The New Threat to Data Center Security: The Underground Economy

Email Print Digg This Add to del.icio.us

In decades past, organizational leadership limited its understanding of the "hacker" to someone looking to cause disruptions or pranks at the expense of an individual, company or government. Their response to such things was to let IT security deal with the issue using firewalls and antivirus products. Then, they moved on to more pressing "real" organizational issues.

Those days are long gone. The motivation has changed, and so have the players. Yet organizational leadership still has not come around to understanding the seriousness of the problem. "Hackers" today are not a true threat to the enterprise. What is a threat now are highly organized, highly funded professionals who work for criminal enterprises or rouge nations.

Today, there is an underground economy fueled by stolen data and the pursuit of maximum criminal financial gain. Organizational leadership must understand the players and the conditions and act accordingly if they stand a chance at protecting the organization from theft or compromise. If you have information, you have power. Understanding that the information can be transformed into something else, such as competitive advantage, critical information or money will certainly change the way leadership addresses INFOSEC priorities.

Let's start with some basic facts. There are more and more users and enterprises (be they businesses or government entities) online now than ever before, with more coming each day. Simple math says with more users, there are more attackers/victims, and this will not slow down any time soon. Then we have economics that are poor worldwide, so the motivation to steal and survive is very high. And finally, the ease and availability of "know-how" on the web, which allows those with even the most basic understanding of computers the ability to commit some type of cybercrime.

Going further, because of the facts above, it is painfully simple for professional criminals to setup crime group mules who can be molded to carry out cybercrimes as puppets for the masterminds behind the scenes. Combine that with the belief that "I will never get caught" and the psychology of not actually committing a violent crime, and you have a recipe for disaster. Or in our case, an underground economy.

Let's stop here for a second and think about what makes a "hacker" who he really is. The media has crafted in your minds what a "hacker" is by painting an image of guys sitting in a dark basement surrounded by empty beer cans and piles of fast food wrappers, while the "good" IT security pros are those dressed in nice suits and sitting at consoles in corporations. It's important to separate yourself from this mindset because many times the bad guys are the ones in suits sitting at consoles while the true good guy is the one hanging out in a dark basement. It is extremely important to look beyond the technical hacking techniques and also understand the behavioral characteristics of a cybercriminal. They may already be operating inside your walls.

The Underground Economy

The high level steps:

• Malware and BotNet propagation
• Banking and e-crime
• Identity theft
• Conversion of data to cash and money laundering

When you examine this topic, you quickly understand, as mentioned, there is no need to use a gun to rob banks anymore. Too many uneducated users and organizations provide ample opportunities for cybercriminals to rob them blind. The underground economy has a very basic business process.

The BotNet

First, the botnet is built via malware or a multitude of other techniques. The goal here is compromising as many hosts as possible, and then harvesting the stolen information back into the hands of the cybercriminals, rouge nations or whomever else is looking for gain. The botnet is diverse in its role, and it is also used to steal identities, banking information, intellectual property and anything else that can be turned into gains.

Cleaning the Prize

Once the financial data is gathered and converted into money, it must be cleaned. Criminals know this, and they set up money laundering networks to accomplish this task. Once your data is in their hands, the trail will eventually run cold because it will quickly be entered into this cleansing process.

Final Thoughts

The hacking world has not always been linked to criminal enterprise. These two radically different groups must be separated out from the collective thought of senior leadership. To understand that one is based on the concept of learning and the other on theft is a must -- if the enterprise is to stand a chance at dealing with the problem. It must be understood that all of the gadgets, apps, Web sites and most of all, data sources, being adding to the business are widening the attack vector for professional criminals.

Ultimately, the underground economy is not a techie issue at all. It impacts all of us including entire countries, governments and businesses, right down to the individual.