Feeds

Security maven sics 'special ops' on botnet gangs

League of net justice

5 things you didn’t know about cloud backup

RSA Sometimes fighting botnets, spam, and other online crime is like raking leaves on a windy day. Bag one operation and almost overnight there are a half-dozen more that take its place.

It's a story that's all too familiar to Joe Stewart, director with SecureWorks' Counter Threat unit. Now, he's proposing members of the security industry borrow a new page.

"Right now, we've got a very scattered approach," he said during an interview at the RSA security conference in San Francisco. "We're looking more at attacks than attackers. As we jump around from attack to attack, we're not really having a long term impact."

Stewart is suggesting a series of small "special ops" groups that work to make cybercrime less profitable by disrupting a gang's business. The special ops teams would work to thwart ongoing attacks by getting known criminals disconnected from the internet quickly and more effectively distributing new malware signatures so exploits can be detected faster.

The approach in many ways emphasizes the economics that's at the heart of most computer crime. At their core, criminal gangs are business enterprises that take risk, reward, and effort into consideration when deciding whether to pursue new attacks. The idea is to create a grassroots movement that increases the risk and effort and reduces the rewards.

Stewart envisions the special tactics as an interim strategy that will tide the law-abiding world over until it can pass a global treaty that would hold each country responsible for the cybercrime perpetrated inside its borders. CERTs, or computer emergency readiness teams, in each nation would be empowered to deal with computer abuse by, among other things, having the legal authority to disconnect people who are using the internet to spread malware or carry out other crime.

Of course, there are some potential land mines in such an approach. As we've pointed out before, self-appointed white-hat netizens who take it upon themselves to disconnect certain parties from the internet with no due process is always a concern. Stewart also worries that the treaty could be monopolized by the RIAA, MPAA, or other intellectual property groups. This seems like a reasonable concern.

But as we learned last year when an internet host by the name of McColo was shut down, a little industry cooperation can go a long way. Almost overnight, spam volumes were cut in half, thanks to the actions of the service providers that were upstream from McColo.

No, there's no one known to be actively working on making this pie-in-the-sky vision a reality, and yes, its specifics are still undefined. But amid the steady rise in cybercrime, it's an idea worth pondering. ®

Next gen security for virtualised datacentres

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.