Overview of

Cyber Threats & Risks

Dr Ram Kumar G, PhD, CISM, CRISC, PMP Topic 2
Cyber Security & Risk Leader
Overview 60 mins

• Changing Attacker Profiles

• Data Leakage Threat Vectors

• Multiple Levels of Security Controls

• Key Attack Vectors

• Risky Actions

• New Threat Vectors

• Knowledge Check

• Appendix
2
3
4
Types of Risk and Threats for Information Security

1. Human factors – specific actions violating security rules

2. Technology factors – security devices and controls

3. Environmental factors – compliance and legal issues

4. Business process factors – reputation, employee competencies,
prevailing culture and extent of information security alignment
(McFadzean et al., 2007).

5
 The Growing Cyber-Attack Surface

6
7 V&A Source: The Threat Lifecycle Management Framework, Log Rhythm
8
Data Leakage Vectors

1.Email
• Outbound Emails
• Unencrypted PII mails
• Outlook Web Access
9.Out of View Sensitive 2.Internet
Data • File Sharing Websites
• Inability to locate and • Send out data using
protect sensitive data personal email IDs

3.Mobile Devices
8.Hardcopy Documents • Loss/Theft of Device
• Personal phones with email
• Ability to print sync
sensitive data & take • Laptops with sensitive data in
home
Data Leakage
hard disk
• Not following Clear • .pst file in local hard disk
• Unrestricted Internet Access
Desk Policy outside company network

Vectors • USB port access

7.Ineffective Controls 4.Poor Access Controls

• No data masking of NPI • Access to sensitive data
• Wrongly configured by unauthorized users
devices/settings • Unauthorized access to
• No vulnerability scans & fixes
Shared Folders
• No periodic technology risk
• Access to NPI by
assessments (configuration
reviews) Privileged Users
• Poor exception management 5.Remote Users • No periodic user access
processes reviews
• No end point controls
• No VPN authentication to
6.Third Party Vendors
access Company network
• Access to sensitive • No 2-Factor
data – processing / authentication to access
storing Company network
• Unrestricted Internet
Access outside company
network
9
Data Loss Risks

10
11
12
13
Key Threats

14
15
16
17
18
19
Business Risks

20
Malware Threats

21
Information Security Threats

22
23
New Threat Vectors

24
New Threat Vectors

25
Risky Actions

26
27
Insider Threat Impacts

28
29
30
31
32
33
34
35
Relatively high-likelihood, high-impact threats

36
Relatively low-likelihood, high-impact threats

37
Relatively high-likelihood, low-impact threats

38
39
40
41
42
43
Multiple Levels of Security Controls

44
45
Knowledge Check

• No scoring 
46
Knowledge Check (1/5)

• What are the attack vectors for Data?

A.Email, Internet and Mobile Devices

B.Poor access controls, Third Party Vendors, Remote Users

C.Ineffective Controls, sensitive hardcopy documents

D. All of the above

47
Knowledge Check (2/5)

• What are the components of key attack vectors?

A. Poor Security Governance Management

B. Insider Threats, Botnets, Malware

C. Hacktivism, Unpatched software, dated Anti-virus software

D. Both B and C

48
Knowledge Check (3/5)

• A hacked PC can be used for:

A. Credential harvesting

B. Launching Botnet attacks

C. Data Theft

D. All of the above

49
Knowledge Check (4/5)

• Which of the following constitute Risky Actions by employees?

A. Leaving Computers unattended especially outside work

B. Accessing Internet via Insecure WiFi

C. Sharing Passwords with others

D. All of the above

50
Knowledge Check (5/5)

• Which of the following makes up for new age threat vectors

A. APTs, Social Media, IoT

B. Physical Security, Network Security

C. Data Leakage, Insider Threats, Malware

D. None of the above

51
Thank You!

52
 Appendix

For further self reading on this topic

53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
Implications of Hacked Email

70
Implications of Hacked PC

71
72
73
74
75
76
77