By now, nearly everyone knows the conduct of a hacker. There are nine steps to hacking a system and they have gotten good at it by exploiting all kinds of system and software vulnerabilities. The hacker is a person of various genres who break into computer systems for the thrill of the hack and to some extent for criminal purposes. While hacking is a crime itself, cybercriminals are far more deviant. It is important to identify a cybercriminal early and monitor in order to head off any issues.
Profiling and categorizing cybercriminals Article Summary
Knowing who cybercriminals are can aid in protecting the digital systems and intellectual property. According to Deb Shinder, author of the book Scene of the Cybercrime, traditional criminals have a cyber counterpart. For example, con artists can talk people out of money or establish elaborate cyber schemes using email and websites. Even with uniquely digital seedy endeavors, the criminal motives are the same. Therefore, Shinder considers a psychological assessment of an unknown person also known as a criminal profile as important. She stresses ‘fitting the profile’ does not mean a person is a cybercriminal. Shinder points to the profile as narrowing the field of possible suspects. In a Sherlock Holmes sort of manner, investigators use inductive and deductive methods to formulate the profiles. Shinder claims the cybercriminal has most of these characteristics:
· Some measure of technical knowledge.
· A disregard for the law or rationalizations about why particular laws are invalid or should not apply to them.
· High tolerance for risk or need for “thrill factor.”
· “Control freak” nature, enjoyment in manipulating or “outsmarting” others.
· A motive: monetary gain, strong emotions, political or religious beliefs, sexual impulses, or even just boredom.
Shinder remarks that a large number of criminals use their employers email and digital equipment to commit cybercrimes posing a situation in which IT professionals may stumble across evidence of a crime that are not company systems related. According to Shinder, indicators of a cybercriminal are:
· Refusal to take time off from work or let anyone else help with his/her job, lest they uncover what’s been going on.
· Attempts to avoid formal audits
· A lifestyle far above what would be expected on the person’s salary with no good explanation for the extra income.
· Large cash transactions
· Multiple bank accounts in different banks, especially banks in different cities or counties
CyberCriminals Go Unpunished Article Summary
John Connell, author of Companies choose to leave cybercriminals unpunished, comments that companies who track down and prosecute those who commit cybercrimes are going against the grain of how most companies handle cybercrimes. Most companies, despite tough talk rarely prosecute today. The reasons vary for this. One of the principle reasons according to Connell is that the assault on the company systems comes from abroad and is too legally complicated to prosecute. He also points out that the legal process can expose company secrets. Another reason Connell brings up is that exposing company vulnerabilities can erode confidence and keeping quiet is better than risking a bad impression. The big question is when will companies risk prosecuting cybercrimes?
Artisan Comments:
Cybercrimes and cybercriminals have been on the rise. Identifying these crimes and tracking the perpetrators is a chore. Chances are that a vast majority of the system administrators and support come across evidence of a cybercrime and fail to recognize it. More importantly, vulnerabilities, which are often doorways to cybercrimes, are often overlooked. Routine training and awareness of tale-tale signs is necessary to thwarting cybercrimes. However, there is a risk that workplace interpersonal dynamics may point to someone for more political reasons than criminal reasons. So these cases also need to be vetted closely and carefully. Since companies and organizations are generally reluctant to prosecute people, it is better to identify the behavior and address it internally before a serious legal issue arises. Some of the better approaches are to counsel or train and reassign the individual when the indicators begins to emerge in order to avoid the legal mess. However, the organization must bear in mind that fitting the profile is not a sure indicator of cybercriminal. A degree of prudent judgment must be exercised in order to avoid false accusations and disrupting legitimate work. The closing remark is to be on a BOLO for cybercriminals and use prudent judgment to avoid serious issues.
References:
Connell, J. (2001) Companies choose to leave cybercriminals unpunished. Techrepublic. http://www.techrepublic.com/article/companies-choose-to-leave-cybercriminals-unpunished/5033678
Shinder, D. (2010). Profiling and categorizing cybercriminals, techrepublic. http://www.techrepublic.com/blog/security/profiling-and-categorizing-cybercriminals/4069
No comments:
Post a Comment