who is challenging internet security?
Efforts to identify intruders are critical both to the assessment of the challenge and the nature of the response. Potential intruders run the gamut from young hobbyists engaged in the equivalent of joy riding to terrorist organizations and nations that are intent on maximizing damage to the target. The problem of identification is particularly difficult in a domain where maintaining anonymity is easy and there are sometimes time lapses between the intruder action, the intrusion itself, and the actual disruptive effects. Moreover, the consequences are not always commensurate with the objectives, in some cases falling short of what the intruders hoped to achieve, and in others going well beyond what they had envisaged.
There is a broad spectrum of potential intruders on the Computer Security and an almost equal number of motives for intrusions against organizations. Not surprisingly, this includes perpetrators conducting operations against other perpetrators. As enticing as this prospect is, it does not mitigate the effects of such internecine rivalry. New and more sophisticated tools are often the result of such interplay. This sort of jousting can also provide valuable insights to analysts once it is recognized, but does not simplify the analytic task and puts an incredible strain on limited analytic/warning resources. With the continuing proliferation of sophisticated computer technologies into the mainstream population, attribution for an intrusion becomes more difficult by the day. The dynamism of the intruder population is itself a problem. On the one hand, success breeds imitation and the sophistication of readily available tools means that even those with limited skills can become intruders. On the one hand, there is a certain degree of attrition in the intruder community. Indeed, there are many reasons why intruders might cease their activity, including increased maturity, a need to find gainful employment, and a perception of the rewards of working to increase network security rather than attack it. The implication, of course, is that the mix of agents threatening network security is changing as the nature of the Internet changes.
The vast majority of the intrusions are probably being conducted by nuisance hackers or "ankle-biters" who have limited objectives and are usually satisfied with the actual penetration of the system or conduct relatively harmless cyber-vandalism such as the defacement or alteration of web-sites. While aggravating to the target, no significant or lasting damage occurs. The more serious problem occurs when an intrusion is carried out by a more sophisticated intruder (either an individual or a group) whose objective is better defined and involves malicious intent. Motives for these sorts of intrusions are also as varied as the persons carrying them out. They range from greed to defined military strategy and doctrine, and all that falls in between.
Four of the more dangerous and less well defined categories of intruder are governments conducting operations against other sovereign states, the organized terrorist group, insurgency or revolutionary groups, and organized crime. All these entities are beginning to appreciate the potential power, anonymity, and effectiveness of the Internet. There are myriad examples of governments instituting programs for Computer Network Warfare.
The obvious challenge is to develop a capacity to identify and track the activities of these potential intruders with the goal of being able to provide predictive analysis and warning of intrusions. Some of the traditional intelligence techniques should apply to these threats, but new methodologies and the ability to contemplate new and complex concepts have to be developed concurrently. This will become even more important (and difficult) as perpetrators of increasing sophistication operate on the Internet. As motivations vary, so will the efforts of the individuals behind malicious operations to either conceal or reveal their responsibility. All of this complicates efforts to track responsible parties determine attribution. Nations and transnational criminal organizations, by their nature, will be diligent in their efforts to maintain anonymity. In some of these cases, identifying the intended victim may give valuable insight into tracking the intruder. Sometimes the target of an intrusion allows the analyst to rule out certain possible perpetrators. A multi-million dollar extortion plot against a major financial institution is probably not the work of a 13-year-old hacker working out of his bedroom. At the same time, however, many victims, especially within government or sensitive industries such as banking or insurance, often complicate the effort to track intruders because of their reluctance to report the incident. In other cases, such as politically motivated attacks, the perpetrators may want their identity known, but not their location. As such operations become more sophisticated; tracking the attack back to its point of origin will be a major challenge to the intelligence analysts involved. What is clear from all of this is that tracking intruders and gaining attribution is much more than just a technical challenge.
One difficulty, of course, is that there are legal constraints on intelligence collection, especially by the military and the national security establishment. Traditionally the focus of intelligence has been on foreign threats, and there are restrictions on intelligence activities directed against individuals or groups that are domestic in nature. Insofar as these groups are the focus of government attention, it is from the law enforcement community. This points to yet another problem: that of coordination and information sharing between the traditional national security agencies and the law enforcement community. Generally law enforcement focuses on individual cases and wants evidence that stands up in court; intelligence agencies in contrast are concerned with protecting the sources of their information so that they can continue to use them. The problem with cyber-threats is that they fall in the gray area where crime and national security merge into one another.
|
