Computer Crime: A New Framework for Protecting Information - Softcover

B. Parker, Donn

Softcover

ISBN 10: 0471163783 ISBN 13: 9780471163787

Publisher: John Wiley & Sons, 1998

Synopsis

Who are the cybercriminals and what can we do to stop them? From the #1 cybercrime expert, a revolutionary new approach to . Fighting Computer Crime A top computer crime expert explains why current computer security methods fall dangerously short of the mark and what we can do to fix them. Based on his 30 years as a cybercrime fighter, during which he interviewed more than 200 perpetrators and their victims, Donn B. Parker provides valuable technical insight about the means cybercriminals employ, as well as penetrating psychological insights into their criminal behavior and motivations. Using many riveting real-life crime stories to illustrate his points, he reveals: Who your greatest security threats really are (be prepared for some surprises!) Why employees undergoing divorce can be your organization's greatest computer security risk How to overcome cyberterrorists who will employ any high-tech or low-tech means necessary to crash your systems. Effective countermeasures for each threat covered in the book How to neutralize even the most powerful cybercrime scheme attempts Why and how the incorrect, incomplete, inarticulate security folk art must be revitalized

About this title

About the Author

DONN B. PARKER has written numerous books and articles on computer crime. The world's most listened-to cybercrime expert, he has been featured in articles appearing in newspapers and magazines ranging from PC Magazine to People and has appeared on 60 Minutes, 20/20, and Nova.

Excerpt. © Reprinted by permission. All rights reserved.

Excerpt from Fighting Computer Crime: A New Framework for Protecting Information By Donna Parker

CHAPTER 6: CYBERSPACE ABUSERS AND MISUSERS

We can learn more about computer and network abuse and misuse from the actual abusers and misusers than we can from information security experts. The abusers are, after all, the people whose misbehavior we need to stop. I have spent a significant portion of my career chasing after these individuals and interviewing them to identify their capabilities and motives. I believe that the knowledge that I've gained through this experience is valuable for implementing security safeguards to protect information from the many, very real threats to it. Much of my experience, however, conflicts with the "traditional" views of security experts. For example, popular knowledge holds that the perpetrators of computer crime are "high-tech" insiders motivated by opportunity and greed. My direct experience and contact with perpetrators indicates otherwise.

This chapter describes the computer criminals that I have interviewed over the years-embezzlers, thieves, and terrorists-and explores both their crimes and their motivations. In the next chapter, I discuss hackers and malicious hackers, who typically perpetrate a different type of crime, for different reasons, and require different safeguards to keep them away from your valuable information.

CHARACTERIZING THE PERPETRATORS OF CYBERCRIME

People who intentionally abuse and misuse information cover the spectrum of criminals. Although it is impossible to characterize these criminals in a single profile, there are some interesting and useful criminal phenomena that we need to know to be effective in protecting information. Several of these characteristics differentiate cybercriminalsfrom white-collar criminals. I refer to these as SKRAM-the criminal's skills, knowledge, resources, authority, and motives.

SKILLS

Skills already possessed or acquired (the S in SKRAM) vary significantly in three major areas: formal learning, experience with information systems, and social interaction with people. Although social skills may be of minimal importance in committing crimes against computers, such skills are clearly desirable for manipulating and/or deceiving gullible people, steps that are often essential for gathering the necessary technical knowledge to execute a crime or for converting crime to gain. Criminals that can combine interpersonal skills with strong information processing skills are in a good position to use computers to take advantage of people, if they so choose. Some of the most successful computer criminals are the ones with the best social skills, not necessarily the greatest formal education or the strongest computer skills.

Some of the criminals that I have interviewed have learning disabilities. They are unable to function in formal classroom education, which affects their interpersonal skills. They are limited to learning from hands on experience, making computers a good source of learning and offering them an area in which they can excel. Computer application skills often come naturally to otherwise dysfunctional people, or they easily and enthusiastically acquire them.

KNOWLEDGE

Knowledge (the K in SKRAM) is another obvious necessity for crime. I divide criminals into three classes: those who create the tools for crime; those who have the necessary skills and knowledge and who plan and carry out crimes; and those who use others' knowledge and follow scripts to act out crimes. Packaging crime scripts for others to use in the computer.

If criminals don't have a thorough understanding of the environments and circumstances of their crimes, they are likely to fail or be caught. Criminals greatly fear the unknown and unpredictable aspects of their crimes that might lead to their failure and identification. For this reason, they usually know more about the crime scene than anyone else in the world, making them formidable adversaries for victims and security practitioners. Unlike the criminals who have the luxury of studying the pertinent crime environment and carefully planning their attack, security practitioners must typically learn all aspects of the environment quickly, gathering the details about many potential vulnerabilities and plugging the gaps in a comparatively short amount of time before criminals can attack them.

Perpetrators who do not possess sufficient knowledge to begin their crimes must obtain it before moving forward. They do this by studying available sources, practising deception where necessary, and-if all else fails-stealing it. Hackers, such as Dark Dante, engage in outright burglary to gain the necessary knowledge of the target environment. Although lock picking is a popular subject among burglars, deception to obtain keys through social engineering is the preferable means of obtaining knowledge. Criminals can also often practice their crimes on systems identical to the real targets.

RESOURCES

Resources (the R of SKRAM) represent the means to engage in the abuse and misuse of information. In most cases, the resources are relatively basic and easy to obtain. We can never assume that criminals can't attack valuable information because they do not have the necessary money, or the wherewithal to acquire them. In most cases, criminals are remarkably skilled at borrowing or stealing what they need, or in using innovative means of attack that minimize the resources they need. Information may, however, be more secure in an uncommon type of system and media simply because fewer people have the necessary resources to obtain or manipulate the data. And, utilities and other tools are generally more difficult to obtain for the less popular operating systems and applications than they are for the common ones such as Microsoft Windows and Intuit's Quicken...

Edition details

• Publisher: John Wiley & Sons
• Publication date: 1998
• ISBN 10: 0471163783
• ISBN 13: 9780471163787
• Binding: Paperback
• Language: English
• Edition number: 1
• Number of pages: 532