Information on cyber security

threats and risks

 Content

1. Cyber security trends, threats and risks

2. The underground cybercrime
3. NBG Group initiatives
4. New regulatory requirements for cyber risk self-
assessment
5. Where we are and where we go?
 Cyber security trends, threats and risks

Environment:

• Expanding global digital economy: 2-3 trillion

USD
• 5 billion devices connected online in 2015, 25
billion in 2025
Cyber security trends, threats and risks

Environment: Rapid growth of online transactions

 Cyber security trends, threats and risks

• Cybercrime: crime performed through computers

and telecommunication networks like internet
• High gain with low risks to the criminals
• Main risks:
• Data leakage
• Financial damages
• Compromised data integrity
• Denial of service
 Cyber security trends, threats and risks

Conclusion of the Internet Security Alliance (ISA) , the

American National Standards Institute (ANSI):

The single biggest risk involving cybersecurity

is ignorance and misunderstanding!

Cybersecurity has historically been looked at as a cost. ISA

believes that increasingly it has to be looked at as an
investment:
Greater trust = Stronger brand = Higher sales
 Cyber security trends, threats and risks

Enemies:

• Outside Intruder (Hacker)

• Insider with malicious intent

 Cyber security trends, threats and risks

Countermeasures:

• Background checks in recruitment

• Raise awareness
• Control access
• Invest in cyber security
• Manage social networking
• Discipline bad behavior
• Beware of vulnerability especially from IT and former
employees
Cyber security trends, threats and risks
 Cyber security trends, threats and risks

• Annual loses due to cybercrime:

• 200 billion USD (10-20% of the total digital
revenue) currently
• 3 trillion USD in 2020
• Cybercrime is a tax on innovation, slows down
the business slow down and reduces the ROI
• Most of the companies are not aware or do
not report losses from cybercrime
Cyber security trends, threats and risks
 Cyber security trends, threats and risks

• Recent case in Croatia:

• March – May 2014, 100 e-banking users
(corporations and individuals) were target
of cybercrime
• 190 unauthorized transactions, 15
successful, 220.000 EUR financial damage
• The regulation and the e-banking security
measures in Croatia are very similar to ours.
• This case triggered the latest regulatory
initiative of NBRM
 Cyber security trends, threats and risks

• Post-attack (regulatory) changes in Croatia:

• New security measures for transaction monitoring
(additional or double verification, etc)
• Customer training
• Additional measures for identity management
(smart cards, additional OTP tokens)
• Changes of agreements with customers (the loss
will be covered by the bank)
• Raising awareness about security
• Information sharing for cyber attacks within the
financial sector.
 Cyber security trends, threats and risks

• Post-attack (regulatory) changes in Croatia:

 Cyber security trends, threats and risks

• Types of hackers based on motives:

• White Hat Hackers: These are the good guys, ethical

hackers, computer security experts who specialize in
penetration testing and other methodologies to ensure
that a company’s information systems are secure.
• Black Hat Hackers: These are the bad guys. Their
motivation is generally to get paid.
• Script Kiddies: Use borrowed programs to attack
networks and deface websites in an attempt to make
names for themselves.
Cyber security trends, threats and risks

• Hacktivists: motivated by politics or religion, revenge,

or entertainment.
• State Sponsored Hackers: It’s all about controlling
cyberspace. State sponsored hackers have limitless time
and funding to target civilians, corporations, and
governments.
• Spy Hackers: Corporations hire them to infiltrate the
competition and steal trade secrets.
• Cyber Terrorists: motivated by religious or political
beliefs, attempt to spread fear, chaos, terror and commit
murder by disrupting critical infrastructures. Cyber
terrorists are by far the most dangerous.
Cyber security trends, threats and risks
 The underground cybercrime

Threats:

• SPAM
• Phishing
• Social Engineering
• IP Infringement
• Unauthorized access
• Malware
• Fraud
 The underground cybercrime

• Deep Web are the parts of the internet that cannot

be indexed by traditional search engines.
• The Deep Web has between 400 and 550 times more
public information than the public Web.
• More than 200,000 Deep Web sites currently exist.
• 550 billion documents are estimated to be found on
the Deep Web
• The Deep Web is accessed with tools like Tor browser.
The underground cybercrime
The underground cybercrime
The underground cybercrime
The underground cybercrime
The underground cybercrime
The underground cybercrime
The underground cybercrime
 NBG Group Initiatives

• Assessments / questionnaires:

• 2010 - Security self assessment

• 2011 - ISO 27001 assessment
• 2014 - Security systems data gathering
• 2015 - Cybercrime questionnaire
• 2016 - Fraud prevention questionnaire
 NBG Group Initiatives

• Workshops:

• 2010 - Security Workshop Sofia

• 2014 - Workshop for information security tool
 NBG Group Initiatives

Information security policy:

• 2012 - Policies and standards v1.00

• 2015 - Policies and standards v2.00
• 2016 - NBG Group Information Systems
Security Architecture

2014 - Appointment of Chief Information Security

Officer (CISO) of NBG Group
 New regulatory requirements for
cyber risk self-assessment
• NBRM announced a mandatory tool for self-assessment of the
inherent cyber risks and levels of readiness

• Questionnaire divided into three levels of readiness:

• Basic (126 controls)
• Intermediate (120 controls)
• Advanced (98 controls)

• Inherent level of risks of SB has been determined as

moderate.The suggestion from NBRM is to fulfill Intermediate
Level of readiness in the next 3 years.
 Where we are and where we go?

• Currently in place:

• Many security controls

• Many audit trails
• Protection of inside and outside perimeters, regular penetration tests
• Access control
• Intrusion detection software

Key issues:

• Complexity constantly increases

• Legacy systems
• Suboptimal size of IT team
• Extended user access to systems / data
• Lack of many security related processes and resources,
noncompliance (PCI-DSS)
 Where we are and where we go?

• We are currently working on:

• Improvement of the internal perimeter

• Upgrade of workstations, network and local systems
• Central management of workstations and systems
• Endpoint protection
• Management of mobile devices

• Improvement of the external perimeter

• Planning firewall upgrades
• Improvement of web and email filtering
• Services from information security providers
 Where we are and where we go?

• Key mid-term goals:

• Improve processes, training and awareness

• Network access protection system, prevent unauthorized
devices
• Improve log management system
• Real time notifications for security incidents
• Active response
• Digital threats management system
• User behavior analysis system