Overview of
Cyber Threats & Risks
Dr Ram Kumar G, PhD, CISM, CRISC, PMP Topic 2
Cyber Security & Risk Leader
Overview 60 mins
• Changing Attacker Profiles
• Data Leakage Threat Vectors
• Multiple Levels of Security Controls
• Key Attack Vectors
• Risky Actions
• New Threat Vectors
• Knowledge Check
• Appendix
2
3
4
Types of Risk and Threats for Information Security
1. Human factors – specific actions violating security rules
2. Technology factors – security devices and controls
3. Environmental factors – compliance and legal issues
4. Business process factors – reputation, employee competencies,
prevailing culture and extent of information security alignment
(McFadzean et al., 2007).
5
The Growing Cyber-Attack Surface
6
7 V&A Source: The Threat Lifecycle Management Framework, Log Rhythm
8
Data Leakage Vectors
1.Email
• Outbound Emails
• Unencrypted PII mails
• Outlook Web Access
9.Out of View Sensitive 2.Internet
Data • File Sharing Websites
• Inability to locate and • Send out data using
protect sensitive data personal email IDs
3.Mobile Devices
8.Hardcopy Documents • Loss/Theft of Device
• Personal phones with email
• Ability to print sync
sensitive data & take • Laptops with sensitive data in
home
Data Leakage
hard disk
• Not following Clear • .pst file in local hard disk
• Unrestricted Internet Access
Desk Policy outside company network
Vectors • USB port access
7.Ineffective Controls 4.Poor Access Controls
• No data masking of NPI • Access to sensitive data
• Wrongly configured by unauthorized users
devices/settings • Unauthorized access to
• No vulnerability scans & fixes
Shared Folders
• No periodic technology risk
• Access to NPI by
assessments (configuration
reviews) Privileged Users
• Poor exception management 5.Remote Users • No periodic user access
processes reviews
• No end point controls
• No VPN authentication to
6.Third Party Vendors
access Company network
• Access to sensitive • No 2-Factor
data – processing / authentication to access
storing Company network
• Unrestricted Internet
Access outside company
network
9
Data Loss Risks
10
11
12
13
Key Threats
14
15
16
17
18
19
Business Risks
20
Malware Threats
21
Information Security Threats
22
23
New Threat Vectors
24
New Threat Vectors
25
Risky Actions
26
27
Insider Threat Impacts
28
29
30
31
32
33
34
35
Relatively high-likelihood, high-impact threats
36
Relatively low-likelihood, high-impact threats
37
Relatively high-likelihood, low-impact threats
38
39
40
41
42
43
Multiple Levels of Security Controls
44
45
Knowledge Check
• No scoring
46
Knowledge Check (1/5)
• What are the attack vectors for Data?
A.Email, Internet and Mobile Devices
B.Poor access controls, Third Party Vendors, Remote Users
C.Ineffective Controls, sensitive hardcopy documents
D. All of the above
47
Knowledge Check (2/5)
• What are the components of key attack vectors?
A. Poor Security Governance Management
B. Insider Threats, Botnets, Malware
C. Hacktivism, Unpatched software, dated Anti-virus software
D. Both B and C
48
Knowledge Check (3/5)
• A hacked PC can be used for:
A. Credential harvesting
B. Launching Botnet attacks
C. Data Theft
D. All of the above
49
Knowledge Check (4/5)
• Which of the following constitute Risky Actions by employees?
A. Leaving Computers unattended especially outside work
B. Accessing Internet via Insecure WiFi
C. Sharing Passwords with others
D. All of the above
50
Knowledge Check (5/5)
• Which of the following makes up for new age threat vectors
A. APTs, Social Media, IoT
B. Physical Security, Network Security
C. Data Leakage, Insider Threats, Malware
D. None of the above
51
Thank You!
52
Appendix
For further self reading on this topic
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
Implications of Hacked Email
70
Implications of Hacked PC
71
72
73
74
75
76
77
