© 2014 IBM Corporation

2014 보안 위협 동향과 내부 통제를 위한 IBM의 제언2014년 5월 20일

Greg Russell

IBM TrusteerHead of Alliances and ChannelsAsia Pacific, Middle East & Africa

Holistic Cyber Fraud Prevention:Transforming Customer Experience

© 2014 IBM Corporation

2014 보안 위협 동향과 내부 통제를 위한 IBM의 제언

2

Agenda

Cyber Fraud Threat Landscape

The Drivers for Fraud Prevention

Fraud Prevention vs. Customer Experience: The Challenge

Holistic Fraud Prevention Approach: Trusteer

Q&A

© Trusteer 2014

We are in an era of continuous breachesOperational

Sophistication

IBM X-Force declared

Year of the

Security Breach

Near Daily Leaks

of Sensitive Data

40% increase in reported data

breaches and incidents

Relentless Use

of Multiple Methods

500,000,000+ records were leaked, while the future

shows no sign of change

2011 2012 2013

Note: Size of circle estimates relative impact of incident in terms of cost to business.

SQL

injection

Spear

phishing

DDoS Third-party

software

Physical

access

Malware XSS Watering

hole

Undisclosed

Attack types

Source: IBM X-Force Threat Intelligence Quarterly – 1Q 2014

Cyber Crime on the Rise!

© Trusteer 2014

61%

data theft and cybercrimeare their greatest threats2012 IBM Global Reputational Risk & IT Study

of organizations say

Average cost of adata breach

2014 Cost of Data Breach, Ponemon Institute

$3.5M

70%of security

executives have cloud and mobile security concerns2013 IBM CISO Survey

Mobile malware growthin just one year

2012 - 2013 Juniper Mobile Threat Report

614% security tools from

vendors

85

45IBM client example

83%of enterprises

have difficulty finding the security skills they need2012 ESG Research

A new security reality is here

© Trusteer 2013

New Security Reality - Mobile Malware

Source: Juniper Networks Third Annual Mobile Threats Report: March 2012 through March 2013

The Drivers for Fraud Prevention

6

© Trusteer 2013

New Threats, Legacy Thinking

7

Device Identification

Challenge QuestionsMalware

OTP DevicesMan in the Browser,Real Time Phishing

Out of band

VerificationMan in the Mobile

Login

Signing

Social Engineering Malware

Virtual Browser

on Stick

Memory Injection Malware

Clickstream

Detection

Malware Adopts Human-like behavior

x

Bypassed

© Trusteer 2014

Malware and PhishingCommon threat to Customers and Employees

1JPMorgan: 2012 Online Fraud Report , 2Gartner: 2290415, 3Ponemon Institute: 2012 Cost of Cybercrime Report: US

Three Losing Battles

• Humans will always make mistakes

• System and application vulnerabilities continue to emerge

• Malware detection will always lag

Two Major Impacts

Widespread Fraud

• $3.4B est lost to online fraud in 20121

Advanced Threats and Breaches

• 85% of breaches go undetected2

• $8.9M average cost of cyber-attacks3

Social Engineering (Phishing)

Vulnerability Exploit

Malware Infection

Fraud SchemeExecution

Money Loss

Enterprise Breach

DataExfiltration

© Trusteer 2014

Source:

Why Customers are Taking ActionFraud Losses and Regulatory Compliance

77%

13%

10%

Man-in-the-Browser and Keylogging

Insider

Phishing and Other

9

Additional regulations

Regulators respondMan-in-the-browser is the biggest risk so…

• Layered Security• Complex Device Fingerprint• Continuous Risk Assessment

“Our auditors have already told us the Trusteer solution is absolutely compliant with the new guidelines”

© Trusteer 2014

Online fraud losses are the tip of the iceberg

Business Impact of Cybercrime AttacksOnline Fraud losses are only 1 element

Extended Fraud Losses

• Check

• Card

• Call center

Compliance & Legal

• Regulatory audits

• Legal exposure

• Litigation

Fraud Management Costs

• Forensic investigations

• Transaction reviews

• Sustained technology

Customer Impact

• Brand

• Customer experience

• Churn

© Trusteer 2014

Costs of Cyber Fraud Attacks

11

In March 2013 disk-wiping malware rendered thousands of terminals useless at three South Korean television stations and a bank. The sustained campaign of cyber attacks on South Korean infrastructure has cost more than $500 million.

Industrialised cyberfraud is keeping businesses awake at nightBusiness ,24 February 14 by Olivia Solon @ Wired!

Fraud Prevention vs. Customer Experience: The Challenge

12

© Trusteer 2014

Management

Security

The Trade Off No One Accepts

Pick 3!

Pick 2?

Experience

© Trusteer 2014

Existing fraud controls are mostly ineffective and burden your customer and internal staff

IntrusiveControls

IncreasedAuthentication

Challenges

DisruptiveValidation and

Verification IncreasedTransaction

Delays

Account &TransactionRestrictions

Convenience Securityor

Operational costs of incident

investigation

© Trusteer 2014

Best way to stop fraud is to block root causes which also unburdens customers and staff

Prevent malware from

ever taking hold

Delay and verify only truly risky

actions

Reduce internal operational

burden

Stop fraudulent transactions

BEFORE they are created

Convenience and Security

Reduce authentication

challenges

© Trusteer 2014

Helping protect against financial fraud and advanced security threats

CLIENT SUCCESS

Customer Protection

Clientless Fraud Prevention

Employee Protection

Endpoint Security

Account Takeover

Detection

Malware

Detection

Mobile

Risk Engine

Cybercrime

Intelligence

Customer Protection

Real-time threat data

from millions of endpoints

A large North American bank

reduced financial malware

fraud incidents from

500to

0in less than 3 months, moving the

security border out to the customer

• Trusteer Apex

• Trusteer Rapport

• Trusteer Mobile

• Trusteer Pinpoint

• Trusteer Mobile Risk

Engine

IBM Security Solutions

Advanced Fraud Protection

Multi-tiered Cyber Prevention Solution required!

© Trusteer 2014

Customer Fraud Protection

17

© Trusteer 2014

Holistic Fraud Prevention - Cross Channel

WWW

Phishing and Malware Fraud

Advanced Threats (Employees)

Online Banking

Enterprise Apps

Account Takeover, New Account Fraud

Mobile Fraud RiskTrusteer Rapport

Trusteer PinpointMalware Detection

Trusteer Apex

Trusteer PinpointAccount Takeover (ATO) Detection

Trusteer Mobile

SDK/APP

Trusteer Mobile Risk Engine

Desktop. Online. Mobile. BYOD.24/7: Anywhere. Anytime. Anyone!

Detect. Prevent. Protect.

© Trusteer 2014

24/7 Cross Channel Fraud Prevention

19

Key Capabilities

•Keeps Computers Clean of Man-in-the-Browser Malware•Detects New Zero-day Threats•Stops Phishing of Login Credentials and Payment Card Data•Notifies Fraud Teams of Threat Activity

Trusteer Rapport Endpoint-centric Fraud Prevention

© Trusteer 2014

24/7 Cross Channel Fraud Prevention

20

Key Capabilities• Detects Malware Infected Devices• Accurately Determines Fraud Risk Levels• Alerts Fraud Team of High Risk Devices• Enables Malware Removal via Trusteer Rapport• Feeds Account Risk Information to Trusteer Pinpoint ATO

Detection and Risk Engines• Detects Evolving Threats and New Attack Vectors

Trusteer PinpointClientless Detection of Malware Infected Devices

© Trusteer 2014

Mobile Fraud Prevention

21

Large retail bank in Europe strengthens security for its mobile money transfers and banking applications with Trusteer SDK

Business problem: A retail bank in the EU sought a secure means to allow its users to perform the same functions they performed online with their mobile devices.

Solution: Trusteer Mobile SDK helped protect the organizations' existing mobile banking application by adding device risk analysis and providing a persistent mobile device ID.

Benefits:

•Detects high risk access from compromised or vulnerable devices

•Generates a persistent mobile device ID for unique device

identification

Featured Security Offering: Trusteer Mobile SDK

$1 millionin fraud stopped in the

first week

$60 millionin fraud stopped in the

first year

© Trusteer 2014

Employee Fraud Protection

22

www.Trusteer.com

Holistic Fraud Prevention Approach:

Trusteer

23

Trusteer 2013 ©

About Trusteer

Global

Hundreds of Customers

100,000,000 Endpoints

Solutions

Cybercrime Prevention

for Customers and

Employees

Leader

Intelligence

Technology

Expertise

Leading Global Organizations Put Their TRUST In Us

7/10Top US Banks

9/10Top UK Banks

4/5Top Canadian Banks

MajorEuropean Banks

© Trusteer 2014

And Many More…

© Trusteer 2014

The Foundation for Effectively Stopping Advanced Threats at Root Cause

Millions of Endpoints Agents

Advanced Research

Adaptable Protection

• Scalability• Compatibility • Attack sensors• Malware & phishing protection

• Evasion tactics• Endpoint compromise• Application compromise• Transaction tampering

• Multiple protection layers• Highly configurable platform• Rapid, global updates

Financial Threats

Enterprise Threats

2007

2013

Trusteer Cybercrime Prevention Architecture

© Trusteer 2013

The Unique Value of Trusteer's Advanced Fraud Prevention Solutions

Advanced Fraud

Prevention

Fast Time to Value

• Integrated: fully integrated to leverage threat data across channels

• Scalable: straight forward deployment, thousands to millions

Seamless Experience

• Transparent: protects existing customer environment

• Automated: minimize “action items” to staff

Effective and Accurate

• Focused: root cause

• Impactful: prevent first, detect next

Adaptive Controls

• Intelligent: proprietary threat intelligence

• Dynamic: rapidly updatable software

© Trusteer 2014

Trusteer Delivers Hard Results

28

Reduction in Cross Channel Fraud in 6 months

30%Top 5

US Bank

0

200

400

600

Before After

Reduction in Phone Channel Fraud in 2 weeks

80%Top 10

UK Bank

Reduction in Risk Engine False Positives

50%Top 5

UK Bank

Reduction inOnline Fraud

100%Many

Customers

© Trusteer 2013

“customers report solid success using Trusteer Rapport and Trusteer Pinpoint Malware

Detection”

“products are very easy to install”

Recognizes Trusteeras a Leader in the 2013 Magic Quadrant for Web Fraud Detection for a second year in a row

Quotes from the Magic Quadrant Report

29

Recognized for Industry Leadership

“products have been used to successfully reduce malware-

based fraud losses”

© Trusteer 2014

Summary:Trusteer gives you an edge

Global IntelligenceContinuous Risk Assessment

Centralized Reporting

Fraud &

Security

Trusteer.Your Partner for Fraud

Prevention and Regulatory Compliance

Fraud Forensics Malware ResearchCounter measures

InnovativeLeadingProven

31