Striving to Create a Safe Haven Online: ID Theft, Worms, Bugs, and Virtual Eavesdropping Banks Cope with Escalating Threat. (Tech Topics)

Now in its seventh year, the 2002 Computer Crime and Security Survey shows that theft in cyberspace is far more pedestrian--and costly--than previously supposed. Conducted jointly by San Francisco-based Computer Security Institute and Federal Bureau of Investigation's computer intrusion squad (also in San Francisco), the survey showed that 38% percent of 503 survey respondents, 19% of which are banks, suffered unauthorized access or misuse on their websites during 2001. In an age where fairly sophisticated intrusion monitoring systems are available, 21% said they didn't know whether or not they'd been hacked. Among those intruded upon, 70% reported site vandalism; 55% noted denial of service; and 12% said they experienced theft of transaction information; 6% indicated being the victim of financial fraud. To frame the issue in hard dollars, the highest single amount reported stolen back in 1997 was $10 million and an average loss of $954,666, with 20% of respondents then acknowledging theft of proprietary information and 21 respondents quantifying financial loss. By 2002, while proprietary information theft held steady, losses soared to an average of $6.57 million. The highest reported loss? $50 million. Even if you dismiss the findings as limited to a comparatively small group, casual attention to newspapers and portals clue the reader in to the fact that the online realm is not as benign as some companies take great pains to present. Because, as good as these companies have become in creating and maintaining online environments, mistakes in coding or security tool configuration still happen. And, as transactional systems and online traffic have become more common, these lapses have led to breaches that have been real doozies. As was first reported early in March on Internet Banking Wire, for instance, a server known as the SQLSlammer Worm attacked Microsoft's SQL Server 2000 and Desktop Engine 2000 software, slowing online traffic and even temporarily cutting off cash at some ATMs at Bank of America and Canadian Imperial Bank of Commerce. The worm caused so much congestion on the bank's internal network that an ATM went to communicate or dispense cash, it was unable to do so, explained a Bank of Amercia spokesperson. Security vendor Symantec, Cupertino, Calif., tracks activity on the internet as part of its offerings and issues a Security Response Report regularly. They noted that in recent months Klez, Bugbear, and OPA serve constituted 80% of the malicious code gathered from monitoring systems deployed at client locations. Yet worms or viruses, which become media darlings and tend to come through e-mail and attack the most ubiquitous platforms, are far from the only concern. Identity theft and sophisticated, blended threats, which we'll get into later, continues to be big potential risks for e-commerce providers, according to Louis Carpenito, Symantec's vice-president of security business and a former IT security chief at Fidelity. Hackers rule? That outsiders held such sway online despite increasingly sophisticated intrusion detection, firewall, and other security systems surprised the FBI. The security community had long believed that the bigger threat to organizations came from insider breaches or the careful schemes of outsiders aided and abetted from within. Not everyone is equally caught off guard by these findings or impressed by the chops of hackers. Carpenito, for one, still thinks insiders or outsiders with inside accomplices have the highest success when it comes to the most costly fraud. But whatever they think about who or what is riskier, most security experts agree that outsiders can and do get passwords and data on a fairly regular basis and that much of the mayhem could have been avoided with a more organized approach to security or use of newer tools. A good hacker can turn code against the less than 180% vigilant, notes Bob Walters, chief executive officer with Teros, Santa Clara, Calif. …

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.