SECURITY experts like to say that there are now two types of company: those which know they have been hacked and those which have been hacked without realising it. An annual study of 56 large American firms found that they suffered 102 successful cyber-attacks a week between them in 2012, a 42% rise on the year before. Rising numbers of online attacks are stoking a debate about how best to combat cyber-crooks. One emerging school of thought holds that companies should be allowed to defend themselves more aggressively by “hacking back”—using hacker-like techniques to recover stolen intellectual property and frustrate their assailants.
The discussion has been sparked by the rise of a new generation of hacker, either working for criminal groups or with close links to the state in places such as China. Advocates of hacking back argue that the usual digital defences are no match for these attackers. Instead, firms need to go on the offensive, using everything from spyware that monitors suspected hackers’ activities to software that retrieves or deletes pilfered property (see article). If an aerospace firm spots the blueprints for its next plane flying off its database and into the computers of a foreign rival, it should be able to give chase.
How is it really doing?
- Can China clean up fast enough?
- A byte for a byte
- Addio, Silvio
- A new prescription
The concept of hacking back has some prominent supporters, notably in America. In May a private commission on intellectual-property theft, whose members include Jon Huntsman, a former ambassador to China, and Dennis Blair, a former director of national intelligence, gave its support to technology that helps firms track stolen files and then reclaim them or prevent their use without damaging other networks. Another idea, floated more recently, is for governments to license private firms to hunt down and deal with hackers on businesses’ behalf. But encouraging digital vigilantes will only make the mayhem worse.
Hackers like to cover their tracks by routing attacks through other people’s computers, without the owners’ knowledge. That raises the alarming prospect of collateral damage to an innocent bystander’s systems: imagine the possible consequences if the unwitting host of a battle between hackers and counter-hackers were a hospital’s computer.
Endorsing the idea of hacking back would also undermine current diplomatic efforts to get China and Russia to rein in their hordes of unofficial hackers. America has been a cheerleader for an international convention on cyber-crime that prohibits private actors from striking out online. Letting American companies, or their hired guns, retaliate against hackers would undermine that effort.
Governments can still help firms battle cyber-criminals. They can spend more investigating online attacks on firms. Many are already on recruiting drives for digital sleuths. They should also share more intelligence on cyber-threats. Companies say the advice they receive is often too vague, perhaps because spooks do not want to reveal their sources. And greater clarity is needed about exactly what digital tools can be used to combat hackers. The American Bar Association says it plans to release a report on this issue in the autumn.
More intel inside
Companies should also take a long, hard look at themselves. The hackers may be getting more sophisticated, but the methods they use to get their hands on corporate secrets are often absurdly simple. A report released this year by Verizon, a telecoms firm, found that over three-quarters of network intrusions at companies were the result of weak or stolen user names and passwords. Instead of tooling up to fight the hackers, firms should focus on plugging the holes that let them in.
Powered by Facebook Comments