Sign Banking Form Montana Computer

Industry sign banking montana form computer

[Music] let's kick it off so here's the agenda that we're going to talk a little bit about today brandon's going to give us kind of a forward here and some some high level takeaways and then we're going to jump into the report itself where we're going to talk about some of the laws in montana the number of montanans that were affected by cyber breaches and look at it year over year the average length of those breaches the number of organizations and then we'll wrap up by looking ahead and so folks will kind of put a wrap on it at the end i'm happy to answer any questions as they come forward throughout the webinar so don't hesitate to send those in but now i'll hand it off to brandon for a little bit of an intro let me get off music uh thanks chase uh yeah so basically i just kind of always like to start uh any presentation we do it's kind of a why statement why are we here what's the purpose of this and um well what one i think we're all here and the great audience that we have i'd like to thank one jace for for putting this together i think this is our third year doing this um and his presentation and the data he's pulling and what we're extracting from it keeps getting better and better so kudos to you jay jayce for doing that uh and thanks to the high-tech business alliance i think we have a great audience today because of their um you know sharing sharing the message that we have and i think we've been a partner for uh at least five years with the high tech business alliance and so thank you to you guys for adding value to all of us and that's what we're going to try to do today is that's value back to to the group and those of you that are part of the business alliance that's great as well we're just here to add some value and uh hopefully we create some conversations with you and your organizations and and your peers and um see if we can all get better because of it so uh you know main points i have is we want to raise awareness with data so uh we've been doing cyber security type of conversations for a long time uh we've gotten better and better every year uh i noticed the fir the very first one i ever did all i did is just scare everybody i just scared them with a ton of things that we're seeing and i really didn't give them much from a data perspective or really any kind of guidance of where to go um so that's a big thing for me is i want to raise awareness and i want to raise awareness of data i want to learn from each other uh i we don't claim to know everything and i see everything in a cyber security but it's an ever-changing battle um that you're we're facing those same battles with you so we want to learn from each other what what some of you are doing some successes some failures and uh just be stronger together and then the other thing is just brainstorm some resolution strategies so that's another thing that we've learned over the years of doing these these uh presentations uh it's one thing to to scare and give a bunch of information show how how complex this problem is but we realize we need to give some ideas of what we can do what could you leave here with that you could take on on your own in your own organization or you could reach out to a company like ours to to help you out uh to to solve the problems go ahead next slide james so this is just a quick slide uh and then i'm done which is is good for everybody um about who painkov is so we've been in business for 28 years uh we've evolved as it the it industry has evolved as you can see we're we're spread spread out across the region and uh currently we support about 25 000 users a day uh across a lot of different verticals uh and a lot of different sizes so uh we've just seen a lot of things we don't know all the answers but we got our buds kicked a lot in the it industry so we we have a lot of experience of some things to do and some things not to do um and then uh just to just some of our our solutions and kind of who we are we really try to fill in the gaps for the underserved organizations and that really started very simple and we you know we got our start in the in the public sector arena you know schools uh municipalities where ic staffs are not robust but one thing we've found is as cyber security threats have evolved and just ideas evolved we're all underserved i mean i i doubt if you ask yourself do you feel like you're you know fully you know you have a staff that can handle the day-to-day battles of cyber security rit we all could use more help and so what we found is the verticals and the sizes that we've grown into has grown because we've we're all in this battle together of not having enough resources to battle uh the things that we're seeing day in and day out so um you can see from our services obviously we we provide different solutions and really how you can think of us is we don't develop anything we go out and try to find the best solutions out in the industry and bring those to our customers so whether that's inside the cyber security field uh infrastructure you know wired and wireless networks um communication physical security um just all the different things that go into an i.t portfolio we try to come in as a consultant to our customers and provide some experience and some recommendations um so that's us and we'd love to to talk further with anyone we have some kind of some action items at the end that certainly we can we can jump in and add some additional value to you to your organizations but um that's it for me and i'll kick it back over to jase all right thanks brandon okay let's dive in so before i dive into to some of the numbers that we're going to talk about uh i just wanted to share my email address there we've been expanding this report for the last three years it's gotten better more information every year but and we have some some plans for next year's as well but we love feedback here we're blessed to have some data to look upon most of the data that you're looking at when it comes to national reports and things like that are based off of surveys this is concrete data that's actually reported to the montana department of justice and so we're kind of blessed to have this and have some takeaways on a yearly basis but as we kind of go through the data if you have any thoughts or ideas on things you'd like to see in the future feel free to email me or contact us through our website love to brainstorm or collaborate with anyone out there that has ideas on this having said that let's jump in so let's take a look at why do we have this data it goes back to 2015 when montana implemented a law requiring all organizations to report data breaches to the office of consumer protection and then this information is uh shared and available on the montana department of justice website so if you download the montana cyber security report link is in the chat you can actually there's a hyperlink to where we get get this information from so if you do want to do some some own some of your own exploring into that data you know you can definitely do that on the you know pulling that data from the montana department of justice website so some of the things they're required to report include a copy of the consumer notifications they sent to anyone that was affected they report the number of montanans that were affected there's no lower limit so if even one montanan is affected they have to report it to the montana department of justice they also report when the breach started and ended and the length of the breach and their organization name i think that's that's pretty much it so that's the data that we we use to pull this report from a few notes about it before we dive in so the first one is that the information isn't necessarily comprehensive so it's not a significant number of organizations but we do see it some organizations will say well i know montanans were affected but i don't know how many so how do we analyze that data it could be one montana it could be a thousand or hundreds of thousands of montanans so what we do when we come across that when analyzing the data is we just count that as one montanan so it's the best we can do we don't want to inflate the numbers at all um but keep that in mind as well like i said it doesn't happen a lot but it's worth noting the second point here is this information is only as accurate as it's reported to the montana department of justice so it kind of leaves you to wonder how many organizations don't report that sure there's a law out there that requires them to but how many fall through the cracks and don't report i'm not sure but just kind of something to consider as well and then the start and end date the start date of the breach and the end date of the breach have to be reported but often it's estimated so not perfect information but it's the best that we have and it's still valuable as you'll see in the in a little bit when we go over it and then throughout this presentation we'll look at year-over-year graphs comparing some of the numbers and the change year-over-year well this law went into effect mid-2015 and i think they started publishing the results of different breaches in i think august of 2015 so we've included 2015 on the different year-over-year graphs we're going to talk about but it's not going to be comprehensive of the whole year so keep that in mind as well chat section uh oh so someone's asking for a link to the report so if you go to our website pinecc.com it's under resources we'll also send out a link to it after the webinar is over if you don't see the chat section there right next slide so before we dive into the into the uh into the numbers one other note here is the state in 2019 invested in a project they have going on called the montana cyber security enhancement project so i think between 2019 and 2023 they're spending 6.3 million dollars to improve the state's cyber security protection which is interesting right as businesses that operate in the state it's kind of makes you raise your eyebrows a little bit well if the state is investing that much money and to prove improving its security posture maybe we need to look at it as well you can see here this quote on the second bullet point is pulled directly from the piece of legislation where they're restricting the expenditures of that 6.3 million dollars to everything in that list so next generation antivirus staff student programs firewalls email threat monitoring compliance software etc so they're doing some significant audits and improvements of their cybersecurity posture which i think is something that's worth noting and i think that they're setting a good example here that uh threats are evolving pretty significantly and it's time that we need to evolve our security as well so this will uh it's hard to find you know we'll continue to research and monitor uh those expenditures as they go through and try to report on some of them through our blog at pineco pinetc.com but it's clear that they have realized it's a it's a priority and it's a good thing that they have because we could pull up dozens of of government entities that have suffered breaches in the last years a few years so there's that note and with that let's dive into the numbers that were seen this year so uh in 2020 we're starting off on kind of a a good note but good is is pretty relative in this situation a total of 82 531 montanans fell victim to a data breach in 2020 um that may not seem like a good thing and it to be honest it's not really but if you look at it relatively to the previous year in 2019 where there was 233 500 montanans that fell victim to a breach right it looks it looks a little bit better so uh there's a few notes here though um we're gonna talk about this in one of our future slides but although the number 82 000 is significantly lower than in 2019 in both 2019 and 2018 we saw a few outliers of massive cyber breaches that kind of bolstered the numbers there so we're going to kind of make note of that as well but i suppose it's it's worth you know it's better to be 82 000 than up around where we were last year so so that's some good information when you're looking at the at the numbers in more detail there was one major breach in 2020 that affected 32 000 montanans and then there were everything else was more of a smaller breach um not affecting when i say smaller i mean not affecting is a greater such a great number of montanans but we're seeing kind of a bit more spread spread out across a larger number of organizations which we'll talk about in a future slide you'll be able to see what that looks like but let's talk about this largest data breach it's not often we get to understand what these breaches are you know is it what variant of of cyber attack is it and how did it operate we don't really get that information but uh with this one we did so this was the largest breach that affected the greatest number of montanans in 2020 happened to morgan stanley it affected 32 370 montanans so over a third of the total number of montanans affected in 2020 and it's a crazy story we have this information because of a lawsuit a class action lawsuit that's pending so some of this information has uh become public but basically um the social security number the account numbers the passport number contact information date of birth asset value of the of the holder and all the holdings data were all leaked for all those montanans and and we don't know how much that is nationwide but for one breach in affecting 32 000 in montana alone you've got to think it's pretty significant nationwide or even globally so kind of a scary attack here that we saw as i mentioned there's a clash action lawsuit pending and so it's it's good that we kind of get this story because we don't get a report on too many stories of how it happens but basically what happened with this breach was morgan stanley was shutting down two of their data centers they hired a vendor to remove all of their customers data from the equipment they learned that the data wasn't was not fully wiped clean by that third-party vendor so my gut reaction was well maybe morgan stanley doesn't deserve all the flack from this breach but then you kind of read a little bit further and not the data that was on their equipment was unencrypted as well so you know a little bit of negligence there maybe so basically what happened is they had shutting down the data centers the third party didn't wipe all the data so how did it fall into the bad hands well we don't really know but morgan stanley has said quote the equipment is missing so that equipment that didn't get wiped fully clean and wasn't encrypted it went missing and it's now been leaked and the equipment and servers has now the the data on it has uh unauthorized third third-party users that have access to that data which they can use to steal identities make fraudulent purchases um and you know among other things as well so uh it's a it's a bummer that that happened for sure affected a large number of montanans and you just we don't know how many that how many people were affected nationwide or globally but a significant attack there um before i talk about the uh the year-over-year statistics i thought i'd share some data that i found as well so what do they do with this data well according to forbes and statista we have an idea of the market rate for some of these line items of customer data so this varies significantly right if you have the account number um of someone someone that has more money in their account that account number is much more is worth a lot more than someone who doesn't have a lot of money in their account so this varies but this is kind of the averages that we saw from from those two articles um so for account numbers alone they're going uh their their going rate is about 259.56 on average social security numbers are going for about four dollars a pop and then the passport information is 18.45 per uh passport if you can get a hard copy of a passport it's like a thousand dollars but uh for just the information you get about 18 and a half interestingly social security numbers used to be worth a lot more money but uh which i kind of raised my eyebrows with that when i saw that number only four dollars but apparently when the equifax breach ha pened in 2018 it flooded the market with social security numbers and so they're just not worth as much uh today as they used to be but anyway looking at so so this the account numbers the social security number the passport information um those are all those were all part of the morgan stanley breach so if you kind of break that out and just assume on average they made 282 dollars per person well the hackers that were able to exploit those montana's information made over nine million dollars just from the montana information they were able to gather so quite a payday for them and that's montana only we like i said we don't know what that looks like nationwide or globally so there's a there's a market out there for sure for this information and it's kind of scary but uh you know it's we have to talk about it you have to stay educated on the threats and you know we don't like to scare people into cyber security or anything but uh the facts are the facts right so we're just reporting on the facts let's look at it uh year over year now so before i do that let's cumulatively since this information has become public in 2015 899 000 montanans have been affected by a cyber breach and that can range from uh email and password getting leaked to what some of the information we saw in the morgan stanley breach of social security numbers and bank accounts etc so uh if you were to assume that each one of the montanans affected was a unique individual which obviously that's not true but for the sake of a hypothetical if you do assume that each one is unique that would mean that 89.4 of all montanans have fallen victim to a data breach in the last six years which is just crazy uh it's kind of mind-boggling um so look at looking at the graph there you know 2020 looks pretty good but i put some numbers there at the bottom there was a montana hospital system in 2019 um so in 2019 you know we're looking at about 230 000 i think it was uh overall and 126 000 of those came from one breach in uh to a hospital system in northwest montana so uh a bit of an outlier there and then in 2018 we have equifax so even you know even though we're looking at i think it was about 420 or 30 000 montanans affected that year 377 000 of them came from that one equifax breach so there are some outliers there that kind of skew the data um to maybe make 2020 look better than it actually was but overall you know we're going to take the the little victories that we can hear and and be happy that um that we have the uh the numbers that we did this past this past year in 2020 i see some questions coming in i'm going to get to those after i present the data if that's all right i just think it'll be easier that way um so yeah i think that in 2019 and 2018 we saw some numbers that negatively skewed the data um but it is what it is right so so that's what we're seeing now we're going to look at the length of cyber breaches so this is an interesting thing to think about because i had never really thought about the length of a cyber breach ever you know i kind of just i'm not i don't come from a tech background but i just kind of assumed that organizations would get into your network and then get what they want and leave but that's that's that was naive of me to think and the data is also confirming that so in 2020 the average number of days an organization suffered a cyber attack was 77 days so from the time that the bad actor penetrated their network to the time they were eradicated from their network on average was 77 days that average is down from 116 days in 2019 and 93 days and 2018 but uh the longest data breach ever reported um in the what is it six five years now we have this data came in 2020 and i'll talk about that on the next slide here as well so it's good to see you know initially it's good to see that the number is decreasing but it also seems a little naive to applause that the numbers at 77 days on average obviously that a bad actor can do a lot of damage in a few hours let alone 77 days within your network so um like i said i think this is an important thing to talk about something we don't talk about a lot in cyber security in my opinion but you got to think about even if you have all the protection to protect your organization from getting hit by a cyber attack you probably should have a plan for if it does happen and so you can remediate it and get it out of your your network as fast as you can as well jason i had something there so you know i think the we hear it a lot when we talk to organizations of you know hey knock on wood thank goodness we haven't been hit yet and the problem is that's great if that's true but how do you know and i think you know we're a lot of us are very very familiar with ransomware at this point where it's very cause and effect it's in your face they want you to know and they want something in return um but these more of you know intricate kind of attacks where they're just going to get into an entry point and work horizontally and start doing a number of different things an example that we see a lot is in the title industry uh and probably many of you have seen an example of this or you've maybe seen your title where real estate companies kind of bolster up how they how they do these things but they'll get in and just start learning how a user is interacting with their clients and so you know they'll they'll obviously steal email signatures and all those things to become that person but also just send out information you know looking at calendar appointments and saying oh i have a closing at 1 pm today 15 minutes before that closing i'm going to email that customer as you and say we've changed how we're going to close and we're going to move this to a wire and we need you to wire you know 300 000 to this account and so that's where these long term type of breaches they're just building more and more things they can do one it's extracting data you know they just they'll stay in there and extract all kinds of personal information they can but the other ones are just trying to become you become you as either the the operator in the in the organization or the key stakeholder that they can take advantage of so there's really two ways this can happen some are very in your face like a ransomware others are very discreet and want to be hidden and want to make very little noise and i think the sophos crew will talk more in depth with that but that's just kind of more of the the details of of why these are happening for such a long period of time thanks brandon uh well you were saying that i was able to look at some of the questions so i'll answer to a few of them right now um uh cheryl you asked uh you know you said you download the the form but you weren't able to get a direct link to it we i'll send everyone a direct link to the report so you don't need you know if you are having trouble accessing the report i'll send a direct link to the report itself um following the webinar in the next day or two and then uh jenny asked how long does it take to have the information about all the 2020 breaches well we kind of scrape that data from the website so if you download the report you'll see a hyperlink to where we get the data from and then we kind of scrape it and compile it so hopefully that answers those questions keep them coming if you have any more i think there was another one that said uh has the cyber threat increased with more people working from home eric and anthony i'm gonna i'm gonna have you answer that when once we get to your portion of the presentation i'm going to talk a little bit about it at the end of my presentation um but maybe it's something you can touch on as well when you have your time it towards the end keep the questions coming if you have any more happy to answer them going back to this so looking at the length of the cyber breaches through the years so hard to you know there's not much of a trend line there also keep in mind like i said at the beginning the 2015 data is incomplete i put it on there because we have the data but it's only for i think a third of the whole year so you know keep take that with a grain of salt but uh you know the trend line maybe is going up a little uh there was a really bad year in 2017 lucky to see that that number come down a little bit in 2020 so looking at the data from 2020 though 31 of the attacks lasted one day the other 69 of the attacks lasted more than one day so you know more than you know two about two thirds of the time maybe a little more we're seeing the attacks happen where it's not just in and out of the network it's lingering around for for several days or years um unfortunately and then i said that i said this in a previous slide but the longest ever reported data breach in all the montana data we have that we scoured through was reported in 2020 and the start date was in 1995. the end date of the breach was in 2020 it was a 25-year long cyber attack where they had bad actors within their network and this wasn't a montana-based company it was a california law firm i believe but uh you know those californians getting us again but uh but it did affect i can't remember how many montanans but a lot of montanans and obviously they had a bad actor in the network for 25 years there's a lot of damage that can be done there it's kind of eye-opening crazy looking at the organizations that were affected by breaches in 2020 this was i feel like our graphs have been pretty good up to this point but this one's not going to be very pretty uh records 684 organizations fell victim to a cyber attack in 2020 that affected at least one montanan this is up more than 150 from 2019 where there was 514 total i mean when you're looking at a list of 684 organizations you can find a company from every single vertical in it basically but when filtering by the attacks that affected the largest number of montanans we saw the industries of cpas retail stores law firms tech firms consultants as kind of being some that kind of stuck out to us as being the most affected but like i said it's it's not like they're targeting one industry in particular we're seeing it across every industry those are just some of the ones that stuck out as in the larger breaches the two largest breaches that happened in montana to montana organizations happened in ravalli and missoula counties and affected about 4 000 montanans um total between the two of them and uh you know we talk about like morgan stanley and there's like 32 000 montanans affected but overall there was 82 000 montanans affected in 2020 and across 684 organizations you know average that out it's not a significant number of montanans but it doesn't take a significant number of montanans per data breach to do some serious damage and we saw that with some of the the information about what those what those different data points are selling for earlier so looking at this year over year uh 33.1 percent increase when you compare 2020 to 2019 and 66 percent increase comparing 2020 to 2018 so not the trend we want to see here um but there's a few takeaways i'd like to kind of point out first of all cnbc reports that when an organization faces a data breach on average it costs 200 000 that average obviously varies significantly but even that number doesn't account for things like shutting down if you have to shut down for re remediation um the cost of your loss data and if you need to restore that and then kind of something that's more invaluable to to calculate uh your reputation damage that can come as a result of that as well so another takeaway for me is rural states are not exempt you know we've heard this before we work in montana with a lot of organizations we're based in montana and sometimes organizations like to balance and uh you know the risk of of getting attacked with the protection itself and we've heard the the thought before that i'm in montana so it's less likely to happen to me well that's just simply not true and the data is showing not to back that up that that's not true montana organizations are getting are getting hit just as much as anywhere else so rural states are not exempt from this at all if you're not in montana and you're on this webinar and you're in one of the rural states that we work in as well you know it applies to to what you've got going on too in your state uh next slide looking at this year over year like i said the trend line here is ugly compared to the the other graphs there was maybe some reason we could be a little bit optimistic but this one doesn't leave much room for optimism we've seen a steady increase year over year of on the number of organizations that fall victim to cyber attacks um i i kind of touched on that jump already but we're looking at 412 in 2018 514 in 2019 and now 684 in 2020 so not not some not two great numbers there um but what we're seeing and i think people who are staying educated on cyber threats and you know following the news news around it and things like that are seen that hackers are starting to evolve they're using more sophisticated tactics than they have before and organizations in many instances are lagging behind that evolution and still relying on outdated you know maybe they're just relying on outdated endpoint security as the end-all be-all it's still necessary but it's not going to it's not going to compete with the tactics the hackers are using today and i i don't say that as a way to to scare people into anything i just say it is it's the truth that what we're seeing and organizations need to kind of evaluate their cyber security posture and relate that to the threats we're seeing today from the bad actors and how do they compare and how can we how can we maintain a security posture that's going to protect us against those evolving threats so let's talk about we're going to leave the numbers now because that's pretty much all the numbers we have like i said in the next year we're going to be kind of diving in a little bit more into some more numbers but um you can review all these numbers and the graphs and everything are in the report which we'll send out a direct link to and um we're going to talk a little bit about what we see as threats coming up in 2021 as the next slide so we continue to expect familiar threats to come through um you know things like ransomware but we also expect to see new threats as well some of the specific things we wanted to highlight well there's three specific things we wanted to highlight the first being ransomware i don't think you can really produce a truly factual cyber security report without talking about it ransomware was a significant tactic used in 2020. we especially saw in healthcare industry and in education it's going to continue to be prevalent it's not it's not going anywhere the remote working concerns so you know previously you maybe had uh one network you had kind of this bubble you could form around your office or your within your network and uh maybe you didn't because that's this has been kind of an ongoing thing right covet code ushered it but people have been working from home before that but now you kind of have to expand the perimeter of your security network into every home that you have an employee as well so it presents some unique challenges as more and more people are working remotely and then the last one being non-traditional threats so we don't talk about this a lot because this is more on the consumer level but now that people are working from home it probably does affect more companies but you see users are quick to embrace some of this new technologies you know things like smart tvs or cameras or doorbells or appliances although they're not traditional computing devices they still provide access can provide access to the network and if they're not secured properly so those are three things we're seeing we could probably talk for forever about all the different things we could see and even if we were to talk forever about it i'm not sure we would cover it all as there's going to be things that we can't predict or new variants of cybersecurity threats that we we just don't know exist yet so uh those are three we wanted to highlight specifically that we think are going to be prevalent here in 2021 though and then this is my last sl de so before i hand it off to sophos what are some security measures that we can think about for 2021 uh well attention to detail is the first one so in in 2020 we saw a lot of cyber attacks that were a result of of negligence on the organization's part so they might have the latest and greatest next-gen all the fancy buzzwords uh technology cyber security but if you don't maintain basic hygiene then it's not going to do what it's designed to do so make sure you pay close attention to your products make sure everything's up to date and patched properly and installed where it needs to be installed the second point was we need to prioritize education so it's hard to understand the threats if you're not educated on the threats so we try to do we try to do that at pineco we try to send out a newsletter we post on our blog what we're seeing but i would recommend you know kind of building a list of of different resources you can use as you try to stay up to date on the threats and the different solutions as well because we hear a lot about the threats it's not maybe not as fun to hear about the solutions because they're kind of you know vendors might be like more product pushing and that may turn you off a little bit we try not to do that here at pinecove but um it's important to stay up to date both on the threats and the evolution of the security uh security aspects of of the network and things like that as well then the last point is let's have a plan so we get approached by organizations that face cyber attacks we can mobilize and try to remediate that threat the best we can um but often times people are scrambling and most times you are because how can you prepare against it uh but there are certain things you can do to prepare against and that's what we're kind of talking about here uh who do you need to call to begin remediation what does that look like what measures in place do you have to restore the data you know um you hope for the best but we got to be prepared for the worst so having a plan would be kind of the last bullet point here of things to prepare for um in 2021 there's obviously much more we could talk about but those are kind of what we identified as three of the big takeaways and with that that's all i have feel free to to um chat any more questions that come in if if any more come in i'm happy to jump on uh and answer them in the meantime we will i'll hand it over to sofos we're lucky to be joined by eric and anthony from sophos they are our cyber security partner we've been partnered with them for a long time we are the highest partner that anyone can achieve with them we're a platinum partner which basically means that we know the technology we've been certified in it and we've sold a lot of it um and anthony and eric are going to talk to us about what they're seeing on a global scale and uh and share some statistics on that as well so anthony i'll go ahead and give you presenter abilities thanks jace uh we're just gonna get anthony to share his screen here and i think it'll be a nice compliment to what you just shared with the laser focus on the backyard here in montana where sophos will give you more of a global purview into what we're seeing with the same type of threat data and anthony is our engineer that covers the rocky mountain territory um is dedicated to supporting both the pine cove partnership as well as our customers in montana and anthony why don't you go ahead and take it away yeah awesome thank you very very much g'day all as mentioned i'm going to cover and just go over uh what so first is seeing as a whole globally and get that sort of purview right so we've got that detailed and kind of that that view of what's happening directly and specifically in montana and what's affecting you every single day in your areas in your environments and so now i'm going to cover what we have seen globally and kind of give you some of the statistics that we've seen in a report that we actually created called the state of ransomware now in this report so first we commissioned an end independent uh research house vincent bourne to survey 5000 respondents across 26 different countries and six different continents now these this this sponsored report it's was given to it managers who have had varying different levels of ransomware experience or or contact and potentially even been lucky enough to to maybe even avoid uh some some of that ransomware contact now in saying that we did not pick those respondents they were where they were selected uh not through and from us and the responses were actually provided and anonymously now you'll actually see here we've got quite the broad spread here and you can see the number of respondents per country as well now as we come over to here this is something to note too we didn't just go after specific sectors we actually have a wide range of sectors both public and private and most likely hitting some of those sectors in which you currently function in now with that in each country we actually had a respondents 50 of those respondents came from organizations between 100 and a thousand employees while 50 or 50 percent of those respondents also came from organizations that were slightly larger from that one thousand to five thousand employees as well and that's important to be able to get that understanding of what that spread is so you can see and uh get a little bit more of a personal touch on on what that actually means to you and your organization now this is actually kind of a a kind of a shocking uh result and and and number and it goes hand in hand with the information that that both uh jace presented as well as the uh the survey that actually happened at the start now the question at the start the very start uh starting question and poll that jace put up was regarding uh your interaction or if you know anybody who suffered a data breach in 2020 and 77 of you said yes okay so that that goes quite uh quite closely my hope is that it wasn't necessarily you uh specifically but that you were just aware of it but based on the number that we see here 51 of respondents that replied from this 5 000 said that they suffered a ransomware incident so that would have it to say that probably one in two of you or you know fifty percent if not i mean i see seventy seven percent uh are at least aware but there's a good number of you on this line today that have either suffered and or uh aware of someone that has suffered a that data breach so the big takeaway here is that everyone should be prepared to be hit okay uh brandon mentioned that that uh you know some of those uh he mentioned the line about it's not going to happen to me or or you know um the bat is coming for someone else and it's not it's be prepared to be hit okay so here's actually a frightening thing that uh the question came up regarding work from home now since covered the fbi has actually reported that cybercrime has increased four times so that's just you know just over this last year it has increased four times now you'll notice that size doesn't matter okay so you've probably heard conversations amongst those in the industry that have made statements like oh we're too small or and they're not going to come for us there's bigger fish to fry you know there's there's a bigger fish to catch and and all those kind of different comments reality has it this report has uncovered that it's almost an even split between organizations of one hundred to a thousand and a thousand to five thousand as we see forty 47 and 54 almost an even split right down the center absolute evidence to show that size does not matter there is no catch and release policy as it relates to this big fish and amongst those thieves now according to cove where now cove where it is a uh code was a company that negotiates ransom uh ransomware um ransoms uh across the industry and and they work with customers to negotiate a lower rate or what have you and according to their ceo stats in 2019 in the fourth quarter the average ransomware payment was 84 000 okay so if that's not enough already 84 000 as the average back in 2019 the fourth quarter that has tripled over the the next following 12 month period up to 230 000 so again this is just the ransomware payment now jayce touched on and and had mentioned that 200 000 as a result of the cost of a breach or what have you and so and and that's just sort of just that cost of the breach per se not necessarily he made reference to not necessarily some of the other facts that are and costs that are associated with that with that breach so with that just being the average ransomware payment you have to factor in things like your actual downtime so you'll see that here as an average downtime for ransomware was 19 days okay again that is just that ransomware component and the average being 19 days so the cost of sodium associated with that the cost associated to restore from backups right the cost associated to bring your people and systems back online now uh a big factor right so is needing to take into consideration that total business impact so it was found that an average cost of a ransomware event is actually something more like 760 thousand dollars when you take into account all of those factors including your brand recognition like seven hundred and sixty thousand dollars to attempt to restore back to a previous state now that is enough to most organizations now if we come over to uh this stat that i'm that i'm showing you now annually verizon actually releases a global data breach report and the number one source of breach identified by them by verizon was actually hacking so jace did mention made reference to uh uh and and actually brandon also referenced that making that um ransomware is not the only thing right there there are many other different types of malicious actors uh malicious payloads and and malicious sophisticated uh attacks going on and this report identifies that in uh you know their their report that they see that 45 of breaches come through hacking and as we drill that down just a little bit more 82 percent or over 80 percent here but it was like 82 of those cases of hacking actually in fall involved brute force or stolen credentials the use of stolen credentials so that is actually quite huge we're talking about having a human-led attacker breaching or entering into your network in your environment with credentials that are legitimate okay so the the way by which they received those credentials those compromise credentials again lost or stolen whether it was from a key logger or whether it was from brute force at the end of the day you've got some human-led attacker now and like brandon mentioned in your environment moving laterally right moving east and and and west and and trying to move from one machine and to another to potentially finding their way to your servers to try and have way with your environment so i can't talk any more loudly or or more prominently about this without making reference to the absolute need for multi-factor authentication okay so you want to front your systems where you can and where possible with two-factor slash multi-factor authentication providing another layer between your credentials and your system and being able to bring that together with a changing rolling uh number or or two-factor authentication key so that even if they had the credentials it places another layer right in front of that access so it is so important for you to do all that you can to help thwart these malicious actors from gaining access to your environment thanks anthony and brandon mentioned earlier you know we don't want to just give you the stats about the doom and gloom with without suggested next steps and we wanted to do this in a way that was more agnostic so this is not a sophos overview on this particular slide here what we're trying to do here is give you an idea of industry best practices and so look there's lots of security solutions out there um but when it comes to what should i do about this and jace mentioned it earlier have a plan there are upgrades needed to keep pace with the evolution of this threat landscape and i think anthony outlined it best that the the data from the verizon breach report indicates that you're going to have a human-led attack if your breach the chances are it's going to be a human-led hacker and in many cases i find organizations don't have a human-led defense they're relying exclusively on products and so what we wanted to do here was give you just some suggestions as you're evaluating your own security posture what components you might want to consider adding for the future and these are industry best practices and and certainly we'd like to show you how sofos can do some of these things but in general you can get these from a variety of vendors out there in the marketplace and anthony just highlighted the bottom left authentication you got to have multi-factor you're going to get an attacker and that attacker is going to have your admin credentials the average price of the admin credentials apparently according to jace's update is actually cheaper than my passport because those sell for a dollar fifty the administrator account on your network would sell for a dollar fifty hacker buys it they start attacking you so mfa multi-factor authentication critical um top left next gen and and we're talking antivirus and firewalls so if you're still using legacy antivirus or you're still using a legacy firewall without next gen capabilities then functional equivalent to the the transportation security administration tsa security that's like only having a no-fly list okay the no-fly list is a good thing we know that those individuals shouldn't be allowed to fly because we've seen them before but what about individuals we've never seen before i mean we don't want to only rely on the no-fly list right so if you're still using legacy signature-based antivirus or if you still have a an old-school firewall that's giving you stateful packet inspection without the next gen capabilities you know you're running tsa with a no-fly list only and what you need is the body scanners and the whole deal um moving on down that path or that line of thinking you have detection and response capabilities and and so now you get into the fusion of artificial intelligence and machine learning and product the fusion of the of the tools and the products with the people and the expertise and really you need both and and back to my tsa analogy sure they they have the metal detectors and whatnot but they still have a human look at the x-ray inside your bag they're combining the technology and the human threat expertise and in this case that's going to be a detection response tool either an edr which stands for end point detection and response or a new industry term that you'll hear from vendors like sofos and palo alto and you know even even cisco's using this sort of top track as is xdr which is extended detection response and what you're talking about here is tools that can pull information from both your firewall and your endpoint protection and make it queryable and correlate the alerts and information you're getting so that you're not just having niche products but you're now correlating the data and you have a threat expert that has the ability to to really hunt and look into suspicious indicators because if i have an admin account i'm supposed to be on your network and what if i use applications that are supposed to be on your network like powershell you know powershell could be a perfectly legitimate use use case or it could be a nefarious use case now how do you know well you need a tool a detection response tool to allow you to ask the right questions and you need an expert who's available to use that tool and then and then make the judgment is this benign or is this a malicious use of these tools and so you got to have a detection response tool um and one other note on detection response tool and forgive me for another yet yet another airline analogy but it a an endpoint detection response tool will also serve the purpose of the black box on the airplane so if you're unfortunate enough to suffer a breach you know without the black box it's hard to know what caused the crash right if you have a detection response tool it's delivering a data recorder and the data recorder will allow you to rewind the tivo if you will you know rewind and see the root cause of the incident so now you a know where to start your your cleanup effort and getting that hacker out of your network removing the back door access that they have and b you can then follow from that root cause forward to be certain that you've eradicated the threat completely and not just a component of it because you can you can follow the trail of breadcrumbs if you will if you don't have an endpoint detection response tool in place and like i said multiple vendors out there this is not a sofos thing it will have a data recorder it will allow you to much more quickly and effectively identify the root of your breach and make sure that you're cleaning it up as quickly and efficiently as possible without that you're going to ask a basically a digital forensics investigation response team to start combing through logs and try to put the puzzle back together without the picture and that takes an awful long time and it's not cheap now the next line down below xdr well you know it's still a member of the detection response family if you will but the problem that i have found and that i think you will find is that most organizations while they may have a good security person or security team even they may not be available 24 7. now sophos has a rapid response team that gets you know the firefighter calls you know we've been breached what do we do right now and those calls spike thursday to sunday because the adversaries this is a human-led attack they know they're less likely to get discovered thursday to sunday and so that's when they really go to work and launch the attack they spend a lot of time staging it they're on your network for a long time setting up the attack and they're not going to launch the attack and and make you aware of their presence until they feel they've really got you where they want you and so a lot of that involves like if if it were a ransomware attack they're going to disable your backup right because if you can restore from backup why would you pay the ransom so it takes time for them to find the sensitive data exfiltrate the sensitive data ensure that your backup is disabled or not available to you etc and so while all that's happening that's when these little suspicious indicators will pop up and they're smart they're going to they're going to evade detection even if you have a good security tool these hackers know you're going to have a good security tool they're going to do their best to evade detection until they want you to know they're there and so that's why it's so important for you to jump on these suspicious indicators right away using your detection response tool and and investigate and if you're if your staff can't be available 24 7 to do that then you can outsource to a managed detection response team and then manage detection response teams effectively you just instead of building your own staff and your own retaining your own people you have a team that's outsourced doing it for you and then finally none of these tools are perfect so you have to have a plan in case you're breached my kids know where to go if there's a fire in the house we meet at the neighbor's house across the street right do you have an incident response plan and so you've got to jump in there and make sure that you are capable of or have a plan in place and know how long it's going to take to get the firefighters to show up in the event that you do suffer a breach so those are your industry best practices there and i'll give it back to anthony where we can give you a couple of points on how sophos does these things we think maybe just a little bit better um but as we're coming up close to the top of the hour i do want to throw out there that as an action item if any of you would like to have a conversation with a sofo subject matter expert about your we have the threat response team about your current security posture and maybe prioritize potential next steps for 2021 or 2022 that's an offer that pine cove and sophos would like to make um as a potential next step we'd be happy to have that conversation broker that conversation with our incident response and threat response experts and you could get maybe some guidance as to what you might do this year and next uh to increase your own posture um so anthony back to you thank you so just really quick again like eric mentioned we're at the top of that hour so so first we have at surface we have the world's best endpoint protection intercept x it is providing you with that next-gen av that was talked about with regard to the industry required with artificial intelligence deep learning with anti-exploit with anti-ransomware with performing just-in-time copies and automatic roll back of your files in a pre-encrypted state with cleaning capabilities and with also threat case and and root cause analysis capabilities as well to be able to see what when where and how now as you kind of step over to that middle uh where it talks about edr intercept x with edr that's that tool set that eric was talking about giving your i.t admins the ability to be able to search hunt discover and remediate now that next step though uh which is actually a crucial step in being able to gain those extra enhance those those skills and and capabilities for your i.t and security teams we know that we could always use extra help and this is where surface mtr can come in and working directly with pine cove and and potentially even with your teams to be able to automatically and 24x7 threat hunt and remediate any malicious type of activity that we actually seen going on in in the environment now one of the biggest benefits of all everything that i just covered that is with a single line item single agent hands on keyboard taking immediate uh taking immediate action and in times like that uh those those challenging times uh speed is absolutely crucial and vital so like eric mentioned as you want to know more you want to get in touch with some experts uh and and even touch uh without in touch with our team uh we will uh happily uh have those calls and i'll hand that time back to uh back to jason to brandon thanks sophos uh appreciate that i know we're we're out of time here people but uh if you know we're gonna send the recording to everyone we're going to send the report to everyone we'll follow up um but just as a we also have a few questions come through so if you do have time and you want to stick around for that feel free brandon is there anything you wanted to to talk about before we answer maybe the one or two questions that are left i don't think so i think we get into the questions i think one of the big takeaways uh i i think you know for the people that are on on this call i think we're probably all here for a reason because we obviously know we we want to learn more about this we're concerned about it but i bet there's a lot of you out there thinking oh man i wish this person was on this or how do i get this this concern that i have across to the people that need to hear my organization and i think there's some data there that we showed that um we are not just the victim like okay there's a big equifax breach in i am one of the hundreds of thousands that was hit um our organizations are now the target because we're easier targets um the the steps that an equifax or a target or a sony have taken to protect against this i guarantee you are far greater than what we've done as our small little cpa shop or as a 25 person it security company we don't have the resources or the expertise to be able to do what they've done and so just like we're telling you the value of outsourcing we have to outsource we don't have 24 7 threat hunters sitting in here at pine cove addressing these things we cannot scale that and i'm i'm doubting the majority of you can scale that either and so that's a big thing to look at okay go to the questions yeah sure so jenny's still here software forward her question on which is 85 of montana's manufacturers have 20 or fewer employees do the statistics hold true for those as well and maybe i'll just quickly answer that we don't have the the numbers on the breakdown of the cyber attacks by company size it's something we hope to do in the future but uh with the conversations we've had and the experience we've had i think brandon can maybe give a little bit of insight into that into that question maybe answer it a little bit better than i could yeah i think um we don't we don't have the data as jay said but i can tell you real world um i've i've been on calls where we've had uh a two-person construction company out of uh billings uh basically had a breach that pretty much was close to putting them out of business two people um they were just they had a hole right i mean again i it's not like these these attackers are looking at what side you are and then you know taking the the approach they're putting a lot of fishing poles in the water and lines in the water to see what hits and and when they get one they want to see how much can they get and what is the value of the target but it doesn't matter how big or not they're going to go as far as they can and extract anything they can of you so we've seen a smaller a two-person shop give us a call in tears not knowing if they're gonna survive it uh we've had a uh i think was an oil and gas company in eastern montana give us a call 20 employees completely taken over by a south african hacking entity took over their phones were making dial calls out to other potential victims using their 406 phone numbers uh as as the uh the starting point so um again i think we're gonna work and get better at targeting those those the the smaller organization numbers but i can tell you we're just as uh well maybe even more so because we haven't taken the the the proactive approaches that we need to where we are very much in danger of these attacks uh similar to these large organizations yeah to echo that brandon for what it's worth we often find that the hacker will know that that's an easier path to success because that you know like if you have a thousand employees they know that you probably spend some money on cyber security and have a security staff and if you're a smaller organization they can invest less time run less risk of having their attacks sorted they have a much higher conversion rate or success rate if you will targeting small businesses and it may be counter intuitive but that actually makes the small business target almost more attractive to the adversary based on what what sofoslab sees great okay i think that's the question yeah i think that's it though i think uh there's no there's no other questions so uh one jace one offer i wanted to make i was gonna show you guys a live example you know of of some live threat hunts you know like brandon just gave some really great real world examples we ran out of time but if you want to include that in the follow up i'd be happy to share some links if anyone would like to read up on some some real world attacks and real real world threat incident response type scenarios that we didn't have time to cover great yeah we actually just had another question come in so the question is could you mitigate attacks by encrypting identifying information so even if the hacker gets in they don't actually get the actual data so plus guys you want to take that one yeah so uh anthony hit so if there's absolutely the the concept of of encrypting at rest as well as obviously in transit right so uh does that make things uh more difficult absolutely that's if they're taking your data while it is in rest it all depends on when and where they get in so in the case where i mentioned with that verizon data breach report and they have hands on keyboard they have uh they have credentials right so they have some level of administrative credentials and they're in your environment they have the keys to the kingdom already and they're able to see and to get access to whatever systems and traffic so it all depends now as i said that's over 80 percent of of uh breaches that are that that come in with regard to the hacking over 80 percent of those are compromised credentials so does it help having data um encrypted at rest absolutely that helps the the whole snatch and grab that whole helps with the you know somebody gets into said system and and tries to exfiltrate data but at the same time depending on how you you have things configured uh your even though the data may be sitting um at uh encrypted arrest while said system is accessing said data then that data is actually unencrypted and accessible so yes and yes thanks anthony she said it made sense so there you go wonderful okay i think we're good we're gonna wrap it up there uh we'll be in touch with everyone with some more information and uh we will be back next year january february march somewhere in there for another presentation of the cyber security report for this year and in the meantime we will continue to push out a lot of content over email and try to stay in touch and keep keep some education flowing on the on the topics we talked about today