banner ad

Experts.com-No broker Movie Ad
 
Create a free acount with PRWeb!
 
Deposition Designation Station
 

Share |

DataChasers Inc. - Computer Forensics Experts

The Internet is a vast universe of discovery, with items of interest for everyone--regardless of your particular curiosity. Unfortunately, this availability often leads to abuse, and sometimes to crime. But, not unlike adolescent discovery, the steps to cybercrime are achieved in stages.

The first stage is availability

Without access to the Internet the potential for abuse becomes a moot point. It was common, several years ago, to simply advise employers against allowing employees access to the Internet; this is no longer practical. Internet access is an integral part of many businesses, and certainly a part of everyday life.

The second stage is abuse, on a variety of different levels



Consider these facts:

  • Twenty-five percent (25%) of an employee's workday is dedicated to web surfing, e-mail, shopping, and other Internet activities not related to the person's job.
  • Pornography is a $20-billion+ industry (PBS.org: Frontline).
  • Surfing for pornography is 60-85% of all Internet activity, and there are 300,000+ porn sites on the world-wide-web.
  • Litigation for a simple wrongful termination defense averages $130-150,000.00.

The third stage is actual cybercrime

  • It is easier, safer, and more profitable to steal in the cyber realm than in the physical world.
  • That 25% of an employee's workday, which is not spent on work related activities, is theft--costing employers millions of dollars in lost work product each year.
  • Several years ago the awareness level was substantially lower than it is today; abuse was primarily limited to pornography, but not so today. It is now common to find a plethora of non-work related material on a computer.
  • "...the tremendous power of today's computers makes it possible for a single cybercriminal to do a staggering amount of damage -- damage far beyond what a single person could typically do in the traditional criminal world...,1"

A recent joint effort by the Computer Security Institute (CSI) and the FBI's Computer Intrusion Squad resulted in the seventh annual 2002 Computer Crime and Security Survey2. More than 500 respondents from U.S. corporations, the U.S. government, medical, financial, and educational institutions revealed that:

  • More than 90% experienced computer security breaches (mostly government agencies and large corporations).
  • 78% of respondents reported employee abuse of Internet privileges, including downloading pornography, pirating software, and unauthorized e-mail intrusion.
  • Financial loss was reported by 80% of the participants; and the 44% who were willing to disclose the amount of their loss brought their total to nearly half-a-billion dollars in loss, mostly via proprietary information and fraud2.

What you should do about it

  1. Be proactive, not reactive. This year DataChasers´┐Ż investigated or participated in about sixty forensic computer investigations. A quick review of the cases indicates that more than half of all abuse could have been averted if proactive measures had been taken.
  2. Involve your attorney at the onset of suspicion.
  3. You should not expect your IT personnel to be solely responsible for your intellectual/electronic property security (see next issue's article: Network Security); neither should you expect them to be a forensic computer examiner, or for your accountant to be a forensic accountant. When you need a specialist, get a specialist3.
  4. Develop, immediately, a computer use policy. Include it in the employees' handbook or policy manual. Have each employee sign for the receipt and understanding of the policy. Enforce the policy throughout the company--bottom to top, always and without exception.

Get additional information at: http://www.cybercrime.gov/industryrespond.htm

Cybercrime Reporting

Cybercrime must be reported, as the Attorney General said: "No matter how hard we work in the Department of Justice, we cannot solve this problem alone. For all our success in prosecuting the cybercrime we know about, we know that much more goes totally unreported. And this is where we need your help.

"Our experience tells us that when a bank is robbed, bank officials call the police. But when valuable commercial information is stolen from computers, only rarely do the victims report this to law enforcement. Why? It could be for a number of reasons. We know from speaking with business managers that they are often embarrassed. Their computers -- which they thought were secure -- were not so secure after all. They fear customer mistrust and competitive disadvantage. And they are afraid that an investigation will disrupt their business.

"We know that a company that does not report cybercrime to law enforcement may find itself in a far worse position than it ever imagined. A company that does not report crime leaves the criminal free to strike again. If a computer hacker has broken into your network and has stolen credit card numbers from your databases or has stolen valuable intellectual property, he may also have created a new backdoor to your network to use if you bar his original path.

"Not reporting the cyber crime also creates incentives for repeat attacks against you. Cybercriminals talk to each other and when you don't report, you are viewed by this community as an easy victim. I would urge you to recognize that when you report incidents of cybercrime, you are not just doing the right thing for the community -- you are also doing something clearly in your own interest.1"

Get additional information at: http://www.cybercrime.gov/reporting.htm

References

  1. Remarks of Attorney General John Ashcroft, First Annual Computer Privacy, Policy & Security Institute, May 22, 2001 (www.cybercrime.gov/AGCPPSI.htm).
  2. As cited in: http://www.gocsi.com/; http://www.cybercrime.gov/industryrespond.htm; http://www.cybercrime.gov/reporting.htm; http://www.silentrunner.com/; and by Margaret T. Simpson, Cybercrime An Unwelcome Wave of the Future, PIHRAScope, December 2002, p.10.

Share |


DataChasers, Inc., is a select, exclusive computer forensics and e-discovery company. Our examiners find the evidence, interpret it, evaluate its importance, and articulate those facts to a jury. Computer forensics and e-discovery is our only business, and we welcome your inquiries about the process, or our procedures.

See DataCahsers' Listing on Experts.com.

©Copyright - All Rights Reserved

DO NOT REPRODUCE WITHOUT WRITTEN PERMISSION BY AUTHOR.