A complex criminal economy

IBM recently released the findings of the 2007 X-Force Security report that points to a disturbing rise in the sophistication of attacks by criminals on Web browsers worldwide. By attacking the browsers of computer users, cyber criminals are now stealing the identities and controlling the computers of consumers at a rate never before seen on the Internet. The X-Force Security Report analyses, monitors and records a wide array of computer security threats and vulnerabilities, allowing it to surface underlying infocomm
security trends.

The study finds that a complex and sophisticated criminal economy has developed to capitalise on Web vulnerabilities. Underground brokers are offering tools to aid in obfuscation, or camouflaging attacks on browsers,
so cyber criminals can avoid detection by security software.

Mr Allor: Organisations should take a holistic approach to threat mitigation and monitoring.

Using these techniques, cyber criminals can infiltrate a user's system and steal their IDs and passwords or obtain personal information like national identification numbers and credit card information. When attackers invade an enterprise machine, they could steal sensitive company information or use the compromised machine to gain access
to other corporate assets behind
the firewall.

The Storm Worm, the most pervasive Internet attack last year, continues to infect computers around the world through a culmination of threats including malicious software (malware), spam and phishing. Last year, delivery of malware was at an all time high, as X-Force reported a 30 per cent rise in the number of malware samples identified. The Storm Worm comprised around 13 per cent of the entire malware set collected in 2007.

Developing an effective infocomm security strategy

Information technology security is changing as more collaborative business models, sophisticated attackers, and complex infrastructures emerge. As a result, today's security technologies, traditionally implemented tactically in silos, are not sufficient to deal with the new reality of risk.

The need of the hour is for data security services, products and research breakthroughs designed to help businesses go beyond merely meeting security compliance requirements to achieve true risk management. Organisations should take a holistic approach to threat mitigation and monitoring. This can be done by strategically managing information technology and operational
risk end-to-end across all five domains of information technology
security including:

• Information security – Securing widespread electronic collaboration while protecting data at rest, in motion, in use, and throughout the lifecycle,
  
• Threat and vulnerability management - Staying ahead of emerging threats on all system components: network, server, and the
  strategic endpoint,
  
• Identity and access management - Assuring that the right people have access to the right information and assets at the right time for the
  right reason,
  
• Application security - Ensuring application and business process security across the software application lifecycle, and
  
• Physical security - Integrating video surveillance and security solutions with industry-standard components.

The role of private-public sector collaboration

Private-public collaboration has to do with situational awareness, incident response and recovery. It is a means whereby the private sector IT industry supports the critical infrastructures and networked enterprises by providing a series of coordinated responses to various major constituencies - governments, global/multinational enterprises and the millisecond sectors - on issues that are of major importance.

Note that governments are an enterprise customer with specific needs in protecting national infrastructures and that they may or may not own/operate. It is within this construct that the private sector, either national-based or global-based, must assist governments. The term collaboration means that we are going to move past the thought of partnership to one where we ask questions and receive answers in a bi-directional manner.

Putting strategy to practice

In today's complex connected world where organisations have heterogeneous IT environments coupled with fluid business environment, a firewall and anti-virus solution are no longer enough to protect a corporate network. This complexity is further compounded by technology convergence. The convergence of mobile devices, PCs and other technology interfaces play a key role in driving business value and increasing the number of users – customers, employees, partners and suppliers – that are allowed to
access information.

As government and industry groups impose an increasing number of regulatory demands related to data privacy, security and business resilience, organisations are faced with the challenge of effectively implementing organisation-wide IT governance and risk management programmes. According to Gartner, companies that select individual solutions for each regulatory challenge they face will spend 10 times more on the IT portion of compliance projects than companies that take a proactive and more-integrated approach.

The most effective way to address this challenge is to adopt a holistic approach to contain, monitor and mitigate organisation-wide risk elements. Manual or segmented approaches to managing security and risk are no longer viable and scalable options. Organisations and economies have to recognise this complexity and prepare likewise. Programmes to manage this would
involve outlining IT performance objectives and implementing risk
management strategies to limit the impact of security threats and improve business resiliency.