Top Hotel Scams and The Human Vulnerability · • George Dvorsky, “The 12 cognitive biases that prevent you from being rational”, io9, September 2013 • Experian, 2015 Second

Top Hotel Scams and The Human Vulnerability

Chris Pogue, MSIT, CISSP, CEH, CREA, GCFA, QSA

Nuix Chief Information Security Officer

COPYRIGHT NUIX 2015

2 28 June, 2016

> whoami

Chris Pogue

• Master’s Degree in Information Security • 18 years experience (US Army Signal Corps Warrant Officer, US Secret Service

Instructor, National Computer Forensics Institute Instructor, Incident Responder, Delivery Director)

• Published Author • Unix and Linux Forensic Analysis – Syngress • Data Breach Response and Investigations - Elsevier • More than 50 interviews and bylines in international media outlets

• 2010 recipient of the SANS Thought Leader Award • CISSP, CEH, CREA, GCFA, QSA • Speaker at more than 75 conferences over the past five years • Creator of the Sniper Forensics methodology • Expert witness • Cybersecurity Adjuct Professor at Southern Utah University

June 28, 2016

Copyright Nuix 2016 3

“Behind every successful fortune, there is a crime.” - Mario Puzo, The Godfather

Copyright Nuix 2015 4 28 June 2016

• Loosely organized, yet extremely effective – Compartmentalized groups – Global communication

capabilities – Craigslist-style advertisement

• Forum-based – Never met, yet trust each

other with millions – Largely Russian speaking – Actors are vetted by at least

two referrals and around US$1,000

• No longer using open channels – Makes monitoring much more

difficult for law enforcement – Isolated, independently

maintained systems – If these go away, it’s all

HUMINT

Criminal Activity

4


• Street gang involvement – Purchasing stolen cards

via forums • Fraudulent purchases • Fencing purchased items • Chargebacks (usually

requires a collusive merchant or cashier)

– Use stolen gift cards or hotel room keys

– Much safer – No tweakers – More comfortable – No mandatory sentencing

• Facilitate other crimes – Violent crimes – Human, weapon and sex

trafficking – Support terrorism

Criminal Activity

5


• Increase in attack complexity?* – Still missing the basics of ‘IT hygiene’ – Adapting to stringent security controls and improved security

technologies • Leverage arrogance • If you know about it, they know about it (the fatal flaw in compliance) • Global coordination • Motivations

– Geopolitical – Philosophical – Retaliation – Financial gain – Opportunity

Criminal Activity

* Hackers are lazy. They are only going to try as hard as they have to.


Criminal Activity

7

June 28, 2016


Criminal Activity

• Hotels remain a primary target for carders • Low risk, high reward • Attribution, apprehension, and prosecution • IT Hygiene continues to be a scourge • Not the core competency of the target • Usually little ability to detect a breach • Post breach landscape

How do we solve this dastardly problem???

June 28, 2016


Agenda

The Cerebral Vulnerability

The Infiltration Causation

Alternative Perspectives

The Cognitive Clash

A Summation of the Psyche Questions


June 28, 2016 Copyright Nuix 2016 11


June 28, 2016



• A cognitive bias is a genuine deficiency or limitation in our brain's ability to process information sufficient for us to make conscientious decisions.

• Some social psychologists believe our cognitive biases help us process information more efficiently, especially in dangerous situations. Still, they lead us to sometimes make grave mistakes.

<Fade in picture of a brain and juxtapose with a computer>


June 28, 2016



“An incident in which an individual name plus a Social Security number, driver’s license number, medical record or financial record (credit/debit cards included) is

potentially put at risk because of exposure.”

“An event in which an individual’s name plus a medical record and/or a financial record or debit card is potentially put at risk—either in electronic or paper format.”

June 28, 2016 Copyright Nuix 2016 15


47% 25% 72% 28% ?

June 28, 2016



System glitches?

<insert some sort of system glitch picture? Maybe a glitch from the Matrix>

Internalization <insert pictures of a happy people celebrating> Externalizing blame <insert pictures of angry people pointing>

Internalization?

Externalizing blame?

June 28, 2016



• Technology is rarely the cause of data breaches • One-hundred percent of:

• Hackers • Insider threats

• Malicious • Non-malicious

• IT personnel • Business personnel …are human beings

• Therefore, 100% of data breaches are the result of human activity

June 28, 2016



• A cognitive bias refers to a systematic pattern of deviation from norm or rationality in judgment, whereby inferences about other people and situations may be drawn in an illogical fashion. Individuals create their own "subjective social reality" from their perception of the input.

• An individual's construction of social reality, not the objective input, may dictate their behavior in the social world. Thus, cognitive biases may sometimes lead to perceptual distortion, inaccurate judgment, illogical interpretation, or what is broadly called irrationality.

June 28, 2016



External driver • Have not yet been breached

Perception • It’s not going to happen to me

Manifestation • Don’t properly test countermeasures

Cognitive biases • Normalcy bias: The refusal to plan for, or react to, a disaster

which has never happened before • Neglect of probability: The tendency to completely disregard

probability when making a decision under uncertainty

June 28, 2016



External driver • Others are breached

Perception • Bad things happen to other people, not me

Manifestation • Failure to prioritize security and plan for a breach

Cognitive biases • Optimism bias: The tendency to be overoptimistic, overestimating

favorable and pleasing outcomes • Ostrich effect: “If I can't see it, it doesn't exist”

June 28, 2016



External driver • Industry experience

Perception • I have been doing this for years—don’t tell me how to do my job!

Manifestation • Lack of realistic understanding of the threat landscape • Focus on non-impactful issues

Cognitive biases • Curse of knowledge: When better-informed people find it

extremely difficult to think about problems from the perspective of lesser-informed people

• Parkinson’s Law of Triviality: The tendency to give disproportionate weight to trivial issues

June 28, 2016



• Data breaches are usually framed as technical failures as opposed to human failures

• Evidenced by the myriad of checklists used in information governance and compliance

• Contain security controls • Do not contain any notion of strategy, decision making, or

staffing • Therefore, solutions are usually framed in the same way:

technical solutions to solve a technical problem


June 28, 2016



HW Heinrich’s Theories of Accident Causation and Prevention proposed that:

• Eighty-eight percent of workplace accidents were caused by unsafe acts

• Ten percent of workplace accidents were the result of unsafe equipment or conditions

• Two percent were unavoidable

June 28, 2016



1. Lack of technical knowledge 2. Failure to utilize the system

as it was intended 3. Failure to properly utilize

prevention mechanisms 4. Failure to follow standard

operating procedures 5. Failure to implement

appropriate configuration settings

6. Failure to establish a proper defensive posture

7. Interaction with critical computing assets

8. Failure to adequately comprehend the threat landscape

9. Failure to implement proper security control mechanisms

June 28, 2016



June 28, 2016



98%

The Cognitive Clash

June 28, 2016


The Cognitive Clash

“Insanity: Doing the same thing over and over again and expecting different results.”

June 28, 2016


The Cognitive Clash

June 28, 2016


The Cognitive Clash – The Battle Plan

1. Admit 2. Identify 3. Automate 4. Learn 5. Hire

June 28, 2016


The Cognitive Clash – The Action Plan

1. Realize there is a problem, and that we are going to do something about it

2. Garner/provide top down support 3. Identify cognitive biases, and implement a mechanism to

overcome them 4. Understand that there is and ROI for security 5. Understand that GRC regimes are a part of the solution, not

the entirety of it 6. Look for wisdom in other areas 7. Institute a “train as you fight” security philosophy 8. Create a culture of security minded employees 9. Realize security is a journey, not a destination 10.The marriage of human intelligence and technology is the

key to success

June 28, 2016


The Cognitive Clash – The Escalation of Commitment and Conservatism Bias

1. Escalation of Commitment - the pattern of behavior in which humans continue to rationalize their decisions and behavior, even when they cause clearly negative outcomes, rather than alter their course.

2. Conservatism Bias - the tendency for humans to insufficiently revise their beliefs even when they are presented with compelling new evidence.

3. Humans do not like to admit fault for anything

June 28, 2016


The Cognitive Clash – The Escalation of Commitment and Conservatism Bias

Are we mentally and emotionally mature enough to push beyond our cerebral programming and alter our destiny?

A Summation of the Psyche

June 28, 2016


A Summation of the Psyche

Questions?

June 28, 2016


Special Thanks

Chris Wright, Ph.D. President/CEO Reliant Talent Management Solutions Rob Caillet EHS & Security Manager GE Manufacturing Solutions Colin McIff Health Attaché to the US Mission to the UN in Geneva World Heath Organization BG Allen Principal BG Allen Consulting

June 28, 2016


References

• BakerHostetler, Data Security Incident Response Report 2015, May 2015 • Michael Carroll, “Part Human, Part Machine, Cyborgs Are Becoming a Reality”, Newsweek, July

2014 • George Dvorsky, “The 12 cognitive biases that prevent you from being rational”, io9, September

2013 • Experian, 2015 Second Annual Data Breach Industry Forecast October 2015 • Sydney Finkelstein, “Why Smart People Make Bad Decisions”, Harvard Business Review,

February 2009 • FireEye Threat Intelligence Reports • Herbert William Heinrich, Industrial Accident Prevention: A Scientific Approach, McGraw-Hill, 1931 • F. Heylighen, “Occam's Razor”, Principa Cybernetica, September 1995 • Identity Theft Resource Center, 2015 Data Breaches, January 2016 • Ari Kaplan Advisors, Defending Data: Turning Cybersecurity Inside Out With Corporate

Leadership Perspectives on Reshaping Our Information Protection Practices, December 2015, • Hans Moravec, ROBOT: Mere Machine to Transcendent Mind, Oxford University Press, October

1998 • Frank Pennachio, “Going beyond the Limits: A 10-Year Study Conducted by DuPont Found That

96 Percent of Accidents at the Company Were the Result of Unsafe Actions by Employees Going beyond Their Limits, Rather Than Unsafe Conditions”, Occupational Hazards, September 2008

• Ponemon Institute, 2015 Cost of Data Breach Study, May 2015 • Verizon 2015 Data Breach Investigations Report, July 2015, • World Health Organization, Report of the Ebola Interim Assessment Panel, July 2015

https://www.bakerlaw.com/files/uploads/Documents/Data%20Breach%20documents/BakerHostetler-Data-Security-Incident-Response-Report-2015.pdf

http://www.newsweek.com/2014/08/08/cyborgs-are-walking-among-us-262132.html

http://io9.gizmodo.com/5974468/the-most-common-cognitive-biases-that-prevent-you-from-being-rational

https://www.experian.com/assets/data-breach/white-papers/2015-industry-forecast-experian.pdf

https://hbr.org/2009/02/why-smart-people-make-bad-deci.html

https://www.fireeye.com/current-threats/threat-intelligence-reports.html

http://pespmc1.vub.ac.be/occamraz.html

http://www.idtheftcenter.org/ITRC-Surveys-Studies/2015databreaches.html

http://www.nuix.com/analyst-briefs/defending-data-report-2015

http://www.nuix.com/analyst-briefs/defending-data-report-2015

http://www.frc.ri.cmu.edu/%7Ehpm/book97/ch3/retina.comment.html

https://www.questia.com/magazine/1G1-186902540/going-beyond-the-limits-a-10-year-study-conducted



http://www-03.ibm.com/security/data-breach/index.html

http://www.verizonenterprise.com/DBIR/2015/

http://who.int/csr/resources/publications/ebola/report-by-panel.pdf