Professional Documents
Culture Documents
Top5 Countering Cyber Threats
Top5 Countering Cyber Threats
By Aliya Sternstein
The federal government is out to stop cybercrooksby reaching potential victims before they do. Public outreach is one of the best countermeasures against hacking, according to agencies and experts. As cybercrime escalates, the FBI has arrested hundreds of groups in this space, says Shawn Henry, the bureaus former cyber chief. What about all the intelligence that could have been shared with these victims before they were victims? Now, the government is trying to arm computer users with the tools and information necessary for the long-term battle against cyber threats. Here are five key public service efforts under way to strengthen cybersecurity.
PUBLIC AWARENESS
The FBI routinely alerts the public to cyber scams through Homeland Security Department bulletins and the Internet Crime Complaint Center, an FBI-led public private partnership. For example, Homeland Securitys Computer Emergency Readiness Team warned in August that fraudsters were posing as officials from U.S. Cyber Command and other federal agencies to scare Internet users into paying bogus fines. A CERT notice said malicious software triggers a computer screen that claims a federal agency has determined the user is involved in criminal activity. The message directs the victim to either pay a fine or lose access to the computer. IC3 had warned of similar schemes that essentially hold computers hostage until victims pay the bogus fine. The August incident apparently was the first time scammers had used the identities of Cyber Command officials to collect ransom. The CERT bulletin closed with instructions for victims on how to recover from viruses and file a complaint with IC3. Federal authorities also are sharing cybercrime findings before closing cases to teach the public how to fix compromised computers. For almost a year, the FBI and DHS have maintained Web pages with directions on checking computers for a virus called DNSChanger, which the bureau partially neutralized after Operation Ghost Click. During that investigation, the FBI and international authorities quashed a botneta network of computers that crooks remotely commandeer without the owners knowledge. The instigators were redirecting people to bogus websites. Agents seized the offenders servers and in November 2011 replaced
them with safe servers that would navigate victims to their desired online destinations. But there was a catch. Unless victims removed the DNSChanger infection, they always would be dependent on the special servers for surfing the Web. So, several agencies published recommendations on how to expunge the worm.
SHARING LEADS
Each year, the Secret Service shares information on computer intrusions with Verizon for the telecom giants annual data breach report. The analysis details population groups while protecting the names of individuals and organizations. The goal of the study is to help law enforcement officials, citizens and Internet service providers fight cybercrime. Usually businesses are hesitant to report breaches if their reputations are on the line. So, U.S. government authorities submit incident data using a standard digital questionnaire that asks only for general demographics, such as the size of an organizations workforce and measures, says Chris Porter, principal for Verizons RISK Team. We get a lean picture of whats happening without having to share information that could potentially embarrass an organization. Separately, bureau officials say they are mindful of privacy when approaching companies for leads on hacks. The FBI understands that the private sector has practical concerns about reporting breaches to law enforcement. Where necessary, the FBI, working with the Justice Department, seeks protective orders to preserve trade secrets and business confidentiality, spokesman Dean Boyd says.
number of information technology staffers. The data amassed is wiped of any information that might identify firms or individuals before the hand-off to Verizons research team for analysis. When the Secret Service sends that information over to Verizon, we dont know that it took corrective
HACKER CRACKDOWN
Justice Department officials are cracking down on scams large and small to cap damages before they skyrocket. In June, officials unsealed charges against a 23-year-old Pennsylvania man, alleging that he and others hacked into computer networks at RNK Telecommunications Inc. in Massachusetts, the Energy Department and other organizations nationwideand then sold access to those systems. In March, federal investigators released lengthy indictments of six hackers, including one government informant, who allegedly are tied to the vigilante group Anonymous. Four of them were charged with compromising computers at Fox Broadcasting Co., PBS and Sony Pictures Entertainment, 860,000 clients and subscribers of global intelligence publisher Stratfor. In May, the ringleader of an international computer hacking scheme was sentenced to five years in jail for defrauding banks. The defendant opened numerous Bank of America accounts in her name at a variety of branches and transferred $14,000 to those accounts through email fraud that led to charges against 100 individualsthe largest number of defendants ever charged in a cybercrime case. All of these enforcement actions were made public.
while a fifth suspect pleaded guilty. Another associate was charged with stealing confidential information, including credit card data, from about
The U.S. Cyber Challenge, designed for high school and college students, urges youths to find flaws during competitions. We include in our curriculum an ethics panel discussion with the campers, which include panelists from the U.S. Secret Service and the FBI, says Cyber Challenge National Director Karen Evans, who held what is now the federal chief information officer position during the George W. Bush administration. The contest provides students with legal information so they will use their talents appropriately.
One SMAll SPARK CAn DeStROy yOUR entIRe FOReSt. Be PRePAReD FOR An ACtIve DIReCtORy DISASteR.
A small glitch in Active Directory could turn into a disaster for your organization. Are you ready if the worst should happen? learn how proper planning and the right tools can help you quickly recover or prevent altogether Active Directory catastrophies. Download that Dreaded Day: Active Directory Disasters and Solutions for Preventing them. Read the white paper at www.quest.com/PreventingADDisasters