The perimeter of a protected network has typically defined the limits of most cybersecurity practitioners’ interest. The cybercrime ecosystem isn’t really a concern until it collides with a system’s border.

However, in his presentation at Scot-Secure 2022, Author & Senior Lecturer of Criminology at the University of Surrey, Dr Michael McGuire warned that this attitude is detrimental to the cybersecurity field.

There is an active and mature cybercrime industry operating beyond the borders of cybersecurity. McGuire said that not only do security professionals need to be more proactive in their engagement, but that complacency is feeding the cybercrime sector.

At present, there is too little dialogue between technical cybersecurity workers and those that study the cybercrime ecosystem.

“There is a danger that cybersecurity practitioners get locked into in their own little bubbles and just talk to each other, exchange ideas about the latest threats, but maybe the imagination and scope of the field needs to go wider than that,” he said.

A Good Offence

In particular, McGuire pointed to understanding how cybercriminals behave as being at the heart of a more pre-emptive form of cybersecurity. This helps practitioners understand where the threats are coming from, to better ensure their defences are tailored to specific threats.

“For most cybersecurity people I talk to, they don’t really think about the crime side as much as how they can fix things,” he said.

In the worst-case scenario, cybersecurity is actually guilty of enabling cybercrime.

“One of the ideas that I like to throw about is that cybersecurity is involved in the commission of cybercrime,” McGuire said.

He noted that many of the concepts and tools adopted by cybersecurity have since been adapted by cybercriminals.

However, he mostly focused on areas where cybersecurity is failing to engage with cybercrime.

“There are things that cybersecurity is failing to do – engaging with certain ways in which cybercrime has become organised.”

To understand how cybersecurity is not dealing with cybercrime, it is necessary to understand what the ecosystem looks like.

Matured

The cybercrime sector has matured in recent years. Cybercriminals have evolved their playbook, diversified their revenues and adopted numerous features seen in legitimate enterprises – think of the portals and helpdesks used as part of ransomware attacks.

“There is a healthy burgeoning and very active cybercrime economy, it’s growing annually, it’s complex and multi-layered,” he said.

While ransomware attacks are a major headache for cybersecurity teams, they form a small part of the cybercrime economy. According to McGuire’s research, cybercrime is bringing in $1.5 trillion per year, coming from a range of streams, such as counterfeit goods and prescription medicines, extortion, and even selling tools and training to burgeoning hackers.

Just as the lines between different criminal ventures are blurred, so too are the lines between cyber and physical criminals. The proceeds from one crime are frequently reinvested to fund other crimes, including terrorism, or even the budgets of nation-states.

Recommended

• The Children’s Code: Lessons learned
• Edinburgh robotics firm takes gold at EdTech Awards
• Edinburgh laser firm Chromacity partners with Tematys in France

But perhaps most importantly, cybercriminals communicate. While most people think of this as taking place on the dark net, McGuire dubbed this the front of house. In fact, much of the discussions around hacking takes place in plain sight on conventional social media platforms.

There, hackers share tips on vulnerabilities, train one another and provide tools.

McGuire’s research found that social media platforms provide $3 billion to the crime economy. In addition, it found a 300% rise between 2017 and 2020 in the use of social media to facilitate crime.

Cybercrime economy provides a steady flow and a ready supply of tools to commit attacks. These can sell for as little as $50, allowing anyone, regardless of skill level, to represent a cybersecurity threat.

In addition, according to McGuire’s research, around 60% of tools available to buy on the dark net were focused on attacking businesses. Many of these are tailored to attack specific business networks, such as healthcare, banking, etc. They are also designed to evade existing cybersecurity systems.

The Challenges

Knowing where the attacks are being discussed helps identify where they are coming from.

“From a cybersecurity perspective, attacks are only an issue once they hit the network and the protections,” McGuire said. “What’s out there in the hinterlands isn’t much of a concern. But it should be because, depending on where you look, you’ll find different types of threats.”

For example, social media platforms provide four of the top five of sources of distribution of crypto-mining software.

“Social media platforms are a direction we don’t always think about as a way to mitigate risk, but actually, the clear net is just as much a problem as anything else,” McGuire warned.

The identity of the attackers is another important issue to consider. Organised cybercrime gangs, nation-states, for example, all have different motivations, goals and capabilities.

But to certain extent, cybercrime represents an existential challenge for cybersecurity.

“Does this cybercrime economy mean that the cybersecurity world as we know it have some existential challenges?” McGuire said. “We live in a world where the attack rate has doubled since 2019. Many people might wonder what they’re paying for, it’s not working, there’s this huge industry, it isn’t doing what it says on the tin.”

Fundamentally, cybersecurity is about connection. While the temptation is to invest in additional tech, engaging in dialogue with experts in criminology, and even with the cybercriminal ecosystem is essentially to getting the insights needed to pre-empt potential attacks.

Get the latest news from DIGIT direct to your inbox

Our newsletter covers the latest technology and IT news from Scotland and beyond, as well as in-depth features and exclusive interviews with leading figures and rising stars.

To subscribe, click here.