Feeds

Security maven sics 'special ops' on botnet gangs

League of net justice

Build a business case: developing custom apps

RSA Sometimes fighting botnets, spam, and other online crime is like raking leaves on a windy day. Bag one operation and almost overnight there are a half-dozen more that take its place.

It's a story that's all too familiar to Joe Stewart, director with SecureWorks' Counter Threat unit. Now, he's proposing members of the security industry borrow a new page.

"Right now, we've got a very scattered approach," he said during an interview at the RSA security conference in San Francisco. "We're looking more at attacks than attackers. As we jump around from attack to attack, we're not really having a long term impact."

Stewart is suggesting a series of small "special ops" groups that work to make cybercrime less profitable by disrupting a gang's business. The special ops teams would work to thwart ongoing attacks by getting known criminals disconnected from the internet quickly and more effectively distributing new malware signatures so exploits can be detected faster.

The approach in many ways emphasizes the economics that's at the heart of most computer crime. At their core, criminal gangs are business enterprises that take risk, reward, and effort into consideration when deciding whether to pursue new attacks. The idea is to create a grassroots movement that increases the risk and effort and reduces the rewards.

Stewart envisions the special tactics as an interim strategy that will tide the law-abiding world over until it can pass a global treaty that would hold each country responsible for the cybercrime perpetrated inside its borders. CERTs, or computer emergency readiness teams, in each nation would be empowered to deal with computer abuse by, among other things, having the legal authority to disconnect people who are using the internet to spread malware or carry out other crime.

Of course, there are some potential land mines in such an approach. As we've pointed out before, self-appointed white-hat netizens who take it upon themselves to disconnect certain parties from the internet with no due process is always a concern. Stewart also worries that the treaty could be monopolized by the RIAA, MPAA, or other intellectual property groups. This seems like a reasonable concern.

But as we learned last year when an internet host by the name of McColo was shut down, a little industry cooperation can go a long way. Almost overnight, spam volumes were cut in half, thanks to the actions of the service providers that were upstream from McColo.

No, there's no one known to be actively working on making this pie-in-the-sky vision a reality, and yes, its specifics are still undefined. But amid the steady rise in cybercrime, it's an idea worth pondering. ®

Next gen security for virtualised datacentres

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Linux kernel devs made to finger their dongles before contributing code
Two-factor auth enabled for Kernel.org repositories
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Scale data protection with your virtual environment
To scale at the rate of virtualization growth, data protection solutions need to adopt new capabilities and simplify current features.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?