The Evolving Cyberthreat

Jimmy Zombie Cybercrime is one of the hottest topics of the digital age. Media outlets are full of stories about retailers, governments, tech companies, celebrities, ordinary people—everything and everyone—getting hacked. Even baseball teams are hacking their rivals now. And the latest series in the CSI television franchise? CSI: Cyber, starring Patricia Arquette and Ted Danson. Book publishers, too, are getting in on the action. Recent releases cover the many forms of cybercrime, why cybersecurity matters, and why both businesses and individuals need to take these issues seriously. You couldn’t ask for a better overview than Future Crimes, by Marc Goodman, a cybercrime adviser to Interpol, the United Nations, and other institutions. He provides jaw-dropping statistics (the best antivirus software catches only 5% of online threats; 80% of hackers work for organized crime rings) and a strong point of view on where our future vulnerabilities lie. Goodman spends several chapters, for instance, on gaping security holes in the internet of things. One of my favorite examples, from 2013, is Chinese irons and teakettles that were illicitly outfitted with Wi-Fi cards, allowing the appliances to secretly join their owners’ home networks and spread viruses and spam. We have more than evil teakettles to reckon with, though. Goodman also touches on the many threats inherent in artificial intelligence and biotech—two areas poised for enormous growth—from killer robots to plagues that are genetically engineered to attack a specific person (say, a sitting head of state). These are nightmare scenarios, and they’re no longer just science fiction. Goodman gives us a much-needed reminder that all our wondrous technology can easily be turned against us. Equally alarming are the stories in Swiped, a detailed account of how hackers steal information and identities by Adam Levin, a cofounder of Credit.com. Our weak spots range from the seemingly minor (When you allow an app to access your phone’s contacts, how do you know you can trust the app’s maker with that data?) to the obviously major (What steps has your employer, medical provider, or bank taken to secure your information?). Levin cites one study (originally published in Science ) in which researchers were able to identify specific people in anonymized data sets by using “a receipt, an Instagram post, and a Tweet about a new purchase or a Facebook post that included the location of a favorite bar or a restaurant.” His main point is that we—particularly young people accustomed to sharing every detail of their lives online—need to be more vigilant about what we post and who has access to it. Theresa M. Payton and Theodore Claypoole agree. Their book, Privacy in the Age of Big Data, out in paperback earlier this year, explores the trade-offs between privacy and convenience and how our everyday technologies routinely force us to choose between the two, whether we know it or not. Payton, a former White House chief information officer, and Claypoole, a technology attorney, note that the United States, unlike many other countries, doesn’t classify privacy as a human right; instead, its laws tend to address privacy only after it’s been violated—in the wake of a data breach, for example. So we are exposed to anyone with the know-how and the inclination to violate it, including our own government. These and other new books on cybersecurity provide good, useful information and paint a frightening and comprehensive picture of cyberthreats today. Where they fall short is in trying to offer practical tips, because even the best advice will have aged by the time a book is published. The authors point out that hackers can change their tactics far faster and more easily than we can update our defenses. They can sidestep security simply by changing their IP addresses or adding a few lines of code to their malware, and they relentlessly pick apart apps, websites, and devices to find security holes they can exploit. New ways to steal your money and personal information are being dreamed up as you read this. Two things are clear: Cybersecurity books are a 20th-century solution to a 21st-century problem, and the solution isn’t working. All three of these books do try to help readers guard against today’s threats, but we’ve heard their advice before. ( Future Crimes, for example, says to use strong passwords and ignore e-mails asking you to send money to foreign princes in need.) And they can’t even begin to arm us against tomorrow’s threats—such as the dangers lurking in AI and biotech—because no one yet knows what those will look like. Further Reading Swiped: How to Protect Yourself in a World Full of Scammers, Phishers, and Identity Thieves Adam Levin PublicAffairs, 2015 Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do About It Marc Goodman Doubleday, 2015 Privacy in the Age of Big Data: Recognizing Threats, Defending Your Rights, and Protecting Your Family Theresa M. Payton and Theodore Claypoole Rowman & Littlefield, 2015 The problem isn’t a lack of information. Even a quick online search for cybersecurity tips returns an overwhelming number of results. Yet studies show that far too many people are still using passwords such as “123456” and “password,” and cybercrime is worse than ever. To combat that dynamic, evolving threat, we need an equally dynamic solution. What if we took all the time, effort, and investment that went into these books and put them toward crafting a less static repository of advice—a Wikipedia for cybersecurity issues, or a GitHub for security best practices on the individual, everyday level? Whatever the format, we need an authoritative central location that is comprehensive, collaborative, constantly updated, and searchable. The bad guys are already working together, whether through a catalog of common internet-of-things devices and how to hack them, the live tech support that attends one of the most nefarious malware packages, or the organized cybercrime rings themselves. The good guys should work together too. IBM’s X-Force Exchange, a free real-time threat-sharing platform open to anyone, is a reasonable start for company-level security, but most people won’t know what to do with its lists of malicious IP addresses and threat locations. Could publishers, authors, and tech companies create similar websites for individuals? Until cybersecurity can stop playing catch-up and actually get out in front of hackers’ efforts, we’ll continue to be on the defensive—and we’ll continue losing.

The Evolving Cyberthreat

Partner Center