an industry perspective on cyber security challenges...myths and reality • anti-virus and ids/ips...

42
© 2014 Deloitte Hungary 13 November 2014 Gergely Tóth | Senior Manager, Security & Privacy An industry perspective on cyber security challenges

Upload: others

Post on 25-May-2020

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

13 November 2014

Gergely Tóth | Senior Manager, Security & Privacy

An industry perspective on cyber security challenges

Page 2: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

2 An industry perspective on cyber security challenges

Agenda

APT examples

How to get inside?

Remote control

Once we are inside

There is more than APT

Conclusion

Page 3: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

3 An industry perspective on cyber security challenges

APT – Advanced Persistent Threat Definition

“The term is commonly used to refer to cyber threats, in particular that of Internet-

enabled espionage using a variety of intelligence gathering techniques to access

sensitive information...” -- Wikipedia

• Advanced

‒ Sophisticated attack potentially

• combining several types of techniques

• including zero-day exploits and social engineering

• Persistent

‒ Targeted instead of being opportunistic: i.e. attack is tailored to the

organization at hand

• Threat

Page 4: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

4 An industry perspective on cyber security challenges

CISO landscape Defenses and attacks

APT

DDoS

Malware

IDS/IPS

SIEM

IDM

Vulnerability scanning

Penetration testing

Security audit

WAF

Anti-APT

Anti-DDoS

Firewall

Anti-virus

Anti-spam

Content filtering

Page 5: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

APT example Spear phishing attack

5 An industry perspective on cyber security challenges

Page 6: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

6 An industry perspective on cyber security challenges

Spear Phishing Example #1

Page 7: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

7 An industry perspective on cyber security challenges

Spear Phishing Example #1, cont’d

Page 8: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

8 An industry perspective on cyber security challenges

Spear Phishing Details of the attack

• Attack lasted two days

• Two user groups received “spear phishing” e-mails

‒ They were not privileged users

• Interesting e-mails

‒ “2011 Recruitment Plan”

• At least one user

‒ Retrieved the e-mail from the “Junk e-mails” folder

‒ Opened the attachment

Source: http://blogs.rsa.com/rivner/anatomy-of-an-attack/

Page 9: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

9 An industry perspective on cyber security challenges

Spear Phishing Details of the attack, cont’d

• The payload

‒ Excel document with embedded Flash object

‒ “Zero-day” (CVE-2011-0609) Flash exploit

• Modified Poison Ivy installed by the payload

‒ Well-known remote management software

‒ “Reverse connect” mode => workstation connects to attacker’s server

• Privilege escalation

‒ Domain users

‒ Service users

‒ Domain admins

• Internal attacks

‒ Internal servers

‒ “Staging” server => storage, compression, encryption

• FTP out collected data to a cracked server

• Clean-up after the attack: wipe traces

Source: http://blogs.rsa.com/rivner/anatomy-of-an-attack/

Page 10: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

APT example “Traditional” systems compromise

10 An industry perspective on cyber security challenges

Page 11: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

11 An industry perspective on cyber security challenges

“Traditional” systems compromise Example #2

DMZ Office

LAN

Secure

LAN

Page 12: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

12 An industry perspective on cyber security challenges

“Traditional” systems compromise Details of the attack

• Attack lasted one month

• Systems compromise route

‒ Web server in the DMZ => used as file manager and “proxy”

‒ Office LAN systems

‒ Secure LAN

• Scale of the attack

‒ All CA servers compromised

‒ Certificates issued using the HSM module => used later in a large-scale attack

(300k+ victims potentially)

‒ Log files tampered with to hide traces of activity

Source: http://www.rijksoverheid.nl/bestanden/documenten-en-publicaties/rapporten/2012/08/13/black-tulip-

update/black-tulip-update.pdf

Page 13: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

HSM

Myths and reality

• We use HSM (Hardware Security Module) in business critical systems for

sensitive transactions

13 An industry perspective on cyber security challenges

HSM used in batch

processes or

automatically

Compromised systems

will use the HSM just as

easily

Page 14: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

How to get inside? The “Spear”

14 An industry perspective on cyber security challenges

Page 15: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” Example #3

15 An industry perspective on cyber security challenges

Source: http://www.securitynewsdaily.com/-cyberattack-hits-oak-ridge-national-laboratory-0709/

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

:::::::::::::::::::::::::::::::::::::::::::::::

::::::::::::::::::::::::::::::::::::::::::::::::

::::::::::::::::::::::::::::::::::::::::::::::::

::::::::::::::::::::::::::::::::::::::::::::::::

::::::

::::::

::::::

::::::

::::::

::::::

::::::

:::::

:::::

:::::

Approx. 5000 users

Approx. 530 targets

57 clicks

::

2 successful exploits

Page 16: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” The “Ignore the security warnings” training course

16 An industry perspective on cyber security challenges

Page 17: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” Myths and reality

• Anti-virus and IDS/IPS stops such attacks

17 An industry perspective on cyber security challenges

Signature-based mechanisms are

ineffective against unknown attack

types (e.g. “zero-day”

vulnerabilities, customized

payloads)

Page 18: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” Experiences (1)

18 An industry perspective on cyber security challenges

‒ Targeted users

Page 19: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” Experiences (2)

19 An industry perspective on cyber security challenges

‒ Fooled users

‒ Insider info (disgruntled

employee)

‒ Stolen laptop

‒ Compromised e-mail

account

‒ Corporate templates

‒ Culture/language habits

‒ Systems, typical e-mail

? Does it really matter?

‒ Autopilot

‒ The myth of templates

This is not a fairytale

from over the

ocean...

Page 20: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

The “Spear” Experiences (3)

20 An industry perspective on cyber security challenges

‒ Successful exploits

‒ Public/industry/insider info

‒ Stolen laptop

‒ Zero-day exploit

‒ Custom payload

Page 21: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

What would be your conversion rate?

21 An industry perspective on cyber security challenges

Targeted users: 1 in 4

Fooled users: 1 in 3

Successful exploits: 1 in 2

Page 22: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Remote control

22 An industry perspective on cyber security challenges

Page 23: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

“Remote control” Poison Ivy

23 An industry perspective on cyber security challenges

Page 24: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

“Remote control” Metasploit - Meterpreter

24 An industry perspective on cyber security challenges

Page 25: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

“Remote control” Metasploit - Meterpreter

25 An industry perspective on cyber security challenges

Page 26: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Remote control

Myths and reality

• We use proxies to access the Internet, which require username-password

authentication

26 An industry perspective on cyber security challenges

The typical exploit injects the

code responsible for

communication into Internet

Explorer

IE authenticates

automatically at the proxy

as the logged in

(attacked) user

Page 27: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Once we are inside

27 An industry perspective on cyber security challenges

Page 28: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Once we are inside An attacker’s heaven

28 An industry perspective on cyber security challenges

• Normal ‘business’ user

‒ Application access

‒ E-mail access

‒ Network (share) access

‒ Helpdesk access

• Privilege escalation

‒ Two-tier applications => Direct database access

‒ Weak authentication schemes => Access with admin role

‒ Weak passwords => Unauthorized access

‒ Unpatched systems => Exploits

Page 29: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Once we are inside The reality

29 An industry perspective on cyber security challenges

Criticality of the system

Length of the patching cycle

Ratio of unpatched devices

Page 30: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Once we are inside Where is your data?

30 An industry perspective on cyber security challenges

Application ServerUser

File Server

Application Server

Application Server

User

User

Printer server

User

Mail Server

User

User

Admin

Page 31: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary 31 An industry perspective on cyber security challenges

Results of systems compromise

• Example #1

‒ Several major VLANs compromised

‒ Access to undisclosed internal sensitive information

• Example #2

‒ Several major VLANs compromised (DMZ, office, secure server)

‒ All critical systems compromised (all CAs and the HSM)

Bankruptcy within 2 months of the attack

• Example #3

‒ Access to undisclosed internal sensitive information

• Commonalities

‒ Skilled and customized attacks

‒ Access to sensitive information

‒ Sophisticated attempts to hide traces

Page 32: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary 32 An industry perspective on cyber security challenges

How advanced is an APT really?

So how advanced is an Advanced Persistent Threat really?

As advanced as needed...

Simple: EXE in a .ZIP; Google translate phishing

Sophisticated: exploit based on reverse engineering vendor patches

Precision strike: zero-day exploit with targeted payload

Page 33: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

There is more than just APT

33 An industry perspective on cyber security challenges

Page 34: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Distributed Denial of Service Myths and reality

• We can survive a DoS...

34 An industry perspective on cyber security challenges

Multi GBit/sec attacks with

1000+ IPs

? Can you handle the load?

Can your ISP?

Page 35: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Distributed Denial of Service Myths and reality

• We have an Anti-DDoS box

35 An industry perspective on cyber security challenges

Application level DoS doesn’t require much bandwidth

But even more system resources...

? Can your application server handle the load?

Can the database?

Page 36: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Banking malware Myths and reality

• Two-factor authentication can prevent banking malware

36 An industry perspective on cyber security challenges

Banking malware can convince the user to install the

malware on the mobile phone as well

? Can your systems detect transactions by a

banking malware residing on both PC and

mobile?

Page 37: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Conclusion

37 An industry perspective on cyber security challenges

Page 38: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

APT – The schematics

Do they look similar?

38 An industry perspective on cyber security challenges

Example #1 – Spear phishing Example #3 – Traditional systems

compromise

It’s not a coincidence...

Page 39: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Defenses

39 An industry perspective on cyber security challenges

Prevent

• Defense in depth – network zones

• Hardening on the external-facing and internal networks

• Specialized systems (anti-APT, anti-DDoS, WAF, endpoint

protection)

Detect

• IDS, IPS, anti-virus, transaction monitoring

• Awareness

• Log analysis

Correct • Incident response

Page 40: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Conclusion

New level of preparedness needed

40 An industry perspective on cyber security challenges

• Targeted and sophisticated attacks => high probability to succeed

• External attacker => internal attacker

• Prevent / detect / correct => there is no silver bullet

• Educate + prepare for incidents

Page 41: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Contact

41 An industry perspective on cyber security challenges

Gergely Tóth

Senior Manager │ Security & Privacy

Tel: + 36 (1) 428 6607

Email: [email protected]

Page 42: An industry perspective on cyber security challenges...Myths and reality • Anti-virus and IDS/IPS stops such attacks 17 An industry perspective on cyber security challenges Signature-based

© 2014 Deloitte Hungary

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited

by guarantee, and its network of member firms, each of which is a legally separate and

independent entity. Please see www.deloitte.hu/about for a detailed description of the legal

structure of Deloitte Touche Tohmatsu Limited and its member firms.

© 2014 Deloitte Hungary.