Insider pose threat for cybersecurity

Bruce Schneier, founder and CTO of Counterpane, outlines the cybercrime landscape enterprises face today. He explains to Computerworld's Stefan Hammond that insiders are a problem, managed security services are a solution, and a determined crew with a chainsaw and a truck is a big problem

Computer security never seems to get better, only worse. Why?

Because security is fundamentally not a technology problem--it's a people problem. And while the technology continues to improve, increasing complexity makes the problem worse.

It's war. But it's much more interesting, and it's always pervasive.

It used to be "script-kiddies" writing goofy viruses, but it's more dangerous nowadays.

Starting about five years ago, hacking shifted from a hobbyist activity to a criminal professional activity. We see that in the structure of current viruses and worms, and in the rise of spam, identity theft and fraud. Current threats represent criminal pursuit--it is a for-profit venture. And criminals are far more dangerous than hackers.

They are also far more professional. Large-scale cybercrime is difficult. Stealing the money is only the first step. Then you have to move the money into a dummy account, probably offshore, and then convert it into something you can withdraw and use. So there's an entire financial back-end that has to be built in order to make this work.

So this crime is moving upmarket. We're seeing organized-crime gangs using identity theft and other online fraud as a way to make serious money. They're mostly coming out of Russia and eastern Europe.

Why those areas?

Because of the lack of serious law enforcement. Russia/eastern Europe is the primary breeding ground for this kind of criminal activity, Asia is second. Then sub-Saharan Africa and South America. Basically, you're looking for a place with ineffective computer crime laws, bribable police forces, and no extradition treaties. So you look for places where the police aren't going to bother. After all, if you're stealing from banks outside their country, why should they bother?

How much do you estimate is currently being stolen by cybercriminals?

We have no idea. So much isn't even reported, and there are many instances where the victims don't even know they're being attacked.

Do you see any progress in enforcement?

Not really. It comes down to where the "push" is. The US government has terrorism as its highest priority, so they're pushing ID cards and focusing on airport security. Meanwhile the media industries are pushing Digital Rights Management for music and movies. No one's pushing cybercrime--it's not "sexy."

To help with enforcement, we really need good information-sharing--for example, on Interpol. We need unified laws and ways to prosecute across borders. But our fear of this terrorism is sucking up the energy that would have gone into fighting cybercrime.

OK, but we're talking about a lot of money that's being systematically stolen.

It's systematic and it could greatly affect the future of the Internet. We're not yet at the point where people are saying: "this e-commerce thing is dangerous." But it could happen. How many more basis-points do we have to lose before people start to seriously question the safety of Internet commerce, before everyone's got a story about a friend of theirs who lost a lot of money? We're at the cusp of what could be a serious crisis of confidence, and the Net's moving faster than a lot of our existing processes.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.