Fatal Attraction

1
Fatal Attraction
Maenard Martinez Sr. Operations Manager for
Asia Pacific
2
Top Ten Cyber Security Threats

• New Faces Behind Cyber Attacks

3
The Digital World
4
Crime is Driving Malware
The Digital Underground
5
The New Era of Threats
Old Era of threats Hacking for fun, fame and
glory Threats are noisy, widespread and
disruptive Remediation action is technical
(remove) Fewer malware/threats variants to
focus onExternal threat focus
New Era of threats Organized and financially
motivated cyber criminals Threats are silent,
highly targeted and steal sensitive
data Remediation more complex, may need to
investigate data leak Overwhelming amount of
malware variants and polymorphic
threats Growing internal threat focus
Source IDC Security Survey 2008
6
Web 2.0 Technologies Bring New Security Risks
Cross-site scripting (XSS)
SQL and XML injections
Directory Traversal
Man-in-the-middle
Session hijacking
Remote file inclusion
ActiveX exploitation
7
The Changing Security Environment

• Web security threats have evolved to reach beyond
  productivity, bandwidth, and liability issues
  URL filtering is no longer enough
• The practice of hackers planting malicious code
  on legitimate Web sites is quickly becoming the
  norm
• Web 2.0 also presents a significant data leakage
  challenge. Message boards, blogs, and social
  networking sites risk becoming a pipeline for
  data leakage and privacy and compliance
  violations
• Web application vulnerability assessment, Web
  application firewalls and other Web security
  solutions will be critical

8
The Philippines is not immune!
9
Top IT Security Threats in 2008
What is the greatest security threat that your
company will face over the next 12 months?
Top 2 boxes (rating of 4 or 5) N 211
Source IDC Security Survey 2008
10
Malware Attacks
Blackhat SEO Leads to FAKEAV Programs
11
Web Compromise
Hacked Websites
12
Phishing

• Phishing Websites

• Email Sample

13
Number of Recorded Phishing Sites in .PH domain
Compromised/hacked websites and websites with
malicious programs in .ph domain 12,000 URLs
14
Data Intrusion/Hacking
have hacked into computers of at least three
government offices in the Philippines
15
A Cyber Infrastructure is only as strong as its
weakest link
Businesses spend a significant portion of their
annual information technology budgets on
high-tech computer security. But the firewalls,
vaults, bunkers, locks and biometrics those
dollars buy can be pierced by attackers targeting
untrained, uninformed or unmonitored users.
-- Journal of Accountancy, 2007
16
(No Transcript)
17
What can you do?
18
Complexity of Security Biggest Challenge
Biggest IT Security Challenges
Managing complexity of security grew from 49 to
62 in just one year!
19
Security Investment Drivers
Source IDC Australia 2008
20
Infrastructure

• Holistic solution
• Real-Time Protection continuous protection to
  users through in-the-cloud and multi-vector
  correlation technologies.
• Reputation Services covers all possible threat
  vectors, assigns a reputation to a domain, I.P.,
  email, file, etc. based on known or associated
  activities

21
People

• Turning employees into security assetsA
  majority of data leaks happen from within, either
  by accident or on purpose by valid users who have
  access to the data within a corporate network. A
  company's greatest asset their employees can
  also be their greatest security liability.
• It is an important part of your company security
  to educate staff about how to protect themselves
  and their computers to safeguard your companys
  assets. However, implementing security measures
  is one thing verifying that they are properly in
  place and effective on an ongoing basis is
  another.

22
Global Best Practices and Industry Standards

• COSO
• Cobit
• ITIL
• ISO

23
Key Takeaways

• New technologies and mobility introduce new
  security complexities
• The Web is a growing threat vector
• Internal threats and data leakage are growing
  concerns
• Security solutions focus on regulatory and
  internal policy compliance enforcement
• Security technologies continue to improve but
  continue to be challenged
• Prepare for Mobile access, Web 2.0 applications,
  Cloud Computing, Social networks, Virtualization
  and other interactive technologies.