Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Cyber-weapons to defend the nation
The government is also investing in not just defence but "proactive measures to disrupt threats to information security". The strategy appears to call for the development of offensive as well as defensive capability without outlining the circumstances in which these offensive capabilities might be used or what form they might take.
A new Cyber Defence Operations Group at the Ministry of Defence, overseen by Air Marshall Sir Stuart Peach, head of the new Joint Forces Command, will develop "new tactics, techniques and plans to develop military cyber capabilities", including offensive as well as defensive capabilities, from April 2012.
The MoD's new Defence Cyber Operations Group - which will include a joint cyber unit hosted by GCHQ - will "develop new tactics, techniques and plans to deliver military cyber capabilities".
Flying a secure kite
Improving consumer awareness about internet threats is seen as a key area by ministers. The government wants to establish kitemarks for cyber-security software to help punters and bosses understand the capabilities of products and allow them to make more informed choices. The idea is that kitemarks will help consumers distinguish between genuine and fake anti-virus products, for example. Several security firms have questioned whether this tactic will prove effective.
"It's easy to predict that scammers will simply put bogus kitemarks on their sites and fake anti-virus products to fool products into believing that they are legitimate. After all, they already use the names of legitimate anti-virus products and award logos," Cluley notes.
The government also wants to boost the Get Safe Online website: "Get Safe Online is a terrific website with superb material, but without more money being sent promoting the site to a wider audience, it will continue to suffer from a lack of awareness and most people will simply not know that it exists," Cluley adds.
Rik Ferguson, director of security research and communication at Trend Micro, was more upbeat about the efforts to bolster Get Safe Online. He was also positive about proposals for ISPs to become more pro-active about warning consumers if their PCs are infected with malware.
"Security companies have been saying for some time now that Internet Service Providers have a greater role to play in informing and assisting their customers who have fallen victim to cybercrime and this report promises to explore that capability although without a concrete timeline,” Ferguson said.
Cybercrime re-organisation and iPlods
Over the next two years the government plans to create new cybercrime unit within the new National Crime Agency that will take the lead in dealing with the "most serious national-level cybercrime and to be part of the response to major national incidents". Scotland Yard's Police Central eCrime Unit will be subsumed into this task force in a move that recalls what happened with the National Hi-Tech Crime Unit was swallowed up by the Serious and Organised Crime Agency back in 2006.
Ferguson welcomed the move: "The report finally promises a unified body at the heart of British law enforcement as well as extensive lobbying and support for cross border cooperation on prosecuting cybercrime, something which is key to successfully closing down criminal operations, as was seen in the Esthosts takedown this month."
However he warned that after several changes over recent years in the structure of policing cybercrime the government needs to stick by its latest re-organisation. "There have been too many changes in the recent past," Ferguson said. "We need stability or else confidence will be lost."
"There needs to be strong links between existing and proposed agencies," he added.
Police forces will be encouraged to recruit more so-called cyber-specialists, part-time officers who are experts in computing, already named iPlods by some wags.
The government hopes to make it easier to report financially motivated cybercrime by establishing a single reporting system for businesses and the public, Action Fraud. Meanwhile courts will be given powers to impose internet restriction orders, a type of cyber-ASBO discussed in an earlier story here.
On the diplomatic front, the government wants to push for wider adoption of the Budapest convention on cybercrime, as a move designed to ensure that their a fewer territories where internet fraudsters can operate with impunity.
Second edition
The overall strategy - which succeeds policies developed by the Brown government and published in 2009 - follows extensive consultation with industry, law enforcement and internet bodies that began while the Conservatives were in opposition. Ferguson commented: "If the UK manages to deliver on all the promises of this report it will put us in a leading position in Europe and globally to prevent online crime in the first instance and take action where it does arise.”
ESET's Harley said that while the Brown government's strategy focused on protecting critical infrastructure firms - banks, utilities and telecommunication carriers - the Coalition's strategy focused on helping a wider range of public and private sector organisations, something he described as a positive development.
“I welcome the fact that the government seems to be aware that the nation’s security is not restricted to those organisations formally recognised as part of the critical national infrastructure. It’s a good thing, on the whole, that more generalised cybercrime will be getting some attention as well as the more glamorous but very fluffy topic of cyber-warfare, as in practice it’s not always easy to separate the two.
"My gut feeling is that the proportion of targeted attacks to run-of-the-mill non-targeted attacks is probably overestimated."
The UK's Cyber Security Strategy can be downloaded from the Cabinet Office website here. ®
COMMENTS
The real industry security concern is
“I’m slightly concerned that if the view of the threat landscape is too cyberwarfare/GCHQ-dominated, it may not always work to the best advantage of the private sector and home users, whose priorities and assumptions may be very different," Harley said.
This will be no help in selling 1/2 price security bloatware in PC World to Joe public and selling the anti-virus, vulnerability scanner, port locking, disk encryption, firewalls and rules analysers, IDS, IPS, HID, HIP, VPN setup tools, DLP, User provisioning, UAM tools, password vaults etc. to industry, all of which fail to stop even the simplest of DDOS attacks and do little to counter cyber warfare. They do allow industry to pass audits and comply with the law, and home users to say 'how did I get infected, I have anti-virus installed.'
Cyber attacks have been talked about for years, STUXNET seems to be the first to emerge to the public at large. The guys at GCHQ could and probably do write similar code, so currently are the best placed to advise how to defend against these types of attack.
The security industry will no doubt catch up with their fully featured latest security tool that will also secure your uranium enriching centrifuge or water pump, and is selling for 1/2 price at a PC World nearby.
We need a consistent and up-to-date WHOIS database where an ISP's connection to the net depends on them having an abuse reporting address, and honouring notifications of abusive/destructive behaviour, whether from users themselves or the malware on their machines.
Such activity should be characterized as spamming, hacking, ddos, port scanning, etc, which is detrimental to the Net as a whole.
The vast majority of worldwide ISPs are delinquent, in that they simply ignore or reject complaints, assuming they even have an abuse address.
If there was a more robust system in place to marginalize those ISPs and restrict the services they can provide to their users, which will affect their bottom lines, then they might start to take notice, instead of continuing to abuse the whole net.
However, there is a dichotomy - most sites want users, hits, page views for ad revenue.
They are reluctant to ban rogue ISPs users, unless they are a consistent source of DDOS, but that is what may be required now to get some improvement done.
If more web providers could ban users based on their ISPs reputation, something would change. If the core providers on the net such as youtube, gmail, yahoo, hotmail and news sites suddenly started seriously blackholing routes (or diverting to warning pages explaining why, in native languages and what to do), from known rogue ISPs then they would surely start to clean up their acts and ensure their flocks behave.
Thanks to spamhaus and spamcop, spam from zombies is 99% blocked by those that use them. The rest is caught by spamassassin, SPF and DKIM. Spam that has any chance of getting through now originates from compromised gmail, hotmail or yahoo accounts. One hopes that the big email providers are dealing with these robustly, as simply banning their mail servers is not an option.
It is scandalous that many phishing subjects such as hmcg.gov.uk, natwest.co.uk etc still have no SPF record, let alone one with a "-all" option to at least try to protect the authenticity of mail from their domain names.
So this is how he keeps the whizzes!
They're turning GCHQ into a private company to get revenue to keep the Internet guy, who are leaving hand over fist.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
