Introduction
Hacking is a cybercrime which is on a rise with every passing year. Due to the lack of policies and proper law against cybercrimes in many countries, hackers roam around freely even after committing crimes. The main problem with hacking is that a hacker can easily trespass into the systems of other countries while sitting in a remote location. Many terrorist networks have hackers operating in countries where it is difficult to nab and arrest them. For example, east European countries are the safe havens for hiding and launching attacks on computers from. Some of the countries have collaborated together to create security net in order to identify and punish hackers but it is still in an evolving stage. Thus, it is of utmost importance to protect all the sensitive information from misuse with the help of some proper security measures. With a brief discussion on how the sensitive information of NASA was compromised when it was attacked by a hacking group, this essay will look into various aspects of the hacking process, highlighting the needful measures to be taken by an organization to reduce vulnerabilities of its IT systems.
Attack on NASA
In 2010, a trio of east European men tried to hack NASA. First they implanted a malware called Gozi Virus into the computers of the NASA. Gozi Virus works in such a way that it is not detectable using any current anti-virus methodology. This virus was developed by an east European group back in 2005. A group of three implanted the virus in NASA in 2010 and went on hacking sensitive information from NASA uninterrupted for several months. They hacked secure information from NASA Space Centre, NASA Advanced Supercomputing Division and NASA Information Power Grid (ABC News, 2013). After NASA found out about the hacking, immediately the hacked systems were taken offline and the extent of loss of data and theft was analyzed.
Actors
In case of NASA the main actors involved were three east European men. Nikita Kuzmin was a Russian national and was the chief architect of the attack. She was arrested in USA in 2010. Denniss Calovskis based out of Latvia was the mastermind behind writing the code for the Gozi Virus. Mihai Ionut Paunescu was the final team member who was operating the ‘hosting services’ for the distribution of the virus. This person was a Romanian and was later arrested from his own country (ABC News, 2013). This shows that how the cybercrime net is expanded beyond boundaries.
This case clearly shows that cybercrime is not a small phenomenon that can be ignored. That a Russian, Latvian and Romanian person can coordinate and launch an attack in such coordinated fashion without the help of a bigger cybercrime network raises many concerns. It is evident from the incident that there are hackers sitting at different locations but connected through some terrorist networks or cybercrime groups which arranges the funds and designs the plan of attack (Victor and Hsinchun, 2012). The same groups and networks also coordinate the hacking and then sell the stolen data in black market.
Who Needs This Information and Why?
There are different kinds of groups and people in need of information from various government agencies. First of all by hacking the personal information from NASA and military servers, hackers gain insight into the profiles and details about military personnel. This information is required by different terrorist groups to create fake identities to enter into the countries of interest under camouflage. They can also use those stolen identities to understand their counterparts in a better way.
Secondly, hackers by hacking the systems of military organizations can steal information related to different research works and confidential documents on armaments. This information can then be sold into the black market to terrorist groups. They can use this confidential information to develop weaponry or other things to launch attacks or disrupt operations of the opponent or target countries. This type of information is very popular among other nations as well (UMUC, 2010). Suppose a hacker hacks information related to the unconventional military weapons from the Pentagon. The government of Chechnya or the government of any other country trying to harm USA will be willing to buy that information to understand the military might of USA and how much they are lagging behind in terms of technology.
Thirdly, there are lots of hackers hacking into the systems of big organizations for fun. They hack for the sake of hacking. They hack into difficult network system and then make that system accessible to public. They derive a personal joy and satisfaction out of this. They might not have personal harmful intentions behind hacking but an organization can lose a chunk of sensitive information because of attacks from this type of hackers (Victor and Hsinchun, 2012).
Finally, a good many nations directly do not get involved into hacking the systems of other nations to grab a hold on sensitive information; rather they hire third party hackers anonymously to capture information about the rival nations. For example, the US government is known to hack into the systems of some of the European countries to acquire sensitive information.
How to Identify Potential Hackers?
In the past it was seen that hackers operated individually. Even during the early years of the century most of the attacks were coordinated by a single hacker. However, due to the advent of social media and global information unification through the internet, the hackers are also coming together. Almost all the cyber-attacks are now coordinated by a hacker group. Hacking community often creates groups in social media or comes close to each other through private chat forums like Internet Relay Chat. These forums are the primary place from which potential hackers and potential hacking activities and actors can be identified. It is also seen that the people who take the lead role in those group activities or who are respected by other community members most are often the lead actors for future hacking activities.
As the place of attack of hackers can be anywhere in the world, it is not easy to identify hackers using geographical searching technique. It is easier to monitor forums, underground hacking chat windows and personal hacking groups to identify the potential hackers. It reduces the total scope of search to a small group of people. It is seen from empirical data that seniority and reputation in hacking forums are often very important to lead a group of hackers. This can be used by the anti-hacking authorities to identify the potential lead hackers.
How to Discourage Hackers?
Hackers are often seen as people with exceptional abilities. They are seen as heroes who can do impossible tasks sitting at home. For many, hacking is the coolest profession on earth. For some, it is a matter of sheer pride to breach the security of a system. There are primarily two ways to discourage hackers. The first and foremost is punishment. Hackers should be treated as offenders of crime in the same league with bank robbers and spies. If strict punishment is meted out on the basis of some exemplary judgments, then a lot of potential future hackers will feel deterred to commit hacking. Secondly, media and related people should stop portraying hackers in a glorified manner as people with exceptional abilities (Chin). Rather media should start portraying them as robbers or thieves or terrorists. Hackers who value their own pride and image will not get into hacking and tarnish their image.
How to Create a Secure Organization?
First and foremost any company should have a map of its total IT chain. Once it is mapped then planning should be made to create securities for the supply chain. It is true for the security chain that the weakest link of the security chain defines its strength. Even if 99% of the network is secure and 1% is weak then also the company is highly vulnerable to cyber-attacks. For example, NASA has a very high level of security for its system and services. However, with the advent of laptops and tablets lot of employees carry secure information outside NASA and all those machines are not encrypted. If any of those systems is compromised, any hacker can easily gather data from that machine. Even after having highly secure encryption in its in-premise systems, because of this one weak link NASA systems become highly vulnerable to cyber-attack (Farhat, McCarthy and Raysma, 2011).
Furthermore, it is important that each and every employee is responsible for the safety of data and system information. The least an organization should force its employees to do is to force them to create passwords which are not easy to crack.
It is also important to create an enterprise wide firewall system which allows the flow of data only if it is authenticated in some secure way. SSL certificate implementation is one good step in securing the web based applications. Furthermore, there are interfaces where the company integrates with outer interface like Facebook, LinkedIn or other social sites. The communication with those systems should also be secure. Finally, all the important data and codes for the organization should be backed up. This will ensure easy recovery in case of cyber-attack.
Conclusion
Hacking is on the rise. With the advent of internet and more sophisticated software, hackers are more prepared than before. Hackers are also coming together and forming communities. There are some hackers who hack systems just for the sake of hacking but most of the hacking happens in a coordinated way for identity and information theft. Terrorist groups often fund coordinated hacking of government secure information systems. In some cases, even some nations fund hackers to capture sensitive information related to rival nations. Organizations can improve their systems to make them less vulnerable to attack. However, exemplary punishment to hackers is the only way to discourage them from hacking and deter potential hackers from indulging in cyber-attacks. Then only such cybercrimes can be thwarted.
References
Cybercrime Ring Targeted NASA (2013). ABC News. Retrieved on 30th October, 2013 from <http://www.abc.net.au/news/2013-01-24/us-charges-east-european-cyber-virus-gang/4481534>
Human Aspects in Cyber Security: Ethics and Psychology (2010). University of Maryland (UMUC). Retrieved on 30th October, 2013 from <http://www.homeworkforyou.com/static/uploadedfiles/User_30672532013UMUC_CSEC620_Week6_ICS.pdf >
Victor, Benjamin and Hsinchun, Chen (2012). Securing Cyberspace: Identifying Key Actors in Hacker Communities. Department of Management Information Systems. University of Arizona. Retrieved on 30th October, 2013 from <http://web.elastic.org/~fche/mirrors/www.jya.com/2013/03/key-hackers.pdf>
Farhat, Vince. McCarthy, Bridget and Raysma, Richard (2011). Cyber Attacks: Prevention and Proactive Responses. Holland and Knight LLP. Retrieved on 30th October, 2013 from <http://www.hklaw.com/files/Publication/bd9553c5-284f-4175-87d2-849aa07920d3/Presentation/PublicationAttachment/1880b6d6-eae2-4b57-8a97-9f4fb1f58b36/CyberAttacksPreventionandProactiveResponses.pdf >
Chin, Wee Yung. Information Gathering and Countermeasures. Retrieved on 30th October, 2013 from <http://icsd.i2r.a-star.edu.sg/staff/sethome/pdf/010.pdf >
