Cybercrime Analytics

CYBERCRIMEANALYTICS TheNewWayToDisruptCybercrime CYBERCRIMEANALYTICS1 ADAPTINGTOTHENEWREALITYOFCYBERCRIME henitcomestoconfrontingthenewrealityofcybercrime,theoptimalwaytobridgethegapbetween cybercrimeandcybersecurityisaccessingthesame informationthatcriminalshave–distilledintoonlythemostactionabledataforyour specificenterprise. ACTINGSWIFTLYONWHATCRIMINALSKNOWABOUTYOURBUSINESSANDYOURCUSTOMERSISNOWTHEONLYWAYTOBEATCRIMINALSATTHEIROWNGAME. Despiteincreasingbudgetsforcybersecurityandfraudpreventionandthewidespreaduseofthreatintelplatforms,securitymonitoringtools,EDR,phishingdetection,andanti-fraudsignals,90%oforganizationswereaffectedbyransomwarelastyear. Criminalsspreadmalwarelikewildfire,identityfraudcontinuesitsupwardtrajectory,anddatabreachesremainatnear-recordlevels–andthat’sjustwhatwecantrack.Manysecurityandfraudprofessionalsbelievethescaleofcybercrimeismuchmorethanwhat’saccountedforinourmodelstoday,andhasthepotentialtodestabilizemarketsandevensocietyasawhole. Theextremegrowthincybercrimerequiresanewapproach.It’snolongerenoughtogatherintelligencetounderstandabroadthreatlandscape.Withoutrelevant,actionableanswersaboutwhatdatacriminalsareusingnowtotargetabusinessanditscustomers,securityandanti-fraudteamsareflyingblind. Enterprisesmustchooseapartnerthatcandynamicallyandcontinuallysurfacetheseinsightsfromthecriminalundergroundwithspeedandactionabilityattheforefront.TheonlyanswerisapartnerofferingCybercrimeAnalytics. ThispaperdefinesCybercrimeAnalyticsandwhythisapproachisdisplacingtraditionalthreatintelligence,howitisadditivetoanti-fraudtechnologies,anditsusecasesandbenefitsindetail. CYBERCRIMEANALYTICS2 CybercrimeAnalytics WHATISCYBERCRIMEANALYTICS? >>> AutomatedAnalytics thatDriveActionfromCybercrimeData It’sthemostadvantageousapproachtodisruptingthecycleofcybercrimebecauseitenablesfaster,moreconfidentactionbasedondeepknowledgeaboutuserexposureinthecriminalunderground.Itrequiresconstantaggregationandlinkageofbillionsofdatapointsaffectingmillionsofonlinepersonas,resultingindistilledinsightsthatcanbeeasilyconsumedincommonsecurityandanti-fraudtoolstodriveremediation. CybercrimeAnalyticscanonlybeaccomplishedwithascalableenginethatcollects,processes,enriches,andanalyzestheoutputsofcybercrime.Those‘outputs’arethestolenassetsfromthird-partydatabreaches,malwarevictimlogs,andothersourcesthataretradedandsoldonthedarknet–datarangingfromusernames,passwords,andsessioncookiestosensitivePIIlikeIPaddresses,physicaladdresses,financialinformation,passportdata,driverslicenses,andsocialsecurityornationalIDnumbers.Comprisingmorethan200datatypes,it’severythingthatmakesupaperson’sdigitalidentitythathasbeenleakedinabreachorexfiltratedfromaninfostealer-infecteddevice.Thescaleismassive,andasaresult,linkageisrequiredtomakesenseofit,andtomakeitusefulfortheteamswhoneedit. CLEAR ACTIVEWEBSESSIONS APPROVE TRANSACTIONS RE-SECUREVULNERABLE ACCOUNTS FLAG POTENTIALSYNTHETICIDENTITIES Butthedataisn’tpackagedinawaythat’simmediatelyusefultoanyone–notevencriminals.Onedatabreachcouldbe100,000files.It’sspreadacrossraw,unstructuredformatsthatrequireprocessingandtimetomakeituseful,sospeedisanessentialpartoftheequation.It’saracetoseewhocanactonthedatafirst:enterprisesorattackers. SpyCloudputsahugeemphasisonspeedwhenitcomestorecapturingthesecybercrimeelementsfromthedeepestlayersofthedarknet(asclosetowheretheoriginalcrimeoccurred)–aswellasaddingvalueateverystage.Theresultinginsightsarerelevant,correlated,andmachine-readable–tyingdisparatebreaches,malwareinfections,affectedapplications,andidentitydatatogetherforindividualsacrosstheirentireonlineidentity. CYBERCRIMEANALYTICS3 WHAT DO CYBERCRIMEANALYTICS REVEAL ANDWHAT CANBEMADEASARESULT? 4 CYBERCRIMEANALYTICS MALWAREDETECTED CREDENTIALSANDSESSIONCOOKIESEXPOSED 3UNIQUEEMAILADDRESSES @ PLAINTEXTPASSWORDS EXPOSED 50%PASSWORDREUSE LASTEXPOSED24DAYSAGO FINANCIALDATAEXPOSED LEAKEDIN1BREACH MEETJON Here’shishighriskprofileaccordingtoSpyCloud’sCybercrimeAnalytics. ACROSS8BREACHESAND1MALWAREINFECTION,WE’VELINKEDJON’SEXPOSEDDATATODETERMINE: Hehas3uniqueemailaddresses. Hisplaintextpasswordshavebeenexposed(andincludedin2combolists,whichputhisaccountsatriskofcredentialstuffing). Hereusesthesamepasswordacrossmultipleaccounts,workandpersonal(50%reuse). Heusedamalware-infectedpersonal/unmanageddevice1monthagotologintocriticalworkforceapplicationsincludingacoderepository,chat,andprojectmanagementsoftware–exposingbothcredentialsandsessioncookiesfortheseservices. HissensitivePII,includinghiscreditcardnumber,wasleakedin1breach.Thelasttimeweingestedhisidentitydatawas24daysago. CYBERCRIMEANALYTICS5 TAKINGACTIONONCYBERCRIMEANALYTICS ArmedwiththesameinsightsaboutJon’sexposure,securityoperationsandfraudpreventionteamscanenhancetheirdecisioninginthefollowingways: THESECOPSTEAMATJON’SEMPLOYER ConsiderJonanunwittinginsiderthreat,exposingthebusinesstoriskofaccounttakeoverorworse–ransomware. ReachouttocoordinatePost-InfectionRemediationofJon’smalware-infectedpersonaldevice,recommendingananti-virussolution,thenresettin