Before I begin discussing insider threats, I want to provide a general overview of cyber crime. This chapter will provide background on the motives, markets, perpetrators, and techniques related to cyber crime. For some, this chapter may be a refresher on cyber criminals and their means of profit; for others, this is an opportunity for exposure to a comprehensive examination of cyber crime. I will cover insider threats explicitly starting in chapter two.

The security threatscape has changed significantly. While the Internet was once a playground for government organizations, large businesses, and academic institutions, it has rapidly become an integral part of daily life for millions around the world. These millions include both individuals and businesses. Many have become dependent on the Internet and computers. Virtually every business vertical has gone global. We see this in everything from finance and technology to manufacturing and retail. Internet and information technology is at the core of globalized movement of information, supply chains, inventory management, and general productivity. Our reliance on technology—along with explosive growth—creates an attractive target for those looking for exploitation opportunities. This has brought an increased number of characters to the cyber world—from spammers and identity thieves to online extortionists and exploitation-writers for hire.

I believe that most people we see walking down the street—the same people who are plugged into the Internet—are good people. But some of them live in ethically gray areas, and a few are outright criminals. The weapons in the cyber criminal’s arsenal are different from those in the arsenal of your average thug. While you’re walking down the street, a pickpocket may steal your wallet. But a cyber criminal can—with relative anonymity—commit the equivalent crime from anywhere in the world. And he or she can do it at Internet-speed against millions of victims simultaneously. With so many potential targets, it’s a numbers game, and the cyber criminal is bound to come away with more than $17.00, a gym membership card, and a couple of photos.

So who are these cyber criminals? Are they a bunch of smart kids who are interested in hacking and have too much time on their hands? Are they curious people who are simply experimenting? The answers to these questions have changed. The new enemy is not experimenting; he is a criminal committing cyber crime for financial gain.

Attacks on computer systems go back much farther than the last twenty years. The first attack may be said to date back to the early 1800s when a gentleman by the name of Joseph Jacquard developed an automated means of weaving for the textile industry. This automation solution was, in fact, the forerunner to the computer punch card. Several employees at the facility were afraid that they were about to lose their jobs. Therefore they sabotaged the technology.

Interestingly, we may then say that the first computer crime was perpetrated by insiders.

While the specific reasons for cyber attacks will differ, the motivations tend to be the same as in traditional criminal activity. Whether the perpetrator starts off with criminal intent, gradually becomes a disgruntled insider, or is an intelligence operative with a foreign government, there are common motivators.

In Ira Winkler’s book, Spies Among Us, he writes that there are four psychological weaknesses that individuals try to exploit when recruiting agents to betray their country. According to Winkler, the four weaknesses are: money, ideology, coercion, and ego (MICE). Money is clearly the primary motivator for most of today’s attacks—both from insiders and external entities.

In addition to these motives, there are certain general conditions that must also be met for a criminal—cyber or otherwise—to commit a crime. In a paper titled “The Insider Espionage Threat” by Richards J. Heuer, Jr. at the Defense Personnel Security Research Center, he details the conditions of opportunity, inhibitions and triggers.

There was a time when hooliganism—such as defacing a Web site for street credibility—was the motive. In these cases, the perpetrator might leave a tag such as an individual or group insignia on the Web site, or brag to other hackers online through BBS (Bulletin Board Systems) or IRC (Internet Relay Chat). They enjoyed seeing their work displayed on Web sites like Attrition.org which, since 1995, had archived web defacements by online vandals. There were plenty of attacks of this type, so many in fact, that in May of 2001, Attrition.org announced that it would stop tracking the online graffiti because it was requiring too much time to keep up.

Today’s cyber criminals are not defacing Web sites or crashing servers for fun. (Though there may be exceptions to this, such as those online activists who correctly or incorrectly are associated with denial-of-service attacks and web defacements.)

We see an example of political motivation in the August 1999 event when Chinese and Taiwanese hackers squared off and hacked each other’s government Web sites.

Today’s cyber criminals are not looking for recognition; in fact they go to great lengths to hide their identity. They certainly aren’t going to brag about their exploits on IRC, but they do create original exploits and may share them within the underground community. They do this in order to exchange their code for other exploits and to be allowed into an inner circle of exploit writers where they may increase their own knowledge. Sharing code amongst a group also makes it harder to trace the exploit’s origin back to a specific individual.

An exploit is a “digital fingerprint.” If the fingerprint can be traced back to a few key sources, an investigation can move quickly to the point of origin. If, however, there are thousands of sources, finding the point of origin can be difficult, if not impossible.

If a cyber criminal writes an exploit and successfully uses it, eventually it will be discovered, and that may lead to his arrest. Now, if that same cyber criminal shares the exploit, which in turn is propagated to others, and so on, it makes associating a particular attack with any one person or group much harder. The drawback for the cyber criminal is that this also increases the general knowledge of these exploits, and organizations may implement more safeguards and be compelled to patch their systems more quickly. This cuts short the usefulness of the criminal’s code.

Again, the goal in most cases is to provide a safe conduit for feeding the criminal’s greed. The longer the exploit can be used, the greater the return on his investment.

Beyond these motivators, cyber criminals actually have several characteristics in common.

In his thesis, A Social Learning Theory and Moral Disengagement Analysis of Criminal Computer Behavior, Marcus K. Rogers of the University of Manitoba lists them. He says cyber criminals:

Rogers further states that people usually don’t engage in reprehensible conduct unless they have justified it to themselves. Making yourself think that what you’re doing is okay puts your conscience at ease. Blaming the victim or circumstances may also do this. Many of his interviews with convicted hackers demonstrated that the hackers were primarily concerned with fulfilling their own needs—typically money—regardless of the consequences.

There are several ways to turn cyber crime into a profitable endeavor. One way is to enter the black market.

Tracking cyber criminals as they interact in on-line black markets is difficult because, as I’ve said, the criminal can be virtually anywhere. In addition, the criminals operate anonymously and can turn their operations on and off rapidly. Some simply cash out, which means that they sell the information—over IRC for example. In many cases they sell the same information over and over again. They may even scam an organization—such as a money transfer business—into being their intermediary. And they may have mules—individuals with fake Ids—pick up the money. When interacting with black markets, a growing number of criminals use a variety of mechanisms to conceal their identities. These mechanisms may take the form of false identities, encryption, underground auction servers, and/or dial-up connections to private off-line servers. We can think of auction servers as being a malicious variant of eBay through which criminals sell and bid on-line on identity information, account information, and the like. The private off-line servers are more exclusive and harder to find. These servers generally take the form of bulletin board systems that invite individuals to dial-in and participate.

While this type of criminal behavior can be hard to track, the collection of actual money can make the criminals vulnerable. If they use any mainstream financial institutions during the process, transactions can be flagged by financial investigators. In fact, some law enforcement stings operate by paying for the information and when the criminal goes to collect the money, that’s when they arrest them. However, as with most crimes, there is no idealistic method that always works for law enforcement or for that matter, always works for the criminals.

Criminals sometimes use compromised systems belonging to legitimate businesses, but whose owners don’t realize that they are hosting illegal activity and content. Often the illegal content resides directly within these servers. For years these have been common mechanisms for exchanging computer exploits, pirated software, movies, music, pornography, and now, personal and financial information. These distribution channels are typically set up with a central navigation server that directs the client to one of the various compromised servers—depending on what they would like to download. This is an extremely dynamic method of distribution, because new servers are continually coming up while other servers are being discovered and taken down.

One thing that draws criminals to cyber crime is that one can remain anonymous while operating globally. Today, there are a number of mechanisms to help criminals remain anonymous. These mechanisms were developed to maintain privacy—not to enable criminal activity—but with the Internet, we have to take the good with the bad.

Another technique involves criminals’ hiding—or at least obfuscating—their identity. A West Indies company called E-gold Ltd. will not perform transactions involving national currencies or bank accounts. Since it does not process sovereign currency, this type of business slides under the radar of the Secret Service. This allows individuals to exchange goods and services for gold. However, even with this or any other framework for exchange, at some point a conversion must be made into money, and in most cases those transactions are tracked. Additionally, it isn’t clear that financial frameworks like this one and the anonymous services would fold under governmental pressure and John Doe lawsuits, thereby assisting authorities with tracking and identifying criminals.

Typically a John Doe suit, sometimes called a cyber slap, will be filed by an organization that provides the defendant’s real name as soon as that name is available. Next the organization will subpoena the owner of the financial intermediary, Web site, university, ISP, or whatever organization can trace events back to a specific person. For example, in 2005, an anonymous posting to a Yahoo message board disclosed proprietary information that belonged to another organization. The organization filed a John Doe suit and subpoenaed Yahoo. In reference to the case, Dallas attorney Michael Linz, who had handled a John Doe lawsuit for the American Civil Liberties Union, stated that Yahoo wasn’t responsible for postings, and that it was not going to do anything to protect privacy. In such cases, Yahoo’s policy is simply to notify the individual who did the posting and tell him that Yahoo has been served. It then tells him that from the date of that notification, there will be fifteen days to file a motion against the subpoena, and if it is not filed within that time, Yahoo will turn over the information the subpoena calls for.

It’s important to add a quick disclaimer in regard to the term hacker. Without getting into a philosophical debate regarding hackers and hacking, I’ll simply say that the terms were initially not related to any type of criminal activity. Rather, it defined individuals with a strong thirst for knowledge who possessed a heightened technical aptitude. A hacker was a person who enjoyed pushing the limits of technology and making something perform a function that it was not initially intended to perform. Today, the media largely uses the terms hackers, crackers, cyber criminals, and the like interchangeably. The individuals and groups that I refer to in this book are not the classical hackers, but are those who use the hacker’s skills with malicious intent. I’ll refer to these people as cyber criminals, malicious insiders, attackers, or simply as criminals who also happen to have a computer.

I’m only mentioning this group as a way of showing the juxtaposition of script kiddies contrasted against true cyber criminals. Script kiddies, when compared to the other cyber criminal groups, are technologically unsophisticated. They generally fall into the FBI’s SAM profile—Socially Awkward Male. They desperately want to belong and be acknowledged as hackers. They use scripts and applications written by others, but lack the level of skill to be considered more than a novice. They also fit the media’s stereotypical image of the rebellious teenage hacker.

From the perspective of most organizations, script kiddies are nuisances. They run port scans checking for open conduits of communication; they attempt to crash servers or even take control over them, but they typically do little more than create a lot of log files and network noise for the organization they are attacking. They spend hours launching Linux server attacks against Microsoft Operating Systems. They revel in the excitement of getting access to a system, and they brag to their friends online. Then they may find that it wasn’t a system that they had actually accessed, but rather that it was a honey pot or honey net—a server or network of servers set up as a trap to contain and monitor malicious activity. The honey pot looks interesting to a script kiddy, but it contains nothing sensitive.

A script kiddy’s primary motivation is to obtain bragging rights—which, in a way, makes him one of the few persons discussed here who is still merely looking for approval from his peers. In general, script kiddies cannot sell their limited skill for profit and are not a significant threat. I say “in general,” because they can always get lucky, and even if they do not, their incessant probing of the network can create data overload that hides real attacks among the tsunami of alerts and logs generated by network devices, servers, applications, and security products. This in turn can allow criminals to target an organization with greater stealth. Ultimately, it is these criminals, not the script kiddies, who pose real risk. However, script kiddies do sometimes make the transition to actual cyber criminal.

I’m going to be spending some time discussing organized groups of criminals, many of which span the globe. However, I don’t want to overstate the issue by ignoring the existence of the solitary cyber criminal. Not all criminals play well with others.

These individuals perform the same types of attacks as the organized groups do; they simply have fewer resources. A skilled programmer may write an exploit that he reverse-engineered in a few months, but an organized group of criminals, such as a drug cartel, may apply enough programmers, money, and technology to shorten that process to just weeks or even a few days.

Exploit writers for hire are cyber criminal freelancers. They are typically very skilled programmers with an in-depth understanding of networks, operating systems, and applications. They sell their code for financial gain and, in most cases, are indifferent to the consequences and the intentions of the person to whom they’ve sold it.

Historically, exploits such as worms and virus code were written to spread quickly and cause damage. New exploits are designed to allow additional features for the attacker by doing the following:

To calculate how much the exploit writer will be paid by his benefactor, one must know a combination of things. How many targets (an estimate of patched versus un-patched devices) are there? What is the probability of the targets being patched following the exploit? Also, one must know the uniqueness of the exploit. Is the writer just reusing existing exploits to which he’s putting a new twist?

It is also worth mentioning that most security professionals agree that for every known and patched exploit there are probably two or three that aren’t yet known. Again—this new breed of cyber criminals will go to great lengths to keep their code, intentions, and tactics hidden. For them, it comes down to a return on their investment. If they spent one hundred thousand dollars to create the exploit and build infrastructure to leverage it, then they want to use it as long as possible before having to reinvest in another scam.

A good example of an exploit written for profit is the Zotob Worm mentioned earlier. Zotob was written by an eighteen-year-old programmer who was paid to write a specific exploit after the vulnerably it was to attack was identified and a vendor patch was released for Windows. His benefactor contracted him to write code that could be leveraged for financial gain. While the exploit itself wasn’t terribly interesting, some things did stand out.

Not all exploit writers create code to target businesses. Some design code that can be sold to target individuals. For example, the Spyware purveyor Carlos Enrique Perez-Melara was indicted for distributing code called Loverspy. For eighty-nine dollars, anybody could purchase the exploit. The purchaser would visit a website and then choose an electronic greeting card with such options as puppies, kittens, and flowers to send to his target. Within the e-card there was hidden malware. For the eighty-nine dollars this malware e-card would be e-mailed to up to five targets. Upon opening the card, the malware was secretly installed on the target’s PC. From that point on, all activity—including e-mail, web access, and entered passwords—was captured and forwarded to the purchaser. Also, the purchaser could now remotely control the target’s PC functions—including reading, modifying, and deleting files. More than one thousand people purchased Loverspy, and it was installed on over two thousand systems. Authorities were made aware of the program by a tip from someone who received a Loverspy spam advertisement.

Exploits like these can be costly, embarrassing, and dangerous, but they don’t come close to the potential damage that groups with larger financial resources—groups such as organized crime and nation-states—can cause.

There is no doubt that cyber crime is on the rise and becoming more organized. Like any other business—legal or otherwise—by organizing, those involved can increase growth and decrease risk. With the greater resources, funding, and technology that result from combined efforts, they are more efficient and effective. By jointly focusing their efforts, they reduce risk and increase the reward—hence, increased involvement by organized crime. The methods used are typically the same in both the virtual world and the real world; fear, blackmail, extortion, and other tactics that you might expect to see in a crime movie. Examples of organized crime now involved in the cyber world are the Italian Mafia, Russian Mafia, Colombian and Mexican cartels, Asian Triads, and Nigerian Criminal Enterprises.

Gambling sites have been a major target for these organized crime groups. With over two thousand sites, a projected $11.6 billion in combined revenue for 2006, and with little legal recourse, it is obvious why they are targeted. It reminds me of the all too famous quote from Willie “The Actor” Sutton, a bank robber in the United States in the 1950s. They asked him, “Hey, Willie, why do you rob banks?” A reporter claimed that Willie’s answer was, “Because that’s where they keep the money.” While the reporter fabricated this quote, the premise—i.e., not ignoring the obvious—rings true.

Just as an aside, Willie’s actual response to the question, “Why did you rob banks?”, was quite a bit different and helped to show that excitement was really his primary motivator. His real answer to this question, outlined in his book, was that not only did he simply enjoy robbing banks, but he loved robbing banks! It made him feel alive, so much so that when he was done robbing one, he couldn’t wait to rob another. To Willy, the money was merely a trophy.

Attacking online gambling establishments is especially common before major sporting events. Why? Because that’s when potential gambling revenue is highest. Equally high is their risk of losing that money to criminal intervention. It works like this: Prior to the site’s most lucrative events, the criminals create an incident—a show of power—such as crashing a single server. Then they demand payment (also known as protection) to prevent more damage and loss of revenue. That’s a powerful incentive to pay up.

Following attacks from extortionists that have shut their sites down, online gambling sites are increasing security safeguards. BetWWTS.com paid thirty-thousand dollars in extortion money when hackers took down their site. However, they didn’t pay until the assault made it impossible for customers to bet and they were losing money. They’ve estimated a loss of $5 million. Another site, according to the president of the company, BoDog Sportsbook & Casino in Costa Rica promptly paid twenty thousand dollars when hackers took down their site to avoid a similar financial loss.

In late October of 2004, the U.S. Secret Service announced to the media that in eight states and six foreign countries, they had arrested members of organized rings of identity thieves and fraudsters known by the group affiliations, Shadowcrew, Carderplanet, and Darkprofits. Working together, officials from the U.S. Secret Service, local and federal law enforcement and their counterparts in Bulgaria, Belarus, Poland, Sweden, the Netherlands, and Ukraine, arrested twenty-eight suspects in what has been called “Operation Firewall.” The suspects had over 1.7 million stolen credit card numbers, and were responsible for over $4.3 million in losses to financial institutions.

Ralph Basham, director of the Secret Service, said, “Information is the world’s new currency. These suspects targeted the personal and financial information of ordinary citizens as well as the confidential and proprietary information of companies engaged in e-commerce.”

While identity thieves traffic in counterfeit credit cards and counterfeiting tools, even more disturbing is the theft of identification documents—passports and birth certificates—that can be used to gain access to a country under a false identity. Identity thieves have even stolen the credentials of newborns.

Sometimes identity thieves traffic in entire wallets. Wallet is an abstract for information on a specific individual used to impersonate that person. This includes address, phone numbers, mother’s maiden name, financial data, social security numbers, and the like. From a purely financial perspective, the impact of this type of fraud on a consumer may be fairly limited. Some banks will not charge the victim anything, while others may charge a fee as small as fifty dollars. But the additional issues that arise are significant.

The victim must now call all the credit reporting agencies and put fraud alerts on accounts, change credit card account numbers, change bank account numbers, pore over financial statements, make calls, send letters, and endure other similar headaches. This is far more painful than losing fifty dollars.

In some extreme cases, if an individual has exhausted all other resources, they may even opt to change their social security number. This is a difficult and time consuming process, and requires the individual to notify everybody that uses their social security number and explain the situation to them. This can be a huge list when considering areas related to healthcare, employment, finance, education and so forth. Because of the level of hassle involved, only about 1,000 people actually changed their numbers in 2005.

For the financial institution, credit card agency, retailer or whomever the information may have been stolen from, the pressures associated with notifying and placating millions of disgruntled customers can be extremely painful. In addition, the institution must now set up new accounts and reissue new credit cards costing about ten to twenty-five dollars each. Legislation is in place that applies more pressure to organizations that have had their information compromised.

California was the first state to address this issue. California Senate Bill 1386—also known as the California Information Practice Act—states that organizations that have access to the personal information of California residents (even one customer or one employee in California) must notify that person if his or her data has been, or may have been, illegally accessed. This bill specifies that that personal information has to include only the individual’s first name or first initial and last name with a combination of any of the following:

About twenty other states have followed California’s lead. New York has its Information Security Breach and Notification Act, and Washington has SB-6043. The primary objective behind these notifications is to make it embarrassing and costly for the companies that become victims.

An ancillary effect of these laws is that the alerts are sometimes ignored because of false positives. I’ve talked to people who have received multiple notifications from multiple sources, sometimes in the same week. They may get these alerts immediately after verifying and changing their account information. As a result, people become indifferent—especially if they’ve received the notification and nothing malicious has happened. The law demands that an organization report the incident even if the information was only possibly compromised, not just verifiably compromised. This is analogous to false positives on network intrusion detection systems (IDSs) creating data overload. With an IDS, if an organization is getting too many false positives, it can tune out the system. With too many notification letters from a bank, the recipient might just drop the notices in the shredder.

Dropping the notification in the shredder is a bad idea. It is true that an organization may not be able to verify implicitly that sensitive information was stolen (maybe because the organization doesn’t understand what’s happening on its network, or it has poor logging practices with insufficient auditing, or its inadequate monitoring). However, individuals notified should still contact the organization and take action.

Consider a cyber criminal who has stolen ten thousand credit card numbers with corresponding information that can be used to make purchases online. In the past, it was doubtful that they could use more than a couple of hundred accounts before a pattern was discovered through financial fraud investigation or general security auditing. At this point, the criminals might think the remaining accounts too dangerous to use, so they simply discard them or perhaps sell the dead accounts to another criminal. Today, there are automated tools for leveraging a greater number of accounts more quickly. Also, the rest can still be sold off, often in auction form as discussed earlier, or through online or traditional black markets while the accounts are still alive.

There are several heated political debates over the correctness of laws like California Senate Bill 1386. I can understand the reasons for the debate. What if the organization did provide adequate protections and something bad happened anyway? Should they still be required to report the incident? Just because a company hasn’t been hacked into doesn’t mean it’s secure; maybe it’s just lucky—for now. On the other hand, a company may have had very strong security measures in place—perhaps stronger than all others—and still suffer an incident. That’s the thing about security countermeasures and safeguards; to be effective, they must work 100% of the time, while a cyber criminal needs to be successful only once.

But anyone involved in security for more then a week can tell you that there is no such thing as 100% security. Still, my perspective is that we are all consumers with sensitive information sitting on servers that we don’t control. We must hold the organizations housing this information responsible for keeping the data as secure as possible—monitoring access to that data, managing incidents efficiently and effectively, and notifying those effected promptly when something does happen. If they don’t have the means to meet these requirements, then they need to partner with somebody who does.

Regardless of my personal perspective on these state laws, they are gaining momentum with federal lawmakers, and they in turn are considering a national law. Senator Diane Feinstein introduced the Notification of Risk to Personal Data Act, a bill modeled on California’s SB-1386. She’s stated that she strongly believes that an individual has the right to be notified when there is an information compromise of a sensitive nature—because that information belongs to the individual.

There are two other acts that are being discussed. They are the Data Accountability and Trust Act (DATA) and the Financial Data Protection Act, both of which were introduced in the House. With their current language, in terms of protecting the consumer, they are a step backwards from state protections such as 1386. However, they are subject to change—rather frequent change, actually—so only time will tell if these acts will morph into something that has national consumer protection teeth equal to state legislation like California’s SB-1386.

Here is a small cross-section of events over the last few years that have to do with identity theft and the general theft of sensitive, private information about individuals.

Often an organization’s success is in direct proportion to the failures of its competition. Since greed is one of the strongest motivators, it isn’t shocking that competitors may be potential enemies, and thus I include them here. Take for example a cyber attack from a competitor aimed at discovering a software development company’s source code, customer list, employee salaries, engineering drawings, marketing strategy, or details on a new product launch. Compromise of this information can be every bit as devastating as being targeted by identity thieves or organized crime rings.

In 2005, an Israeli couple was fined and sent to jail for selling a Trojan horse program that was used in industrial espionage between competitive organizations. The aim of the malicious software was executed through a web link or an e-mail attachment that would infect the computer once installed. The couple apparently tried to sell it to Israel’s defense agencies before deciding to sell it to private investigators representing corporations. Some of Israel’s leading telecommunications companies and several private investigators have been indicted on related charges.

An example from the somewhat distant past is mentioned in Dan Verton’s book The Insider. He mentions an interesting case with Revlon cosmetics. In the 1940s, the secret name of each item in Revlon’s new product line showed up in an advertisement for Estee Lauder’s Clinique cosmetics line in Women’s Wear Daily. Viewing this as industrial espionage, Revlon’s founder Charles Revson increased security throughout the company and became an intelligence enthusiast, trying to avoid leaks while conducting intelligence gathering—even including wiretaps—in order to battle competitors.

I’ve combined these three groups because threats associated with them are often sensationalized in the media. When compared to general crime for profit, they account for a much smaller percentage of attacks. However, as with organized crime groups, they have greater resources to put behind a cyber threat.

Though this brief section is a primer (the next chapter is dedicated to insiders), I want to mention insiders here for completeness. In short, insider threats have the potential to be the most devastating, the easiest to perpetrate, and the hardest to detect, prevent, and manage of all threats. They are often the most politically and emotionally charged. For these reasons, insiders are the focus for all the case studies I’ll explore in the chapters that follow.

Insiders working alone are a threat for sure, but collaborative threats between an insider and an outsider can be especially difficult to prevent, detect, and manage. Working together, the insider can conceal the outsider’s actions, and the outsider can redirect suspicious attention away from the insider. Often, perpetrators are not successful without cooperation between the insider and outsider. I discuss this type of collaboration in some of the case studies to follow.

Larger organizations agree that insiders are the most critical threat. This is a fundamental shift in perception from just a few years ago. The fact is, insiders can no longer be ignored. Just a few decades back, it was common for a person to work for the same employer his or her entire life. It was equally common for multiple members in a family to work for the same employer. This isn’t the case today for most people in countries with a free market economy. Most individuals in these countries will have had more jobs by thirty years of age than both parents combined had throughout their entire careers. This means that few employees develop a sense of devotion and loyalty to an employer. Long term employee loyalty—once an important safeguard for organizations—has nearly disappeared. While lack of loyalty isn’t the only reason that insiders commit malicious acts, it certainly needs to be considered. This issue has come up a number of times with financial organizations that I’ve worked with in London.

Over the years, I have traveled to London a number of times, and on almost every trip I’ve worked with at least a few financial organizations. An interesting thing about London’s financial organizations is their tight-knit security community. The security professionals who work for them tend to be relatively close. This type of industry-specific community is extremely beneficial in terms of sharing best practices, lessons learned, and general information. Another interesting point about this community is that most of the employees, consultants, and contractors have changed jobs so often that, at one time or another, they have each worked for the other’s organization. This in and of itself is cause for concern, but because of this dynamic, they have a feel for whether their security postures have gotten better or worse over time.

On my last visit, the trends were clear. While security appears to be getting better in regard to external threats, the long-time focus on the perimeter has virtually excluded focus on insider threats, so that internal threats are now the cause of much larger issues that I’ll detail in the coming case studies. Also, most of the financials share a common concern within the community: Individuals work for organizations for a few years and then move on to a competitor within the same business vertical. This move usually comes with a more lucrative employment package—a strong motivator for employees to frequently make the change. The issue is that each time they leave, they walk out with specialized knowledge from their former employer and possibly even with sensitive and confidential information. Multiply this by the number of employees making these migrations and then by the number of former employers they’ve had, and the issue quickly becomes quite large.

These concerns are certainly not limited to financials or the U.K.; they are a global concern. Even Asian countries, which have a tradition of employees having career-long allegiance to a single organization, are experiencing this problem. When I was in Beijing, I heard the same complaints from some of their largest telecommunication organizations who worry about their intellectual property and security safeguards being exposed.

IDC conducted a survey in 2005 in which they asked organizations if they felt the most serious threats were from internal or external sources. The results of the survey showed that as organizations get larger, their concerns about internal threats increase while concerns related to external threats decrease. Roughly 30% of the very large organizations felt that the threat was about equal. This is illustrated in Figure 1.1.

Figure 1.1. 

The number of threats is growing at an increasing rate. Techniques used by criminals are becoming more sophisticated, faster, harder to detect, and can be much more damaging than those of the past. A discussion of all the combinations of exploits, techniques and threats from port scans, Trojans horses, viruses and worms through buffer overflows, packet sniffing, and man-in-the-middle attacks would require volumes and is outside the scope of this book. However, the increased number of threats makes it worthwhile to explore a cross-section of tools, techniques, and concepts, because they help illustrate the multitude of methods that criminals are using. Some examples of how these tools have been used and how the malicious individuals using them have been prosecuted can be found in Appendix A.

Threats today come from a multitude of sources, including:

Motivations for these attacks include:

Attacks have changed: