2010/2011 Computer CrIme and SeCurIty Survey - Gatton College ...

2010 / 2011 CSI Computer Crime and Security Surveyspent a couple of years studying ATM machines he’s purchased and that he’s a top-rank securityresearcher, this approach can hardly be at the top of a typical ATM owner’s threat model. Again,from the enterprise security point of view, this was very close to not really being relevant (not evento banks, as the kinds of ATM machines that Jack set his sights on are those used predominantlyby independent operators).The problem that faces the security community right now is not that the current news isn’t fairlygood—we would argue that in fact it is—but that the advanced attacks we don’t see much of rightnow, should they become prevalent, will render many of our defenses moot.The Past Year: Moving to War FootingThe scope of this survey remains narrowly focused on what happens within enterprise networks,but the one-year period covered by the survey is one in which the broader context definitely matters.There isn’t room for a detailed recounting of major cybersecurity events, but a few highlightsbear mentioning.• The Aurora attacks, which began in mid-2009 and continued through December 2009,made history in part because they were made public. The attacks were disclosed byGoogle in a blog post that appeared in mid-January 2010. The attacks, we learned, hadsuccessfully targeted dozens of organizations, including (we now know) Adobe Systems,Juniper Networks, and Rackspace. Media reports have claimed that Yahoo, Symantec,Northrop Grumman, and Dow Chemical were among other targets. This was viewedwithin the security community (and not wrongly) as something of the ultimate proof thatso-called “Advanced Persistent Threat (APT)” attacks were real.• Close on the heels of Aurora going public, a simulation exercise in which a working groupof high-ranking former White House, Cabinet and national security officials came togetherto advise the President as the nation was (theoretically) undergoing a cyber attack. CalledCyber Shockwave, the exercise was aired nationally in mid-February by CNN. What wasprincipally made clear through the event was that there was nothing much in the way ofpolicy or law that the government would be able to draw on should an actual cyber attackoccur.• March saw the sentencing of Albert Gonzalez, who had previously pleaded guilty tothe combined theft and subsequent reselling of more than 170 million credit and ATMcards and from 2005 through 2007, not only the biggest such fraud case in history butalso including some of the most widely publicized data breaches, including HeartlandPayment Systems and TJX. It seems clear that this successful prosecution (Gonzalez wassentenced to two concurrent twenty-year terms) had a chilling effect on the criminal community.We also note in passing that his initial entree into these companies was via SQLinjection, one of the simplest sorts of application-layer attacks and one that continues tobe a major source of problems.10