Cyber crime: the new battleground
THE battle for power and control is as old as time, but preferred methods of attack have changed with the ages.
Battlegrounds, too, have changed. No longer confined by geography or brute force, they now encompass the vast territory of cyberspace, where few rules apply and where faceless aggressors swoop undetected to spy, steal, disrupt or destroy.
In recent months, hackers have breached Twitter, Facebook, Apple, Google and Microsoft accounts, making sacrificial lambs of the sacred cows of tech.
In recent weeks, US intelligence officials have confirmed that in their view, cyber warfare is a greater threat than either al Qaeda or terrorism.
Ireland cannot be complacent, and critical infrastructure has to be protected. As for whose responsibility that is, Enda Gallagher, press officer at the Department of Communications, Energy and Natural Resources (DCENR) reveals that “Every public and private sector organisation carries its own responsibility for the proper functioning of their ICT networks and for protecting themselves against cyber-attacks.”
The department works with critical infrastructure providers, organises structured exercises (such as deliberate hacking attacks to identify security flaws on networks), and liaises with the European Network and Information Security Agency (ENISA) on matters of cyber-security. The UCD Centre for Cybersecurity & Cybercrime Investigation also plays a role.
The centre studies threats to computer-controlled critical infrastructures and identifies early detection and prevention methods. As for whether our critical infrastructure protection is as effective as it might be, Brian Honan, CEO of the Dublin-based security firm BH Consulting, says: “While nobody doubts that critical infrastructure protection is taken seriously by all agencies, a more coherent and cohesive government-led approach would be more effective.
“Ireland’s economy depends heavily on global technological, pharmaceutical and financial organisations setting up operation in Ireland. To ensure that connectivity is best protected, we must ensure our infrastructures are as secure as possible.”
Eoin Keary, director of the Meath-based security firm BCC Risk Advisory, agrees there’s room for improvement.
“Irish organisations are pretty good at securing servers and operating systems but not so good at securing web applications and websites. Also, we haven’t militarised our government systems as others have, and we haven’t made cyber security as high a priority as it is in the UK, France, Germany and the US.”
One Irishman who spends much of his time working with international law enforcers to identify those responsible for cyber attacks is Robert McArdle, senior advanced threat manager at the multinational computer security company Trend Micro.
He and his team have had many successes, the most recent being aiding the arrest of a major cyber crime gang -leader. Brian Honan believes that well-funded criminal gangs are the greatest source of threat to Ireland’s cyber-security. According to the latest figures furnished by IRISS-CERT (Ireland’s computer security incidence response team), 96% of reported attacks were carried out by organised criminals. That said, the potential threat of disgruntled workers, past and present, shouldn’t be underestimated either.
While IRISS-CERT received no reports of hacktivist or cyber-terrorist breaches for the past year, this doesn’t mean no cyber-spying occurs. “A new strain of espionage malware designed for spying on governments and institutions was found on the network of a Dublin based foreign embassy, which was the subject of a targeted attack,” says Honan. We’re likely to hear of more incidents of cyber-spying in Ireland, as the recently released Verzion Data Breach Report confirms that the number of state-sponsored cyber-espionage attacks tripled worldwide over the past year.In Ireland, cyber attacks are on the rise, but the full extent of the problem is not yet known. Reports of breaches to the Data Protection Commission rose from 119 in 2009 to 1,522 in 2012.
While reports are low, the number of cyber attacks is likely to be substantially higher, as fear of incurring reputational damage plays a role in the reluctance of organisations to report, as does the fact that there is currently no obligation on anyone other than telecom companies to report breaches in Ireland.
While the number of breaches is rising, so too is the incidence of ransomware attacks. In his role as CEO of Smarttech.ie, Corkman Ronan Murphy has worked with several Irish organisations which have received ransom demands from cybercriminals. “First their data is blocked, then they receive a demand for €3,000 and a warning to pay the sum by noon in order to regain access to their data. Typically, they’re advised that the ransom will be increased every hour after the deadline has passed.” Individuals are not immune.
“They, too, get ransom notes on their home PCs. For them, €1,000 would be a typical demand, but those that pay find that instead of getting their data back, they get a second demand, this time for €3,000. It’s a murky business.”
While the latest figures show that 75% of reported attacks in Ireland were opportunistic, Ronan Murphy insists the single greatest threat to Irish businesses is targeted attacks: “These are cases where individuals actively attempt to circumvent the security systems protecting a particular network.”
Murphy says that, to prevent attacks, an organisation with 10 employees would need a suite of security products costing approximately €900 per year.
“The question is no longer whether an organisation without adequate security will be hacked; it’s a matter of when,” says Murphy.
*The European Technology Summit 2013 takes place in Cork today.
www.itcork.ie
