Original URL: http://www.theregister.co.uk/2012/10/12/active_defence/

Small biz scrappers urged to take the fight to hackers

Active defence in a hostile world

By John Leyden

Posted in Security, 12th October 2012 15:31 GMT

RSA Europe Small businesses should consider the possibility of developing well formulated plans for "hacking back" at aggressors in the event of a hack attack.

Presenting an "active defence" would not be a form of vigilantism and could even work within the law, argued two speakers at a presentation at the RSA Europe conference.

Companies and governments are constantly under siege by hackers and malware. Standard incident response is failing and police are overstretched. Faced by these challenges, small businesses have the option to actively respond against attackers rather than mounting only a passive defence.

Rather than jumping to the conclusion that any defensive action beyond currently accepted techniques is illegal, better and more effective options need to be considered, the argument runs.

David Willson, a lawyer at Titan Info Security Group, a retired US Army officer, said active response could include measures such modifying a persistent bot infection on a network so that a command channel is swamped. The particular response ought to depend on the severity and persistence of a threat. Measures such as running a honeypot can also help.

Small businesses ought to consult with lawyers beforehand in coming up with an active defence response plan that's akin to a disaster recovery procedure.

Attribution is normally considered a difficult problem in determining the source of cyber-attacks.

Davi Ottenheimer, president of flyingpenguin, an expert in incident response and digital forensics, added that attackers running denial of service attacks almost always connect back to their main server.

Microsoft's ongoing Project Mars (Microsoft Active Response for Security) botnet takedown campaign has been criticised by elements of the security community for failing to work with law enforcement. The lack of liaison means that takedowns could interfere with ongoing (secret) police investigations.

Similar criticisms might potentially be levelled at small businesses running an active defence.

Ottenheimer argued that if law enforcement can't help businesses then businesses are entitled to take their own action. "At the very least you can make it too expensive for attackers to target you so that they move onto other targets," he said. ®