Identify Theft

Identity Theft Jorge Sebastião Founder and CEO

May 2006 – Veterans Administration laptop with personal information on 26.5M veterans is stolen. “Total losses could top $500M.” – VA Secretary Nicholson Jan 2007- Hackers stole data from at least 45.7 million credit and debit cards at retailer T.J.Maxx – total costs could exceed $1.0B May 2006 – CIO, CSO fired Ohio University 137,000 student accounts compromised

More Stats ,[object Object],[object Object],[object Object]

What happens when Hackers grow UP? Criminals

Skimmer • Capacity > 2500 credit cards • 40 hours Operations • Panic button can deleted information to avoid prosecution. • Cost = $500

What Is Identity Theft? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

ID Theft– The old way ,[object Object],[object Object],[object Object],[object Object],[object Object]

ID Theft– New Way Phishing / Pharming Hijack/Skimming

Online Applications Role **2007 top 5-WOASP attacks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Victim's browser sends a pre-authenticated request to a vulnerable web application, which then executes hostile actions in the browser. Cross Site Request Forgery (CSRF) 5 Attackers can manipulate information exposed as a URL or form parameter without authorization. Insecure Direct Object Reference 4 Include hostile code and data in file accepted by web application, resulting in devastating attacks, such as total server compromise. Malicious File Execution 3 Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. Injection Flaws 2 XSS flaws occur whenever an application takes user supplied data & sends it to a web browser without first validating that content. Cross Site Scripting (XSS) 1

Social Engineering ,[object Object],Schrage, Michael. 2005. Retrieved from http://www.technologyreview.com/articles/05/03/issue/review_password.asp?p=1 Bar of chocolate

People is the biggest problem?

WHAT CAN YOU DO? ,[object Object],[object Object],[object Object]

DETER = Protect ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

DETECT ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

DEFEND = Respond ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Old ID Systems ID CARD CPR CARD Driving License

Replaced by Modern ID Systems ,[object Object],[object Object],[object Object],Storage CHIP All external information is duplicated In the Chip in addition to other data of the combined cards. ,[object Object],[object Object],Biometrics

Banks Credit Card Technological Safeguards Truncation of Account Numbers CISP Verified By Visa Issuers’ Clearinghouse Advanced Authorization CVV Address Verification CVV2 Technology Innovations

Identify Theft

Recommandé

Recommandé

Contenu connexe

Plus de Jorge Sebastiao

Plus de Jorge Sebastiao (20)

Dernier

Dernier (20)

Identify Theft