MITIGATING CYBER SECURITY THREATS TO DEFENSE AND FINANCE SYSTEMS AND INFRASTRUCTURE (Virtual)

Thank you so much. We will now hear from Ms. Victoria Beckman, virtually. She's the Director of Digital Crimes Unit at Microsoft. So Ms. Beckman, if you could please join us. Thank you. Buenas tardes a todos. Thank you very much. My name is Victoria Beckman, as they said. And I'm going to speak in English, just because the rest of the panel is speaking English. My name is Victoria Beckman. I'm the Director of the Digital Crimes Unit at Microsoft for the region of the Americas. And I also lead the Critical Infrastructure Group for Latin America. And my presentation today is just going to be based on some of the work that we're doing, recognizing the importance of cybersecurity at Microsoft in the region. Let me start with some very basic numbers that we're probably all very familiar with. But in the last year, we have seen an increase on attacks and cyber attacks, especially some of them taking advantage of the pandemic. Some of them also taking advantage of the fact that we are going through election cycles in South America. We have seen an increase in the percentage of people that are being victims of phishing attacks and social engineering attacks. According to studies that have done, the Ponemon Institute, together with IBM, there is approximately 90 days between the time that there is an attack and the time that an organization recognizes that they have been subjected to an attack. Ninety days is a long time and it could cause a lot of issues, not only economic issues, reputational issues, legal issues, but in the long run, it could be something that wasn't discovered, that wasn't handled the right way. We have statistics of 24 to 48 hours for an attacker to have complete control of a network. And as we have seen lately, there have been also an increase in attacks to critical infrastructure, including water supply plants, oil plants, including also beef manufacturing or processing plants. The cost of a cyber attack, the average cost of a cyber attack, and this is in U.S. dollars, is about $4 million, which could be something that an organization could afford if it's an organization the size maybe of Microsoft or some other companies. But for a small or medium organization, this could be the end of their existence. And the statistics are $8 trillion spent to fight cyber crime and the cost to the global economy in general, resulting in victims and loss of business, having to update systems and things of that nature. So what are we doing to help with this? Well, Microsoft created the Cyber Crime Center, was built in about 2013, and this is a place where we all work. It's kind of a collaboration between the public sector, the public sector, to try to bring together technical and legal experts to fight against cyber crime. So in my unit, my team, the Digital Crimes Unit, our mission is to lead the fight against cyber crime, to protect our customers and to promote global trust in Microsoft. And we're doing that through technology, including artificial intelligence and machine learning, to follow trends and discover bad actors. We're using digital forensics. We're using creative legal strategies, as was mentioned. There are a lot of countries that don't have legislation covering these kind of attacks or these kind of crimes yet. So we're trying to come up with different theories, different ways to maybe go after these perpetrators and to try to stop cyber criminals. We also work with criminal referrals to law enforcement throughout the region, including criminal referrals in cases of online child exploitation. And we have public and private partnerships with governments, with companies across the Americas to try to have our efforts combine and work together against cyber crime. We work with security and privacy, and this also includes legislation and with a big component is education and awareness throughout the region, as well as working with policy and trying to generate these ideas to have laws that are evolving at the same rate that the technology is evolving. So our our main programs in terms of disruption and what the DCU Center does, and by the way, once this COVID and the whole pandemic restrictions are over, I hope to welcome some of you in person to visit our lab and our facilities that we have initiatives to combat malware. We do take down some botnets. We do, especially in big countries like Brazil, Mexico, we have constant operations to try to combat this malware as well as ransomware. We have seen an increase in ransomware and ransomware targeting critical infrastructure of countries. We also work with combating business email compromise, which is together with payment disruption affects the financial industry mainly and the professional services industry with any malicious use of Azure or the cloud to commit these kinds of crimes. Technical support fraud, which is also contacting somebody pretending to be Microsoft, Apple, Google to provide support and then business operation integrity that again includes a strategic enforcement of IP, but also supply chain integrity and and most importantly, customer engagements, including policy and work with different governmental entities, different governments trying to to share information and come up with solutions and even model laws and things of that nature to work together. I'm going to do a very, very quick run of how these programs work to give time to my co-panelists. But but some of the key ones and the ones that are affecting the financial and the critical infrastructure areas are the business email compromise. We're trying to disrupt, deter, strengthen and communicate, meaning that we are trying to look ahead of time for this. Who are the who are the attackers? What are they doing? What kind of we're doing entire operations trying to get to this to these attackers and disrupt them before they can continue doing what they're doing. We work in collaboration with different entities, including Europol, Interpol, FBI. We have gone in the past year. We have done we have for this bad actors to to the authorities and it has resulted in arrest of cyber attacks, attackers, sorry, disrupt and recovery of some amounts that were returned to the victims. There were arrests overseas, not only in the United States, but in Europe. And we haven't we haven't done one yet in Latin America, but it's coming. And we also have worked pretty hard concentrating on malware cases. These malware cases include the spam. It also includes ransomware. And again, same thing, we're trying to to provide authorities and to work together with authorities to give them the information, the evidence that they need to work these cases and to hopefully stop, deter and prosecute cyber attackers. Just an overview of different malware disruption operations that we have done throughout the year that have resulted in successful disruption and closing down of big nets of cyber attackers, some of them located overseas. But we have collaborated so that we can actually have this impact across jurisdictions. We also have worked with the Cyber Trade Intelligence Program. There are multiple companies throughout North, Central and South America that are cooperating with us that have signed these kinds of agreements. And these agreements are basically an agreement to share information about threats, about vulnerabilities, about what we're doing, how we're disrupting this. And I'm saying from the side of the companies, the private companies, so that we can hopefully have this network that is working together to to disrupt these attacks. As I mentioned, we also work on tech support fraud and mostly awareness campaigns and education of users as to what this is, how they're proliferating, how depending on this on the situation going around in the country, the political situation, COVID, they're taking taking advantage and doing the scams. And as I mentioned, same enforcement and deterrence and referrals to law enforcement. And those are basically what our program basically, as I mentioned, also, we work together with with different countries in promoting policy that addresses cybersecurity, that addresses education in cybersecurity, building of critical skills and capabilities, building. And here's my information. If anyone has any questions in English or Spanish, feel free to reach out. Thank you.