Cybercriminals are increasingly embracing a sophisticated business-model approach

Criminal hacking groups can employ HR specialists, marketers, and training gurus, HPE says

Cybercriminals can call on an extensive network of specialists for "business" expertise, including people who train and recruit, launder money, and provide escrow services, according to HPE.

The cybercriminal underground includes people who provide human resources functions, like recruiting and background checks, but also specialists who help market and sell exploit kits and compromised data and others who serve as middlemen in anonymous transactions, says The Business of Hacking white paper from Hewlett Packard Enterprise.

Cybercriminals are increasingly taking a business-based approach toward their activities, with some organizations developing in-house training, disaster recovery, and other business functions, and others contracting for those services in the underground marketplace, said Shogo Cottrell, a security strategist with HPE Security. Cybercrime is maturing as a business model, he added.

"They are following the money, in a sense," Cottrell said. Cybercriminals are embracing the "traditional sound business practices of increasing your revenue, reducing your costs, maximizing your profit."

Some criminal hacking businesses offer 24-by-seven telephone support, others offer money-back guarantees on their products, Cottrell said.

These traditional business models, with marketing teams focused on the reputation of the cybercriminal groups, help build up the groups' reputations in the criminal underground, Cottrell said.

It's hard to maintain trust and a reputation in the cybercriminal community, "given that there's a lot of paranoia and there's a lot of distrust," Cottrell said. With a marketing team, "they can market the things they're doing a put a good face in front of the underground public."

The HPE paper identifies advertising fraud and extortion as types of cybercrime that have high payout potential while requiring relatively little effort and involving low risk to criminals. Hacktivism and credit card fraud are relatively easy and low risk but offer low payout potential.

Organized crime and intellectual property theft, on the other hand, offer large paydays, but can be difficult to pull off and can be risky.

The HPE paper recommends that businesses take several steps to disrupt cybercriminals. Businesses can disrupt hacker profits by using end-to-end encryption on their sensitive data, and by deploying application security tools, the white paper says.

"Attackers prefer easy targets, so deploying any technologies to harden your assets will have dramatic results," the paper says.

Many businesses suffering breaches still fail to deploy basic security measures, such as patching software and two-factor authentication, Cottrell said. Hackers conduct their own risk analysis on potential targets; if a company looks difficult to attack, they will move on, he said.

Honeypots or deception grids -- realistic duplications of a business' network set up to trap attackers -- can also be effective, HPE said. These duplicated networks are "complex but may represent the future of getting ahead of the attackers and disrupting them," the paper says.

Businesses being attacked by cybercriminals shouldn't rely on government action, however, the paper says. While many countries are enacting harsher punishments for cybercrime, there's an enforcement problem in some parts of the world, the paper notes.

Harsh penalties in some countries are "driving attackers to operate in ... more lenient countries to reduce their risk," HPE says.

Join the CSO newsletter!

Error: Please check your email address.

Tags cybercrime

More about Hewlett Packard

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Grant Gross

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place