Modern day pirates

Many of you will remember long summer days with the streets filled with laughing children congregating to play football or just hang out with their friends – I certainly remember a neighbor or two chasing us down the street for being too noisy. Today, far too many roads are silent as our kids stay indoors and virtually gather online to play. Of course, many would argue that’s progress but its just one example of our shift to a digital world.

Another example is our oceans. Once a dangerous place with bands of pirates sailing the seas looking for vulnerable vessels to board and plunder, today modern day bandits have swapped the seas to surf the internet looking for victims to pillage. While our children play in virtual worlds, cyber criminals parley virtually, working together to develop their digital weapons.

With more computers worldwide, especially in economies where even “light” cybercrime (such as farming gold for World of Warcraft) is a welcome option to spending 12+ hours a day in a factory, what is the truth about cybercrime?

Safe seas
I often get asked whether one country is considered a greater, or lesser, target from another. Unfortunately, cyber security cannot be encased in typical physical or political boundaries – such as countries, companies or even social groups. While it’s fair to say that the resilience to attacks, awareness of exposure and certain political/economical factors might have an affect on a company’s security exposure, it certainly wouldn’t make it completely immune.

Permission to come aboard
While it’s true that anyone is at risk of a cyber attack, governments, major corporations and companies with valuable IP are far more likely to be targeted by computer related attacks than companies without obvious valuable digital assets (valuable for people outside of the company, an accounting system is always valuable for the company running it).

That said, while criminals will unleash malware to worm its way into an intended victim, most worms don’t make a distinction between one organisation, or industry sector, from another. For this reason, while an attack may initially be targeted at a particular government or sector, there is no reason why the worm would stop there.

Pirate law
Legislation, to some extent, will have an affect on an organization’s exposure to computer-based threats. Statistically, countries where there are stronger laws against misuse of computer systems by employees tend to be in better shape than those where there are none. That said, it doesn’t stop a lawless society launching an attack against organizations where regulation is tight. Similarly, if the headlines are to be believed, powerful leaders such as President Barack Obama are not adverse to playing dirty either!

Rough waters
All forms of crime tend to increase in a recession so it’s natural that instances of cyber crime too would increase. Cyber criminals have definitely become more active in recent years, however there are also more laws regarding cyber crimes too, which inevitably creates more criminals.

Today, we face an arms race and what is obvious is that both sides are becoming more sophisticated. The good news is that detection mechanisms are also becoming more sophisticated, and awareness is also rising. However, I’d also warn that committing cyber crimes is becoming much easier. Where you had to physically rob a bank at gunpoint or infiltrate a high security environment requiring a lot of physical skill and expensive equipment (see “Sneakers” or “War Games” for “take-it-with-more-than-one-grain-of-salt-references”), nowadays a lot of money can be made from the safety of your own home or a random cybercafe.

Here are five simple steps business owners can take to ensure they don’t become a victim of cyber crime:

1. Take security seriously. Don’t assume you won’t get hit because you have nothing of value to attackers. Even if it’s just to use your computers in order to stage larger attacks, everything is interesting.

2. Try to keep up with patches. In my humble opinion, this is the single most important thing to do in order to increase security.

3. Don’t start thinking about computer security after it’s too late. Get your personnel trained, increase their skills, and raise awareness of security at a company level.

4. Get help from outsiders. Most companies cannot afford a huge full-time team, but having someone from the outside come in every once in a while and assist can make a huge difference. As a personal recommendation, I’d say more isn’t always better. Smaller agencies often care about what they do and a 10 page text report about *your* problems is more valuable than a 500 page report with a big name at the top.

5. Don’t overdo it. Computer security companies will talk about the upcoming apocalypse to sell you their products, but it isn’t as bad as it seems. Common practices, patching, common sense, some external help and continuous effort will help you raise your “difficulty level’ enough for most attackers to search for an easier target. I believe that a robust security solution needn’t cost a fortune. Open source and open source based security products, combined with good old fashioned collaboration, are great alternatives.

At the end of the day, if a cyber criminal really wants to get in, he will launch an attack at your organization. Your best bet is to detect and stop him, rather than trying to prevent all types of attacks.