n e w s 6 Infosecurity Today May/June 2006 Australian computer crime changes tack Ian Grant Fewer reported attacks and less harm done suggest Australian cybercrime is under control. Big mistake. B ragging rights are passé; now it's about getting away clean away with the cash. This is the conclusion of AusCERT's latest computer crime survey, published on 22 May.Australia has the world's most consistent re- search into the nature, caus- es and attack methods used by cyber-criminals. The latest survey, which more than doubled the num- ber of respondents, reveals that reported attacks are down slightly, but the prom- ise of easy cash through ID theft has produced more motivated and more sophis- ticated cyber-thieves. Only 22% of respondents reported an attack that dam- aged the confidentiality, in- tegrity or availability of net- work data or systems. In 2005 the figure was 35%, and 49% in 2004. The average financial loss rose 65% to over A$240,000. But this was skewed by a single A$40 million loss reported by one firm. Excluding this, average loss- es dropped to A$42,000 compared to A$153,000 in 2005. Attacks that use trojans and rootkits rose to 21% of all attacks, says the report. Many are able to switch off computer defences and evade detection. In addition, 60% were undetected by current defensive software until discovered “in the wild”.This means actual infection rates may be much higher. Kathryn Kerr, manager of analysis and assessments at AusCERT, says,“It is hard to know what is causing the decline in figures. It could be sample anomalies (e.g. manufacturers repre- sented 19% of respondents compared to 10% in 2005 and are low users of IT relative to their size), and/or a lower level of reporting due to the nature of some malware attacks, such as rootkits. “We have separated trojan/rootkit attacks from other attack vectors and we can now see that one in five of all victims reported a trojan or rootkit infection. “This is remarkably high considering that such malware does not self-propa- gate.We think this reflects high attacker activity. It is consistent with the relative- ly high volumes of online ID theft trojan attacks AusCERT is seeing.” The report also shows fewer respondents using for- mal IT security standards and practices, and lower uni- versity enrolments for computer and IT courses. Coupled with a declining trend in reported attacks and damage, is complacency is setting in? Kerr says this would be a mistake.“Now is not the time to be winding back on adequate information security protection, detection and response strategies, giv- en the growing evidence of cybercrime motivated by il- licit financial gain that AusCERT,Australian law en- forcement and many others are seeing in Australia and internationally. “Many sectors are not affected by some of the new attacks. However, online ID thefts and other financial scams are likely to become more common as more companies increase their online presence.We already have seen non-banking and finance sector industries tar- geted, and there is every rea- son to believe it will extend further. “Unfortunately, spending on IT security has to com- pete for funds against new IT services.There is also a lag between identifying new threats, being affected by them, and responding to them, before IT security staff can make the business case for more funds.” The report is published at www.auscert.org.au/crimes urvey . AusCERT’s Kathryn Kerr

Australian computer crime changes tack

Download PDF Report

Upload
ian-grant
View
219
Download
6

Embed Size (px)

Citation preview

Page 1: Australian computer crime changes tack

6In

fosecu

rity Tod

ayM

ay/June 2006

Australian computer crime changes tackIan Grant

Fewer reported attacks and less harm done suggestAustralian cybercrime is under control. Big mistake.

Bragging rights are passé;now it's about getting

away clean away with thecash.

This is the conclusion ofAusCERT's latest computercrime survey, published on22 May.Australia has theworld's most consistent re-search into the nature, caus-es and attack methods usedby cyber-criminals.

The latest survey, whichmore than doubled the num-ber of respondents, revealsthat reported attacks aredown slightly, but the prom-ise of easy cash through ID

theft has produced moremotivated and more sophis-ticated cyber-thieves.

Only 22% of respondentsreported an attack that dam-aged the confidentiality, in-tegrity or availability of net-work data or systems. In2005 the figure was 35%,and 49% in 2004.

The average financial lossrose 65% to over A$240,000.But this was skewed by asingle A$40 million loss re-ported by one firm.Excluding this, average loss-es dropped to A$42,000compared to A$153,000 in2005.

Attacks that use trojansand rootkits rose to 21% ofall attacks, says the report.Many are able to switch offcomputer defences andevade detection. In addition,60% were undetected bycurrent defensive softwareuntil discovered “in thewild”.This means actual in-fection rates may be muchhigher.

Kathryn Kerr, manager of analysis and assessmentsat AusCERT, says,“It is hardto know what is causingthe decline in figures. Itcould be sample anomalies

(e.g. manufacturers repre-sented 19% of respondentscompared to 10% in 2005and are low users of IT rel-ative to their size), and/or alower level of reportingdue to the nature of somemalware attacks, such asrootkits.

“We have separated tro-jan/rootkit attacks from oth-er attack vectors and we cannow see that one in five ofall victims reported a trojanor rootkit infection.

“This is remarkably highconsidering that such mal-ware does not self-propa-gate.We think this reflectshigh attacker activity. It isconsistent with the relative-ly high volumes of online IDtheft trojan attacks AusCERTis seeing.”

The report also showsfewer respondents using for-mal IT security standardsand practices, and lower uni-versity enrolments for com-puter and IT courses.Coupled with a decliningtrend in reported attacksand damage, is complacencyis setting in?

Kerr says this would be amistake.“Now is not thetime to be winding back on

adequate information secu-rity protection, detectionand response strategies, giv-en the growing evidence ofcybercrime motivated by il-licit financial gain thatAusCERT,Australian law en-forcement and many othersare seeing in Australia andinternationally.

“Many sectors are not af-fected by some of the newattacks. However, online IDthefts and other financialscams are likely to becomemore common as morecompanies increase theironline presence.We alreadyhave seen non-banking andfinance sector industries tar-geted, and there is every rea-son to believe it will extendfurther.

“Unfortunately, spendingon IT security has to com-pete for funds against newIT services.There is also alag between identifying newthreats, being affected bythem, and responding tothem, before IT securitystaff can make the businesscase for more funds.”

The report is published atwww.auscert.org.au/crimesurvey.AusCERT’s Kathryn Kerr

http://www.auscert.org.au/crimesurvey