The New Order of Security George Chang Vice President, Southeast - PowerPoint PPT Presentation

People First, Ministry of Science, Performance Now Technology and Innovation 10010101010 010110101101 110010110101 001010110010 101010110101 "Securing Cyberspace for Economic Growth" The New Order of Security George Chang Vice President, Southeast Asia and Hong Kong gchang@fortinet.com 14 November 2013 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

Key Note: : All four countries attribute high levels of importance towards IT security, with Malaysia registering the highest level. How important is IT Security to your overall business setup? Mean Score ( 1 � Not important at all | 5 � Very important) 4.32 4.51 4.27 4.25 4.25 100% ¡ 0.0% ¡ 1.0% ¡ 1.3% ¡ 1.3% ¡ 1.3% ¡ 5.3% ¡ 11.7% ¡ 10.7% ¡ 12.0% ¡ 18.7% ¡ 80% ¡ % of respondents 34.7% ¡ 41.7% ¡ Not ¡Important ¡At ¡All ¡ 48.0% ¡ 46.7% ¡ 37.3% ¡ 60% ¡ Not ¡important ¡ Neutral ¡ 40% ¡ Important ¡ 58.7% ¡ Very ¡Important ¡ 45.7% ¡ 44.0% ¡ 20% ¡ 40.0% ¡ 40.0% ¡ 0% ¡ Overall ¡ Malaysia ¡ Singapore ¡ Hong ¡Kong ¡ Thailand ¡ Survey by Frost & Sullivan, Oct 2013 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

Key Note: The majority of respondents treat IT security as important from the viewpoints of securing data and protecting against external threats. How important is the IT Security to your overall business setup? Not ¡ important ¡ Top 5 reasons why IT security is 1% ¡ considered important: Neutral ¡ (Very Important & Important) 12% ¡ To ¡secure ¡data ¡and ¡informaJon ¡ 49.6% ¡ Protect ¡against ¡external ¡aNacks ¡ 15.3% ¡ Important ¡ 42% ¡ Ensure ¡confidenJality ¡ 11.5% ¡ Very ¡ CriJcal ¡to ¡overall ¡business ¡ 7.3% ¡ Important ¡ 45% ¡ Ensure ¡reliability ¡ 5.3% ¡ % of respondents N = 300 Survey by Frost & Sullivan, Oct 2013 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

Key Note: Singapore organizations are more likely to view APT solutions as being highly critical, whilst Hong Kong organizations are more focused on DDoS prevention solutions. How would you rate the criticality of the respective IT security solutions listed below to your What are your opinions towards the following statements What are your opinions towards the following statements What are your opinions towards the following statements What are your opinions towards the following statements overall security posture? ApplicaJon ¡Security ¡ Overall ¡ Data ¡Security ¡ Network ¡Security ¡ Singapore ¡ Database ¡Security ¡ Endpoint ¡Security ¡ Thailand ¡ Wireless ¡Security ¡ DDoS ¡PrevenJon ¡SoluJon ¡ Malaysia ¡ Cloud/VirtualizaJon ¡ Security ¡ Advanced ¡Persistent ¡Threat ¡ (APT) ¡SoluJon ¡ Content ¡Security ¡ Hong ¡Kong ¡ Managed ¡Security ¡Services ¡ 3.50 ¡ 3.60 ¡ 3.70 ¡ 3.80 ¡ 3.90 ¡ 4.00 ¡ 4.10 ¡ 4.20 ¡ 4.30 ¡ Mean Score (1 � Not critical at all | 5 � Very critical) Critical Survey by Frost & Sullivan, Oct 2013 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

Key Note: The CEO’s participation in IT security decision making is higher than that of the CIO. CFOs also have a high participation rate and high degree of influence, compared to IT Heads. What are your opinions towards the following statements Who are the people involved in the decision making process for IT Security spending? What are your opinions towards the following statements What are your opinions towards the following statements 80.0% ¡ 70.0% ¡ 69.0% ¡ Decision ¡Maker ¡ 60.0% ¡ Key ¡Decision ¡Maker ¡ % of respondents 50.0% ¡ 40.0% ¡ 45.7% ¡ 40.0% ¡ 43.7% ¡ 29.7% ¡ 30.0% ¡ 29.7% ¡ 20.0% ¡ 11.7% ¡ 11.0% ¡ 17.3% ¡ 10.0% ¡ 13.3% ¡ 3.3% ¡ 2.7% ¡ 0.3% ¡ 7.0% ¡ 0.0% ¡ 4.7% ¡ 1.7% ¡ 3.7% ¡ 1.3% ¡ 0.0% ¡ 0.0% ¡ CEO ¡ CIO ¡ CFO ¡ IT ¡Head ¡ COO ¡ CTO ¡ CSO ¡(Chief ¡ CSO ¡(Chief ¡ CMO ¡ Others ¡ Security ¡ Strategy ¡ Officer) ¡ Officer) ¡ Survey by Frost & Sullivan, Oct 2013 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation The Largest DDDOS Ever … • April, Target against Spamhaus – RBL provider – 150 Gbps DDOS Traffic • “Masterminded” by a 15 year old London boy – 1 laptop controlling 5-7 compromised servers • Mainly DNS amplification attack Send requests to an open DNS resolver asking for a copy of a larger DNS zone Spoof DNS query from file victim (Amplification: 1 query = 100 reply) 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation The Apache gets attacked by Stealth Malware • Hit at least 50 of which are ranked by Alexa as among the world’s most popular 100,000 • Cdorked – secretly redirects visitors using selected browser/OS to a compromised website that hosts the Blackhole exploit kit – attempts to find and take advantage of software vulnerabilities. – The redirect commands run in memory only, they aren’t captured by Apache logs – Does Not load additional malicious modules on the infected server – Does not attempt to redirect each and every visitor to a BlackHole site or visitors of certain language/geographical area 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation Botnets are still alive • This year most infectious botnet - ZeroAccess (2011) – around 1 million active and infected machines – owners continue to pay their infection affiliates a significant amount of money to keep the 100,000 new infections per week going – Primary motive revolves Bitcoin mining and click fraud 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation Time to worry about your friends • Spear phishing – More focused attack typically aimed at an individual with access to corporate assets – Scammers try to create an email that's apparently from a trusted source and that seems legitimate, so the victim will click on the poison link – Use owner’s public tweets and other public posts to fine-tune messages, mimicking writing style 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation New DDOS trick – The Browser Botnet • Eliminates need to work hard getting malicious software installed on thousands of computers • Simply by spending some money on banner ads • The moment that ad showed up, your browser executed a snippet of Javascript, and the attack left no traces behind … 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation NSA and privacy • Surveillance is an attempt to monitor communications in order to prevent attacks on USA - a form of preventive security – Questionable Effectiveness – Invasion of Privacy – Questionable Legality • Recent revelations on spying foreign government and commercial communications – Drives requirement for non-standard encryptions – Close system communications 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation Raise of the Mobile Malware • Currently, tracks over 300 unique families of Android mobile malware • Crossing over 1,000 new samples every day – 30% increase in six months • Result of: – Wide scale manufacturer adoption of Google’s Android OS globally – available applications to extend device functionality 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101

People First, Ministry of Science, Performance Now Technology and Innovation The Birth of Mobile Ransomware • An Andriod malware that pretends to provide malware and virus protection to the victim’s phone – About six hours after FakeDefender is installed, it will lock the victim’s phone with an image of pornography and a link to purchase software that will clean up the phone. – searches for key files on the phone and erases them, in the hopes of preventing restoration of the phone from a backup file. 10010101010 "Securing Cyberspace for Economic Growth" 010110101101 110010110101 001010110010 101010110101