As governments and businesses continue pivoting towards a fully digital world, information security threats continue to grow exponentially. In their workshop: The Anatomy of Cyber Crime, Ankura’s Kajen Subramoney and Yousif Almuzayen discuss today’s cyber landscape and rise of attack attempts post the COVID-19 pandemic as organizations continue to grow their online footprint. They also discuss the stages of cyber-attacks from reconnaissance, penetration, exploitation to defense mechanisms against common attack attempts.

Subramoney and Almuzayen share insights using two case studies of cyber incident response investigations they supervised, and the common patterns threat actors used to commit their crimes. Furthermore, the workshop aims to establish an understanding of sufficient response that follows a cyber incident, such as digital forensic and incident response team composition, playbooks and planning to ensure business continuity, how quicky DIFR teams can respond to future incidents, and how to effectively and strategically communicate with stakeholders in times of crises.

Additionally, the Ankura team will discuss cyber risk controls and potential solutions executives might need to consider, such as virtual CISO (vCISO) and proactive intrusion monitoring and detection.

Workshop Structure

1. Introduction – Speakers Background
2. Today’s cyber environment (statistics on targeted entities, top causes of cyber-attacks, and rise of number of attacks post COVID-19 pandemic)
3. Stages of Cyber attack
   1. Reconnaissance
   2. Penetration (BEC, obtaining Email Access)
   3. Exploitation (data leakage, ransom encryption, or denial of service)
   4. Defence (Proactive intrusion detection, BCP and Governance)
4. Case Studies:

• Case 1: Reconnaissance – The Modern Bank Heist
• Case 2: Impersonation – The Man-in-the-Middle Owning Your Emails

Cases discussions:

-What was the response for such incidents like?

-Is there a dedicated DFIR team?

-Are there DFIR playbooks / plans for different types of incidents?

-How quickly can the DFIR team respond to different types of incidents?

-How can you effectively and strategically communicate with your stakeholders in times of crises?

-Continuous monitoring: Proactive Detection, vCISO for remote locations or SMEs. Ensure policies, processes, and procedures are in place to effectively mitigate against risks and threats