If you`ve ever wondered why the world is an impossibly intertwined place to try and understand, consider this: "Risk is now chaotic and complex in a way that a small incident in one place can become a major incident in another place that you hadn`t even thought of. What could start off as a simple intrusion into a corporate network could very quickly become a national security incident." The quote comes from Nick Beale, research and development officer for intelligence services group Infrastructure Defence, UK. And he`s spot on. The complexity is way beyond the capability of even the most technically capable person to manage.
Having just come back from the UK, I have a few observations. Firstly, the British e-snooping bill has come under fire from all quarters; one leading Internet service provider (ISP) has threatened to relocate its business from the UK if the bill goes through. The proposed bill is a piece of legislation to provide the law enforcement authorities with the ability to monitor e-mail messages.
What is it about Nasa that gets hackers trigger-happy? The space agency has admitted that it was attacked 500 000 times in the last 12 months. This was in response to a recent BBC story which alleged that an attacker interrupted communications between Nasa`s ground station and a space shuttle. Strike one for the good guys, 500 000 for the baddies.
The complexity [of security risk] is way beyond the capability of even the most technically capable person to manage.
Ian Melamed, MD, Ian Melamed Secure Computing
Good news for e-business as Baltimore and RSA have linked their PKI technologies. Customers with Baltimore`s UniCert digital certificate management system will be able to read and manage certificates issued by RSA Security`s Keon PKI software. This represents a further stage of consolidation in the security market.
The best advertisement I saw in the UK was flighted by British Telecom. It simply has nameplates on parking bays: Managing Director - Hacker - Chairman. Underneath is the caption "Shouldn`t you be making it harder for the wrong sort of person to get into your organisation?" Surely a message for us all!
The scorecard on the Life Stages worm last week was that it was causing infections at the rate of one every three minutes. This was according to UK-based Messagelabs, whose clients include ISPs such as UUNet. This is another virus like I Love You and spreads in the same way.
Lastminute.com, the British company with South African roots, has advised companies to follow its example by outsourcing its security, preferably to more than one outsource company. Lastminute.com chief technical officer Dominic Cameron admits that Lastminute had "been affected by one or two global viruses", but states that hacking was the biggest problem. "Our major concern is people hacking through the network, accessing information about our customers," he says. Viruses are competing for number one e-commerce risk spot with hacking. Denial of service can result from either action. While outsourcing places the responsibility for security with the outsource company, this does not change the fundamental responsibility for security, which resides firmly with the board of directors.
Some reflections on the virus issue. Anti-virus software products, when kept up-to-date, are very effective at the detection and removal of old viruses. Melissa, CIH and I Love You have shown the opportunity for virus damage exists in every organisation. But, when 98% of all major organisations have anti-virus protection, why are virus outbreaks not being contained? Firstly, because fixes for new viruses are not being developed and distributed fast enough to beat the infection spread; and the Internet ensures very rapid worldwide distribution of viruses. And, while anti-virus vendors have made great strides in speeding up the disassembly and availability of virus fixes, distribution remains the major delay factor.
The problem is that downloading updates from Internet sites is for most users a turgid process. And Internet site overload leading to denial of service was experienced by users during all the recent virus outbreaks. E-mail viruses now account for +95% of all virus infections. The use by viruses of e-mail address books for distribution means the virus window of opportunity for spreading is instantly available as soon as the virus is launched. All of this points to satellite delivery of data as the mechanism for keeping users virus-free.
And, finally, a school for virus writers. Fred Cohen`s College Cyber Defenders programme in California teaches students that virus writing is really pretty easy. Subsequently, writing virus defence programs is not so difficult either. A recent Washington Post article describing Cohen`s school implies that little genius has yet been dedicated to the art of writing malicious code. Virus writing is compared to graffiti as an adolescent outlet for expression; reference the frequently attached comment lines that help investigators track down virus authors.
(Source information for items in this issue was gleaned from USA Today, Silicon.com and the Washington Post.)
Share
