Cyber Security Threats

1
Cyber Security Threats

• CS 4235
• Group 7
• Luke Simpson
• Sandhya Sivaramakrishnan
• Steven Studniarz
• Matthew Winters
• John Yen
• Evan Zasoski

2
Todays Enterprise Security Threats

• Web-borne E-mail borne Threats
• Always-on network and remote connectivity
• Visiting insecure WebPages
• Opening infected email attachments
• Application vulnerability (Only Firewalls dont
  help)
• IDS not extensively used
• Very low application layer security
• Corporate Espionage
• Spy ware versions not far behind
• Phishing
• Corporate identity spoofing
• Fraudulent messages from seemingly legitimate
  businesses for purposes of identity theft

3
Some Statistics

• Only 47 of IT executives surveyed said they used
  firewall software at home
• Only 38 of IT professionals said that they were
  very confident in their enterprise security
• The highest confidence rate from IT executives
  for security is in the banking industry at 79
• Only 25 of organizations surveyed have insurance
  against cyber security risks
• Only 20 of organizations surveyed report
  computer intrusions to law enforcement
• The leading dollar amount of losses from security
  risk comes from viruses

4
Organizational Role vs. Awareness

• Approximately 33 of those surveyed were in a
  high profile role (CEO, CIO, CSO, CISO) within
  their organization
• 28 of respondents unsure if incidents occurred
• 35 unsure of external incidents
• 44 unsure of internal incidents
• Highest percentages in past 4 years
• 15 not sure of budget spent on security
• Alarming percentages of uncertainty
• Are the high profile positions uninformed or do
  they simply choose to ignore the very real
  threats?

5
Why do breaches go unreported to law enforcement?

• Negative publicity would hurt public image or
  stock price 43
• Competitors would use to their advantage 33
• Civil remedies seemed best 16
• Unaware of law enforcement interest - 16
• Patch security hole 73
• Share information 63
• Report to law enforcement 20
• Report to legal counsel - 12

Responses to security breaches
6
Cyber Insurance

• Breaches/downtime/fraud all cost companies huge
  dollars
• Hard for insurers to determine value of data and
  risk/losses
• Sometimes you cant put a price tag on data
• Insurance is still expensive - Polices start at
  20K per 1M per year
• Theres no such thing as complete security
• Not a substitution for good security