Comments
From Green Goblin to Kaine, Shocker to Jackal, Sandman to Octopus, the list of Spiderman adversaries reads very long. In each of these Spiderman episodes, the agile superhero wins the battle after some breathtaking stunts. But always, the game for one-upmanship continues.
A Spiderman comic is much like the fight between cyber criminals and individuals/enterprises/governments. The fight never seems to have an end in sight. The nature of cyber attacks have long ceased to be funny or entertaining. Cyber attacks are having a devastating impact on networks, causing immense financial losses and posing major threats to national security.
New, lethal attacks
APT or Advanced Persistent Threat is a relatively new, lethal form of attack that is sending shivers down the spines of corporations and sovereign governments. Unlike largely unorganised cyber criminals and cliques, APTs are launched by some countries themselves to steal intellectual property from R&D-intensive sectors such as pharma and defence. They also lay in wait for critical infrastructure of nations to launch debilitating attacks at an opportune time.
Sophisticated APTs are hard to spot and it takes weeks or months before an intrusion is identified, says Uri Rivner, Head of New Technologies (Consumer Identity Protection) of RSA. These intrusions can easily bypass traditional anti-virus protection.
FireEye, an advanced security solutions firm, says traditional security systems rely heavily on signatures and known patterns of misbehaviour to identify and block threats. “This leaves a gaping hole in network defences that remain vulnerable to targeted APT attacks,” it says.
Companies in the US, Europe and Africa have been hit most by APTs in the recent times. According to Rivner, APTs, financial attacks and hacktivism are the three major sources of concern in today's virtual world.
APTs find weak links in the form of individual employees. Using their computers, APTs break into a corporation's network. Cyber criminals don't really bother with targeting an individual. They find websites with vulnerabilities and hijack them. And as a result, anyone accessing these sites are, in turn, hijacked. A hijacked computer could compromise security for an entire corporation.
Several experts feel that 2011 was a watershed year in terms of the sheer volume and variety of attacks.
Tightening security
Keeping in view threats the to governments, corporations and financial markets, there was a unanimous verdict at the recently concluded RSA Conference in San Francisco that there is a need for a proactive approach to tackle cyber criminals.
The US has set up a unified, military-grade Cyber Command to defend cyber space, which works to create an early warning system. It calls for a paradigm shift from a passive, fragmented defence to an integrated dynamic system. The US Cyber Command, headed by an officer of General rank, covers the US Army (ARCCYBER), Navy (Fleet Cyber Command), Marine Corps (Marforcyber), Air Force (24AF AFCYBER) and Coast Guard (CGCYBER).
Arthur Coviello, Executive Chairman of the US-based security solutions firm RSA, says security on the Internet can be likened to driving on a highway. You can only prevent accidents by following necessary precautions. For this, he calls for gathering intelligence by picking up faint signals in cyber space. The Cyber Command of the US has begun to institutionalise processes and procedures to prepare various cyber defence agencies in facing threats.
The day-to-day use of cyber risk intelligence is no longer a need for government agencies – it's a required competency for corporate survival, Coviello says.
“The tempo and serious nature of recent attacks calls for urgent and bold countermeasures that position organisations not only to detect advanced threats, but also to predict how attacks may occur,” he says.
Combating advanced threats requires a new security mindset and vastly improved practices for gathering, sharing and acting on cyber risk intelligence.
No wonder then that the biggest names in cyber security showcased the latest solutions to insulate organisations against attacks.
Next on the hit list
Mobile devices are attacked relatively less. “Not because they (cyber criminals) are not interested. They benefit more when they attack computers whose scale is very high. They soon will target mobile devices too. If they don't, they will go out of business,” Rivner points out.
Rivner says that for an average user, following some basic precautions could help. “You need to constantly upgrade important applications such as Java, your operating system and Flash to plug the gaps. When you say `Remind me later', you in fact are opening the door for attacks,” he warns.
(The author was recently in San Francisco to attend the RSA Conference)
Comments
Comments
Comments have to be in English, and in full sentences. They cannot be abusive or personal. Please abide by our community guidelines for posting your comments.
We have migrated to a new commenting platform. If you are already a registered user of TheHindu Businessline and logged in, you may continue to engage with our articles. If you do not have an account please register and login to post comments. Users can access their older comments by logging into their accounts on Vuukle.