// archives

Digital Crime

This category contains 30 posts

Details of Cyber Attacks: Sharing is Caring

 

On 29 December 2016, the US government entered a new round in its fight against malicious cyber attackers. It released a 13-page report, accompanied by a much more detailed listing of almost 1,000 technical indicators. The goal of the report was to help companies detect, block and eradicate cyber attacks on their networks.

The move followed a rough year where not only the Democratic National Committee suffered a consequential and highly mediatized breach, but also think tanks, universities, critical infrastructure and many more. Fears that further attacks are coming appear well-grounded. The US government’s report is important and relevant for many businesses, also here in Switzerland, for at least three reasons:

Aligned with private companies
Firstly, it confirms what private companies – including PwC – have been saying for a couple of years. The released information is a mixture of yet-unseen declassified technical indicators with a few also coming from the private sector. Private cyber security companies have therefore been doing quite a good job at gaining visibility and tracking what attackers have been up to. The investigative methods of private companies appear to match the ones the US government is using.

Overview on known attacking methods
Secondly, the report strongly highlights current state-of-the-art ways of attacking networks. Attackers send e-mails with malicious content enticing users to click on them. Once in a network they try to gain access to even more protected valuable resources (so-called “lateral movement” aimed at “escalating privileges”). The e-mails need not be precisely targeted: despite the hype over “spear phishing” e-mails, many rather resemble spam being sent to thousands of recipients at a time.

How to tackle threats
And this leads to the third point. The bulk of the US government’s report focuses on how to tackle such threats. And it notes: “These strategies are common sense to many, but DHS continues to see intrusions because organisations fail to use these basic measures”. This aligns very well with PwC’s experience and conclusions. In other words, many organisations, also in Switzerland, have yet to implement strong cyber security measures to ensure that they cannot easily fall victim to such attacks.

The way forward: sharing more data
Technical reports of this kind are very welcome. They lead the way by stressing that the sharing of information is crucial to defending against cyber attacks, and they contribute to normalising such a practice. Until now, indicators of cyber attacks have been very often looked at as sensitive information, thus there has been a notorious reluctance to share them between oft-ashamed victims. PwC supports the idea of sharing: when companies exchange information about experiences they’ve had with cyber attacks, negative experiences included, companies not only bring benefits to other companies, but also to themselves in the long run. They can get feedback on other companies’ experiences and this way improve their own security mechanisms. Reports like the one from the US government may contribute to changing the current mindset.

We’d also suggest adding even more precision and more details to such reports and not merely mention the many different malware names involved. For example: attackers launch their offensives in stages and use different tools and techniques at each of these stages. To protect different areas of their network, it is useful for companies to know exactly which technique is being used and at which stage. And lastly, many of the indicators provided, such as IP addresses (the address of a machine on a network), may have at times been used for legitimate purposes. To be able to differentiate between what is actually a part of the attack and what is not, it is necessary to know the exact time at which the infrastructure was used, this by means of what are commonly referred to as timestamps.

All in all, companies are well-advised to take a close look at the indicators of compromise that the US Government has provided and to use them as much to detect potential current breaches as to prevent future ones. Investigative work means that one must be ready for false-positives and shouldn’t necessarily take the initial result at face value. But, again, sharing with the rest of the community the difficulties and outcomes of these investigations can only help to strengthen the overall state of cyber security.

The above mentioned report and indicators are available under:
https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity

Joining PwC – some thoughts at the start of the journey

It has been an interesting week to say the least and this morning I have time to catch my breath and reflect on the last few days – my first week at PwC as Partner, Cybersecurity. First and foremost, I want to thank everybody who reached out and sent me their congrats and wished me a good start. I will get back to you and answer personally but it still might take a few days. With the congratulations came also quite often the question why change to PwC? It is a good question – one that I will try to answer in this post.

The “why change” has really two factors. First, why leave Microsoft and second why join PwC and I will address them in that order. Leaving Microsoft has been a difficult decision. I am looking back at the last 5 years and it has been an extremely interesting time where I had the possibility to grow and show what impact security can have. Being able to help clients take advantage of modern technologies and being part of a company that is developing leading edge technology has been very inspiring and in the process I have made great friends and met many inspiring people. At the 5-year mark came the time where I had a hard look at where Microsoft is going and where I believe the needs of our clients are. In the end my view was that I cannot really help solve many of the big challenges in Cybersecurity when I look at it from a predominantly Microsoft perspective. To make myself clear – I actually believe Microsoft has a huge impact, will stay relevant and become probably even more relevant under the lead of Satya in the coming years but with the strategy being very clearly “cloud first” it leaves a big gap at today’s clients that is not really addressed from a cybersecurity perspective as there Microsoft is “just one” component. So I took a step back and looked at the big picture. In the end security is my passion (I know – it sounds weird…) and I want to be part in solving the really hard problems. And that is where PwC comes into the picture.

Joining PwC and not another of the big four or one of the leading global security providers comes in the end down to culture, capabilities, ambition and if it feels right. With PwC I ended up with the fantastic situation that all of these factors are in good shape. While not many people yet think first of PwC when they think about Cybersecurity the firms’ and my ambition is that this will change. PwC is doing a strategic investment push into technology – namely “digital, analytics and cyber”. The people that have had (sometimes long) discussions with me know that I see Cybersecurity as one of the biggest challenges today but more important as an enabling factor and not mainly a topic by itself. Cybersecurity and Privacy are the cornerstones for our society to function and grow. The present technologies that we all depend on, and even more the ones to come to play in the next years, will only be used when we trust them. And we typically only trust something that we know is secure and sufficiently private or would you sit in a car that is not safe and broadcasts to everybody at what locations you have stopped during the last half year? So being part of a big technology push together with digital and analytics is exactly where I want to be. And PwC itself has a fantastic brand, incredible capabilities and a corporate culture that I feel at home in. And the last part was for me something especially important. There are plenty of enterprises where the words say that it’s about the people and in the end it is predominantly about the numbers in spreadsheets and people don’t matter really and are looked at purely as an interchangeable resource. On a short term that might even be successful but I am not into this for the short term. I want to have a long-term impact and do something that I believe is worthwhile doing and that has a positive impact on clients, my firm, people and society in general. And that is where I felt that PwC really shines. A respectful culture, a group of very smart people that want to make a difference and a company that has the ability and the willingness to solve the hard problems.

This shows some aspects of my thoughts and why I changed to PwC. Obviously not everything will go as expected and not everything will work out perfectly and there are many challenges to solve. But I am in it for making a difference and we have very ambitious plans. So if you feel that my thoughts resonate – join me and ideally bring your team with you . We want to grow and have only just started this journey. If you are a security professional and/or cloud assurance specialist contact me through LinkedIn or Xing and let’s discuss it. I am looking forward hearing from you.

This weeks top of the news in Cybersecurity (week 45)

Information on Cybersecurity is becoming almost overwhelming. The series on “this weeks top of the news in Cybersecurity” is a collection of a few articles that I found noteworthy throughout the week. Perfect Friday or weekend reading to catch up on events if you have missed them or have been too preoccuppied or swamped with the Bond Spectre movies review!

 

Blackberry Priv. Can an awesome keyboard justify the Blackberry Priv?
Wired

It has been a (very) long time since I have used a Blackberry and frankly I am not missing it. I have also not tested the Blackberry Priv and will not do so but I still found the review interesting as I like some of the features that Blackberry built in it. For example I would like to have a notification if an app tries to access something and then bind it back if I don’t like it. But the more interesting and yet also more alarming part is that Blackberry will patch the Android OS on a monthly basis with security updates and in addition hotfixes when things cannot wait a month. More information can be found here but I ask myself if it really needs to be the phone vendor and not the OS vendor that should do that as this way we will never get to a better protected overall mobile phone base.

 

The Role of Machine Learning in Cyber Security
IT Pro Portal

 I believe that machine learning and big data will have a huge impact on cybersecurity and we will see impactful applications especially of machine learning more and more in the close future. With that in mind I found the Q&A with Garry Sidaway (SVP Security Strategy & Alliances at NTT Com Security) interesting. It is fairly short but gives a few ideas on the topic.

 

Security Tools’ Effectiveness Hampered by False Positives 
CSO

False positives are a significant problem at many enterprises and valuable events get burried under large amount of data. It goes so far that I have talked to large companies who invested substantial money into SIEM’s only to then turn them off again as they could not handle the amount of information. This article takes a look at the problem of false positives and how they distract companies from dealing with legitimate security alerts.

 

U.S. and U.K. Testing Response Scenarios for FinancialSector Cyberattacks
The Daily Dot

As cyberattacks don’t just target typically one country it makes sense to approach the defense against them with a wider view than most of today’s critical infrastructure protection efforts do. The U.S. and UK have scheduled test response scenarios that will take place later this month in an effort to mitigate the consequences of a large-scale cyberattack again their respective financial sectors.

 

More Companies Form Data Breach Response Plans  
Business Insurance

Being prepared for a data breach is critical today as realistically your company will be breached or has been breached and you may or may not know about it. A new study by the Ponemon Institute finds that although more companies are launching new data breach response plans (good!), relatively few have confidence in their effectiveness (bad). Talking to many CISO’s and CIO’s it seems to me that most companies just don’t have the resources for this and in my view will have to more and more use managed security services and work with retainers for such events.

 

U.S. Retailers Push Banks to Use PINs on Credit Cards as Confusion Reigns
Reuters

From a european perspective this is just plain silly. I have a few credit cards and only my american one does not have a chip and pin. Looking around there seems to be no problem whatsoever to use pins with credit cards on a quite large scale throughout Europe. Now some US retailers are looking to use PINs (personal identification numbers) on their store-branded credit cards that are embedded with computer chips, but are getting resistance from the banking industry. Really?

 

SnowdenBlessed ‘Signal’ Encrypted Calling, Messaging App Comes to Android
NBC News

A new Android app is claimed to securely make phone calls and send messages , which Edward Snowden says he uses “every day.” I found that a bit a special statement and probably would touch that app even less if I would have an Android phone as now the attack motivation just skyrocketed and I have a hard time seeing how Edward Snowden would have the actual technical capabilities to verify the security of such an app.

 

ACSC Releases 2015 Threat Report  
US-CERT

I always like to look through the different threat reports so will include this one here in my recommended reading list. The Australian Cyber Security Centre (ACSC) has released its 2015 Threat Report. It provides information about threats that Australian organizations are facing, such as cyberespionage, cyberattacks, and cybercrime and conclusions towards other geographies are certainly realistic.

 

And that is it for today and best wishes for the weekend!

This weeks top of the news in Cybersecurity (week 42)

Information on Cybersecurity is becoming almost overwhelming. The series on “this weeks top of the news in Cybersecurity” is a collection of a few articles that I found noteworthy throughout the week. Perfect weekend reading to catch up on events if you have missed them!

A Second Snowden Has Leaked a Mother Lode of Drone Docs
Wired

Another leak of classified documents on the use of America’s unmanned vehicles. It is not the first release of sensitive documents (remember Snowden and Chelsea Manning of course) and most likely it will not be the last. Everybody involved in sensitive topics should have a very hard look into their Cybersecurity investments and also put Information Rights Management on the list.

 

CyberAttack Warning After Millions Stolen from UK Bank Accounts  
The Guardian

Law enforcement in the UK, U.S., as well as Interpol, are searching for cyberattackers who have stolen at least £20 million from British bank accounts through the Dridex malware. On the good news side is that with most security products (including Microsoft’s) the malware is detected now and removed.

Additional Information: The United States Computer Emergency Readiness Team (US-CERT) has released an alert to provide further information about the Dridex botnet.

 

Consumer Alert: Debit Card Fraud at Walmart Discovered in 16 States
CSO

There has been an increase in fraudulent purchases made at Walmart, most of which include charges that are US$50 and under. While this is US centric it serves as a warning to check your credit card statement diligently to detect such fraud activities. No credit card is safe today any more.

 

FBI Takes Down Alert on Chip Credit Cards After Bankers Complain
Network World

Wrong priorities in my view for the financial services institutions. A warning from the US Federal Bureau of Investigation (FBI) on October 8, 2015, was removed the next day. The announcement warned that chip-enabled credit cards should only be used with a PIN (personal identification number). The message was removed after there were complaints from banks that issue the credit cards. I know that many banks are very hesitant to talk about fraud and cyberrisks but if we want to make progress in this we need to be more open for information exchange.

 

87% of Android Devices Are Exposed to at Least One Critical Vulnerability
Sophos

The University of Cambridge reports that 87 percent of Android devices are exposed to at least one known critical vulnerability. I know that it is not always easy or even possible to update Android devices but it is crucial to do it as quickly as possible once an update is available. The latest Android version is called Marshmallow right in time for making smores – yumm!

 

Amazon, Google Boost Cloud Security Efforts
eSecurity Planet

Kudos to Amazon and Google as they have announced new features to provide security safeguards on their cloud services. One of the areas where Microsoft’s cloud services are heavily investing and in my view market leaders. It is good to see Amazon and Google investing here too significantly.

This weeks top of the news

Information on Cybersecurity is becoming almost overwhelming. Here you will find a few articles that I found noteworthy during last week. Happy reading!

Microsoft Renews InformationSharing Partnership with NATO
PCWorld

A bit on what we are doing providing transparency to our customers and partners. Microsoft and NATO (North Atlantic Treaty Organization) have agreed to renew their partnership where NATO receives access to source code for key Microsoft products including Windows and Office, information about Microsoft’s cloud services, and intelligence about cybersecurity threats.

 

China Tries to Extract Pledge of Compliance from U.S. Tech Firms
The New York Times

A worrysome but not really surprising push. The Chinese government is asking some tech firms to pledge their commitment to policies that could require them to turn over user data and intellectual property.

 

White House Urged to Support Encryption
SC Magazine

I believe encryption is one of the main ways to keep our data secured also in the future. Unfortunately many governments see it more as a threat. US President Obama reportedly is being urged to support encryption and shun legislation that would force companies to unlock customers’ smartphones and apps when presented with a court order. This raises the question what they then do if they actually don’t hold the encryption keys and cannot unlock them?

Related reading: Obama Advisors: Encryption Backdoors Would Hurt Cybersecurity, Net Infrastructure Vendors.

 

Vodafone Australia Admits to Hacking Journalist’s Phone in Public Statement
Neowin

This was a disapointing article. Vodafone has admitted that it improperly accessed the phone of a reporter — who was writing an article about the online accessibility of personal information of millions of Vodafone customers — in an effort to find the reporter’s source.

 

GM Took 5 Years to Fix a FullTakeover Hack in Millions of OnStar Cars
Wired

As you can see I like Wired a lot. University researchers in 2010 privately disclosed their ability to hack into a car to the US National Highway Traffic and Safety Administration and also shared their exploit code with General Motors. However, the vulnerability was not patched until 2015. Vulnerabilities will continue existing but the key is to address them swiftly once they are discovered. 5 years is NOT swiftly! Google 90 days disclosure policywith exceptions if it is highly complicated.

Related reading: Automakers Asked to Explain CyberSecurity Protections, Your ‘Check Security’ Light Is on, and Intel Sets Up Talking Shop to Improve Automotive Security.

Cover up your webcam – hands on solution

 

Back from vacation I read an article on vice about how a cybercriminal sent a woman pictures of herself that he took with her own webcam. The whole story is available here. Unfortunately it is in many cases trivial to take over a computer (regardless if Mac OS X, iOS or Windows or anything really) and have control over what is stored on it and track what is done with it or turn things on and off. The camera is just one of the many aspects that can be misused if the device is not adequately protected. However, an approach against the camera misuse is so trivial that I briefly wanted to share a 30 second hands-on solution that I am using on my devices.

What you need for it is one of these small screen cleaners that are typically handed out as a gift. They stick to the back of your phone and you can use them to clean the screen of it when needed. However, they are ideal to also cover the camera on your tablet, PC, Mac, phone and also TV if you have one of these smart TVs that have a built-in camera. The approach is simple and you just cut the screen cleaner sticky to a size that fits over the camera that you want to cover up. It can be taken away and re-attached many times and barely adds to the thickness of the device. And as an additional benefit you always have a screen cleaner with you and it is free. A win-win-win situation really.

Below two pictures showing one of these cleaner pads and how it looks on my Surface computer.

step one WP_20150806_18_17_24_Pro

European Union’s recent activities on Security

The European Union is quite active on security and especially cybersecurity issues but is less present in the media for it than for example the US. To raise awareness on current reports and recommendations that I see as relevent please find some links below. We can now debate if this is too much, just raight or not enough but for that discussion knowing more about what actually exists or is in process is a prerequisite of course.

Joint Supervision Tool for Telecom Security
On 9 April, ENISA published a joint framework to supervise the security of services and personal data processing by telecom providers in the EU in accordance with Article 13a and Article 4. Full report is available here.

Electronic Evidence – a Basic Guide for First Responders
On 25 March, ENISA published a report based on past work done in the field of good practices for CERTs and LEAs in the fight against cybercrime. The main aim of the report is to provide a guide for first responders with a special emphasis in evidence gathering.

National/Governmental CERTs – ENISA’s Recommendations on Baseline Capabilities
On 20 March, ENISA published recommendations on baseline capabilities. The document covers ENISA’s updated considerations for capabilities of so called national / governmental CERTs, thus teams who serve the government of a country to protect critical information infrastructure. The primary target audience of this document are these CERTs and those policy-making bodies in the European Union Member States that are responsible for initiating and planning the establishment and operation of a national / governmental CERT. Still quite an interesting reading.

Standardisation in the Field of Electronic Identities and Trust Service Providers
On 24 March, ENISA published a paper that explains why standards are important for cybersecurity, specifically in the area of electronic identification and trust services providers. Additionally, the paper also discusses concrete standardisation activities associated with electronic IDs and trust service providers, providing an overview of standards developed under the mandate from the European Commission and others, related to eIDAS Regulation. It concludes with a proposal of a standard on cryptographic suites for electronic signatures and infrastructures, put forward by ENISA and related to the ETSI TS 119 312. Full report is available here.

Motion for a European Parliament Resolution on Cybersecurity
On 30 March, Italian MEP Nicola Caputo published a motion for resolution on cybersecurity and calls on the Council and the European Commission to strengthen the EU’s response capability to this global threat, to strengthen network and information security and to support Member States in their research and innovation aimed at promoting public and private digital security. steps on the dossier were not disclosed. Interesting though that the security of IoT (Internet of Things) starts to become also a policy topic. I expect that we will see more to come and hope that it will help in addressing the real challenges that we face.

Security Webinars on Cloud Resilience and Addressing Modern Cyberthreats

Security Webinar I recently gave two live webinars as part of a security webinar series of Microsoft Switzerland where I covered aspects of cloud resilience and achieving resilience against modern cyberthreats. The webinars are in German and if you are interested you can get access to the recording below.

 

 

 

Webinar 1: Schutz vor Gefahren aus dem Cyberspace
Die heutigen Gefahren aus dem Cyberspace sind immer grösser, Angriffe werden immer ausgefeilter, die Hacker selbst immer professioneller. Traditionelle Schutzmechanismen, wie beispielsweise Virenschutzprogramme und Firewalls, sind angesichts der neuen Entwicklungen nicht mehr ausreichend. Erfahren Sie in diesem Webinar alles über die Vorteile eines dynamischen Sicherheitskonzepts, das Ihre IT-Landschaft basierend auf den Prinzipien Protect – Detect – Respond effektiv vor modernen Cybergefahren schützen kann und für hohe Resilienz sorgt. Das Webinar ist hier verfügbar.

Webinar 2: Resilienz und Cloud Computing
Cloud Computing verändert und beschleunigt die Arbeitswelt; standardisierte Services aus der «Rechenzentrumswolke» entlasten Unternehmen von Investitionen in eigene, teure Server-Infrastrukturen. Dennoch bestehen grosse Vorbehalte hinsichtlich Verfügbarkeit, Sicherheit und Datenschutz – speziell in einem Umfeld, in dem Gefahren durch kriminelle Aktivitäten lauern und NSA-/PRISM-Aktivitäten für Rechtsunsicherheit sorgen. In diesem Webinar dreht sich daher alles um Fragen wie Resilienz mit der Cloud, Resilienz in der Cloud oder Resilienz trotz der Cloud. Das Webinar ist hier verfügbar

On Lenovo’s “Superfish” and how to remove it

I am quite a fan of Lenovo devices mostly still from the time where they were IBM ThinkPads. However, when the discussion started on the “Superfish” adware they put onto some Lenovo devices I took a mental step back and asked myself how a company that develops and sells plenty of business devices could make such a bad decision.

There are some good descriptions on what “Superfish” does so I will not repeat that in detail. In the end it seems that the adware hijacks encrypted web sessions and it seems that it may make users vulnerable to https man -in-the-middle attacks that are simple for attackers to exploit. If you are interested in knowing more I recommend that you read the Arstechnica article on that topic.

Lenovo was slow to pick-up on this topic although by now they reacted and the Lenovo CTO said in an interview with the Wall Street Journal that  “we didn’t do enough” due diligence before installing Superfish, but that the company doesn’t believe laptop owners were harmed by the app”. You can read here the full article on the WSJ blog.

Another interesting question on why Lenovo pre-loads any software and here is his response: Hortensius: In general, we get pretty good feedback from users on what software we pre-install on computers. What we’re going to do in the next few weeks is dig deeper, and work with users, industry experts and others to see how we can improve what we do around software that comes installed on consumers’ computers. The outcome could be a clearer description of what software is on a user’s machine, and why it’s there.” It seems that I am clearly not their targeted audience if they say such things. When I get a new computer the first thing I do is to newly install Windows from scratch and with that get rid of any bloatware and adware that might be on there. Then install the necessary drivers (not many any more – Windows 8.1 or 10 is in the majority of cases (if not all) taking care of that) and apply all updates and the computer is running faster, more stable and the disk has quite some more space in most cases than before.

So what to do now if you have a Lenovo computer and are not sure if Superfish runs on there or you know and want to remove it? One way to address this is to run Microsoft’s security software which will detect and remove the Superfish software from the Lenovo device. If you have Windowws 8 or 8.1 on your computer Windows Defender is installed by default so you only need to let it update itself. If you have an older version of Windows you might already have the Security Essentials installed where the same applies to. And if you are not sure check out the website on our free security software that you can download and that will take care of Superfish.

Security Snippets: February Reading Nr. 1

 

The security snippets series highlights some articles that I read recently. I hope they help in keeping up with the raise of security incidents and trends which becomes more and more difficult with the increasing professionalism of cyber attacks.

 

Bank Hackers Steal Millions via Malware
as read in the New York Times

The New York Times writes based on Kaperski information that a group of attackers impersonated bank officers and took over cash machines and transferred millions of dollars from more than 100 banks in Russia, Japan, Switzerland, the United States, and the Netherlands into fake accounts set up in other countries. This brings a new scale to Cybercrime.

 

Evolution and Adaptation in the Security Jungle
as read in Threatpost

 Enterprise security teams need to catch up on understanding the methods that modern attackers use. The article on Threatpost does a good job at giving an overview. Active defense is crucial in that aspect and I described that with the protect, detect, response framework also in my whitepaper on achieving resilience against modern cyberthreats.

 

Visa Wants to Track Your Smartphone to Prevent Credit Card Fraud
as read in the Hacker News

It seems that Visa plans to release a new location-based feature that will help cardholders update their location via smartphone. With credit card fraud still on the raise that could be a good way to fight that. I just hope that it will be clear to the user that another service performs location tracking.

 

PlugX Is RAT of Choice for Nation States 
as read in eSecurity Planet

The “2014 CrowdStrike Global Threat Intel” report finds that the PlugX Remote Access Tool (RAT) is the most observed malware variant used by nation-state backed threat adversaries. I don’t think that this is necessarily so clear as in my view many nation states have more customized and elaborate capabilities but it shows how far such tools have come.

 

One Billion Data Records Compromised in 2014 Worldwide
as read in Softpedia

The article writes about a report from the Breach Level Index (BLI) which finds a 49 percent increase in data breaches and a 78 percent increase in number of records that were stolen or lost in 2014. While the absolute number might be even higher the massive increase is something that we observe as well.

 

Microsoft Achieves Globally Recognized ISO/IEC 27018 Privacy Standard
as read in the Microsoft Cyber Trust Blog

This more on privacy and trust than security although that also plays an important aspect. Microsoft on February 16, 2015, obtained the ISO/IEC 27018 privacy standard for Microsoft Azure, Office 365, and Dynamics CRM Online. Brad Smith’s blog has more information on that and is worthwhile reading in my view.

 

How to Keep Your Webcam Safe from Hackers [Video]
as read in We Live Security

If you follow the link you will see a video that covers five tips to prevent someone from spying on you through your webcam. Something becoming more important after an anonymous website began posting live streams of the world’s unprotected webcams.

 

 

About the Author

Reto is partner at PwC Switzerland. He is leading the Cybersecurity practice and is member of PwC Digital Services leadership Team. He has over 15 years work experience in an information security and risk focused IT environment. Prior to working at PwC he was Microsoft's Chief Security Officer for Western Europe and also has work experience as group CIO, Chief Risk Officer, Technical Director and Program Manager.

more about me and contact info

Translate

Chinese (Simplified)EnglishFrenchGermanItalianPortugueseRussianSpanish

replica Rolex