Winter 2011: Password security standards and trendsThis article originally appeared in the autumn 2011 issue of IT in Europe Information Security magazine. See the complete issue for more articles about compliance.
On the opening day of Infosecurity Europe 2011, when Eugene Kaspersky, founder of Kaspersky Labs, took the podium to deliver a wide-ranging and humorous speech about cybercriminals, he could hardly have imagined the news that would reach him shortly afterwards.
As we now know, his 20-year-old son Ivan had been kidnapped in Moscow and was being held for a ransom of 3 million euro. Kaspersky flew to Russia, and, with the help of security forces, managed to get his son freed without harm, and without paying any ransom.
Ironically, the theme of Kaspersky’s talk had been “How to make the criminals unhappy,” although he was obviously referring to cybercriminals, not kidnappers.
He said the last few years had been a golden age for cybercriminals; they have been able to make huge sums of money with little risk of ever being caught. But, he argued, the balance of power is now changing. Cloud-based
Requires Free Membership to View
SearchSecurity.co.UK members gain immediate and unlimited access to breaking UK industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.co.UK today!
Michael S. Mimoso, Editorial Director
reputation services, he said, enable antimalware companies to respond much faster to new threats, and thus limit the amount of damage hackers can cause. That will, therefore, reduce the return on their investment, and make their activities less profitable. “I know from their comments that I see on underground forums that they are becoming very unhappy,” he announced, grinning broadly.
Some types of malware, such as targeted attacks or server-side polymorphic malware, will still be able to bypass traditional defences and pose significant digital risk. But, as he said, that kind of code is much harder to write, and is beyond the skills of the majority of hackers.
He proposed a couple long-term solutions. The first was an Internet Interpol – a force capable of working internationally to catch criminals quickly that isn’t subject to strong national boundaries that hamper current police investigations. The other is an Internet passport, a digital identifier that any individual would need to have before they could contribute information to the Internet.
Those measures, he predicted, might take 20 or even 30 years to achieve, but will be absolutely essential for generations of people who will expect to conduct most of their daily transactions online, whether it is voting in an election or arranging a social gathering. Such complete dependence, he said, will require the kinds of controls he proposed.
Meanwhile, the gang of unhappy criminals in Moscow who carried out the botched kidnapping is a reminder of the global cyberthreat that some of our best-known security researchers face in Russia and its neighbouring countries.
Mikko Hypponen, head of research at Finnish security company F-Secure Corp., admits that sometimes he has to moderate his public pronouncements because, as he says, when he drives to work in the morning he sees a sign reminding him that St. Petersburg is just a short drive across the border. The mafia there have a hand in all kinds of crime, including cybercrime, and so it would be unwise to antagonise them openly.
It’s a sobering reminder that, while the worst that most of us can expect is to lose our credit card account details, some of those who play a critical role in defending cyberspace face much greater dangers.