Social networks: Criminal enterprise, Part 1

The buck stops here – since a loss from a competitor still means risk for my company and the entire business sector we compete within, we're now in this cybersecurity struggle together, sink or swim.

November's SC Magazine has published several key articles discussing the threat of cyberespionage. My November Cybercrime Corner blog articles look deeply into intelligence-gathering methods, known as competitive intelligence and industrial espionage and, most importantly, corporate policies which effectively and cheaply counter these persistent and advanced threats.

We're in this together: Counter intelligence

In understanding the value of cyber threat intelligence and the value of deploying counter intelligence tactics, techniques and procedures, one must first understand that the opposing force (OPFOR) is global, organized and not afraid to go kinetic.

Criminal social networks: Connected, dangerous

As the movie quote from Heat made famous by Al Pacino:

Simply put, expecting cybercriminals to stay digital and not hire out for witness tampering or other data-related disruptive events is not realistic.

Harden the target. Ensuring your staff's awareness of physical security concerns means providing adequate training for receptionists on up through executives. This training is often dual purpose and will also cover the prevention of social engineering attempts.

The resulting strong physical security layer is the most effective policy against cybercriminals with the option to go kinetic, often with just an email to an affiliate bartering service for service within the gray market. Do this right and everyone will sleep well at night if one of your cybercrime first-responder-trained IT staff ever gets called to become a witness.

Criminal social networks: Not Facebook

In the draft of Douglas Farah's working paper intended for the World Bank, a diagram of criminal social networks is drawn. This overlaps partially into the cybercrime ecosystem because many cybercrime crews are partially or fully supported by organized crime and the networks are often multigenerational.

Additionally, protection through sovereignty should be considered. The cash cow analogy for any regime is simple – if revenue attributable to cybercrime is the cash cow feeding the growth of coffeeshops, restaurants, and construction, what incentivizes a regime to outlaw it?

These criminal organizations are modular and cell-oriented. Cybercrime can be seen as just one more aspect of criminal enterprise, plus the technical challenges for prosecution are larger for law enforcement.

An entire operation is swiftly financed, supervised by a trusted member, and in the face of impending threat, it can easily be dismantled overnight – often with a bullet. The World Bank paper states:

The internet offers larger global communication potential which means that cybercrime is quicker to start up. Cybercrime is believed to be much larger than the $300 million voluntarily reported through IC3.gov and preliminary bank reporting research indicates that when business banking is included the real amount may exceed $50 billion in annual losses for the U.S. alone.

Consider the potential influence that billions of dollars flowing into five to 10 host countries whose regimes are now fully dependent on the foreign cybercrime money. One source from Russia reflected recently that physical violence was down because of the ability to simply pay off the judicial system and attributed this to the high volume of money from cybercrime.

Examine the influence criminal enterprises may provide to governments who shelter them. Described within Douglas Farah's paper:

There is a weakness – apparently power corrupts, and absolute power corrupts absolutely. The question remains – should business help against criminal social networks? Is countering cybercrime a critical element which should be considered to be a goal of corporate business or is it merely a job for law enforcement?

Countering criminal social networks

For international business to remain competitive in the face of an organized global threat, such as cyberespionage, law enforcement must have the highest level of information provided to the right branch in a timely fashion.

Businesses and CIOs can help in one simple way: Mandating the use of ic3.gov for reporting all detected cyber threats whether monetary, denial of service, strange employee-related laptop thefts, etc. The threads knit together when the pieces are all laid out over time and this centralized reporting helps build the big picture for LEOs across multiple jurisdictions.

Fighting fire with fire: Public-private partnerships

The long-term key to the success of law enforcement and policymakers is through partnerships. The information exchange from the public-private partnerships which share cyber threat intelligence provides another method of threads knitting together.

Human nature dictates that people do not intrinsically trust one another without physical presence, therefore these partnerships must be cohesive, transparent and regional. The human nature aspect of building these relationships is, in my opinion, one reason most DHS cybersecurity workshops are free – not only to educate but also to affiliate.

Regional efforts, such as Securing Our eCity, do well to provide the hosted locations and events which allow the meeting of old friends, as former SDPD Chief Bill Maheu says in this event video:

Four action items for CIOs

One high-level overview of countering the criminal social network is the disruption of operations – targeted efforts on the key members. Not unlike the counter insurgency operations (COIN) doctrine for effective military operations for the past decade, the ability to detect, identify, track, localize and neutralize key social network members is the metric with which law enforcement and national security success is measured. These metrics are often classified and we may see only glimpses of the struggle through periodic news stories of FBI and Secret Service victories or through committee testimony on Capitol Hill.