Looking ahead to future threats
'Industrialisation of hacking,' is the term John Regnault uses to describe an emerging trend. "We are starting to see the first influx of organised crime into commerce space through 'phishing', such as identity theft, and through denial of service extortion threats," he says.
"In both," he adds, "compromised computers are being used by the attackers. If you take into account that there are possibly a million compromised computers on Internet and that these are now being used as currency by organised crime, you can understand that it's not going to stop here."
In short, BT's head of security technologies believes hacking is becoming a criminal enterprise, with extreme-end hackers and virus writers writing trojan codes for criminals.
Theft, extortion & fraud online
'Phishing' will spread across the world of online commerce, he predicts, while virtually every crime involving theft, extortion and fraud that can be carried out physically can also be performed online. Mobile phones are not immune - a proof of concept virus has already shown that.
Additionally, and perhaps more worryingly, there is a potential threat of some nation states using IT as something that can be attacked.
A virus, he points out, is now something that can cause collateral damage to a country's infrastructure, and as we move further into the future with more electronic devices always on and functioning, the possibility that these can be taken over and used as weapons for crime will increase.
Balanced judgement needed
If security risks have been underestimated by a lot of businesses in the past, he says, now is the time for companies to take a balanced judgement on risk assessment and to institute combined policy management.
Perimeter fences and intrusion detection are among the basics. But enterprises should also ensure that every PC is up to scratch with filtering systems, that sensitive information is protected a by a level of separation and audit, and that mobile staff have the best possible protection - ranging from encryption through to education aimed at protecting users from themselves. In network situations, interfaces should be considered and managed.
A more simple future?
If this is the reality now, then Ian Pearson, BT's futurologist, looks ahead to a re-design of the way computing is done, not only to beat the security problem but also to tackle other issues at the same time.
The system being investigated, not only by BT but also by several universities and other companies, is known as 'ultra-simple computing', based on a security philosophy of just-in-time as opposed to just-in-case.
"Why not have a tiny operating system and why not buy it in chip form?" Ian Pearson asks. "No matter how clever a hacker is, he can't attack it - it's hardware, not software. Memory chips are very cheap now, but to save taking the machine apart to insert a chip each time you use it, you could also have it on a smart card."
A similar philosophy is being applied to the software for such a machine. "If I just load up the things I want, the bare minimum, I have a very guarded facility. A virus will have a much more difficult target. If you do get one, it would disappear when you start up again. This is a new design philosophy - don't load it until you need it."
In fact, he adds, things would also be less expensive this way. "It would be a cheap machine with cheap hardware and cheap software. Boot time is down, battery consumption is better. The basic principles are quite sound and, given all the benefits, it's got a lot of potential mileage."
Jigsaw viruses & smart bacteria
Looking ahead to future threats, Ian Pearson says that one issue in the next five years or so could be a 'jigsaw virus', a virus that enters a machine in perhaps three parts and starts up when the three applications these had attached to were launched in parallel. Even further ahead, beyond 2020, a major security threat could be so-called smart bacteria, "and that is something we will have to start worrying about", he says.
"However, we are now facing much greater threats," he adds. "The electronic domain is a very interesting one for terrorists, for example, and it's something like an arms race - we have to stay ahead."
More information
You can read more about this topic at:
Ensuring Enterprise Security and managing risk
If you would like to know more about research at BT Exact, please visit
www.btexact.com
