Flavio Aggio: COVID-19 Cybersecurity Attacks

So, again, this is FLA AJU. Thank you for the opportunity to speak in this event, this cybersecurity leadership summit 2020, I have a presentation I'd like to share with you, and I will try to not worry with a lot of slides, so it will be fast and we can have questions towards the end. So before I start, it is important to understand what the world health organization do. And I like this simplest slide because three things, we promote health. We keep the world safe and we serve the vulnerable. So those are the three statements that are quite important.

And let me talk and share about the COVID 19 cybersecurity attacks. We had a lot of technology and a lot of investments in multiple organizations to identify, protect the task, respond and recover, and they are extremely important, but not sufficient. So my presentation is geared to show that the human OS, we are talking about a lot of operating systems and we invested a lot in technology and, and windows, Mac, Android Linux. And we have a long list of operating systems, but we don't put the right emphasis on the human operating systems.

So the, that upgrade needs to happen to safely use the internet. And it is not only about training awareness, which are very important. So with the COVID 19 attacks, we look at every single action from the community and from the it community. And we need to be absolutely open to acknowledge systems vulnerabilities. If we don't do that, if you don't change that behavior and trying to hide, we will never be able to be prepared to work online. And humans are the weakest and strongest links in cybersecurity.

As you can see in my next slides, you'll be able to see that humans are the ones writing software are the ones supporting organizations, and they are the weakest and strongest links as equally important as the users that use the technology. They need to understand how to use it. So training it's quite important and be aware of the risks and the tracks and the limitation of technology technology has a limitation. So human and technology together will be able to really defend organizations.

So I mean, evidence or indication of cyber attacks, especially preparation by apt groups. I got this from good friend, Alexei Orbe, an ethical hacker and cyber lawyer. As you can see in this is lined the number of internet new website, domain registrations with Corona, or COVID 19 in the name you can see in February when Alexei started capturing new registration, a very high number 1,468. And that is the high number based on his experience in us on major events like NFL. This is a very high number trying to imagine what he told me about March on 76,000 new entries.

Of course, several very small percentage of that are geared towards sites that are not illit, but most of the on preparation from APTs are based on new websites, registrations, as you can see, it went now in April, may and June, and now in July and August, it started to go back to the same number as February. So this shows a high indication of evidence that a lot of fishing, a lot of attacks are being prepared and were prepared to attack healthcare organizations, international organizations, and others, and on the internet by APTs that are staging attacks.

So I like to use this line as a clear evidence of what's going on. So on the COVID 19 pandemic, we w H O experienced a fivefold increase in cybersecurity attacks. And with that we've recommended nine key important components of an integrated cybersecurity program. So iden I gonna least hear very quickly. So at least you see the nine key important components, the number one identity management, quite important, because if you don't manage the identities, you not be able to really provide the security that is needed along with privilege access management for it to do their work.

If you don't have that controlled and managed properly, you will not be able to really secure systems multifactor authentication. This is something that is important and now even internal and external distinction is being dissolved. So it doesn't matter if you're inside of your cast or outside you be vulnerable. So the advice is to enable MFA mode factor authentication for all it services internally and externally. The fourth is password management for it, professionals and users.

The fifth is a integrated thinking process of the SOC, including the typical SIM, which is the security information and event management, vulnerability management, including patch management, track intelligence for internal tracks and external. So if you don't have that platform integrated with sock, the sock will be insufficient endpoint detection and response for all devices essential because that is your instrumentation. If you don't have an EDR, you will be flying without instrumentation. That is very difficult cloud proxy for any device.

When you have a device that especially now that most of the population is working from home, it's important to be able to protect their access to the internet. And the cloud proxy can do that. The six item out of the nine, very important, if you don't know what demark is, demark is the domain based message authentication reporting conformance. When the COVID 19 pandemic was really announced as a pandemic, we see we saw a huge number of impersonation and about 5 million messages. Unique messages were impersonated of the w two address to the public.

So the public were receiving messages from w two that were not sent by w O. And the reason for that is demark was not enabled. As soon as we enable demark in may of this year, the impersonation dropped by 70% and we enable demark in 30 days. So I really recommend that if you don't have demark enabled, enabled as quickly as you can. The seven item is email advanced threat protection for safe links and attachments. Most of the attacks that we observed started off links and attachments.

This is basically the, the, the, the BA the basic initial process of an attack and organizations must invest on special technology to really protect the, those safe links and attachments. So when the user clicks were opens, there is an additional work needed on top of the training and awareness. So quite important, remote access via browser is the preferred market. Because if you have that via browser, it's easier, you don't need to update all the time, and it is safer.

And the last item that I recommend is to look at for your VPN and firewalls, they are still necessary, but my recommendations to move to the zero trust strategy. So no parameter, no safe place inside of any organization. So with that, I completed the list of the nine technology elements that you needs to really concentrate because of the increase of cyber attacks.

Now, let's talk about the upgrades of the human OS for it, professionals and, and users. Again, technology is not enough. The human factor is in play, and there are three elements. The first one is what is normal cybersecurity awareness program with training, regular fishing exercise and briefings very important. If you don't have it, you need to start doing, if you have it improve with gamification and increasing of the regular fishing exercise, because if your users exercise all the time, they will understand when a real fish happens and they will know what to do.

But the other elements that are important is to have a cybersecurity policy and governance to really bring the human factor and the discussions about risk with the integrated risk management approach. So solutions should be really connected with the risk integrated way, and the ability to address all those three points a little bit more on the human OS upgrade. If you wanted to improve cyber defenses, you need to really manage the human risks by changing the digital behavior. So all the actions that you do is to really change the digital behavior. So do a factor authentication.

All the elements that we discussed before on the list of the nine can really integrate into your program, implement and maintain the cybersecurity awareness, quite important. The item number three, build red and blue teams to create the checks and balances. The red team looks for vulnerabilities, trying to do the internal penetration testing and penetration tasks and externals as well. And the blue team trying to do the defense. So the red team is unsuccessful. This approach improves your security and changes.

The behavior changes the perception of your, it, not all it organizations understand that this is absolutely required. The number four is recognized and mitigate it. Pro products, processes, vulnerabilities, establish a risk honor, and being able to accept the risk, but understand the implications of that risk up to the highest level of the organization. Using the governance that I mentioned before the fifth is promote and perform softer update continuously software, all software written by humans will have vulnerabilities in one point in this life cycle.

So having a constant software upgrade update is important. The six item is to enable rapid response.

So when a, a breach happens, when an attack happen or a suspicion happen, the rapid response from the sock is essential, and all the instrumentation will help you to do that. And the seventh will be recognized and address potential conflicts of interest between it and cybersecurity. Normally it is under cybersecurity is under it.

However, the it elements are to really improve business operations, to be able to deliver value. And if it does some shortcomings, the cybersecurity, if it is under it, there's a natural conflict of interest. So the tendencies to really move cybersecurity to a different type of level of risk of the organization. So the checks and balances can be maintained. So now a little bit about key tips to protect you and your family, because if you are protected, your family is protected. Organizations will protected as well. So three simple things.

One is use long and unique passwords for every service pass raises 20 characters or more and unique for each system, personal or work. How can you memorize so many passwords, use a password vault. There are several pastors vaults that are very important, free, or paid less pass one password or key pass XC. You can use those suggestions or others, but use a password vault, keep it unique long. And that will be very difficult for hackers to do brute force. And the last important thing for everybody is to use token mode, factor authentication suggestions for token Google, Microsoft authenticator.

I am using also alt. Now alt has a very interesting feature that enables me to use in multiple devices. So please, please, please do all those three things from a personal family point of view, because that changed digital behavior. So towards the end, I repeat this light that I shared with you. Cybersecurity technologies are very important, but not sufficient human S needs to be upgraded. And it is not only about training awareness. So policy governance, risk management play a huge role and an integrated approach. Also acknowledgement of systems vulnerabilities.

We need a little bit more from the it community to openly acknowledge that and, and deal with that. And again, the humans are the weakest and strongest links in cybersecurity. So with that, I finish my presentation. I'm ready for the questions and answers.