A brief overview of the cyber crime phenomenon, the internet threat landscape, lessons learned and what we can do about it.

1. New challenges in Data privacy.
Zdravko Stoychev, CISM CRISC
Information Security Officer
Alpha Bank Bulgaria branch
South East European Regional Forum on Cybersecurity
and Cybercrime, 2013
11-13 Nov 2013
Sofia
1

2. CYBERCRIME FORUM
Alpha Bank
 Founded in 1879.
 The Bank grew considerably in the last decades,
developed into a major Group offering a wide range of
financial services.
 In 1999 the bank acquired 51% of the shares of the
Ionian Bank. The name of the enlarged, new Bank,
resulting from this merger is ALPHA BANK.
 On February 1, 2013 the entire share capital of
Emporiki Bank S.A. has been transferred to ALPHA
BANK.
 ALPHA BANK is one of the largest banks in Greece.
The Bank's activities cover the entire range of
financial services.
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
2

3. CYBERCRIME FORUM
Agenda
 Current landscape


Trends & Statistics
The Internet Security
 Posed challenge



Fighting Cybercrime
Home vs. Enterprise
Global vs. Country
 Lessons Learned


Factors That Contribute
What Can We Do
 Summary
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
3

4. CYBERCRIME FORUM
Threat Landscape
Internet – a global shared domain
“The scale of DDoS attacks continue to expand”
“Web sites of security companies hacked by Anonymous”
“The damage done by cybercrime increased by 50%”
“Barely 4% of (UK) companies trust their IT security”
“The yearly average cybercrime cost per company in USA
increased by 78% in the past 4 years”
“The goals under attacks of this week [Dec 2012]:
U.S. Bancorp, JPMorgan Chase&co, Bank of America, PNC
Financial Services Group, SunTrust Banks, Inc.”
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
4

5. CYBERCRIME FORUM
Down to Rabbit-Hole
The DDoS attacks achieved traffic per second
60%
50%
40%
30%
2013
2012
20%
10%
0%
~1Gb
2-10Gb
Source: Arbor Networks
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
5

6. CYBERCRIME FORUM
Down to Rabbit-Hole
 Attacks with duration under a hour:
87%
 Average time to mitigate the attack is on:
130% increase
 Less victims reported but the cost is on:
50% increase
where
 BYOD users constantly online:
49%
 Smartphones and tables w/o unlock PIN:
48%
Source: Arbor Networks , Ponemon Institute, Symantec
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
6

7. CYBERCRIME FORUM
Internet Security Threats
Cyber threats and Internet attacks are difficult to characterize and
respond to for a number of reasons:
 There are many different malicious actors.
 These actors have many different motives.
 The attacks look similar, so the nature of the attack does not always
help to identify the actor and the motive.
 Incident Handling Team will be required in place to manage the
attacks on per case basis.
 The speed of attack may overwhelm response methods that require
human interaction.
 The potential consequences of an attack can be hard to predict.
 The worst-case scenarios are alarming.
Source: Collective Defense Applying Public Health Models to the Internet
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
7

8. CYBERCRIME FORUM
The Posed Challenge
 Cyber crime is a fast-emerging threat and cyber attacks are being
recognised as a threat to national security.
 The most commonly reported crime is the theft of financial login
credentials, i.e. Web and mobile banking.
 The biggest and most common motivation is the financial gain.
 It drives a range of criminal activities, including phishing, pharming,
malware distribution and the hacking of corporate databases.
 Cyber crime is a truly global criminal phenomenon which does not
respond to single jurisdiction approaches to policing.
 Cyber crime is forcing us to rethink the basic skills needed for the job,
i.e. we need more Forensic Investigation specialists.
 Organisations need to assess the likelihood of being the target and
then defend against the techniques the most commonly use.
Source: Infosecurity Europe 2013, Global Economic Symposium
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
8

9. CYBERCRIME FORUM
Home and Enterprise Threats
Source: Microsoft
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
9

10. CYBERCRIME FORUM
Lowest Infection Rates Trends
Source: Microsoft
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
10

11. CYBERCRIME FORUM
Where Are We as a Country
Source: Microsoft
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
11

12. CYBERCRIME FORUM
Lessons from Least Infected Countries/regions
Factors that contribute to consistently low infection rates:
 Strong public–private partnerships exist that enable proactive and
response capabilities.
 Computer emergency response teams (CERTs), Internet service providers
(ISPs), and others who actively monitor for threats enable rapid response
to emerging threats.
 Enforcement policies and active remediation of threats via quarantining
infected systems on networks in the country/region is effective.
 An IT culture in which system administrators respond rapidly to reports of
system infections or abuse is helpful.
 Educational campaigns and media attention that help improve the public’s
awareness of security issues can pay dividends.
 Low software piracy rates and widespread usage of OS Update/Update
has helped keep infection rates relatively low.
Source: Microsoft
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
12

13. CYBERCRIME FORUM
What Can We Do About It
 Deploy security in multiple layers
 Collaborate with CERTs, ISPs and others
 Seek public–private partnerships
 Ensure enforcement of security policies
 Run corporate educational programs
 Raise public’s awareness of security issues
 Well-known security tools may be outdated
 Utilize security analysis on network-level
e.g. BigData processing for trends detection, etc.
Source: Arbor Networks, Ponemon Institute
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
13

14. CYBERCRIME FORUM
Summary
 The threat landscape continues to become more complex and
mixes various threats to increase the likelihood of success.
 Awareness can secure humans by changing behaviors.
 Re-tool and incorporate next-generation technology.
 Collaboration, public-private relationships, early-warning
systems and real-time knowledge are needed.
 Security, thus data privacy, is everybody`s business.
South East European Regional Forum on Cybersecurity and Cybercrime, 2013
14

15. Questions?
Thank you!
Zdravko Stoychev, CISM CRISC
Company Information Security Officer
Alpha Bank Bulgaria branch
Email: zstoychev@alphabank.bg
Twitter: @zdravkos
15