Article

Targeted cyberattacks: Lessons learned from a former FBI guy

"You don’t have a malware problem; you have an enemy problem," says Crowdstrike president and former FBI executive assistant director Shawn Henry. He explains further in a video interview.

October 2, 2014

by Rebecca Hellmann, marketing manager, Welch ATM

"You don't have a malware problem. You have an enemy problem."

So said Shawn Henry, president of the services division at CrowdStrike, retired FBI executive assistant director, and keynote speaker at the 2014 ATM & Mobile Innovation Summit in Washington, D.C.

Cyberattacks are evolving and the thieves behind them are not just opportunists, Henry said. Some spend months — years even — planning an attack. The bigger the heist, the more time and effort invested — possibly even including placing someone on the inside.

Detecting a deliberate attack requires consistent and constant vigilance, Henry said. This means thorough hiring and vetting processes, consistent and attentive monitoring of computer systems and networks, and appropriate information storage and transmittal protections. Moreover, it means teaching employees to recognize suspicious activity.

For example, if "Bob" is strictly a 9-to-5 worker but his computer is logging onto the network at 3 a.m. on Saturday — that's suspicious. But someone has to be actively monitoring the network to detect this activity.

Executives should take action by empowering their entire company, not just the IT department, to take action — to develop tactics and procedures that will help increase security and mitigate risk, Henry said.

These policies might include a higher level of monitoring and reporting but should be based on appropriate and regular security training and education for all employees, focusing not on the malware problem — but rather, the enemy problem.

Following his presentation, Henry spoke at length with Will Hernandez, editor of Mobile Payments Today — a sister publication of ATM Marketplace — about what companies can do to prepare for the inevitable — a security breach of some sort.

cover photo courtesy dave newman | flickr