0 0 8 A nnu al S ec u ri ty R eport


T he Ci sc o 2 0 0 8 A nnu al S ec u ri ty R eport

w w w . cisco. com/ g o/ secu rity rep ort

congresso crimes eletrônicos, 08/03/2009 - apresentação ghassan dreibi

Technology

o n s p

s o p h

t h reat s t

u s ers t ru s t

d b log s

s torm2

s of tware

harnes s