Hacking SMEs

mi2g writes that hacking is a growing threat, especially to medium and small companies that don’t have the resources to defend themselves, and that governments are going to have to step in:

As the damage done by radical, criminal and intellectually motivated hackers continues to rise, about six Billions Dollars of economic value was destroyed worldwide by overt and covert digital attacks including viruses and worms in October alone. As a result, the mi2g Intelligence Unit predicts there will be a growing requirement for Governments to intervene and to mobilise counter-attack-forces that protect economic targets and critical national infrastructure constituents on a 24/7 basis.

In a study to be released later this month, mi2g will reveal a new trend developing with far more damaging economic consequences. The near doubling of hacking incidents every two months in late 2002 will be shown to have shifted away from targeting government departments and agencies towards focusing principally on Small to Medium size Enterprises (SMEs) and large corporations where opportunity allows.

The SMEs are incapable of sheltering themselves or having the budget and expertise to be able to ward off sustained digital mass attacks, which have now become a daily occurrence with widely available, automated and easy-to-use sophisticated digital attack tools. The mounting collective losses to businesses might impact on governments’ revenue streams through reduced tax collection, so in the future, it will be prudent to look after the SME growth engines and not just large businesses, who on the whole have the budgets and manpower resources to look after themselves.

National Interest

In the not too distant future, there is a likelihood that command and control attacks, which blend cyber terrorism with physical terrorism, simultaneously seek to disrupt transport or telecommunication hubs; financial services or commerce; water or energy distribution; could also be manifest as hackers organise themselves more rigorously along the lines of criminally financed terrorist syndicates with specific ideological agendas and become more adept at social engineering to procure insider help locally.

Historically, politicians in civilised Western democracies have challenged their defence forces to provide adequate defence capability within limited resources. The focus has been on the four physical dimensions – land, sea, air and outer space – and not on the new 5th Dimension, which is cyberspace. There is no real digital defence capability deployed so far – other than occasional simulations and exercises which are to uncover gaps in the national critical infrastructure’s digital defences. The redressal lies primarily in developing counter-attack-forces, which would begin to arrest the imbalance of power between ill-motivated hackers on the one hand and little-prepared businesses on the other.

It is unrealistic to expect that any defence department can provide ‘counter-attack-forces’ against digital attacks for an entire nation’s economic targets immediately and, in any case, the expertise needed is relatively fast moving and cannot be ‘trained’ into would be combatants in a short period of time.

….”After four successive record breaking months in the number of overt digital attacks this year, mi2g believes that we have entered an era of sustained attacks from radicals, criminals and intellectual power zealots, who will be difficult to contain and to deal with at the consumer and small to medium size corporate level in the 21st Century. The roll out of ‘always on’ full broadband and wireless connectivity tilts the balance against the innocent citizens and corporations. In the years to come, government intervention to deal with 5th dimension warfare could become imperative. It is no longer a question of if but when,” said DK Matai, Chairman and CEO, mi2g.

“It is unlikely that governments will choose to remain oblivious to the challenge of daily digital attacks on their citizens and their livelihoods given the Billions of Dollars of damage being caused to digital commerce, productivity, intellectual property and employed capital. Organized crime syndicates embarking on identity theft, elaborate scams and financial fraud have now become rampant. As knowledge management based authentication systems proliferate both at airports and digital commerce sites, digital identity theft levers are going to be exercised by future criminals.”

….Over the last six years, the worldwide economic damage estimate for all forms of digital attack has been estimated via EVEDA at between: $35 and $43 Billion (2002 so far); $35 and $43 Billion (2001); $22 and $27 Billion (2000); $18 and $22 Billion (1999); $3.6 and $4.4 Billion (1998); $2.9 and $3.7 Billion (1997); $800 and $970 Million (1996).

This follows from a corollary of Murphy’s Law: if it can be messed with, it will be messed with.