E-crime changes tack

Around two years ago, Eugene Kaspersky, boss of antivirus vendor Kaspersky Labs, warned that the Mafia was starting to exploit the Internet. At the time, there wasn’t much hard public evidence, and that remains the case. However, Kaspersky’s senior technical consultant David Emm, says there’s been a qualitative change in the nature of exploits.

“There’s a close link between exploits and money these days,” he says. “In the old days people used to prove they could crack systems by leaving obvious signs of their exploit. Now they try to stay under cover and to go after money, personal data or company secrets. That suggests a more deliberate criminal intent.”

A further pointer, says Emm, comes from an experiment the lab set up last year. It set up several fake websites with apparently genuine personal information. The sites were hacked, and Kaspersky was later able to trace the stolen information to a different group to the one that hacked the site.
“This suggests there is an active trade in information,” says Emm. There is also competition in providing such information, he adds.

Some of these activities could lead to blackmail and extortion, or to illegal gathering of competitive intelligence on commercial firms. “We’ve already seen gambling sites hit with denial of service attacks unless they’ve paid up,” says Emm.

However, Italy is “not a particular hotbed” of cybercrime, he notes. “It’s a small world; an attack can originate anywhere. Just recently we’ve seen a lot of activity in South America, Russia and Eastern Europe, as well as cooperation between virus-writing gangs like 29A, which has members in Russia, Spain and other places.”

Italian sources interviewed for this article were quick to separate infosecurity from cybercrime issues. “There’s little evidence that organised crime gangs in Italy are into cybercrime,” said one.

Calls to the Italian state police were not returned, and Interpol declined to comment, saying this is up to each jurisdiction.

Spread the word

Luisa Franchina is director general of the Institute of Communications, the Italian government’s sword and shield against infosecurity threats. Everyone should join in, she says.

Infosecurity: What are the main challenges you face as director general? What changes are you happy with, and what are your priorities for the next two years?

Luisa Franchina: In the fields you are interested in, the main challenge I face is to build up government-driven information sharing initiatives. The following list is not exhaustive.

Firstly we aim to transfer information security knowledge and best practices from highly qualified Italian actors (namely, former monopolists in telecommunications network operators, energy suppliers, historical critical information infrastructures, civil protection departments, public centres of excellence, etc) to the private sector, small and medium enterprises, other public administration sectors, and even to home users.

These activities aim to build up a common minimum infosecurity defence, widespread in the country, with special focus on the role of the network operator in providing adequate network and information security.

To do this I set up round table meetings, grouping more than 100 public and private entities that together are developing guidelines on specific issues. Three such guidelines are already published and five are in an advanced state of elaboration. The three out now cover

• Quality of Service in telecommunication networks (gives parameters, values and measurements methods also for security)
• Risk analysis and management
• CIIP (Critical Information Infrastructure Protection) and their dependency on telecommunications networks.

They are available at www.iscom.gov.it and will be published in English by November.

Next, we want to spread throughout the country (in both the public and the private sectors) the culture and the practice of information security “third party” certifications, and, in particular, those systems and products that are based on the Common Criteria (ISO 15408) security certification.

In my capacity as director of OCSI, the Italian Common Criteria certification body, we set up a special strategy to deal with system security certification. We are sharing this strategy through various initiatives with international partners such as EU countries, NATO, the G8, etc.

We do this by organising international workshops and conferences. The next one will be held in Rome from 2 to 4 November. It is co-hosted by ISCOM (Institute for Communications, the body for which I am Director General), FUB (Fondazione Ugo Bordoni, an Italian high level research institute on telecommunications), and ENISA (the EU Agency on network security). The aim is to promote and coordinate Italian initiatives in the international ring, with special regards of EU initiatives.

I’m also the ENISA management board representative for Italy, where I actively support ENISA’s work in Italy. Finally, my job is to push for better regulations on information security at government and Italian Parliament levels.

Infosecurity awareness among businesses and consumers in Europe varies considerably. Where would you rate Italy in terms of awareness and practice? What more should the government do now?

Our infosecurity awareness initiatives are in an advanced state of completion, especially if compared with similar initiatives taken in other EU countries. Of course, a lot of work should be done more, especially in translating information sharing and awareness initiatives into practical realizations of best practices. In this regard, one of the main issues we have to address is to spread best practices to private companies, and, in particular, to CIIPs.

E-commerce and e-banking transactions are rising in most countries, as are problems such as spam, hacking and identity theft. What are the trends in Italy, and is the government happy to see this? What measures should government take to ensure that e-transactions are fair, legal, judicially actionable and transparent to, for example, the tax authorities? Do you believe that e-commerce will accelerate moves towards a truly level economic playing field in Europe, and would this be a desirable outcome?

The security of e-commerce, e-banking, etc, can be reached if and only if a large variety of actors (ISPs, telecommunications companies, government, private and public actors, etc) set up a common strategy against spam, hacking and identity theft.

Our main work in this field is to build up a common understanding of the above problems and a common strategy. The main route we are following is the international cooperation with EU countries, and we participate actively in all major EU initiatives in these fields. We believe that regional or local solutions to the above problems are inadequate, especially if they are not properly part of a wider context.

Given the growing importance of electronically-mediated transactions, what is the government doing to increase the number of uitably qualified infosecurity professionals?

As a major consequence of the activities of OCSI cited before, we are producing highly qualified professionals in the field of Common Criteria security certification. We are also promoting national synergies between Common Criteria and BS7799 certification bodies.

In addition, ISCOM is the leading body in a security awareness program that will involve all public sector staff (more than 60,000 people) from the chief executive of the various directorates to the “simple” public sector end user.