Schneier on Security

vas pup • March 10, 2017 9:40 AM

Technology is now at the “root” of all serious criminality, says Europe’s police agency.
The returns generated by document fraud, money laundering and online trade in illegal goods helps to pay for other damaging crimes, said Europol.
The wider use of technology by criminal gangs poses the “greatest challenge” to police forces, it said in a study.
It revealed that Europol is currently tracking 5,000 separate international organized crime groups.
http://www.bbc.com/news/technology-39231676
Many gangs were turning to technology to help make well-established crimes more lucrative.
For instance, said the report, drones were now being used to transport drugs and many burglars now track social media posts to work out when people are away from their home .
The steady increase in the number of reported burglaries across Europe was a “particular concern” for many nations, it said.
Smart machines v hackers: How cyber warfare is escalating.
http://www.bbc.com/news/business-38403426
There is a gaping hole in the digital defences that companies use to keep out cyber thieves.
The hole is the global shortage of skilled staff that keeps security hardware running, analyses threats and kicks out intruders.
Currently, the global security industry is lacking about one million trained workers, suggests research by ISC2 – the industry body for security professionals. The deficit looks set to grow to 1.8 million within five years, it believes.
The shortfall is widely recognized and gives rise to other problems, says Ian Glover, head of Crest – the UK body that certifies the skills of ethical hackers.
Help has to come from another source: machines.
“If you look at the increase in automation of attack tools then you need to have an increase in automation in the tools we use to defend ourselves,” he says.
‘Drowning’ in data
That move towards more automation is already under way, says Peter Woollacott, founder and chief executive of Sydney-based Huntsman Security, adding that the change was long overdue.
For too long, security has been a “hand-rolled” exercise, he says.
That is a problem when the analysts expected to defend companies are “drowning” in data generated by firewalls, PCs, intrusion detection systems and all the other appliances they have bought and installed, he says.
Automation is nothing new, says Oliver Tavakoli, chief technology officer at security firm Vectra Networks – early uses helped antivirus software spot novel malicious programmes.
“Machine learning is more understandable and more simplistic than AI [artificial intelligence],” says Mr Tavakoli, but that doesn’t mean it can only handle simple problems.
The analytical power of machine learning derives from the development of algorithms that can take in huge amounts of data and pick out anomalies or significant trends. Increased computing power has also made this possible.
These “deep learning” algorithms come in many different flavours.
Some, such as OpenAI, are available to anyone, but most are owned by the companies that developed them. So larger security firms have been snapping up smaller, smarter start-ups in an effort to bolster their defences quickly.
At the Def Con hacker gathering last year, Darpa, the US military research agency, ran a competition that let seven smart computer programs attack each other to see which was the best at defending itself.
The winner, called Mayhem, is now being adapted so that it can spot and fix flaws in code that could be exploited by malicious hackers
So now cybersecurity analysts can sit back and let the machine-learning systems crunch all the data and pick out evidence of serious attacks that really deserve human attention.
“It’s like the surgeons who just do the cutting,” says Mr Tavakoli. “They do not prep the patient, they are just there to operate and they do it very well.”