Schneier on Security

Over the past few years, we have seen hacking transform from a hobbyist activity to a criminal one. Hobbyist threats included defacing web pages, releasing worms that did damage, and running denial-of-service attacks against major networks. The goal was fun, notoriety, or just plain malice.

The new criminal attacks have a more focused goal: profit. This difference makes the new attackers more dangerous and potentially more damaging.

Criminals differ from hobbyists in several respects. One, they care less about finesse. Hobbyist hackers looked for new and clever attacks, while criminals will use whatever works. Hobbyists regularly advertised their presence, while criminals are more likely to be stealthy. Hobbyists generally didn’t care who they attacked, while criminals are more likely to target individual organizations. Criminal attackers are less risk-averse; they’re willing to risk jail, which hobbyists are largely not. As such, criminal attackers will engage in behavior that hobbyists avoid…