‘The first step in any prevention and protection action is to understand the threat’

Yaron Dycian, Head of Products – Identity Protection and Verification, RSA, in conversation with Nivedan Prakash talked in detail about Internet security and online fraud network prevalent in the market today.

Yaron Dycian

For the Internet is to become a safer place, why is it imperative to understand the trends and developments taking place in the Internet threat landscape and maintain online security best practices?

The Internet is rapidly becoming the primary ‘playground’ for organized crime for a number of reasons—theft is relatively easy to perpetrate. It is much easier to steal money online than, for example, rob a bank. Online fraud is also international, so a fraudster located in Nigeria can easily defraud an Indian bank. There is a lot of money online. Practically every bank account and every e-commerce transaction are out there. And every company now has online presence, sometimes giving employee access to sensitive corporate infrastructure that could be abused by fraudsters.

Besides, it’s a safe crime. No online fraudster will be shot at or physically hurt while stealing online. Furthermore, law enforcement is extremely difficult since online crimes cross countries and borders and law enforcement agencies need to coordinate complex investigations and prosecution efforts. Most online fraud goes unresolved and unprosecuted. These elements make online fraud an almost ‘perfect crime’, and are driving its proliferation worldwide.

The first step in any prevention and protection action is to understand the threat. By knowing how fraudsters operate, both from the technology perspective and the perpetrators mode of operation, effective defenses can be designed. We have been studying and penetrating fraudsters’ operations through our Fraud Intelligence team and our understanding of technologies such as Trojans, fraud operations, and the social engineering aspects of fraud are the foundation of our success in fighting online threats.

Could you please comment on the fact that the rise of blended threats illustrates that Web security intelligence is a critical component of any email and data security strategy?

Indeed, threats are becoming more complex and sophisticated very rapidly. Online criminals are using combinations of technologies and social engineering with ever growing cleverness. Preventing and protecting from these threats requires very deep knowledge of the threats, as well as an adaptive solution that can easily change as threats evolve.

As an example, Trojans are no longer detectable by anti-virus software because Trojan distributors use technologies that can rapidly alter the Trojan signature, making it all but undetectable by anti-virus technology. These kinds of adapting threats call for solutions based on two core capabilities—one is the real time intelligence on threat operations and technologies, and secondly, rapid adaptability to the threats.

The convenience and ease of conducting financial transactions with a single click is increasingly witnessing online banking coming of age in India and many other parts of Asia. As a result, these geographies represent a ripe new market for cyber criminals who look to launch online attacks and commit fraud. What are the strategies of RSA to mitigate such risks?

RSA mitigates financial fraud by providing a layered approach that prevents fraud in areas of the fraud supply chain:

• RSA’s Fraud Intelligence service specializes in collecting information about criminal activities and stolen credentials. Customers of this service receive information on targeted attacks and fraudster plans against them, as well as data—such as login credential—stolen from them and their customers.
• RSA’s Anti-Trojan and Anti Phishing services protect from these threats through fast detection and shutdown of phishing sites, and by preventing Trojan infections through RSA’s network of blocking partners.
• RSA’s adaptive authentication protects financial institutions against account takeover attacks by identifying risk and protecting banks from unauthorized access. Multiple authentication mechanisms are also available to prevent such attacks.
• RSA’s Transaction Monitoring solution monitors granular activity performed within the account to detect risky actions such as large money transfers.

Additionally, RSA runs the eFraud Network—the world’s biggest network for the prevention of fraud.

Why is it necessary for the financial institutions to establish a layered approach to security which is seen as a key to lowering the overall risk posed by phishing and other online threats?

The fight against online crime is an ongoing, ever-evolving battle. Just like physical banks deploy vaults, alarm systems, and guards, so too does online crime require a multi-layered approach since no single solution can stop all fraud. The sophistication of fraudsters and their evolving attacks mean that to ensure that risks are stopped, a combined approach that includes collection of intelligence, protection of the perimeter, monitoring of actual activity, and adaptive authentication tools. This ensures that penetration of one layer will be blocked by the next defense mechanism.

Could you provide an insight on how the fraudster network works, their business model, the latest technologies they have access to, and the latest threats that Internet users are exposed to?

Online threats have traditionally applied to financial institutions—mostly credit card and online banking fraud. Recently, however, fraudsters have starting collecting information about enterprises and gaining access into various organizational systems such as finance and HR systems. This expansion of the fraud threat is a very alarming trend, as it means that every organization is now being targeted by fraudsters.

Harvesting fraudsters are experts collecting information such as user credentials, logins into companies’ internal systems, credit card data, and so on. These fraudsters use techniques such as phishing, Trojans, etc. Cashout fraudsters know how to turn this data into cash. They run fake companies, mule networks and other human-based operations that can convert the information collected by the harvesting fraudsters into a profit.