SlideShare ist ein Scribd-Unternehmen logo
1 von 28
Downloaden Sie, um offline zu lesen
THE LECTURERS

 Fabio Ghioni

Roberto Preatoni
Corp Vs Corp:
Industrial Espionage
   and Cyberwars
INDEX
1)
 Introduction: old and new threats after September 11th
2)
 Industrial Espionage: state-sponsored espionage
3)
 Cyber defense methodology: from digital identification of
    attacker to counterattack strategy
4)
 Cyber counterattacks: information leakage, Injected
    Interception
In the aftermath of September 11th, security issues came into the
limelight… everybody focalized their attention on increasing anti-terrorist
measures and countering the increasing number of hacker attacks to
business and government networks…
… but hardly anyone has ever mentioned a more insidious and
widespread criminal activity: INDUSTRIAL ESPIONAGE




                      WHY ?
Companies are often reluctant to publicly admit that they have been
 victims of industrial espionage for two main reasons:
•it implicitly means that THERE WAS SOME KIND OF VULNERABILITY to
 be exploited
•it implies the unveiling of MORE CONFIDENTIAL lines of business
WHAT exactly is INDUSTRIAL ESPIONAGE?


The illegal acquisition of intellectual property and trade secrets, in other
words THEFT!
The techniques to steal information from outside a company range from the
traditional eavesdropping to social engineering tactics…
The FBI generally defines economic espionage as
“government-directed,       sponsored,    or     coordinated
intelligence activity, which may or may not constitute
violations of law, conducted for the purpose of enhancing
that     country’s   or    another    country’s    economic
competitiveness by the use of the information by foreign
government or by providing it to foreign private business
entity thereby giving that entity a competitive advantage in
the marketplace,...”
Since the 1990s Western Intelligence Agencies appear to have
focused most of their time and resources on industrial espionage
In most countries corporations rely on Government Agencies to carry
out investigations whose results can be used to boost the National
economy…
France, the United States and Israeli have often been accused to
spying on competitors’ industrial secrets through scanning systems
such as Echelon or the Helios 1A satellite up until the more recent
Carnivore software
Conversely, the INDUSTRIAL INTELLIGENCE process consists of
researching information on public source documents in order to
draw inferences about what competitors might be going to do and
provide the basis for possible counteraction
Situational Awareness is the key word…
The classic Intelligence Cycle




Source: Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies
       http://www.cops.usdoj.gov/mime/open.pdf?Item=1396
". . . attaining one hundred victories in one hundred battles is not the pinnacle of
excellence.
Subjugating the enemy's army without fighting is the true pinnacle of
excellence."
Sun Tzu, The Art of War
"There are but two powers in the world, the sword and the mind. In the long run
the sword is always beaten by the mind."
Napoleon Bonaparte
Nevertheless, there is sometimes a fine line between the legitimate
tactics of competitive intelligence gathering and the illegitimate
practice of industrial espionage…
Information may be obtained through the use of unethical but legal
techniques, such as social engineering or the exploitation of
competitors’ errors or negligence (e.g. e-mail hijacking)
Today, indeed, companies can rely on cyber-based techniques and methodologies
to react to attacks coming from the real world…

The Internet and the Web have dramatically impacted the classic intelligence cycle

More information is migrating to the Web as companies use it to automate their
value chain and build tight linkages with their business parties
THE ATTACKS
Distributed Denial Of Service
•Set up of botnets or drones instructed to perform synchronized attacks
Information leakage and data manipulation
•Intranet access due to loose access policies
•Weak corporate applications
•Exploitation of insiders
CASE STUDIES 1/4


T-Mobile
• At the end of 2003 a hacker got access to the T-mobile users’ accounts and stole
 private material from jet-set users as well as a C.I.A. document located on a T-
 Mobile transit e-mail account belonging to a C.I.A. agent. The hacker exploited a
 Bea Weblogic interface flaw.
CASE STUDIES 2/4


Skynet 1.0
• A new application of Artificial Intelligence
• Set up of intelligent networked agents
• Underground work is in progress
CASE STUDIES 3/4


Israel Trojan Horse
• In 2005 Israel was put in a difficult situation by an industrial espionage scandal
 involving several corporation and dozens of people.
• Once again data were stolen using a trojan and social engineering.
• Trojan-based attacks are growing rapidly and are considered as among the most
 important security risks for today’s corporations.
CASE STUDIES 4/4


Chinese Trojan Attacks
• Several American corporations got compromised in the last year by trojan attacks
 perpetrated by chinese citizens, according to the attacks' logs.
• Myfip, the trojan used for most of the attacks appeared to be one of the most
 sophisticated ever and one of its peculiarity was that it tried to steal also CAD/CAM files,
 usually related to engineering design works.
• According to an IBM report, in the first half of 2005, 'customized‘ attacks against
 governments, corporations and financial institutions jumped to 50 per cent.
THE DEFENSE METHODOLOGY 1/2
Digital Identification of the Attacker
•Understanding the originating path
•“Digital fingerprinting” and pre-analysis of the attack methodology
Passive Observation and Tracking
•Logging the identified activity
•Spotting the attacker
THE DEFENSE METHODOLOGY 2/2
Active Honeypots and Honeynets
Situational Awareness
•Case mapping
Definition of Counterattack Strategy
•Resource selection and allocation
•Definition of timing, effort and techniques
CYBER COUNTERATTACKS
An example…
Injected Interception
•allows to trace the IP address of a target and gain direct access to all data
contained on the computer no matter what is the means of data transport (i.e.
physical or digital)
The security management learning model

                                               Technology                     Methods
    Tools




                                                                Resources


                         Prevention/intelligence        Incident Management Emergency/crisis management
    Security processes




                          Policy and       Tools         Detection        Handling         Contrast   Recovery
                          procedures



                         Risk analysis   Assessment      Planning           Analysis       Planning   Analysis
    collection and




                                                   Feed back                         Feed back
      Feed-back




                                                               Learning
       analysis




                                                         Common Knowledge Base




                                                                Security KPI
                                                     (Need to identify threshold values)
Questions?                          ¿Preguntas?
                        English                 Spanish




‫ﺃَﻳﱠﺔ ﻣَﻄَﺎﻟِﺐ‬               Domande? вопросы?            Russian
                                  Italian
     Arabic




                          Ερωτήσεις?
                                  Greek




tupoQghachmey Klingon                              Japanese

Weitere ähnliche Inhalte

Was ist angesagt?

AI for CyberSecurity
AI for CyberSecurityAI for CyberSecurity
AI for CyberSecurity
Satnam Singh
 
3 f6 security
3 f6 security3 f6 security
3 f6 security
op205
 
Francesca Bosco, Le nuove sfide della cyber security
Francesca Bosco, Le nuove sfide della cyber securityFrancesca Bosco, Le nuove sfide della cyber security
Francesca Bosco, Le nuove sfide della cyber security
Andrea Rossetti
 
Creating cyber forensic readiness in your organisation
Creating cyber forensic readiness in your organisationCreating cyber forensic readiness in your organisation
Creating cyber forensic readiness in your organisation
Jacqueline Fick
 

Was ist angesagt? (20)

Internet of things, New Challenges in Cyber Crime
Internet of things, New Challenges in Cyber CrimeInternet of things, New Challenges in Cyber Crime
Internet of things, New Challenges in Cyber Crime
 
CYBER AWARENESS
CYBER AWARENESSCYBER AWARENESS
CYBER AWARENESS
 
AI for CyberSecurity
AI for CyberSecurityAI for CyberSecurity
AI for CyberSecurity
 
Incident handling of cyber espionage
Incident handling of cyber espionageIncident handling of cyber espionage
Incident handling of cyber espionage
 
Info sec 12 v1 2
Info sec 12 v1 2Info sec 12 v1 2
Info sec 12 v1 2
 
Cyber Forensics & Challenges
Cyber Forensics & ChallengesCyber Forensics & Challenges
Cyber Forensics & Challenges
 
Cyber Security in 2018
Cyber Security in 2018Cyber Security in 2018
Cyber Security in 2018
 
Cyber Security and the National Central Banks
Cyber Security and the National Central BanksCyber Security and the National Central Banks
Cyber Security and the National Central Banks
 
Cyber of things 2.0
Cyber of things 2.0Cyber of things 2.0
Cyber of things 2.0
 
Cehv6 module 01 introduction to ethical hacking
Cehv6 module 01 introduction to ethical hackingCehv6 module 01 introduction to ethical hacking
Cehv6 module 01 introduction to ethical hacking
 
Cyberwarfare
CyberwarfareCyberwarfare
Cyberwarfare
 
Cybersecurity - Sam Maccherola
Cybersecurity - Sam MaccherolaCybersecurity - Sam Maccherola
Cybersecurity - Sam Maccherola
 
3 f6 security
3 f6 security3 f6 security
3 f6 security
 
Francesca Bosco, Le nuove sfide della cyber security
Francesca Bosco, Le nuove sfide della cyber securityFrancesca Bosco, Le nuove sfide della cyber security
Francesca Bosco, Le nuove sfide della cyber security
 
Cyber Influence Operations
Cyber Influence OperationsCyber Influence Operations
Cyber Influence Operations
 
Social Engineering | #ARMSec2015
Social Engineering | #ARMSec2015Social Engineering | #ARMSec2015
Social Engineering | #ARMSec2015
 
Internet safety and security strategies for building an internet safety wall
Internet safety and security strategies for building an internet safety wallInternet safety and security strategies for building an internet safety wall
Internet safety and security strategies for building an internet safety wall
 
Cyber crime trends in 2013
Cyber crime trends in 2013 Cyber crime trends in 2013
Cyber crime trends in 2013
 
Social engineering tales
Social engineering tales Social engineering tales
Social engineering tales
 
Creating cyber forensic readiness in your organisation
Creating cyber forensic readiness in your organisationCreating cyber forensic readiness in your organisation
Creating cyber forensic readiness in your organisation
 

Ähnlich wie Fabio Ghioni

Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
ssuser4237d4
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
ssuser4237d4
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidente
Damir Delija
 

Ähnlich wie Fabio Ghioni (20)

GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
GDG Cloud Southlake #4 Biodun Awojobi and Wade Walters Security Programs and ...
 
Digital Forensics for Artificial Intelligence (AI ) Systems.pdf
Digital Forensics for Artificial Intelligence (AI ) Systems.pdfDigital Forensics for Artificial Intelligence (AI ) Systems.pdf
Digital Forensics for Artificial Intelligence (AI ) Systems.pdf
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
Cyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdfCyber Threat Hunting Workshop.pdf
Cyber Threat Hunting Workshop.pdf
 
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
UMS Cybersecurity Awareness Seminar: Cybersecurity - Lessons learned from sec...
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Road map for actionable threat intelligence
Road map for actionable threat intelligenceRoad map for actionable threat intelligence
Road map for actionable threat intelligence
 
CLASS 2018 - Palestra de Denis Prado (Security Intelligence Sales Leader Lati...
CLASS 2018 - Palestra de Denis Prado (Security Intelligence Sales Leader Lati...CLASS 2018 - Palestra de Denis Prado (Security Intelligence Sales Leader Lati...
CLASS 2018 - Palestra de Denis Prado (Security Intelligence Sales Leader Lati...
 
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
Bug Bounties, Ransomware, and Other Cyber Hype for Legal CounselBug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
 
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
Bug Bounties, Ransomware, and Other Cyber Hype for Legal CounselBug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
Bug Bounties, Ransomware, and Other Cyber Hype for Legal Counsel
 
MCCA Global TEC Forum - Bug Bounties, Ransomware, and Other Cyber Hype for Le...
MCCA Global TEC Forum - Bug Bounties, Ransomware, and Other Cyber Hype for Le...MCCA Global TEC Forum - Bug Bounties, Ransomware, and Other Cyber Hype for Le...
MCCA Global TEC Forum - Bug Bounties, Ransomware, and Other Cyber Hype for Le...
 
Cyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fickCyber forensic readiness cybercon2012 adv j fick
Cyber forensic readiness cybercon2012 adv j fick
 
The Hacker Playbook: How to Think like a Cybercriminal to Reduce Risk
The Hacker Playbook: How to Think like a Cybercriminal to Reduce RiskThe Hacker Playbook: How to Think like a Cybercriminal to Reduce Risk
The Hacker Playbook: How to Think like a Cybercriminal to Reduce Risk
 
IBM Cyber Threat Analysis
IBM Cyber Threat AnalysisIBM Cyber Threat Analysis
IBM Cyber Threat Analysis
 
Računalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidenteRačunalna forenzika i automatizirani odgovor na mrežne incidente
Računalna forenzika i automatizirani odgovor na mrežne incidente
 
Cyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APTCyber Defense - How to be prepared to APT
Cyber Defense - How to be prepared to APT
 
Cyber security with ai
Cyber security with aiCyber security with ai
Cyber security with ai
 
Cyber Threat Intelligence
Cyber Threat IntelligenceCyber Threat Intelligence
Cyber Threat Intelligence
 
2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA2016 ISSA Conference Threat Intelligence Keynote philA
2016 ISSA Conference Threat Intelligence Keynote philA
 
Case Study.pdf
Case Study.pdfCase Study.pdf
Case Study.pdf
 

Mehr von Fabio Ghioni

Fabio Ghioni, Roberto Preatoni The Biggest Brother
Fabio Ghioni, Roberto Preatoni   The Biggest BrotherFabio Ghioni, Roberto Preatoni   The Biggest Brother
Fabio Ghioni, Roberto Preatoni The Biggest Brother
Fabio Ghioni
 

Mehr von Fabio Ghioni (7)

Fabio Ghioni Hero Z Private Investigation
Fabio Ghioni Hero Z Private InvestigationFabio Ghioni Hero Z Private Investigation
Fabio Ghioni Hero Z Private Investigation
 
Fabio Ghioni Intervista Andromeda
Fabio Ghioni Intervista AndromedaFabio Ghioni Intervista Andromeda
Fabio Ghioni Intervista Andromeda
 
Fabio Ghioni Hero Z Private Investigations
Fabio Ghioni Hero Z Private InvestigationsFabio Ghioni Hero Z Private Investigations
Fabio Ghioni Hero Z Private Investigations
 
Fabio Ghioni La Nona Emanazione
Fabio Ghioni La Nona EmanazioneFabio Ghioni La Nona Emanazione
Fabio Ghioni La Nona Emanazione
 
Fabio Ghioni - Preatoni Ombre asimmetriche. La guerra cibernetica ei suoi pro...
Fabio Ghioni - Preatoni Ombre asimmetriche. La guerra cibernetica ei suoi pro...Fabio Ghioni - Preatoni Ombre asimmetriche. La guerra cibernetica ei suoi pro...
Fabio Ghioni - Preatoni Ombre asimmetriche. La guerra cibernetica ei suoi pro...
 
Fabio Ghioni Asymmetric Warfare and Interception revealed
Fabio Ghioni Asymmetric Warfare and Interception revealedFabio Ghioni Asymmetric Warfare and Interception revealed
Fabio Ghioni Asymmetric Warfare and Interception revealed
 
Fabio Ghioni, Roberto Preatoni The Biggest Brother
Fabio Ghioni, Roberto Preatoni   The Biggest BrotherFabio Ghioni, Roberto Preatoni   The Biggest Brother
Fabio Ghioni, Roberto Preatoni The Biggest Brother
 

Kürzlich hochgeladen

Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
WSO2
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 

Kürzlich hochgeladen (20)

Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUKSpring Boot vs Quarkus the ultimate battle - DevoxxUK
Spring Boot vs Quarkus the ultimate battle - DevoxxUK
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Architecting Cloud Native Applications
Architecting Cloud Native ApplicationsArchitecting Cloud Native Applications
Architecting Cloud Native Applications
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Corporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptxCorporate and higher education May webinar.pptx
Corporate and higher education May webinar.pptx
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
Exploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with MilvusExploring Multimodal Embeddings with Milvus
Exploring Multimodal Embeddings with Milvus
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost SavingRepurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
Repurposing LNG terminals for Hydrogen Ammonia: Feasibility and Cost Saving
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 

Fabio Ghioni

  • 1. THE LECTURERS Fabio Ghioni Roberto Preatoni
  • 2.
  • 3. Corp Vs Corp: Industrial Espionage and Cyberwars
  • 4.
  • 5. INDEX 1) Introduction: old and new threats after September 11th 2) Industrial Espionage: state-sponsored espionage 3) Cyber defense methodology: from digital identification of attacker to counterattack strategy 4) Cyber counterattacks: information leakage, Injected Interception
  • 6. In the aftermath of September 11th, security issues came into the limelight… everybody focalized their attention on increasing anti-terrorist measures and countering the increasing number of hacker attacks to business and government networks…
  • 7. … but hardly anyone has ever mentioned a more insidious and widespread criminal activity: INDUSTRIAL ESPIONAGE WHY ?
  • 8. Companies are often reluctant to publicly admit that they have been victims of industrial espionage for two main reasons: •it implicitly means that THERE WAS SOME KIND OF VULNERABILITY to be exploited •it implies the unveiling of MORE CONFIDENTIAL lines of business
  • 9. WHAT exactly is INDUSTRIAL ESPIONAGE? The illegal acquisition of intellectual property and trade secrets, in other words THEFT! The techniques to steal information from outside a company range from the traditional eavesdropping to social engineering tactics…
  • 10. The FBI generally defines economic espionage as “government-directed, sponsored, or coordinated intelligence activity, which may or may not constitute violations of law, conducted for the purpose of enhancing that country’s or another country’s economic competitiveness by the use of the information by foreign government or by providing it to foreign private business entity thereby giving that entity a competitive advantage in the marketplace,...”
  • 11. Since the 1990s Western Intelligence Agencies appear to have focused most of their time and resources on industrial espionage In most countries corporations rely on Government Agencies to carry out investigations whose results can be used to boost the National economy… France, the United States and Israeli have often been accused to spying on competitors’ industrial secrets through scanning systems such as Echelon or the Helios 1A satellite up until the more recent Carnivore software
  • 12. Conversely, the INDUSTRIAL INTELLIGENCE process consists of researching information on public source documents in order to draw inferences about what competitors might be going to do and provide the basis for possible counteraction
  • 13. Situational Awareness is the key word…
  • 14. The classic Intelligence Cycle Source: Law Enforcement Intelligence: A Guide for State, Local, and Tribal Law Enforcement Agencies http://www.cops.usdoj.gov/mime/open.pdf?Item=1396
  • 15. ". . . attaining one hundred victories in one hundred battles is not the pinnacle of excellence. Subjugating the enemy's army without fighting is the true pinnacle of excellence." Sun Tzu, The Art of War "There are but two powers in the world, the sword and the mind. In the long run the sword is always beaten by the mind." Napoleon Bonaparte
  • 16. Nevertheless, there is sometimes a fine line between the legitimate tactics of competitive intelligence gathering and the illegitimate practice of industrial espionage…
  • 17. Information may be obtained through the use of unethical but legal techniques, such as social engineering or the exploitation of competitors’ errors or negligence (e.g. e-mail hijacking)
  • 18. Today, indeed, companies can rely on cyber-based techniques and methodologies to react to attacks coming from the real world… The Internet and the Web have dramatically impacted the classic intelligence cycle More information is migrating to the Web as companies use it to automate their value chain and build tight linkages with their business parties
  • 19. THE ATTACKS Distributed Denial Of Service •Set up of botnets or drones instructed to perform synchronized attacks Information leakage and data manipulation •Intranet access due to loose access policies •Weak corporate applications •Exploitation of insiders
  • 20. CASE STUDIES 1/4 T-Mobile • At the end of 2003 a hacker got access to the T-mobile users’ accounts and stole private material from jet-set users as well as a C.I.A. document located on a T- Mobile transit e-mail account belonging to a C.I.A. agent. The hacker exploited a Bea Weblogic interface flaw.
  • 21. CASE STUDIES 2/4 Skynet 1.0 • A new application of Artificial Intelligence • Set up of intelligent networked agents • Underground work is in progress
  • 22. CASE STUDIES 3/4 Israel Trojan Horse • In 2005 Israel was put in a difficult situation by an industrial espionage scandal involving several corporation and dozens of people. • Once again data were stolen using a trojan and social engineering. • Trojan-based attacks are growing rapidly and are considered as among the most important security risks for today’s corporations.
  • 23. CASE STUDIES 4/4 Chinese Trojan Attacks • Several American corporations got compromised in the last year by trojan attacks perpetrated by chinese citizens, according to the attacks' logs. • Myfip, the trojan used for most of the attacks appeared to be one of the most sophisticated ever and one of its peculiarity was that it tried to steal also CAD/CAM files, usually related to engineering design works. • According to an IBM report, in the first half of 2005, 'customized‘ attacks against governments, corporations and financial institutions jumped to 50 per cent.
  • 24. THE DEFENSE METHODOLOGY 1/2 Digital Identification of the Attacker •Understanding the originating path •“Digital fingerprinting” and pre-analysis of the attack methodology Passive Observation and Tracking •Logging the identified activity •Spotting the attacker
  • 25. THE DEFENSE METHODOLOGY 2/2 Active Honeypots and Honeynets Situational Awareness •Case mapping Definition of Counterattack Strategy •Resource selection and allocation •Definition of timing, effort and techniques
  • 26. CYBER COUNTERATTACKS An example… Injected Interception •allows to trace the IP address of a target and gain direct access to all data contained on the computer no matter what is the means of data transport (i.e. physical or digital)
  • 27. The security management learning model Technology Methods Tools Resources Prevention/intelligence Incident Management Emergency/crisis management Security processes Policy and Tools Detection Handling Contrast Recovery procedures Risk analysis Assessment Planning Analysis Planning Analysis collection and Feed back Feed back Feed-back Learning analysis Common Knowledge Base Security KPI (Need to identify threshold values)
  • 28. Questions? ¿Preguntas? English Spanish ‫ﺃَﻳﱠﺔ ﻣَﻄَﺎﻟِﺐ‬ Domande? вопросы? Russian Italian Arabic Ερωτήσεις? Greek tupoQghachmey Klingon Japanese