back to article International effort to disrupt cybercrime moves into operational phase

The Cybercrime Atlas, a massive undertaking that aims to disrupt cybercriminals across the globe, enters its operational phase in 2024, two years after organizers laid the groundwork at the RSA Conference. At the time, the public-private collaboration was still in the proof-of-concept stage with one ambitious goal – to map out …

  1. Mike 137 Silver badge

    "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

    What hasn't joined 'discussion' yet at that 'forefront' is the Board's recognition that, without application of substantial resources most organisations remain wide open to even quite trivial attacks. The myth of the "sophisticated adversary" is for most victims, just that -- a myth.

    Until infosec is properly funded and fully integrated into the corporate risk strategy, there's little point in focusing on the perps. Until then, what's needed is recognition of, and response to, the fact of being still a soft target.

    Interestingly, the new version of the NIST Cybersecurity Framework, released on Feb 26th, is the first version to incorporate a governance function. Since the framework was first released in 2014, it's only taken a decade for this to register as necessary. This does typify the fundamental problem, doesn't it.

    1. Anonymous Coward
      Anonymous Coward

      Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

      "there's little point in focusing on the perps"

      I dunno. A dozen or so renditions by special forces snatch sqads then live video feeds of the perps being flayed, before being burned alive followed by a "You're Next" list of the names of a bunch of active crims would probably have some impact.

      1. Mike 137 Silver badge

        Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

        "probably have some impact"

        Ignoring for now the illegality of that proposal, it probably wouldn't work anyway as a deterrent for a couple of reasons. First, the adversary has for a long time been organised hierarchically, just like any other corporation, and it's in general only the grunts at the bottom (who do the actual cracking) that are exposed to consequences. Plus, even where a 'leader' is arrested, there's always someone else to take their place. Second, draconian and brutal punishments have historically never deterred crime (and there's plenty of precedent to prove that).

        1. Len

          Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

          Agreed, you could halve the severity of the punishment, if simultaneously you double the chances of getting caught you've just created a greater deterrent.

      2. martinusher Silver badge

        Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

        >A dozen or so renditions by special forces snatch sqads

        ..and there lies a big part of the problem. You can't have your government behaving like a bunch of terrorists, especially extra-territorially. Its not only a drag to have yet another annoying teenager killed by a cop because he was "holding a gardening implement" (potentially a weapon.....but, seriously?) -- calling the cops shouldn't be life threatening -- but having the cops dressing up in tactical gear and acting all the time as if they're in a war zone is not the way to public cooperation.

        We've been plagued with real and attempted cybercrime for decades now. Government does little about it because preventing it and tracking down the puerps doesn't involve breaking down doors and bashing in head, it requires a certain amount of finesse and intelligence to combat.

        Incidentally, when you start this whole 'cops as special forces' things you get Mexico, the criminals organize. When they eventually outgun you then you get Haiti. Life is not a videogame -- GTA's fun but not how most people want to live.

        1. Headley_Grange Silver badge

          Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

          "You can't have your government behaving like a bunch of terrorists"

          I agree, in principle, but what do you do when other goverments behave like terrorists? Today Russia, allegedly, jammed GPS on the aircraft the UK Defence Minister was travelling in. Russia, China and the Norks turn a blind eye or maybe even support their cyber crims as long as they don't interfere domestically. They've already hit hospitals and power distribution in the US and Australia and, as far as we know, there's been no serious retaliation*. How far would they have to go before we, say, considered it an act of war?

          *I realize that just cos we haven't heard anything doesn't mean that it's not happened.

          1. ChoHag Silver badge

            Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

            > How far would they have to go before we, say, considered it an act of war?

            Russia's been gambling on "until someone officially calls it war", which has lasted quite long so far.

            (Of course from Russia's point of view nothing Ukraine says is Official otherwise that game would be over, and for some reason we all go along with that)

    2. ChoHag Silver badge

      Re: "brought cybercrime to the forefront of discussion among CEOs and boards of directors"

      Who else hasn't joined the discussion?

      > 20-plus law enforcement agencies, private-sector security companies and incident responders, financial institutions, NGOs, and academics

      Any of the engineers who run this stuff.

      That is to say, any of the engineers who try to run this stuff on the shoe-string budget and general derision that they receive.

  2. Inachu

    I would like to join and or help out and just do this as a hobby.

    Just imagine some nobody taking down some major cyber crime gang lol

  3. Anonymous Coward
    Anonymous Coward

    Stop using certain products then

    Adobe and Microsoft are the Boeing of the computer world, and have been for decades.

    If they lost business because of their lack of proper attention to fundamental security (instead of trying to plaster over it post release with patching ad infinitum and lots of extra crap just to keep the risks almost in check) things would improve dramatically.

    Yes, other platforms are attacked too, but the risk vector in the overwhelming majority of breaches tends to reside in their products.

    Let the downvotes begin..

    1. Headley_Grange Silver badge

      Re: Stop using certain products then

      "the risk vector in the overwhelming majority of breaches tends to reside in their products"

      I'd like to see some data on that. I'm not saying you're wrong, but if we're opening a book my money on the highest risk vector would be people doing stupid things - password123, never changing admin account name and being phished by clicking on an attachment.

      1. Boris the Cockroach Silver badge
        Facepalm

        Re: Stop using certain products then

        When the 'certain products" stops allowing a script inside an e.mail to run in its flagship browser which then leads to the script being able to link to a key system process and execute a malicious payload , then I'll wake up and pay attention.

        But since "certain products" hold a near monolopy on the desktop PC operating system business, it makes it damn good value to target them for the stupid decision not to seperate core system functions and memory from being affected by anything in user space by tying the browser into said operating system..

        1. Anonymous Coward
          Anonymous Coward

          Re: Stop using certain products then

          IMHO there oughtta be a law. Make delivery of this kind of stupidity a punishable offence.

          Time to wind up the EU about that, now it is dawning on the suppliers that those privacy laws have teeth? Who else has the sense to add security laws to the pot? Hey, Ursula, ya listenin'?

          1. Prst. V.Jeltz Silver badge

            Re: Stop using certain products then

            30 years in and Microsoft still hide filename extensions by default .

            This is probly the number one way the criminals get people to click on exes in an email.

            They even do it on server installs , who is running a server and wants the filename extensions hidden?

            1. Anonymous Coward
              Anonymous Coward

              Re: Stop using certain products then

              Hey, I bet you can still find systems that can be breached by sending them a picture.

              Honestly, I wonder how on Earth they can continue selling to governments. Must cost them a serious amount of money, but I guess they get that back many, many times over.

      2. harmjschoonhoven

        Re: Stop using certain products then

        @Headley_Grange, OK old data, but data any way: Inside Cyber Warfare by Jeffrey Carr, page 193.

        Windows: 501515 Backdoors, Hacktools, Exploits & Rootkits; 40188 Viruses and Worms; 1232798 Trojans.

        FreeBSD: 33 Backdoors, Hacktools, Exploits & Rootkits; 10 Viruses and Worms; 0 Trojans.

  4. johnrobyclayton

    Security is not prifitable, until it is.

    Security is never worth the bother,

    Except:

    Predators always exist in the presence of prey.

    Once prey that does not have security is known to exist, predators will form to take advantage of them.

    Computers and the use of them in business is relatively new and their use is constantly changing in lots of ways.

    Every new business opportunity that is developed is going to be less profitable if security needs to be baked in from the start.

    New businesses and business models cannot afford that.

    So they start out with inadequate security. They build up until they are attractive prey. Predators form.

    And Presto:

    Security becomes profitable

    And for some reason people are still surprised that security is only looked at once the screaming starts.

  5. amanfromMars 1 Silver badge

    Tendering for and Tending to the Impossible is a Thankless Task

    "From the World Economic Forum perspective, this is a very unique project," Goldstein said. "It's really going into a very operational level, which is beyond what the Forum is usually doing."

    It also underscored the growing emphasis that the WEF has placed on cybercrime – and cybersecurity – over the past few years.

    According to the WEF's Global Risks Report 2024 [PDF] published in January, "misinformation and disinformation" is the top short-term global risk, with "cyber insecurity" coming in at number four.

    All budding wannabe Lex Luthors thank you for that intel on what renders them unilaterally and universally, a disconcerting leading advantage.

    Does the World Economic Forum imagine themselves and their new best friend partners to be suitably au fait with all that be needed to prevent unauthorised anonymous remote third party exploit of their virtual vulnerabilities and practically non-existent cyber defences?

    The abiding unfortunate difficulty that is surely a cause for constant concern is that if one does not know how to effectively successfully attack and destroy systems with impunity one can never be immune, safe and secure from that and/or those that DO KNOW and would exercise that knowledge to prove the point and present a novel opportunity for another quite different reality ..... which you might to worry about accepting is realised via virtual means and AIMemes.

  6. John H Woods

    Interesting that this is "very unique" rather than ...

    say, moderately unique

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like