HOLLYWOOD, Calif. (9/27/13)--Global cybercrime costs about $114 billion annually with another $274 billion thrown in to allow for the costs of staff time in tracking and fixing the damage done, Randy Romes, principal of information security at CliftonLarsonAllen, told attendees Wednesday, the final day of the CUNA Technology Council and CUNA Operations, Sales & Service Council joint meeting in Hollywood, Calif.
| Once cybercriminals penetrate computer systems, 80% of the internal propagation is the result of weak administrative credentials, Randy Romes, principal of information security at CliftonLarsonAllen, told attendees Wednesday, at the CUNA Technology Council and CUNA Operations, Sales & Service Council joint meeting in Hollywood, Calif. Next year's joint conference is scheduled for Las Vegas. (Photo provided by CUNA)|
"Cybercrime costs the world significantly more that the global black market in marijuana, cocaine, and heroin combined, which is estimated at $288 billion," he said.
"Hackers tend to go for the easy money, and credit union members are much easier targets than credit unions themselves," he said. "In instances of cybercrime, the weakest link is the end user."
Nearly 62% of illegal intrusions in 2012 were completed by exploiting remote access applications, Romes said, citing a 2013 research report published by TrustWave. Once cybercriminals find their way into computer systems, 80% of the internal propagation is the result of weak administrative credentials. And once hackers make their way into a system's stored data, it takes an average of 1.5 years for them to be detected, according to the TrustWave report.
"The research shows that most of the compromised systems were managed by third parties--63% were managed by third parties; 37% were managed in-house," he said.
Romes has seen a sharp increase in losses due to "social engineering," which he defines as the use of nontechnical attacks to gain information or access to technical systems, such as pre-texting phone calls or unauthorized entry into a building. "The best defense against social engineering is to constantly be creating awareness among your staff to the types of threats they might be subject to," Romes told credit unions.