eCrime Symposium wrap: Satisfaction tinged with frustration

Two moods permeated the third annual eCrime Symposium in Canberra this week: quiet satisfaction and a subtle disgruntlement.

The satisfaction was fuelled by the steady progress being made by policymakers and law enforcement. The success of the Australian Crime Commission (ACC) and the Criminal Intelligence Fusion Centre reported yesterday. The development of Australia's Cyber White Paper.

Globally, there's more widespread adoption of the Council of Europe Convention on Cybercrime, and the successful takedowns of botnets led by Microsoft.

The disgruntlement seemed to have several threads.

One was the frustration that businesses still don't get it, despite years of repeated security messages. We reported ACC chief John Lawler's call for businesses to harden up, but others expressed that frustration too.

Andrew Bycroft, lead security architect at Earthwave, said that discussing his company's services with CEOs, CFOs and CIOs was "a very painful process because they simply don't understand security." Even prevent-detect-respond has to be explained with simple metaphors.

Of the 50 or 60 data breach investigations conducted by Klein & Co over the pass two years, almost all of them small and medium businesses, only 7 percent had managed to detect the breach themselves. The other 93 percent found out the embarrassing way — by being told they'd been hacked, probably weeks or months earlier.

According to principal Nick Klein, most of the targets were low-hanging fruit and the attacks were brazen.

"It's the electronic equivalent of a ram raid," he said. "You can see exactly where they've got in. They've got their old-style SQL injection tool. The logs are lit up like a Christmas tree and they've stolen the data and they've got out of there without even bothering to cover their tracks."

Another thread was that the public focus seems to be wrong.

Yes, nation states are conducting espionage online. Yes, major corporations are targets. Yes, big corporations lose credit card numbers and personal data by the shipload. And yes, LulzSec and Anonymous took down some high-profile websites.

But in the full spectrum of infosec concerns LulzSec and Anonymous are little more than amusing nuisances. And the rest of it adds up to saying, "Well, if I'm not Lockheed Martin or News of the World then I'll be right." Which of course isn't true.

Then there was disgruntlement edged with despair.

"The bad guys are better at capitalism than what we are," said former Internet Industry Association chief Peter Coroneos. "They've actually created a commercial model out of this cybercrime, and they have none of the strictures that govern our response."

"Our citizens are becoming increasingly desensitised," said David Sykes, head of government relations for McAfee Australia.

"In the old days, when I started in this business, our consumer sales used to spike every time we had a Nimda and a Code Red. That impact has completely died out now. You have a major breach and it hits the news for a little while, and then it fades away like a digital fart within a few days."

Personally, I felt that the steady progress was real, and there's plenty of goodwill to support better cooperation in the right against cybercrime. But I still reckon things will get a lot worse before they get better.

Contact Stilgherrian at Stil@stilgherrian.com or follow him on Twitter at @stilgherrian

• Tweet