Информационна сигурност за мениджъри

ПРОГРАМА ЗА ДИСТАНЦИОННО ОБУЧЕНИЕ НА МЕНИДЖЪРИ ПО:

Изграждане, внедряване, поддръжка и развитие на 
Програма за Информационна сигурност в бизнес организациите



ОСНОВНА ЦЕЛ НА ПРОГРАМАТА
Да подготви мениджърите за реално изпълнение на задачите по разработването, на цялостна Програма за информационна сигурност (ПИС) в организацията.

ОРГАНИЗАЦИЯ НА ОБУЧЕНИЕТО
Обучението се извършва на база предоставени на обучаемия, необходимия и достатъчен за целите на обучението материали (презентации, примерни документи, стандарти и др., както е приложимо), поотделно  за всеки един от учебните модули (14 бр.) на Програмата.
На базата на тези предоставени материали, обучаемият провежда самоподготовка. По време на самоподготовката обучаемият може да задава въпроси, свързани с материалите от съответния модул и да бъде подробно консултиран от водещия обучението.
След приключване обучението по съответния модул се провежда тест, за оценка на придобитите знания.
Като основен метод за комуникация се използва електронната поща – за предоставяне на материали за обучение, за задаване на въпроси, за отговор на въпроси, консултации, за предоставяне на тестове и др.
След завършване на обучението, обучаемия получава Удостоверение за завършено обучение с приложения – Програмата за обучение и Резултати от проведените тестове.

ВРЕМЕТРАЕНЕ НА ОБУЧЕНИЕТО 
Препоръчителното време за изпълнение на Програмата и в рамките на три / четири месеца.

ПЕРСОНАЛНА ЦЕНА НА КУРСА – 150 Евро (цена за един обучаем)

ВОДЕЩ ОБУЧЕНИЕТО:
ПЛАМЕН ИВАНОВ КАМЕНОВ - Водещ одитор по ISO 27001
infosecservicebg@gmail.com
0886 655 315

ЗА ПРОВЕЖДАНЕТО НА ОБУЧЕНИЕТО ПО ТАЗИ ПРОГРАМА СЕ ПОДГОТВЯ, СЪГЛАСУВА И СКЛЮЧВА ДОГОВОР МЕЖДУ ОБУЧАЕМИЯ (НЕГОВАТА ОРГАНИЗАЦИЯ) И ВОДЕЩИЯ ОБУЧЕНИЕТО!

СЪДЪРЖАНИЕ НА ПРОГРАМАТА:

МОДУЛ 1 – ВЪВЕДЕНИЕ В ИНФОРМАЦИОННАТА СИГУРНОСТ И СИСТЕМИТЕ ЗА НЕЙНОТО УПРАВЛЕНИЕ
Съдържание:
- Какво е информационна сигурност ?
- Какво е Система за управление на информационната сигурност (СУИС) ?
- Стандарти за информационна сигурност – фамилия ISO 27000
- Ползи за бизнеса (организацията) от внедряването  на СУИС
- Тест за оценка на придобитите знания

МОДУЛ 2 – УПРАВЛЕНИЕ НА ИНФОРМАЦИОННАТА СИГУРНОСТ
Съдържание:
- Изисквания зя управление  на информационната сигурност
- Компоненти на управлението на информационната сигурност
      o Стратегическо планиране на информационната сигурност
      o Структура за управление на информационната сигурност
      o Ключови функции и отговорности
      o Политики и Ръководства за информационна сигурност
      o Наблюдение и контрол на състоянието на информационната сигурност
- Основни предизвикателства към управлението на информационната сигурност и фактори за постигане на успех

МОДУЛ 3 – ЖИЗНЕН ЦИКЪЛ НА РАЗРАБОТВАНЕТО НА СИСТЕМИ
Съдържание:
- Инициираща фаза
- Фаза на разработване / придобиване
- Фаза на внедряване
- Фаза на функциониране и поддръжка
- Фаза на преустановяване на функционирането и поддръжката
- Дейности по сигурността през жизнения цикъл

МОДУЛ 4 – РАЗБИРАНЕ / ОСЪЗНАВАНЕ И ОБУЧЕНИЕ ПО ИНФОРМАЦИОННАТА СИГУРНОСТ
Съдържание:
- Политика за разбиране / осъзнаване и обучение
- Компоненти:  разбиране / осъзнаване, тренировки, обучение, и сертификация
      o Разбиране / осъзнаване
      o Тренировки
      o Обучение
      o Сертификация
- Проектиране, разработване и въвеждане в изпълнение на Програма за разбиране / осъзнаване и обучение по информационната сигурност
      o Проектиране на Програмата
      o Разработване на Програмата
      o Въвеждане в изпълнение на Програмата (Внедряване на Програмата)
- Дейности след внедряването на Програмата
- Наблюдение на съответствието на изпълнението на Програмата
- Развитие / подобряване на Програмата
- Управление на промените на Програмата
- Индикатори за успех на изпълнението на Програмата

МОДУЛ 5 – КАПИТАЛНО ПЛАНИРАНЕ И УПРАВЛЕНИЕ НА ИНВЕСТИЦИИТЕ
Съдържание:
- Интегриране на информационната сигурност в процесите за капитално планиране и управление на инвестициите
- Функции и отговорности за капитално планиране и управление на инвестициите
- Идентифициране на нивото на съответствие с основните изисквания за информационна сигурност
- Идентифициране на критериите за приоритети по информационната сигурност
- Определяне на приоритетите за инвестиции в информационната сигурност на нива „системи” и „организация”

МОДУЛ 6 – СВЪРЗАНИ СИСТЕМИ 
Съдържание:
- Управление на свързаността на системите
- Подход за управление на жизнения цикъл
      o Фаза 1: Планиране на свързването
      o Фаза 2: Изграждане на свързването
      o Фаза 3: Управление и поддръжка на свързването
      o Фаза 4: Прекъсване на свързването (временно)
- Преустановяване на свързването
      o Преустановяване, поради спешен / критичен случай
      o Възстановяване на свързването


МОДУЛ 7– ИЗМЕРВАНЕ НА ИЗПЪЛНЕНИЕТО 
Съдържание:
- Типове средства / механизми за измерване
- Разработване на средства / механизми за измерване и подход за тяхното внедряване
- Процес за разработване на средства / механизми за измерване
- Програма за внедряване на средства / механизми за измерване
- Подготовка за събиране на данни от проведените измервания
- Събиране на данни и анализ на резултатите
- Определяне на корективни действия
- Прилагане на корективните действия

МОДУЛ 8 – ПЛАНИРАНЕ ПО СИГУРНОСТТА
Съдържание:
- Главни приложения, основни па.оддържащи системи, по – маловажни приложения
- Функции и отговорности за планиране на сигурността
      o Главен информационен мениджър
      o „Собственик” на информационна система
      o Собственик” на информация
      o Старши служител по информационната сигурност в организацията
      o Служител по сигурността на информационните системи
- Правила за поведение
- Одобрение на План за сигурност на системите
      o Анализ на „границите” на системите и на контролите / защитите по сигурността
      o Контроли / защити по сигурността
      o Ръководство за обхвата на контролите / защитите по сигурността
      o Компенсиращи контроли / защити по сигурността
      o Общи контроли / защити по сигурността
- Избор на контроли / защити по сигурността
- Завършване и одобряване на датите в Плана за сигурност на системите
- Поддръжка на Плана за сигурността на системите


МОДУЛ 9 – ПЛАНИРАНЕ НА ИТ ПРИ ВЪЗНИКВАНЕ НА НЕПРЕДВИДЕНИ ОБСТОЯТЕЛСТВА
Съдържание:
- Стъпка 1: Разработване на изложение, относно разработването на Политика за планиране на ИТ при възникване на непредвидени обстоятелства
- Стъпка 2: Провеждане на анализ за влиянието на непредвидени обстоятелства върху бизнеса на организацията
- Стъпка 3: Определяне на контроли / защити за превенция
- Стъпка 4: Разработване на Стратегия за въдтановяване
- Стъпка 5: Разработване на План на ИТ при възникване на непредвидени обстоятелства
- Стъпка 6: Тестване на Плана на ИТ при възникване на непредвидени обстоятелства, обучение и тренировки по неговото изпълнение
- Стъпка 7: Поддръжка / развитие на Плана на ИТ при възникване на непредвидени обстоятелства

МОДУЛ 10 – УПРАВЛЕНИЕ НА РИСКА
Съдържание:
- Оценка на риска
      o Стъпка 1: Характеризиране на системата
      o Стъпка 2: Идентифициране на заплахите
      o Стъпка 3: Идентифициране на заплахите
      o Стъпка 4: Анализ на риска
              Анализ на контролите(защитите)
              Определяне на вероятностите
              Анализ на въздействието
              Определяне на риска
      o Стъпка 5: Препоръки за контроли (защити)
      o Стъпка 6: Документиране на резултатите
- Смекчаване на риска
- Оценка на резултатите

МОДУЛ 11 – СЕРТИФИЦИРАНЕ, АКРЕДИТИРАНЕ И ОЦЕНКА НА СИГУРНОСТТА
Съдържание:
- Функции и отговорности
      o Главен служител по информацията
      o Отговарен мениджър по информационната сигурност
      o Старши служител по информационната сигурност
      o "Собствени" на информационна система
      o "Собственик" на информация
- Делегиране на функции
- Процес за сертифициране и акредитиране
- Документация за сертифициране по сигурността
- Решения за акредитация
- Непрекъснато наблюдение
- Оценка на програмата

МОДУЛ 12 – УСЛУГИ ПО СИГУРНОСТТА И ПРИДОБИВАНЕ НА ПРОДУКТИ
Съдържание:
- Жизнен цикъл на услугите по информационната сигурност
- Избор на услугите по информационната сигурност
- Избор на инструментариум за управление на услугите по информационната сигурност
- Основни въпроси, свързани с услугите по информационната сигурност
- Основни разбирания за услугите по информационната сигурност
- Избор на продукти за информационна сигурност
- Списък по сигурността на ИТ продукти
- Организационни конфликти на интереси

МОДУЛ 13 – ОТГОВОР ПРИ ИНЦИДЕНТИ
Съдържание:

- Подготовка
      o Подготовка за отговор при инциденти
      o Подготовка за събиране на данни за инцидент
      o Превенция на инциденти
- Разкриване и анализи
- Възстановяване след инциденти
- Дейности след възстановяването от инцидент

МОДУЛ 14 – УПРАВЛЕНИЕ НА КОНФИГУРАЦИИТЕ
Съдържание:
- Управление на конфигурациите през  жизнения цикъл за разработване на системи
- Функции и отговорности за управление на конфигурациите
- Процес за управление на конфигурациите

2016 Security Predictions

from Zscaler CISO Michael Sutton 

Android finally cleans up its act 

Love it or hate it, Apple’s walled garden and refusal to allow downloads from third-party app stores has paid security dividends. Sure, Google Play has Bouncer, and it’s done a fine job of keeping the miscreants out, but that’s of limited value when users are willing to go to shady Chinese app stores to save a buck on Candy Crush. Google clearly knows that this will hurt it in the long run, and while the company is taking steps to increase security, it needs to be much more aggressive going forward, by: 
• Cracking down on third-party app stores
• Taking more drastic steps and restricting the permissions available to apps not vetted through the Google Play submission process 
• Expecting side-loaded apps that request Administrator permissions to become a thing of the past 
• Mandating acceptable timeframes for patches and firmware upgrades from Android licensees 

Some developers and partners will push back, but Google will have little choice but to implement these changes if it wants to get malware under control. These steps won’t eliminate Android malware, especially with Android’s slow O/S upgrade cycle, but they will raise the bar for third-party app stores, just as Bouncer is doing for Google Play. 

Terrorists target critical infrastructure 

This prediction is one that saddens me to write, but I feel this threat is inevitable and one that can’t be ignored. We know that terror organizations are continually searching for new avenues to instill fear, but we also know that they require significant funding to further their hateful agendas. Unfortunately, skilled hackers can aid on both fronts. Cyber-attacks can clearly be used by terrorists to obtain intelligence, and we’re already seeing early signs of cyber-attacks being used to cause physical damage through targeting critical infrastructure. Last year, hackers caused significant damage to a German steel mill when they disabled systems responsible for controlling a blast furnace. 
This wasn’t just kids playing around either, as the attacks reportedly required substantial knowledge of industrial control systems in order to succeed. With almost all industries reliant on computerized systems, the potential attack surface for critical infrastructure is enormous. Hacking is also extremely lucrative and, sadly, terrorists won’t necessarily need to acquire the necessary skills themselves to carry out cyberattacks, as there is no shortage of cyber criminals willing to rent their skills out to the highest bidder and look the other way.  

Password reuse attacks decline 

And now for some good news. Password reuse attacks will begin to decline. Attackers are quite happy to compromise virtually any site, even if it’s not the endgame, as they can generally recover information and resources that will aid in other attacks. Most people use a handful of passwords at best. (Think of your favorite password that you’ve used over the years. How many sites have you used it on? You lost count, didn’t you?) Fortunately, this is starting to change, thanks in large part to the smartphone. Smartphones can be many things, but they make for a handy, secure, and always-with-you data repository. As such, people are starting to adopt password managers such as 1Password, LastPass, etc., as they offer user-friendly smartphone apps that present a convenient option for always having sensitive data, such as passwords, within easy reach. Advancements in biometrics are also helping the cause with consumer-grade fingerprint scanners now becoming a standard feature on modern smartphones. This not only makes accessing that password repository quicker and more user friendly, but also makes it an option—finally—to do away with passwords altogether. While less user friendly, most major web properties are also adding two-factor authentication as a standard option. At last, the average user has realistic authentication options that don’t involve sticky notes.          

The encryption showdown 

Encrypted communications have long been the bane of law enforcement and those in the intelligence communities. As privacy concerns mount, thanks in part to the Snowden revelations, leveraging strong encryption for messaging and data storage is no longer the realm of geek speak. It is, in fact, an expected and differentiating feature. iOS now encrypts data by default and Android, while lagging, is fighting to get there. Popular chat applications like WhatsApp tout encryption as a key feature, and Apple’s iMessage app, which features end-to-end encryption and no central key store, is often referenced by law enforcement when arguing for a “backdoor.” In 2016, this battle will come to a head. While politicians used to dance gingerly around the topic given the privacy abuses exposed by the Snowden revelations, recent terrorist attacks have brought this issue front and center. Multiple pieces of legislation are sure to be introduced that will propose weakened encryption protocols or procedures to grant law enforcement access to decrypted communications as needed. Weakening encryption to benefit law enforcement will also reduce security for everyone, and if the U.S. government mandates a “backdoor,” you can rest assured that China, Russia, and [pick a country] will be demanding the same for their citizens. This is one battle that will have serious repercussions for years to come. Here’s to hoping that Apple, Google, Microsoft, Yahoo!, and the like manage to prevail.               

PII is the new hotness  

PII is the new hotness In 2015, the trend of major retail data breaches resulting in bulk debit and credit card theft continued, but the year also marked a shift that will accelerate in 2016. In the coming year, expect attackers to move away from targeting financial information and instead begin to target personally identifiable information (PII). The quest for PII is being driven by two separate groups of attackers. While nation states desire PII for espionage, criminals are also shifting to PII, as it is generally more valuable than credit and debit cards, which are getting more challenging to harvest in bulk due to greater awareness of the problem and new technology. PII is highly sought after in the underground as it can be leveraged to commit financial fraud on several fronts, such as applying for credit, submitting false medical/insurance claims, or filing for fraudulent tax refunds. Whereas credit cards can be easily canceled, it’s not generally an option to change one’s name, address, and social security number, so the stolen data remains valuable for a longer period of time. In 2016, attackers will increasingly target sectors known to store bulk PII, including finance, healthcare, and government entities, to harvest valuable PII.

Дистанционно обучение - курсове и цени

ДИСТАНЦИОННО ОБУЧЕНИЕ ПО:


1. ИНФОРМАЦИОННА СИГУРНОСТ ЗА МЕНИДЖЪРИ - ИЗГРАЖДАНЕ, ВНЕДРЯВАНЕ, ПОДДРЪЖКА И РАЗВИТИЕ НА ПРОГРАМА ЗА ИНФОРМАЦИОННА СИГУРНОСТ В БИЗНЕС ОРГАНИЗАЦИИТЕ

Цена на курса:

- за персонално обучение – 150 Евро

- за корпоративно обучение – по договаряне, в зависимост от броя обучаеми, но не повече от  500 Евро 

2. ИНФОРМАЦИОННА СИГУРНОСТ - ISO 27001:2013 - ИНФОРМАЦИОННИ ТЕХНОЛОГИИ – СИСТЕМА ЗА УПРАВЛЕНИЕ НА ИНФОРМАЦИОННАТА СИГУРНОСТ (СУИС) – ИЗИСКВАНИЯ

Цена на курса:

- за персонално обучение – 150 Евро

- за корпоративно обучение – по договаряне, в зависимост от броя обучаеми, но не повече от  500 Евро 

3. УПРАВЛЕНИЕ НА ИТ УСЛУГИТЕ - ISO 20000-1:2011 - ИНФОРМАЦИОННИ ТЕХНОЛОГИИ — УПРАВЛЕНИЕ НА УСЛУГИ —ЧАСТ 1: ИЗИСКВАНИЯ КЪМ СИСТЕМИТЕ ЗА УПРАВЛЕНИЕ НА УСЛУГИ (СУУ)

Цена на курса:

- за персонално обучение – 150 Евро

- за корпоративно обучение – по договаряне, в зависимост от броя обучаеми, но не повече от  500 Евро 

4. МЕРКИ ЗА ПРОТИВОДЕЙСТВИЕ НА ЗАПЛАХИТЕ   КЪМ ИНФОРМАЦИОННАТА СИГУРНОСТ, ПРЕДИЗВИКАНИ ОТ ЗЛОНАМЕРЕНИ „ВЪТРЕШНИ ХОРА” (ЗЛОНАМЕРЕН „ВЪТРЕШЕН ЧОВЕК”)

Цена на курса:

- за персонално обучение – 125 Евро

- за корпоративно обучение – по договаряне, в зависимост от броя обучаеми, но не повече от  400 Евро 

5. УПРАВЛЕНИЕ НА КАЧЕСТВОТО - ISO 9001:2015 – СИСТЕМА ЗА УПРАВЛЕНИЕ ТА КАЧЕСТВОТО (СУК) - ИЗИСКВАНИЯ

Цена на курса:

- за персонално обучение – 100 Евро

- за корпоративно обучение – по договаряне, в зависимост от броя обучаеми, но не повече от  300 Евро 

Забележки:

1. Програмите за дистанционно обучение по горепосочените курсове са публикувани в този  блог -  http://infosecservicebg.blogspot.com/ 

2. За допълнителна информация:

- 0886 655 315 – Пламен Каменов

- e mail: infosecservicebg@gmail.com

- http://infosecservicebg.wix.com/study-security

Хакерството, като бизнес модел

НОВИЯ СВЯТ НА КИБЕР ПРЕСТЪПЛЕНИЯТА – КОГАТО ХАКЕРСТВОТО СТАВА ГОЛЯМ БИЗНЕС

В ранните си години  хакерството наподобяваше Дивия запад. В тези времена, отделни хакери предизвикваха  хаос, където, когато и както могат – напр. чрез „открадване” на номерата на кредитни карти  или информация / данни за банковите сметки на нищо неподозиращите жертви.

В днешно време хакерството е доста по сложно и усъвършенствано. В последно време се наблюдава  значително разнообразяване в подходите за постигане на печалби чрез хакерство – тази нова тенденция на практика съпровожда изцяло кибер престъпленията в последните години.

НАЙ-ГОЛЕМИЯ СЛУЧАЙ НА КИБЕР ХАКЕРСТВО ВЪВ ФИНАНСОВИЯ СЕКТОР НА САЩ

През  м. ноември, 2015, Министерството на правосъдието на САЩ публикува съобщение, относно предявяването на обвинение към трима души, в което се съобщава за най-големия случай на кибер хакерство във финансовия сектор на САЩ.  (Обвинението представено по-долу)

В съответсвие с предявеното обвинение, в периода 2012 до 2015, тримата предполагаеми престъпни конспиратори Гери Шалон, Зив Оренщейн и Джошуа Самуел Аарон (на свобода, към момента на публикуване на съобщението на Министерството на правосъдието на САЩ) са приложили хакерска  схема, насочена към финансовия сектор – като най-голямата им цел е била JP Morgan. За тях се предполага, че са откраднали персонална информация за повече от 100 милиона потребители, чрез пробиви с системите за данни, като впоследствие са използвали  тази информация в интерес на различни престъпни организации.

В допълнение към хакерските действия към различни големи банки, тримата нападатели също са „прали” пари, организирали са нелегални търговски операции с Bitcoin, а също са пуснали в действие нелегални online игрални домове (казина). Те са използвали  откраднатите имената и e-mail адресите им, придобити от финансови институции, за да се свържат с неволни жертви и да ги убедят да купуват акции (с  изкуствено надути стойности)  по класическата измамна схема "помпай и зарязвай".

НОВИТЕ КИБЕР ПРЕСТЪПНИЦИ

В много случаи, съвременните кибер престъпници  не са хакери с високо технологични познания. Вместо това, те използват своите  бизнес знания, с цел усъвършенстване на хакерските схеми. На практика те предпочитат да прехвърлят „чисто” хакерските действия от себе си на други, неизвестни изпълнители. По този начин хакерството се превръща от просто, бързо печелене на пари в действие за поддръжка на различни престъпни групировки.

Едно от доказателствата  за новия свят на кибер престъпленията е повдигнатото обвинение от Министъра на правосъдието на САЩ и Областния прокурор на Манхатън за проникване в мрежите на финансови институции на САЩ и др. компании (публикувано по-долу)

Department of Justice

Office of Public Affairs

---

FOR IMMEDIATE RELEASE

Tuesday, November 10, 2015

Attorney General and Manhattan U.S. Attorney Announce Charges Stemming from Massive Network Intrusions at U.S. Financial Institutions, U.S. Brokerage Firms, Major News Publications and Other Companies

Breaches Included the Largest Theft of Customer Data from a U.S. Financial Institution in History

Defendants Hacked in Furtherance of Securities Market Manipulation Schemes, and Vast Gambling and Payment Processing Schemes

Attorney General Loretta E. Lynch, U.S. Attorney Preet Bharara of the Southern District of New York, Assistant Director in Charge Diego Rodriguez of the FBI’s New York Field Office and Special Agent in Charge Robert J. Sica of the U.S. Secret Service (USSS) New York Field Office announced today the unsealing of a superseding indictment charging Gery Shalon, aka “Garri Shalelashvili,” “Gabriel,” “Gabi,” “Phillipe Mousset” and “Christopher Engeham,” with orchestrating massive computer hacking crimes against U.S. financial institutions, brokerage firms and financial news publishers, including the largest theft of customer data from a U.S. financial institution in history (the U.S. Financial Sector Hacks).  Shalon is charged with committing these crimes with Joshua Samuel Aaron, aka “Mike Shields,” in furtherance of securities market manipulation schemes that Shalon and Aaron perpetrated with defendant Ziv Orenstein, aka “Aviv Stein” and “John Avery” in the United States. 

As alleged, Shalon also orchestrated computer network hacks and cyberattacks in furtherance of other major criminal schemes, including unlawful internet casinos and illicit payment processors which Shalon operated with Orenstein.  Shalon also owned and controlled an illegal U.S.-based Bitcoin exchange known as Coin.mx.  Shalon and Orenstein were arrested in July 2015 by the Israel Police on an indictment that charged the underlying securities fraud, and they remain in custody in Israel pending extradition on those charges.  The U.S. Attorney’s Office will seek their extradition to stand trial in the United States on the additional charges announced today.  Aaron remains at large.  Also announced today is the unsealing of a separate indictment charging Anthony R. Murgio with operating Coin.mx in the United States, and related crimes.  Murgio, who was arrested on a complaint in July 2015, will be arraigned before the Honorable Alison J. Nathan.

 “As set forth in the indictment, these three defendants perpetrated one of the largest thefts of financial-related data in history – making off with the sensitive information of literally thousands of hard-working Americans,” said Attorney General Lynch.  “These charges were made possible in large part because those victims came forward and worked with the Department of Justice to hold the perpetrators accountable.  In an age when enormous quantities of vital information are stored in digital format on potentially vulnerable Internet-connected devices, public-private partnerships and information-sharing are more critical than ever.  The Department of Justice is committed to protecting the financial data of all our citizens and the financial integrity of our institutions.  I’d like to thank the prosecutors and law enforcement professionals who worked tirelessly on this case, and the victims who offered their full cooperation with law enforcement to make these criminal charges possible.”

“Today, we have exposed a cybercriminal enterprise that for years successfully and secretly hacked into the networks of a dozen companies, allegedly stealing personal information of over 100 million people, including over 80 million customers from one financial institution alone,” said U.S. Attorney Bharara.  “The charged crimes showcase a brave new world of hacking for profit.  It is no longer hacking merely for a quick payout, but hacking to support a diversified criminal conglomerate.  This was hacking as a business model.  The alleged conduct also signals the next frontier in securities fraud – sophisticated hacking to steal nonpublic information, something the defendants discussed for the next stage of their sprawling enterprise.  Fueled by their hacking, the defendants’ criminal schemes allegedly generated hundreds of millions of dollars in illicit proceeds.  Even the most sophisticated companies – like those victimized by the hacks in this case – have to appreciate the limits of their ability to uncover the full scope of any cyber-intrusion and to stop the perpetrators before they strike again.  If they have been hacked, most likely others have been as well, and even more will be.  The best bet to identify, stop and punish cybercriminals is to work closely, and early, with law enforcement.  That happened here, and today’s charges are proof of that.”

“Shalon, Aaron and their co-conspirators allegedly robbed victim companies, often for months at a time, stealing the contact information of tens of millions of customers,” said Assistant Director in Charge Rodriguez.  “They cloaked themselves in secrecy, but their methods rivaled those of the traditional masked robber.  Today’s indictment sheds light on an increasingly complex threat.  But just as criminals continue to develop relationships with one another in order to advance their objectives, the law enforcement community has developed a collaborative approach to fighting these types of crimes.”

“This investigation is indicative of the sophistication and complexity of cybercrime and the transnational criminal organizations that are responsible for it,” said Special Agent in Charge Sica.  “Transnational cybercriminal organizations operate with impunity regardless of national borders as these criminal organizations seek to profit from information stolen through the unauthorized access to victims’ networks.  Through the U.S. Secret Service global network of Electronic Crimes Task Forces, our field offices located overseas and the close cooperation of our foreign law enforcement partners, no cybercriminal is beyond our reach.  We will remain relentless in pursuing these criminals wherever they may reside.”

According to the allegations contained in the superseding indictment^[1]:

From approximately 2012 to mid-2015, Shalon, working with Aaron and others, orchestrated the U.S. Financial Sector Hacks, stealing personal information of over 100 million customers of the victim companies.  Among these, their network intrusion at one bank (Victim-1) resulted in the theft of personal information of over 80 million Victim-1 customers, making it the largest theft of customer data from a U.S. financial institution in history.  Shalon, Aaron and their co-conspirators engaged in these crimes in furtherance of other criminal schemes.  In particular, in an effort to artificially manipulate the price of certain stocks publicly traded in the United States, Shalon and his co-conspirators sought to market the stocks, in a deceptive and misleading manner, to customers of the victim companies whose contact information they had stolen in the intrusions. 

In addition to directing the U.S. Financial Sector Hacks, Shalon directed computer network hacks and cyberattacks against numerous companies outside of the financial sector.  Shalon and his co-conspirators engaged in these crimes in furtherance of large-scale criminal businesses that Shalon and Orenstein operated in the United States and other countries.  In particular, between approximately 2007 and July 2015, Shalon owned and operated unlawful internet gambling businesses in the United States and abroad; owned and operated multinational payment processors for illegal pharmaceutical suppliers, counterfeit and malicious software (malware) distributors, and unlawful internet casinos; and owned and controlled Coin.mx, an illegal U.S.-based Bitcoin exchange that operated in violation of federal anti-money laundering laws.  Nearly all of these schemes, like Shalon’s securities market manipulation schemes, relied for their success on computer hacking and other cybercrimes committed by Shalon and his co-conspirators.

Through their criminal schemes, between in or about 2007 and in or about July 2015, Shalon and his co-conspirators earned hundreds of millions of dollars in illicit proceeds, of which Shalon concealed at least $100 million in Swiss and other bank accounts.

Shalon, Aaron, Orenstein and their co-conspirators operated their criminal schemes, and laundered their criminal proceeds, through at least 75 shell companies and bank and brokerage accounts around the world.  The defendants controlled these companies and accounts using aliases, and by fraudulently using approximately 200 purported identification documents, including over 30 false passports that purported to be issued by the United States and at least 16 other countries.

The U.S. Financial Sector Hacks

Between approximately 2012 and August 2014, Shalon and a co-conspirator (CC-1), working at times with Aaron, executed the hacks of the computer networks of Victims 1 through 9.  Among other things, in foreign-language electronic communications, during these hacks, Shalon bragged about the size and scope of his securities market manipulation schemes and described to CC-1 his use of the stolen data in furtherance of those schemes.  Shalon and CC-1 also discussed expanding their network intrusions to encompass thefts of material non-public information from the financial institutions and other firms they were hacking. 

The Securities Market Manipulation Schemes

Since 2011, Shalon, Aaron, Orenstein and their co-conspirators orchestrated multimillion-dollar stock manipulation – or “pump and dump” – schemes to manipulate the price and trading volume of dozens of publicly traded microcap stocks (penny stocks) in order to enable members of the conspiracy to sell their holdings in those stocks at artificially inflated prices.  In some instances, Shalon and Aaron caused the companies to become publicly traded in furtherance of the scheme.  To do so, Shalon caused privately held companies to engage in “reverse mergers” with publicly traded shell corporations Shalon controlled.  Orenstein managed bank and brokerage accounts used in furtherance of the schemes under aliases that he supported with false passports and other false personal identification information. 

To artificially manipulate the trading volume and prices of dozens of stocks, among other things, at pre-arranged times, Shalon and Aaron disseminated materially misleading, unsolicited messages by various means – including by email (spam) to up to millions of recipients per day – that falsely touted the stock in order to trick others into buying it.  Shalon and Aaron engaged in the U.S. Financial Sector Hacks in part to acquire email and mailing addresses, phone numbers and other contact information for potential victims to whom they could send such deceptive communications.  Shalon and his co-conspirators generated tens of millions of dollars in unlawful proceeds from the securities market manipulation schemes. 

The Unlawful Internet Gambling Schemes, Hacks and Cyberattacks

From at least in or about 2007 up to and including in or about July 2015, Shalon, Orenstein and their co-conspirators operated unlawful internet casinos in the United States and elsewhere through hundreds of employees in multiple countries.  In the United States, the defendants knowingly operated at least 12 unlawful internet casinos (the Casino Companies) which, through their websites, offered real-money casino gambling in violation of federal law and the laws of numerous states, including New York state.  Through the Casino Companies, Shalon, Orenstein and their co-conspirators generated hundreds of millions of dollars in unlawful income.

In furtherance of his unlawful internet gambling schemes, Shalon and his co-conspirators engaged in massive hacks and cyberattacks against other internet gambling businesses to steal customer information, secretly review executives’ emails and cripple rival businesses.  For example, Shalon orchestrated network intrusions of Victims-10 and -11, companies that provided operating software to Shalon’s internet casinos.  In doing so, Shalon sought to, and did, secretly obtain access to the email accounts of senior executives at both companies to ensure that the companies’ work with Shalon’s competitors did not compromise the success of Shalon’s unlawful internet gambling businesses.

The Illicit Payment Processing Scheme and Hack

From at least in or about 2011 until in or about July 2015, Shalon, Orenstein and their co-conspirators operated IDPay and Todur, multinational payment processors for criminals who sought to receive payments by credit and debit card in furtherance of their unlawful schemes.  Through these payment processors, Shalon, Orenstein and their co-conspirators knowingly processed credit and debit card payments for, at a minimum, unlawful pharmaceutical distributors, purveyors of counterfeit and malicious purported “anti-virus” computer software, their own unlawful internet casinos and Coin.mx, an illegal U.S.-based Bitcoin exchange owned by Shalon.  In doing so, Shalon, Orenstein, and their co-conspirators knowingly processed hundreds of millions of dollars in transactions for criminal schemes, for which they earned a percentage of every transaction.  

Beginning in or about 2012, Shalon and his co-conspirators hacked into the computer networks of Victim-12, a U.S. company which assessed merchant risk and compliance for credit card issuers and others, including by detecting merchants that accepted credit card payments for unlawful goods or services.  Thereafter, on an ongoing basis, Shalon and his co-conspirators monitored Victim-12’s detection efforts, including by reading emails of Victim-12 employees, so they could take steps to evade detection by Victim-12 of their unlawful payment processing scheme. 

The Unlawful Bitcoin Exchange

From in or about 2013 to in or about July 2015, Shalon knowingly owned Coin.mx, which was operated by Murgio in the United States at Shalon’s direction in violation of federal anti-money laundering (AML) registration and reporting laws and regulations.  Through Coin.mx, Shalon, Murgio and their co-conspirators enabled their customers to exchange cash for Bitcoins, charging a fee for their service.  In total, between approximately October 2013 and July 2015, Coin.mx exchanged millions of dollars for Bitcoins on behalf of its customers.

*                *                *

Shalon, 31, of Savyon, Israel; Aaron, 31, a U.S. citizen who resides in Moscow; and Tel Aviv; and Orenstein, 40, of Bat Hefer, Israel, are charged with the following offenses, which carry the maximum prison terms listed below:

Count	Defendants	Charge	Maximum Prison Term
One	Shalon and Aaron	Conspiracy to Commit Computer Hacking	five years
Two	Shalon and Aaron	Computer Hacking	five years
Three	Shalon and Aaron	Computer Hacking	five years
Four	Shalon, Aaron and Orenstein	Conspiracy to Commit Securities Fraud	20 years
Five	Shalon, Aaron and Orenstein	Conspiracy to Commit Wire Fraud: Securities Market Manipulation Scheme	20 years
Six to 12	Shalon, Aaron and Orenstein	Securities Fraud	20 years
13	Shalon, Aaron and Orenstein	Wire Fraud	20 years
14	Shalon, Aaron and Orenstein	Identification Document Fraud Conspiracy	20 years
15	Shalon, Aaron and Orenstein	Aggravated Identity Theft	Mandatory two years
16	Shalon and Orenstein	Unlawful Internet Gambling Enforcement Act Conspiracy	five years
17	Shalon and Orenstein	Unlawful Internet Gambling Enforcement Act	five years
18	Shalon and Orenstein	Operation of Illegal Gambling Business	five years
19	Shalon and Orenstein	Conspiracy to Commit Wire Fraud: Unlawful Payment Processing	20 years
20	Shalon	Conspiracy to Operate an Unlicensed Money Transmitting Business	five years
21	Shalon	Operation of an Unlicensed Money Transmitting Business	five years
22	Shalon, Aaron and Orenstein	Money Laundering Conspiracy: Securities Market Manipulation Scheme	20 years
23	Shalon, Aaron and Orenstein	Money Laundering Conspiracy: Internet Gambling and Payment Processing Schemes	20 years

For his alleged conduct, Murgio, 31, of Tampa, Florida, is charged with the following offenses: conspiracy to operate an unlicensed money transmitting business, which carries a maximum prison term of five years; operation of an unlicensed money transmitting business, which carries a maximum prison term of five years; conspiracy to make corrupt payments with intent to influence an officer of a financial institution, which carries a maximum prison term of five years; making corrupt payments with intent to influence an officer of a financial institution, which carries a maximum prison term of 30 years; conspiracy to commit wire fraud, which carries a maximum prison term of 20 years; wire fraud, which carries a maximum prison term of 20 years; and money laundering, which carries a maximum prison term of 20 years.

The maximum potential sentences in this case are prescribed by Congress and are provided here for informational purposes only, as any sentencing of the defendants will be determined by the judge.

U.S. Attorney Bharara praised the investigative work of the FBI and the USSS, and expressed his sincere gratitude to the Office of the State Attorney of the Israel Ministry of Justice’s Department of International Affairs and the Israel National Police, Cyber Unit - Lahav 433, for their support and assistance with the investigation and the ongoing extradition proceedings.  He also thanked the U.S. Securities and Exchange Commission, U.S. Immigration and Customs Enforcement-Homeland Security Investigations, the Financial Industry Regulatory Authority, the National Credit Union Administration, the Justice Department’s Office of International Affairs and the Financial Services Information Sharing and Analysis Center, which significantly aided the investigation by facilitating information-sharing among the victim institutions.

The prosecution of this case is being overseen by the U.S. Attorney’s Office of the Southern District of New York’s Complex Frauds and Cybercrime Unit.  Assistant U.S. Attorneys Nicole Friedlander, Eun Young Choi and Sarah Lai of the Southern District of New York are in charge of the prosecution.  Assistant U.S. Attorney Edward Diskant of the Southern District of New York’s Money Laundering and Asset Forfeiture Unit is in charge of the forfeiture aspects of the case.

The charges contained in the indictment are merely accusations, and the defendants are presumed innocent unless and until proven guilty.

---

[1] As the introductory phrase signifies, the entirety of the text of the superseding indictment and the description of the indictment set forth herein constitute only allegations, and every fact described should be treated as an allegation.