Feeds

Security maven sics 'special ops' on botnet gangs

League of net justice

Providing a secure and efficient Helpdesk

RSA Sometimes fighting botnets, spam, and other online crime is like raking leaves on a windy day. Bag one operation and almost overnight there are a half-dozen more that take its place.

It's a story that's all too familiar to Joe Stewart, director with SecureWorks' Counter Threat unit. Now, he's proposing members of the security industry borrow a new page.

"Right now, we've got a very scattered approach," he said during an interview at the RSA security conference in San Francisco. "We're looking more at attacks than attackers. As we jump around from attack to attack, we're not really having a long term impact."

Stewart is suggesting a series of small "special ops" groups that work to make cybercrime less profitable by disrupting a gang's business. The special ops teams would work to thwart ongoing attacks by getting known criminals disconnected from the internet quickly and more effectively distributing new malware signatures so exploits can be detected faster.

The approach in many ways emphasizes the economics that's at the heart of most computer crime. At their core, criminal gangs are business enterprises that take risk, reward, and effort into consideration when deciding whether to pursue new attacks. The idea is to create a grassroots movement that increases the risk and effort and reduces the rewards.

Stewart envisions the special tactics as an interim strategy that will tide the law-abiding world over until it can pass a global treaty that would hold each country responsible for the cybercrime perpetrated inside its borders. CERTs, or computer emergency readiness teams, in each nation would be empowered to deal with computer abuse by, among other things, having the legal authority to disconnect people who are using the internet to spread malware or carry out other crime.

Of course, there are some potential land mines in such an approach. As we've pointed out before, self-appointed white-hat netizens who take it upon themselves to disconnect certain parties from the internet with no due process is always a concern. Stewart also worries that the treaty could be monopolized by the RIAA, MPAA, or other intellectual property groups. This seems like a reasonable concern.

But as we learned last year when an internet host by the name of McColo was shut down, a little industry cooperation can go a long way. Almost overnight, spam volumes were cut in half, thanks to the actions of the service providers that were upstream from McColo.

No, there's no one known to be actively working on making this pie-in-the-sky vision a reality, and yes, its specifics are still undefined. But amid the steady rise in cybercrime, it's an idea worth pondering. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.