CFC Week 4: Cybercrime mitigations
Learning outcomes
- List and describe the various mitigation strategies.
- Understand that there is a constant arms race between criminals and investigators.
List four mitigation strategies
- Engineering
- Securing computers and networks crippling botnet operations.
- Law
- Effectively prosecuting malware authors and their associates.
- Economics
- Making sure that cybercriminals don’t make money.
- Education
- Increasing user awareness of cybercrime threats.
Two types of Intrusion detection system (IDS)
- Misuse-based IDS
- rely on models of malicious behaviour to identify matching entries in the event stream
- Anomaly-based IDS
- rely on models of normal behaviour to identify anomalous entries in the event stream
List engineering mitigations techniques
- antivirus software
- intrusion detection
- patch vulnerabilities
- Blacklist
- mitigate blackhat search engine optimisation
- DNS sinkholing (ISPs can avoid directing their clients to domains that are known to be malicious)
- Dynamically allocating the resources (against DDoS)
How to take down a botnet?
- seize active C&C servers (law enforcement/ ISPs)
- mitigate existing infections (DNS sinkholing)
- clean up infected computers (redirect the user and teach them how to)
How to improve user awareness for reducing the rate of malware infections
Educations on:
- Social engineering, how to avoid installing scareware
- Software updates, how to keep systems up to date to avoid driven-by download attacks
- Scams, how not to be money mule or reshipping mule scams
Why arrest criminals is more effective
-
Attackers could always set up a new operation
-
Botnet is easy to set up
-
Attackers learn from the takedown and make the operation more resilient
Two reasons for taking down C&C servers:
- Because the act of misusing computers through malware is illegal
- Because the operations that the botnet carried out are illegal
List economics mitigation strategies
- Raise domain cost to curb misuse
- ISPs need to keep good relations with each other
- Banks need to keep good relationships with other financial institutions which force rogue banks to stop doing business with cybercriminals