D'Amato: Non-state criminals stole $10 million from a bank overnight in 2010
David D'Amato · a16z Podcast | Cybersecurity in the Boardroom vs. the Situation Room · Jan 2, 2019 · at 4:42
David D'Amato, a cybersecurity expert and investigator, illustrates how non-state actors with basic technical skills and financial knowledge can execute major cyber thefts without nation-state backing.
0:00 / 0:26exact quote · 26.1s
▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark
“One of the first cases I ever worked on back in 2010 was a bank that lost about ten million dollars overnight. It's a gang of criminals who were loosely affiliated with each other, who had a reasonable set of skills from their computer science degrees, from their experience in education in college, who had combined with some individuals with banking knowledge. And overnight we're able to steal ten million dollars in a very sophisticated way. And again, not associated with the nation state, not associated with tremendous amount of resources.”
quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →
More from David D'Amato
D'Amato: Corporate board focus on China and Russia is a distraction
“They're simply really interested in things that are in the news. So if you look at things like China and Russia that don't impact most organizations, they want to know who's attacking and where they're from, what they're doing. And to be honest with you, that'…”
D'Amato: Cyber attack attribution does not matter for private corporations
“And for most organizations, the attribution doesn't matter. For the government, it absolutely matters. But as a corporation, what will you be able to do? You're not going to be able to hack back that, that country.”
D'Amato: Cyber attackers often understand target networks better than defenders
“Most organizations don't really understand their own organization, their environment, and that in many cases, attackers understand the environment much better than the defenders do.”
D'Amato: Chief Security Officers commonly do not know their endpoint count
“When I asked them how many systems they had in their organization, how many endpoints they had, computers and servers and things like that, They had no idea. So that's pretty common.”
D'Amato: Penetration testers breached top secure facilities in under two hours
“I'll be honest with you, I was not very good, but within about a week or less, I think my best was about two hours, we were able to break into some of the most secure locations in the world. Physically and Based on information technology.”