Is ‘Cyber Crime’
Just A Buzzword?
Why Companies
Should Worry
A discussion on current and future cyberthreat trends, how artificial intelligence willchange the game and your digital assets are
the key to your security strategy.
Is ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 20191

Meet our Roundtable Panel

MARK FLEGGSØREN BRANDBYGE

At CSC®, Mark Flegg is responsible for advising a
global client base on digital risk and the preventative
measures brands can take to safeguard their digitalassets. During his 16 year career, Mark has acquired
a wealth of experience in cyber security technology
focusing on domain management systems, domainname systems, secure sockets layer, and distributed
denial of service protection software and mitigation.

Søren manages DNS cryptography systems for
LEGO, and is part of a team building security
solutions. His previous and concurrent experience
includes being the appointed GTS representative forall DK research institutions, tasked with participationin building the research network; contributing to the
DK-related OECD report on spam; co-authoring a
PhD thesis, writing articles, lecturing, and building
tools he releases to the public. He also writes articles
about economics, math, physics, IT security, social
politics, third-world development, ethics, and humor.

Global Product Director,
Domains and Security

Infrastructure Engineer, Security
Engineering at LEGO Group

Søren has a variety of degrees, including aninternational master’s degree in food engineering .
He also holds a master’s in information technology,
with a specialty in multimedia production, from the
University of Southern Denmark (SDU-Odense).
He’s currently working on his third master’s in math.

Is ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 20192

Executive summary
Over the past few years, we’ve seen an uptick in articles, alerts, recommendations, and solutions for cyber crime. In the
beginning of 2019, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the UK
National Cyber Security Centre, and other leading security organizations issued an alert about domain name system (DNS)
infrastructure hijacking campaigns. The Internet Corporation for Assigned Names and Numbers (ICANN) followed suitby alerting particular registries, registrars, and organisations of the heightened risk, and promoted domain name systemsecurity extensions (DNSSEC) as a way of mitigating the threat.
It only took a few days for the media around the world to pick it up. Other government agencies in Sweden, France, theUnited Kingdom, and more—as well as registries—issued notifications to their partners and clients, CSC included. The
Danish Centre for Cybersecurity—a government agency—recently published their annual report threat assessment: The
cyber threat to Denmark 2019. It looks at the current known forms of attacks, provides specific examples, and discusses thecurrent level of risk, as well as future trends.
With all that happening in the first six months of 2019, we have to ask—what’s really behind it? Is cyber crime just anotherbuzzword, or should organizations around the world, and the public, really be worried?
Søren Brandbyge, infrastructure engineer for LEGO System A/S, expert, and thought leader in security, cryptography, and
DNS joins CSC’s Mark Flegg, global director for Security Services, to give us insight into these current events, what actions
companies can take to secure their brands, and their views on current and future threat trends.

Index
1 recent increase in government alerts means?
Can you give us an overview of what the

2 or form of attack for companies and brands?
Do you consider cyber espionage a threat

you explain the difference between
3 Can
cyber crime and cyber hactivism?

4 common forms of attacks companies experience?
Can you give us some insight into the mostyou seen any new form of
5 Haveattacks recently that worry you?

do those attacks affect a
6 How
company and their vital functions?

would you recommend to companies to
7 Whatstay protected against those types of attacks?

8 you see global companies neglecting today?

What are the primary security measures that

In recent months, we’ve seen an increase inalerts from government agencies as well as
the press all over the world regarding DNS
hijacking threats. Can you give us a quick
overview of what’s going on?
Mark Flegg (MF): DNS hijacking isn’t new. This formof attack has been ongoing for years. However, this formof cyber attack was previously predominantly used byhacktivists for political reasons. Now, that’s changed.
Over the past four years, DNS hijacking has been
increasing and cyber criminals—rather than hacktivist—
are becoming more and more active.
In January 2019, FireEye®, a security vendor, released
its report on DNS hijacking campaigns. Around the sametime, the U.S. Department of Homeland Security issued
an emergency directive ordering all U.S. federal civilian
agencies to secure the login credentials for their internet
domain records. KrebsonSecurity, run by American
investigative journalist, Brian Krebs, then reviewed all
DNS hijacking findings on his blog—and coupled with the
ICANN alert to its members of the domain name industry,registries, registrars, and resellers—global media outlets
picked up the news.

IoT, AI, and 5G being, are threats
9 Withgrowing or changing? How and why?

In most countries, the media reinforced the alerts. In somecases, in particular in France, the alerts were misconstrued
as a cyber attack on ICANN. Our French office received
many calls in regards to that mistake, but thankfully Le
Monde and other media outlets were quick to correct themisinformation.

do you think your clients need to stay secure
11 Whatin the future? Any insight on your plans?

Søren Brandbyge (SB): There is really no simple
answer to what’s going on. But the long answer is thatthe general public is catching up—knowledge wise—to
the current state of the IT world. The reality is like theWild West online, so blatant that a layperson can nolonger ignore it. This embattled environment has given
way for opportunists, criminals, and a wide range ofhas the rapid evolution of the internet shaped
10 How
how global brands conduct their business?

12 buzzword of the year or decade?
So, is cyber security just theIs ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 20193

diverse actors to exploit technology for their own gain.
On the surface, it looks like an immense uptick in
hostile activity—an offspring of the building tensions
around the globe—with IT as the new weapon of choice,enabling the various actors to use the lack of common
regulation and enforcement to their benefit.
But people are probably thinking we’ve passed thetipping point now, relying on IT as an integral part ofalmost every society’s infrastructure. The reality has
dawned that disruptions have catastrophic impact—not
just globally, but also to individuals directly. I thinkrecent cases make it impossible to ignore this fact, thus
the increase in warnings and alerts.
Likewise, for the criminal actors who long ago saw thevast opportunities to (almost) risk free exploits andearnings, the extent of that economy has grown over theyears to a level that dwarfs most other crimes and eventhe gross domestic product of many states. This kind of
unregulated economy could destabilize countries andcertainly be a threat towards even the largest companies.
Again, it is something that cannot be ignored anymore.

The internet is a fast moving
space. New technology is being
adapted by customers at a very
quick rate. I think we are in very
exciting times, however you will
always have people trying to
exploit new technology for either
political or monetary reasons.
Adding to the mix is the emergence of artificial intelligence(AI) and the expected quantum computing. Lessons
learned from the last several decades is that suchtechnology will be used to the full extent by both state
actors and organized crime. These additions will mostprobably accelerate the gap between the capabilities of
the general public (and small states, most companies,etc.) and the select few having (almost) unlimited
funding and technological capability. It looks like it ishistory repeating itself. We are putting all our eggs into
one basket (and we keep adding more)—because wehave gone from real life activities and economics in atransparent and regulated realm to a boarder-free, andunregulated realm with ample room for actors to hide andleach information. This conversion is almost one-to-one,
yet we seldom have a “plan B.”

Cyber espionage, also known as cyber
spying, has been a known threat togovernments, typically aimed at political
gain or destabilizing governments. Do you
consider cyber espionage a threat or form ofattack for companies and brands?
Is ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 2019

SB: Cyber espionage is a broad term. It covers many bad
actors, agendas, methods, and most importantly, manydifferent timeframes.
Most would associate the term with state actors having
specific political and economic intents, but that would
only cover a fraction of the activities taking place. A
more full definition encompasses all covert actions togain control of vital data that another entity depends onto achieve a specific goal. Another aspect is that cyberespionage is just a set of tools in a much larger tool
chest, so the possible drivers for the activity have to beassessed to determine long-term impact. When figuring
out the reasons for espionage, companies have to think
like the criminal does—in terms of “what’s in it for me?”That could include gaining control, knowledge, power,
or profit.
The motives that top the list for companies are direct
economic gain (i.e., learning secrets that can be used
to siphon finances) and exfiltration of trade secrets(e.g., specifications for IP or products). The common
denominator is that the threat actor stands to gain
something, as long as they’re not spotted or hindered.
How the criminal gets a foothold is another story, using
all the tricks and techniques available at any given time,hence my point that cyber espionage is just a fraction of
the whole picture.

The recently published threat assessment
talks about the high levels of cyber crime andcyber hactivism threats. Can you explain the
difference between the two types of crime?
SB: The terms are easily defined. Cyber crime is any
activity that is deemed illegal in the context of the victim;
cyber hactivism is a small subset of cyber crime PLUSa range of activities (that are either legal or not yet
regulated by law) using the electronic platforms available.
The devil is in the details. If you look up the most costly,
most disruptive, and most often seen and reported
types of cyber activities, cyber hactivism is almost laston the scale of most used. The reason we hear about ita lot is because cyber hactivism sells newspapers, so
it always makes the headlines. A very good source togain an overview of the different types of cyber crimeis the National Institute of Standards and Technology
lists of crime types. Lumping several activities together
under the term cyber hactivism still accounts for lessthan 0.1% of cyber crime (both in number of reported
activities and financial impact).
Digging back through the last 20 years, hactivism
has steadily declined in the overall picture. There aremany reasons for that, including that governments
acknowledged early the damage these activities
can cause and focused on both controlling it andpossibility using hactivism as a method. My worry isthat it’s becoming easier for the early the damage these
activities can cause and focused on both controlling it
and possibility using hactivism as a method. My worry
is that it’s becoming easier for the bad actors to gettools, exchange knowledge, hide in the masses, andform sub groups under the radar. What we have seen
over the years is a steady recruitment and an increasing4

diversity in tool chains (sub-contractors) in businessmodels resilient to legal measures and our defence.
That trend seems to also migrate into hactivism as well,blurring the boundaries.

Can you give us some insight into themost common forms of attacks companies
experience today?
SB: There are two major classes mostly seen: zero day
exploits and tailored attacks.
The attacks shift over time, both in response to thesecurity posture one has and to the ongoing arms
race between the good and bad actors. Attackers arevery fast at picking up on what a company’s security
posture is, adjusting their methods accordingly, andramping up their efforts. What we also see is that threat
activities are very obviously driven by simple economy
calculations. If the expected gain is less than the needed
effort, they move on to another target.
MF: In our industry, the most common attacks we see
are phishing, domain name system (DNS) hijacking,man in the middle attacks, structured query language(SQL) injection, and distributed denial of service(DDoS), to name a few. We find that these types ofattacks are becoming more and more sophisticated andvicious, and this is of great concern to us.
Most organisations are focusing on protecting theirassets inside the firewall, which you can also call a
gateway. However, since 2018, we’ve refocused ourconcern more on what’s happening outside of thefirewall—the pathways where a company’s online
presence links to their internal systems and data.
Domain name security is the key element to securing
a company’s online brand. When your domain isbeing attacked—be it from phishing, DNS hijacking,
DDoS, etc.—a business is being attacked. Since
these connections are outside the usual, rigorous IT
infrastructure, a higher degree of risk needs to beaccounted for to ensure the whole system stays secure.

Personal data is under attack,which is whythe European Union’s
implementation of the General
Data Protection Regulation (GDPR)
is so important.

Have you seen any new form of attacks
recently that worry you?
SB: Every day, a new variant or a new concoctionof techniques show up. It is not as much the steadyevolution and broadening of attack vectors and theirincreasing impact that is worrying, it’s that the focus
seems to be shifting more and more into a massive
harvest of personal data and profiles. If you combine thatwith the fact that more of our personal lives and identities
are kept electronically, we’ve got a recipe for problems of
epic proportions. So personal data tops my list.
MF: I agree with Søren. Personal data is under attack,which is why the European Union’s implementationof the General Data Protection Regulation (GDPR)
is so important. Fines for companies found to havecustomer data breaches was not enough, so it has
been equally as important that GDPR also gives powerback to European consumers to control personal datacollected and stored. Just reading the daily news
headlines underscores why this provision is important
to consumers, and in turn, companies. It costs far lessto get domains secured ahead of time than it does toclean up a data breach, restore customer confidence,and catch up on annual revenue.

How do those attacks affect a company andtheir vital functions?
MF: Depending on the form of attack, the worst casescenario is a complete take down of an entire system.
That does not just include websites customers might
depend on, but entire email, VPN, and telephonesystems that employees depend on to conduct business.
A full-blown, successful DDoS attack can paralyze anentire business for hours or even days.
Data breach or data leak will have a severe impact on acompany, especially with the implementation of GDPR.
A data breach via malware on IoT, phishing, or even by
DDoS attack is very common and should be avoided by
implementing all proper security and training.
Whatever attack we’re looking at, it will cost a company
dearly, it will damage a brand’s reputation, and therefore
account for a loss of their customer base.

What would you recommend to companies tostay protected against those types of attacks?
MF: Take action! And remove any conditional
statements when reviewing security strategy—it’s not if,
but when an attack will happen.
I always recommend a three-step approach.

Websites, email, cloud-based authentication, virtualprivate networks (VPN), voice over IP, file transfer
protocol, and apps all depend on domains being
functional and secure. With new technologies constantly
introduced into the marketplace, networks will
increasingly grow more complex. Internet of Things (IoT)
devices come to mind, and companies will embrace thoseopportunities, yet they MUST also secure them.

Is ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 2019

Step 1: Audit all digital assets. What domains, digital
security certificates, apps, social media handles, etc.
do you own? What security measures are in place? Are
you using registry and registrar locks? Are two-factor
authentication and DNSSEC in place? What DDoS
protection has been applied? How secure is your DNS
vendor? Are you using email fraud protection? The list
seems long, but it’s actually pretty straight forward.
Step 2: Train and retrain employees on security. Thisis the most vital element as the enemy is within (even5if it’s often accidental). Human error is the biggest risk
to security. Training should be repeated regularly, andemployees should be tested for compliance.
Step 3: Educate your customers. Your customers needto understand how to differentiate between a phishingemail, phone call, or otherwise. Make sure they knowthat security is one of your top customer priorities. Tellthem what they can expect from you, and especiallywhat they won’t get from you, e.g., that you’ll never ask
them for their password.

What are the primary security measuresthat you see global companies neglecting
today? Are there any typical blind spots
companies tend to miss when securing
their business online?
SB: Globally, I think we’re being subverted into thinking
that advanced persistent threats and sophisticatedattacks are the biggest threats—threats that call for hightech counter measures and specialized tools. But most ofthese threats rely on some rather simple techniques andattack vectors. I would argue that our biggest global—
and growing—blind spots are the basics. We tend to
focus on the end goal while not paying enough attention
to the chain of events and methods, meaning we miss theissues that are indeed under our control and can easilybe handled without the need for elaborate technology.
In short, any type of attack relies on a reconnaissancestage, access, more intel gathering, then escalation, andgaining control. From the very beginning of this chainof events, basic security should be governing counter
actions, like making sure security is up to date, using bestpractices, and so on. It also calls for a thorough look into
one’s capability of monitoring, and what you own that’s ofvalue to criminals. Think about redoing some processes
and solutions instead of just adding band aids. Blind spots
like DNS, email, and data storage are the most overlookedsupportive systems for the infrastructure.
MF: Here again, I fully agree with Søren. As previously
mentioned, domain names aren’t understood enough.
And it doesn’t get more basic then that. We’ve seen
domain security being passed around like a hot potato,
yet this is a crucial element when talking about securing
blind spots outside the firewall.
Over the years, we’ve produced several cyber security
reports focusing on different industries and are still
shocked by how many companies are using their own
DNS, for example, and not switching on registry andregistrar locks. Secure sockets layer certificates are also
an interesting topic; we are seeing many companies
not using the correct certificates and, even worse, notmanaging those already in place in a central repository.
Multiple people in a company could be buying
certificates, using their personal email address to register
them, then letting it lapse when they change departments
or leave the company—so certificates are not being
reissued when they should, leaving websites unsecured.
It’s our job to educate our clients. It’s not always easy,
as many stakeholders from various departments are
involved, but we feel this is our responsibility.
Is ‘Cyber Crime’ Just A Buzzword? Why Companies Should Worry | 2019

With IoT, artificial intelligence, and 5G
being introduced slowly but surely into all
our lives, are threats growing or changing?
If so, how and why?
SB: Whenever you add complexity to your operation,
you add risk. Whether or not that also equates toa growing threat depends on how you go about
implementing new technology, the security required, andespecially how much you depend on the new components.
In addition, all industries tend to focus on the potential
gain of new tech, downplaying the hidden cost ofadditional blind spots. We need to understand how newtechnologies transform our infrastructure and what anormal baseline should look like. Issues mostly arise in
the boundaries between systems and functions.
Expecting the provider of a new technology to deliver 360
degrees of security coverage is probably not realistic.
Lastly, industry as a whole quite often doesn’t
understand new security technologies fully before
implementing and using them. Take artificial
intelligence (AI), for instance. AI has been heralded
as a silver bullet that can be fed almost anything,making sense out of incoherent data. But AI is notcapable of deducing anything that is not in thedata. Mathematically speaking, AI can only be usedmeaningfully for a very confined set of problems. AI
is probably the most misunderstood new technology,
opening us up to risk. What we need is industry
cooperation to find a secure way forward with AI.

Companies have to think about
how to protect the customer
before protecting themselves.
It’s basic: build it, build what
supports it, safeguard it,
andhave alternatives ready.
How has the rapid evolution of the internet,
which includes major opportunities andrisks, shaped how global brands conduct
their business?
SB: A broad historical question demands a broad
encompassing answer. As I am not an expert on businessmodels, I have to describe the evolution from a technicalview. The emergence of IT as a business tool back inthe 70s through the 90s created new ways of modifying
internal procedures and services, mostly a one-to-one
conversion from manual to IT-based labour.
As such, the internet was a new extension in the IT
toolbox, not yet recognized as a new method for reachingout to customers. The challenges with the new internet
were rooted in catering to customers by delivering solutions
that are tailored, not just reused mock ups.
Risks arise when services that support our secure services
6fail, opening up exponential avenues of exploitation andrisks. We are forced to adapt to the customer througha simple architecture, and risk. If we can do this right,
the future doesn’t look bad. For starters, we should
acknowledge that controls are good, but are at best justa band aid if we do not build the services correctly fromthe start. Companies have to think about how to protect
the customer before protecting themselves. It’s basic:build it, build what supports it, safeguard it, and havealternatives ready.

New technology is being
adapted by customers at a very
quick rate. I think we are in very
exciting times, however you will
always have people trying to
exploit new technology for either
political or monetary reasons.
Sharing knowledge is also paramount. We see the badguys thriving in a dynamic, dark economic businessevolution, building very mature systems by sharing
knowledge. If we really have the aspiration to get aheadof this game, we need to act as one entity, sharing bestpractises, sightings, failures, and learnings. We also needto embrace our customers and value their feedback. Someof this is already happening, but is far from the level
matching the adversaries. Even though the dark economy
is working at their highest capacity, the legitimate world isstill capable of gaining the upper hand.

At CSC, what do you think your clients willneed to stay secure in the future? Any
insight on your plans?
MF: The internet is a fast moving space. New
technology is being adapted by customers at a very
quick rate. I think we are in very exciting times, however
you will always have people trying to exploit newtechnology for either political or monetary reasons.
Our top priority at CSC is to protect and secure ourclients’ online presence. For that, we always try to lookahead. How are connecting devices going to change thesecurity levels of our clients? How will 5G affect HTTPS
and DNS, and what does that mean for our clients?
Can blockchain be an alternative to the current DNS or
online IP?
In our industry, you can’t stand still. That makes it themost exciting industry to be in right now, yet neverforget to focus on your clients and their needs.

So, is cyber security just the buzzword of
the year or decade?
MF: I sometimes wish it was. We do see companies
using the term cyber security when they actually havenothing to do with it. So I would advise everyone toresearch, and when talking to those companies, digdeep. As Warren Buffet once said, “You only find out
who is swimming naked when the tide goes out.”
Securing your company’s business from the inside out
must be the priority, therefore ensuring you get theappropriate solution with a trusted vendor in place.
SB: If by buzzword you mean a word used to the extent
of becoming diluted and almost meaningless, thenyes. Cyber security is used and referenced in so many
contexts that it is as precise as saying “life can be
hard.” But, it’s a really good catchphrase. It sells papers.

CSC supports companies that are making significant investments in their security posture by exposing
blind spots that exist within fundamental internet assets such as domain names, DNS, and digital
certificates. By leveraging our proprietary security solutions, CSC secures companies from cyberthreats to their digital assets, helping them avoid devastating revenue loss, brand reputation damage,or significant financial penalties as a result of policies like GDPR. Along with internet assets, CSC
protects online brands that are being exploited via counterfeit websites, fraud, and IP violations, andhelps monitor and mitigate this, providing enforcement and advisory services to protect many of theworld’s largest brands. Learn more at cscdigitalbrand.services.

1 800 858 5294

cscglobal.com

Copyright ©2019 Corporation Service Company. All Rights Reserved.
CSC is a service company and does not provide legal or financial advice. The materials here are presented for informational purposes only. Consult
with yourlegalJustor financial
advisorWhy
to determine
howShould
this information
applies to you.
Is ‘Cyber
Crime’A Buzzword?
Companies
Worry | 20197