Cybercriminals are becoming increasingly aggressive,
and they're counting on your organization to have a fractured response to their bad behavior.
But you can take back the upper hand by developing a new unified risk operations center strategy.
This strategy uses machine learning and open platforms
to enable you to detect attacks that previously would have gone unnoticed.
So the problem with what we're doing today is risk management is really being built in silos.
We have a department for anti-fraud.
We'll have a different department for anti-money laundering.
We've got the security operations center, corporate security insider a threat,
and the issue is that all of these different groups are duplicating their effort.
They have duplicate data, tools and tactics and duplicate processes.
And ultimately, this results in gaps and inconsistencies that cybercriminals really love to exploit.
So let's take a little look at an example scenario.
Today, we're going to have our attacker
who's going after our unsuspecting victim, Jim.
So our attacker is going to send Jim an email,
a phishing email, which contains malware.
So Jim's a nice guy.
He's not expecting to be phished today.
He opens that email,
which results in his banking credentials being sent to our attacker.
Our attacker then uses these credentials to log into Jim's bank account.
But Jim was smart.
Jim set up second factor authentication.
Unfortunately, our attacker is pretty crafty
and steals Jim's mobile number by performing an illegitimate SIM swap.
So now he's able to approve the second factor authentication challenge,
which gives him full access to Jim's bank account.
With this access, he then buys $500,000 worth of cryptocurrency,
which he then transfers to different mule accounts,
uses a crypto laundering service to make this unable to be traced back to him.
So we can have a think about how our different departments might detect and respond to this today.
Our security operations center might say that this is actually just legitimate behavior.
There's nothing suspicious here.
Our Anti-Fraud Department might say that this looks like a case of compromised credentials.
And our anti-money laundering department might actually say that Jim was the one who was laundering money.
So the point is, all these different departments don't have full visibility into what took place,
which means that none of them can respond accurately and timely to the incident.
So how are we going to bring power back to the organization?
Well, we can bridge the gap by building a unified risk operation center strategy.
So this strategy makes use of a couple of core principles.
So one being using data wherever it lives in whatever format from across the organization,
consolidating that data to make it accessible.
We also use machine learning and risk profiling at the core,
and we build consistent workflows on top of this data and the machine learning insights that we get
so that everything is handled consistently across the organization.
And finally, this is a consumable service
so that other parts of the business, other applications and services are able to use the insights that we're getting out of our risk analytics.
Okay. So how do we get there?
This is an iterative journey.
It doesn't happen overnight.
What we do is we pick some use cases and we build on them each time,
proving value to the organization of doing so.
So to start with here, we're going to start by integrating our anti-fraud and our anti-money laundering departments.
So at this point, we've got a small swarm team which has got a couple of people from the different groups.
We're starting to do joint strategy and operations planning between these groups,
and we're also rationalizing the tools and controls between them.
So what can we detect now?
Well, our anti-money laundering department might have noticed that this money went to a crypto laundering service,
and our anti-fraud department might have noticed that, you know, this transaction took place at an unusual time of day.
So from here we can start to remediate.
We can start to take action on these insights.
So we could automatically block future access to this account
and we can automatically notify the authorities so that we're preventing future losses to the business.
Okay. So our next step is then to scale up.
So now we're going to pull in information from our security operations center (SOC)
and our corporate security groups.
So now our swarm team is getting bigger.
We're including people from these new departments.
We're also further rationalizing the tools and controls so we're reducing that duplicate set of tools in the organization.
And at this phase of maturity, you're really starting to make these insights consumable.
So other parts of the business can use the rich insights that we're building here.
Okay, so what are we going to be able to detect now?
Well, the SOC might be able to tell us that our organization is being targeted at the moment by a phishing campaign.
We might also know that Jim had malware on his device at the time of compromise.
And we can start to pull in information from other third parties.
So the telco might be able to tell us that,
you know, the SIM swap that took place was actually illegitimate,
or in fact, we could look up information about recent activity on Jim's account.
So now what can we do with this information?
Well, we can see how the attacker got access in the first place,
which means we can start to remediate and ensure that this type of attack doesn't take place again in the future.
Okay, so now we want to do our final iteration.
We want our fully fledged unified risk operations center.
So what we're going to do is we're going to make sure that all of the departments in our organization
are integrated into this platform.
So we're pulling data from wherever it lives in the organization, in whatever format it lives in.
We are able to consolidate this data so that we can do machine learning on top of it.
And we're getting those risk insights associated with all different types of entities throughout the environment.
We also have well-defined workflows so we can automatically deal with known threats
and we have a really well structured way for dealing with unknown threats.
And of course, as I mentioned before, this is all consumable, so other parts of the business can use this information.
Okay. So now what can we detect at this final phase?
Well, all the pieces of the puzzle are starting to come together.
We might be able to see things like this device that was used to authenticate
the attacker was actually a new device, which in itself isn't an indicator of fraud,
but it does increase the suspiciousness of this particular incident.
We can also correlate this with other information from consortium data, for example,
and we could say, okay, well, we've actually seen this device be used for fraud in the past.
We can do machine learning on different parts of our environment.
So we could do machine learning on Jim's usual transaction.
So the transaction value in the transaction type,
which would flag this particular transaction as an anomaly.
And ultimately what we're doing is we're pulling all these little pieces of risk information together
to be able to inform real time decisions.
So in this case, we can prevent this transaction from ever actually having taken place anyway.
Okay. So we know that our existing mechanisms of building risk management around specific silos isn't sustainable.
We need to bring together the data, the tools and the people in order to be able to effectively manage risk.
Consider your risk management modernization journey
and have a think about how a Unified Risk Operations Center strategy could help you manage risk now and into the future.
Thank you.
If you like this video and want to see more like it,
please like and subscribe.
If you have questions, please drop them in the comments below.