CH. 6 - UNDERSTANDING CYBER CRIME
Chapter Description
Understanding Cyber Crime provides the reader with an overview of the marketplace for criminal activity and the security behavior of defenders, this chapter paints a broad picture of the cyber crime ecosystem. It describes malicious software, the roles of criminal groups, and opportunities for law enforcement intervention. It also discusses tools to incentivize good security behavior such as data breach notification laws and cyber insurance.
Sample Chapter Graphic
Chapter Highlights
-
Defining Cyber Crime. Cyber crime covers a wide range of activities that include theft, fraud and harassment; stealing valuable intellectual property as part of industrial espionage; committing financial fraud and credit card theft; and disrupting internet services for ideological goals (“hacktivism”). The crimes target both firms and consumers, and while they rarely result in physical harm or property damage, there can still be severe consequences.
-
Smart Investments. Both the cost of acquiring and implementing malware and the security posture of potential firms can influence target selection by criminal groups. Successful cyber-attacks can therefore be considered a result of mismatched investment in security.
-
Disrupting Criminal Markets. To combat cyber crime, one approach may be to attack the reputation mechanisms, disrupting the tenuous chains of trust that link buyers and sellers for malicious software and stolen information.
-
Leveraging Insurers. The data collected by insurance carriers affords them a unique advantage over any other entity--even government agencies--when it comes to assessing the benefits of different information assurance controls and practices.
-
Shared Responsibility. Discussions regarding policies or regulations to force firms to increase cybersecurity should also be balanced with discussions of inducing consumers to take appropriate security and privacy precautions.
-
Optimizing Government Intervention. Framing security as an investment, proposes that the purpose of government intervention is to support a market that encourages companies to find the optimal point between the cost of attacks and benefit of defensive information assurance measures.
***The information above is an excerpt from the Understanding Cyber Crime Chapter.***
CHAPTER 6 - AUTHORS
Sasha Romanosky, Ph.D.
Author
Dr. Sasha Romanosky researches topics concerning the economics of security and privacy, national security, applied microeconomics, and law & economics. He is a Policy Researcher at the RAND Corporation. Sasha holds a Ph.D. in Public Policy and Management from Carnegie Mellon University and a B.S. in Electrical Engineering from the University of Calgary, Canada. He was a Microsoft research fellow in the Information Law Institute at New York University and was a security professional for over 10 years within the financial and e-commerce industries at companies such as Morgan Stanley and eBay. Sasha is also co-author of the Common Vulnerability Scoring System (CVSS), an international standard for scoring computer vulnerabilities.
Trey Herr, Ph.D.
Co-Editor, Author
Dr. Trey Herr is a Fellow with the Belfer Center's Cyber Security Project at the Harvard Kennedy School. His work focuses on trends in state developed malicious software, information security risk, and the structure of criminal markets for malware. Trey is also a non-resident fellow with New America’s Cybersecurity Initiative and an adjunct researcher with the Institute for Defense Analyses. He holds a PhD and MA in Political Science from George Washington University and a BS in Theatre and Political Science from Northwestern University.