THE CHANCELLOR, PHILLIP HAMMOND, has announced a £1.9bn investment in Britain’s cybersecurity strategy. The money is to be used to protect the country from hacking attacks on all fronts, from opportunistic raids on individuals and businesses to focused cyberwar led by state-run teams.
THE CHANCELLOR, PHILLIP HAMMOND, Hammond has promised a big sum, but the world of hacking is easily large enough to occupy all that money and more. It’s double the amount set out for a similar strategy in 2011, but has to deal with a world where cybercrime has moved from science-fiction novels and Hollywood movies to our banks, phones and even fridges.
What are cyber-attacks?
The range of misdeeds which can be described as a cyber-attack is vast, and demands a similarly large range of responses.
At the most technically complex end, cyber-attacks can entail a close-knit team of hackers working under the remit of a nation state to create programs which take advantage of previously unknown flaws in software – called 0days, or zero-days, for the amount of time the manufacturer has had to fix them – in order to exfiltrate confidential data, damage key infrastructure, or develop a beachhead for further attacks.
Examples of that sort of cyberwarfare include the Stuxnet worm, a specially made computer virus attributed to the US and Israel, which was deliberately designed to infect and damage centrifuges used in the Iranian nuclear program, and the 2015 hack of the Office of Personnel Management, attributed to China, which led to the personal information of millions of US government workers being stolen.
The most dangerous hacking groups are known as “advanced persistent threats” (APTs): not only nation-states, but highly competent criminal organisations that carry out technically difficult targeted hacks.
But not all cyber-attacks involve high-end technical skills or state-sponsored actors. At the opposite end of the scale are hacks that take advantage of long-fixed security mistakes, ambiguities in user interfaces, and even good old-fashioned human oversight.
Many hackers are opportunistic, picking not the most valuable targets but the most lightly defended ones, such as computers that haven’t had security updates installed, or users who will happily click on malicious links if they are told that their bank sent them.
If APTs are like the Hatton Garden Heist, these hackers are the sort of people who will grab an unattended handbag and run. It may be less impressive, but for the vast majority of computer users, that’s the sort of cybercrime they should spend more of their time defending against.
Source: Guardian