Using Return Path Data to Protect Your Brand: Security Breakout Session - Sao Paulo
Download as pptx, pdf0 likes414 views
The document discusses the impact of email fraud and phishing on brand reputation and customer trust, emphasizing the need for effective data-driven strategies to combat these threats. It highlights findings from a presentation by Return Path, detailing the prevalence of phishing attacks, significant financial losses suffered by brands, and various tactics employed by cybercriminals. The document also presents recommendations for businesses to authenticate emails, leverage threat intelligence, and educate customers to protect their brands.
Using Return Path Data to Protect Your Brand: Security Breakout Session - Sao Paulo
- 1. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris
- 2. #RPWT#RPWT Utilizando dados da Return Path para promover sua marca 17:10 - 17:40 Little Data, Big Decisions: Keynote Sentido para os dados. Direção para os negócios. 15:20 - 15:50 Matt Blumberg, Chief Executive Officer, Return Path Miranda Reeves, VP of Solutions Management, Return Path Brian Westnedge Director, Client Services, Return Path 17:40 - 18:00 Dados reais, Resultados reais: Painel & Premiação de clientes 15:50 - 16:40 Utilizando dados da Return Path para proteger sua marca Boas-vindas e introdução 15:00 - 15:20 Louis Bucciarelli, Regional Director LATAM, Return Path 18:00 - 20:00 Coquetel de Networking Bruno Motta Rego, InfoSec Director – CISSP – CSSLP 16:40 - 17:10 Coffee Break Eliane Iwasaki, Marketing Director LATAM, Return Path Rodrigo Mesquita Account Director Return Path Prêmio Top 5 Clientes
- 3. #RPWT#RPWT Brian Westnedge Return Path Senior Director, Client Services @bwestnedge
- 4. #RPWT Using Return Path Data to Protect Your Brand Brian Westnedge, Sr. Director, Client Services, Email Fraud Protection @bwestnedge
- 5. #RPWT Agenda • Email fraud trends and impact • The power of data: email threat intelligence • The Return Path Data Cloud • Tactics used by cybercriminals today • Unite against email fraud: tips for defending your customers, brand, and bottom line
- 6. #RPWT Email Fraud Trends & Impact
- 7. #RPWT Email Delivers Business Value… Increases Customer Loyalty Boosts Revenue Reduces Operating Costs
- 8. #RPWT …But Its Impact Is Being Eroded 5 out of 6 big companies are targeted with phishing attacks Phishing costs brands worldwide $4.5 billion each year RSA identifies a phishing attack every minute Email fraud has up to a 45% conversion rate Source: http://www.emc.com/emc-plus/rsa-thought-leadership/online-fraud/index.htm $4.5 B 1 MIN 5/6 45%
- 9. #RPWT Phishing Leads To – Unwanted Media Attention
- 10. #RPWT Phishing Leads To – Remediation Costs Fraud Losses Malware Infection Investigation Remediation
- 11. #RPWT Phishing Leads To – Revenue Losses • Reduced trust in brand: • Subscribers don’t know what to trust • Reduced effectiveness of email • ISPs don’t know what to trust Customers are 42% less likely to interact with a brand after being phished or spoofed.
- 12. #RPWT#RPWT “If you boil the jobs down of IT security professionals, they are ultimately tasked with protecting the brand… If you have a breach, research suggests that 60% of your customers will think about moving and 30% actually do.” Bryan Littlefair Global Chief Information Security Officer Aviva
- 13. #RPWT Source: Spam and Phishing in the First Quarter of 2015, Kaspersky Geography of phishing attacks, Q1 2015 Top 10 countries by percentage of users attacked: Brazil Tops Most Phished Country List Rank Country % of users 1 Brazil 18.28 2 India 17.73 3 China 14.92 4 Kazakhstan 11.68 5 Russia 11.62 6 UAE 11.61 7 Australia 11.18 8 France 10.93 9 Canada 10.66 10 Malaysia 10.4
- 14. #RPWT Can You Spot a Spoof?
- 16. #RPWT Anatomy Of A Phishing Email to: You <[email protected]> from: Phishing Company <[email protected]> subject: Unauthorized login attempt Dear Customer, We have recieved noticed that you have recently attempted to login to your account from an unauthorized device. As a saftey measure, please visit the link below to update your login details now: http://www.phishingemail.com/updatedetails.asp Once you have updated your details your account will be secure from further unauthorized login attempts. Thanks, The Phishing Team 1 attachment Making an email look legitimate by spoofing the company name in the “Display Name” field. Tricking email servers into delivering the email to the inbox by spoofing the “envelope from” address hidden in the technical header of the email. Including logos, company terms, and urgent language in the body of the email. Making an email appear to come from a brand by using a legitimate company domain, or a domain that looks like it in the “from” field. Creating convincing subject lines to drive recipients to open the message. Including links to malicious websites that prompt users to give up credentials Including attachments containing malicious content.
- 17. #RPWT Email Fraud: Primary Attack Vectors Domain Spoofing (from domains owned by the brand) Brand Spoofing (from domains outside the brand’s control) [email protected] [email protected]
- 18. #RPWT The Power of the Right Data
- 19. #RPWT Only 30% of Attacks Spoof Your Domains 30% spoof your domain • Active Emailing Domains • Non-Sending Domains • Defensively-Registered Domains 70% spoof your brand in other ways • Cousin Domains • Display Name Spoofing • Subject Line Spoofing • Email Account Spoofing Source: Return Path / APWG White Paper, 2014
- 20. #RPWT Knowledge Is Your Best Defense • We know there is no silver bullet solution to combat against the other 70% of email attacks. • But we also know the only way to build a comprehensive defense is through comprehensive understanding. • Data is the key to that understanding.
- 21. #RPWT Breadth, Depth, and Speed Contactually Molto ParibusGetAirHelp Message Finder UnsubscriberOrganizer
- 22. #RPWT EMAIL THREAT DATA · Consumer inbox data · Email delivery data · Authentication results · Message level data · SPAM trap & complaints data EMAIL THREAT INTELLIGENCE · Domain-spoofing alerts · Brand-spoofing intelligence · Suspicious activity map · Fraudcaster URL feed · Sender Score: IP reputation
- 23. #RPWT Unite Against Email Fraud Tips for defending your customers, your brand, and your bottom line.
- 24. #RPWT Leading Companies Fighting Email Fraud
- 25. #RPWT DMARC (Domain-based Message Authentication Reporting & Conformance): • Technical specification created to help reduce the potential for email- based abuse (www.dmarc.org) • Prevents domain-based spoofing by blocking fraudulent activity appearing to come from domains under your control • Provides threat reporting mechanism (aggregate and forensic data) #1: Authenticate Your Email
- 26. #RPWT#RPWT “Simply put, the DMARC standard works. In a blended approach to fight email fraud, DMARC represents the cornerstone of technical controls that commercial senders can implement today to rebuild trust and retake the email channel for legitimate brands and consumers.” Edward Tucker Head of Cyber Security Her Majesty’s Revenue & Customs
- 27. #RPWT • Addressing the 70% of email attacks that spoof your brand using domains your company does not own requires email threat intelligence. • Get visibility into all types of email threats targeting you today. #2: Leverage Email Threat Intelligence
- 28. #RPWT • The reality is, some attacks are always going to get through. • The more prepared your customers are, the better. • Create an educational website • Include anti-fraud language within your legitimate email • In the event of an attack, warn your customers immediately #3: Educate Your Customers
- 29. #RPWT • Engage with Brand Protection teams to make the business case. • Create a sense of urgency. • Communicate the risks that result from not taking action: • Email fraud destroys brand reputation and erodes customer loyalty • Email fraud thwarts email marketing effectiveness • Email fraud negatively impacts revenue #4: Raise Awareness with Top Executives
- 30. #RPWT Learn More br.returnpath.com/emailfraudprotection Twitter: @StopEmailFraud New: Download the Email Threat Intelligence report at bit.ly/EmailThreatIntel
- 31. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris Thank You!
- 32. #RPWT#RPWT Bruno Motta Rego Diretor de Segurança da Informação de um Importante Ecommerce @brunomottarego
- 33. #RPWT Using Return Path Data to Protect Your Brand Bruno Motta Rego, @brunomottarego
- 34. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris World Tour 2015 We believe there is no better way to build relationships with customers and partners than to come together for inspiration, education, and networking. Data is the key to creating trusted relationships with your customers. But data alone isn’t enough. You need the right data and the right insights to promote and protect your brand. Join us on the World Tour to: Agenda • Desafios do cenário atual • Soluções • Resultados • Considerações finais
- 35. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris Desafios do cenário atual Abuso de marca: reputação e confiança do consumidor Falta de visibilidade: estratégia e agilidade de remediação Vulnerabilidade do consumidor final Millhões de mensagens de phishing relacionadas à marca identificadas por dia
- 36. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris Soluções • Protocolos de Autenticação DMARC Governança de e-mails Processo de implementação
- 37. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris World Tour 2015Resultados • Bloqueio de 99,78% de mensagens de phishing (Setembro/2015) • Redução da incidência de mensagens suspeitas • Confiança do consumidor
- 38. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris World Tour 2015Considerações finais Monitore seu negócio Desafie-se Compartilhe melhores práticas com seus pares na indústria
- 39. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris Obrigado! @brunomottarego
- 40. #RPWTSydney • London • São Paulo • Chicago • New York • San Francisco • Los Angeles • Paris
- 41. #RPWT#RPWT
Editor's Notes
- #3: Need to update for each location.
- #8: Value to businesses Email is a very valuable marketing medium for businesses for all of the above reasons (low cost, effectiveness, scale, format), but it’s also effective for fraudsters for the same reasons.
- #9: Every day, beyond your control, cybercriminals send emails that spoof your brand, targeting your customers, partners, and suppliers with malicious content. Email Fraud continues to grow (50% YOY growth in volume of email attacks based on APWG data) and, in spite of the recent shutdowns of larger botnets, phishing shows no sign yet of abating, with more than 400 brands are phished each month (Anti-Phishing Working Group) Two biggest trends: an increase in the volume of attacks and an increase in the sophistication.
- #10: Phishing is on old problem, and it’s not going away so lets look at the way it is impacting businesses today. #1 – Phishing is Making Headlines and Is Destroying Reputations Some of the most respected brands out there are making the headlines: Amazon, Home Depot, Booking.com and more recently US health insurer giant Anthem.
- #11: #2 – Phishing Is Losing Companies Millions in hard costs Fraud losses Malware infection (secondary damages/losses) Investigation Remediation
- #12: #3 – Phishing is Impacting Revenue. Email fraud has a dramatic impact on the trust your customers have in your brand. It also reduce the effectiveness of email that is legitimate. A great data point from Cloudmark here: customers are 42% less likely to interact with a brand after being phished or spoofed. So, we all recognise that it’s an old problem and most of us know that it hurts our business. And yet many companies we speak to still struggle to justify investment in solutions, leaving their brands and their customers vulnerable. I believe that’s because, in the first place, measuring the impact is difficult: tying fraud losses and expenses back to specific activities is difficult and quantifying the value of brand integrity has always proved elusive. Okay, so let’s talk now about solving the problem. Prior to working at Return Path, I worked in the brand & fraud protection industry for 10 years. And, during those 10 years, I watched the evolution and growth of the problem space and observed the stagnation of innovation.
- #13: Here is a great quote from Aviva’s CISO Bryan Littlefair on why it is the CISO’s responsibility to protect the brand, in collaboration with Marketing.
- #16: Can you spot the spoof? (chances are you can) Now.. Are you confident YOUR CUSTOMERS can? The simple answer is NO. So this is why it is critical that you use the right data to shine the light on all the types of email threats that are targeting your brand today.
- #17: If you have to explain to marketing... graphic to use security and tech. See that as aware when comes to email look at points they can hit on in order to break through. Not just Friendly From, different ways to use email. What highlighting here. Fits with email advantages email slide... 97% of people globally cannot correctly identify a sophisticated phishing email. And there is a plethora of ways fraudsters can spoof your identity…
- #18: Fraudsters will target your brand in two ways: by spoofing your domains, or by spoofing your brand in other ways. Both attack vectors are critical and you need visibility into all attacks, which is why it is important to have access to the RIGHT data.
- #19: Show of hands if you think that the majority of the email threats against your brand spoof domains under your control? In other words, what percentage of attacks come from a legitimate hsbc.com domain?
- #20: We ran some primary research in sept 2014, looking at 18 billion suspicious emails, targeting 11 banks in the UK and the US. And what did we discover? 30% of the attacks came from an email address from a domain that was owned by the bank that leaves 70% that were spoofed in some other ways like display name spoofing. This is REALLY relevant to our solution because we seek to address both: the 30% and the 70%. We analysed 40 of the top global brands for a period of 2 months (july/August 2015) and looked at fraudulent emails coming from the 70% we covered here. These are some of the tactics we were able to uncover thanks to email threat data: 1. Snowshoeing is still rife and monitoring IP reputations needs to be part of a multi-faceted email fraud protection strategy 2. Fraudsters do not go to the trouble of rotating elements of their subject lines, preferring a more template-based approach. Access to message-level data from email threat intelligence sources should help you prioritize your efforts around attack mitigation. 3. The most frequently spoofed Header From field is the Display Name, for which there is currently no authentication mechanism. Visibility into Display Name spoofing is critical in identifying and responding to phishing attacks leveraging your brand.
- #21: So what are we saying: well at risk of sounding obvious, knowledge is your best defense.
- #22: With such a complex threat landscape, you need breadth, depth and speed when it comes to email threat intelligence, and this is what we mean by it: data from mailbox providers, data from security vendors, and data from consumer inboxes to give you a complete pictures of all the threats spoofing your domains (under your control) and your brand (outside your control).
- #23: Powered by the Return Path Data Cloud, our proprietary email threat intelligence empowers you to identify threats beyond DMARC — so you can respond to the 70% of email attacks spoofing your brand from domains that you do not control. We use over 100 data feeds from more than 70 providers to detect, classify and analyze data relating to over 6 billion emails every day. Now imagine having this data available to your teams so you can detect, block and respond to email threats in real time. Respond to the 70% of email attacks spoofing your brand from domains that you do not own. DMARC is a great first step, but it’s not a complete solution, protecting your brand from only 30% of email threats. Powered by the Return Path Data Cloud, our proprietary email threat intelligence empowers you to identify threats beyond DMARC. We use over 100 data feeds from more than 70 mailbox and security providers to detect, classify and analyze data relating to over 5.5 billion emails every day. With Email Threat Intelligence, you can: Get insight into email threats, coming from domains that your company does not own (e.g. cousin domains, display name spoofing, subject line spoofing). View redacted message-level samples of fraudulent emails targeting your brand. Identify phishing URLs embedded in fraudulent emails and inform your takedown vendor(s). Integrate intelligence into your existing systems through a RESTful API. Manage all Email Governance and Email Threat Intelligence alerts from a single portal.
- #24: It’s time to unite against email fraud… And here are some of the leading brands out there at the forefront of this initiative (next slide)
- #30: Security understands the risks, but Marketing and Sales executives must be shown how this affects real dollars. This impacts revenue, market share and partnership opportunities, to name a few. Reduced effectiveness: Once they have been harmed by something tied to your brand, customers are afraid to open anything that comes from you. All of the work you put into crafting an effective message is wasted, if they refuse to open it. This can be especially bad for seasonal promotions. The bad guys know you’ll be sending out special promotions, so they’ll send their own versions to trick people. Word gets out about a scam and people won’t open your promotional notes during the key perioe. This also skews your metrics, because you don’t get a good sample of “regular” customer reactions to a campaign. Customers now have a bad feeling tied to your brand. Even if their head accepted the explanation that something was really not from you, their gut has a twinge when they see your brand. When they’re shopping next time, that will impact their mindset. Maybe they’ll try another brand. (Google, Orbitz, Kayak searches) It's not just lower revenue. There are hidden added costs of dealing with reversing fraudulent purchases, resetting customer accounts, resolving customer issues. Also - It's not just about business. You don't want anyone using the power of your brand to trick people.
- #32: Update based on each location.
- #34: This can be the Hold Slide
- #35: Challenges Solutions Results Final considerations
- #36: Abuso de marca: praticantes de fraudes online se aproveitaram do reconhecimento da marca por entre os consumidores para realizar ataques maliciosos, utilizando formas agressivas de phishing, tática que falsifica o domínio principal de envio de mensagens e envia e-mails fraudulentos. (explicar spoofing e risco de inclusão do domínio em blacklists – o que dificultaria a entrega de emails legítimos também) Visibilidade: sem visibilidade do tamanho e escala de ciberataques, empresas costumam reagir a esses incidentes de maneira reativa, na maior parte das vezes tomam conhecimento dos ataques após receber reclamações de clientes por meio de seus canais de comunicação, porém não têm informações suficientes para tomar medidas judiciais, como investigações forenses Vulnerabilidade do consumidor final: 97% não sabe identificar um email de phishing Situação: total de 6 millhões de mensagens de phishing relacionadas à marca em um único dia (300 milhões ao ano) Fonte: Return Path (confirmar se poderá divulgar estes números!)
- #37: processo de implementação do DMARC, de como chegaram na política de bloqueio das mensagens – sem arriscar bloquear as mensagens legítimas – por meio da governança. E como atualmente é feito o monitoramento destas informações da plataforma da Return Path
- #38: Results 99.78% of phishing messages blocked in Sep2015 Suspicious messagees reduced Gain customer trust
- #39: Final considerations (Got this from previous presentation that this client did during Mind the Sec event) Monitor your business Challenge yourself Share the best practices with your peers in industry
- #41: This can be the Hold Slide