Die ganzen Ransomware-Gangs da draussen verdienen ja richtig Geld.
Darkside verlangte nette 4 Millionen Dollar vom Betreiber der
Colonia Pipeline. Aber was kostet eigentlich so ein Cyber-Angriff
in der Durchführung? Was sind die laufenden Kosten für
Cyber-Operationen? Was kostet Personal? Wie teuer ist die
Entwicklung von Schadsoftware? Über all diese Fragen wissen wir in
der Forschung ziemlich wenig. Kriminelle und Cyberkommandos sind
wenig gesprächig, wenn es um das Thema Kosten geht. Aus dem
Staatshaushalt kann man das auch nicht rauslesen. Deswegen näheren
wir uns in dieser Folge mal dem Thema an und machen Reverse
Engineering: Wir definieren ein paar Grundannahmen und gucken
darüber, welche Komponenten Cyber-Operationen so brauchen und
welchen Einfluss bestimmte Aspekte wie Dauer, Teamgröße und Auswahl
von Schadsoftware auf den Preis hat. Um das ganze etwas besser
nachzuvollziehen hat ein Kollege von mir ein Tool gebaut, mit dem
man die Kosten für verschiedene Angriffskampagnen modellieren kann.
Viel Spaß damit! Shownotes Cyber Attack Cost Calculator:
https://percepticon.de/material/open-data/cost-of-cyber-attack-calculator/
Ablon, Lillian, and Andy Bogart. 2017. Zero Days, Thousands of
Nights: The Life and Times of Zero-Day Vulnerabilities and Their
Exploits. Research report RR-1751-RC. Santa Monica, Calif: RAND.
Accessed May 26, 2020.
https://www.rand.org/pubs/research_reports/RR1751.html Ablon,
Lillian, Martin C. Libicki, and Andrea A. Golay. 2014. “Markets for
Cybercrime Tools and Stolen Data: Hackers' Bazaar.” Barzashka,
Ivanka. 2013. “Are Cyber-Weapons Effective?” The RUSI Journal 158
(2): 48–56. https://doi.org/10.1080/03071847.2013.787735 Browning,
Kellen. 2021. “Hundreds of Businesses, from Sweden to U.S.,
Affected by Cyberattack.” The New York Times, July 2, 2021.
https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html
Collier, Kevin. 2021. “Luxury Cars and $100 Bills: Police Bust
Ransomware Gang in Ukraine.” Accessed June 17, 2021.
https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199
CompTIA. 2017. “Your Next Move: Cybersecurity Engineer.” Accessed
June 17, 2021.
https://www.comptia.org/blog/your-next-move-cybersecurity-engineer
Cybernews. 2021. “Million-Dollar Deposits and Friends in High
Places: How We Applied for a Job with a Ransomware Gang.”
Cybernews, April 21, 2021.
https://cybernews.com/security/how-we-applied-to-work-with-ransomware-gang/
Deloitte. 2018. “Black-Market Ecosystem. Estimating the Cost of
"Pwnership".” Accessed July 01, 2021.
https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-risk-black-market-ecosystem.pdf
Jobilize. 2021. “Exploit Developer with Security Clearance Job in
Columbia.” Accessed June 17, 2021.
https://www.jobilize.com/job/exploit-developer-security-clearance-columbia-mount-indie-united-states;jsessionid=e_xYHPefDaUpLRbiI3PaD0IzWOp2-vLK3nILfB0J.web01?src=drblsrch
Lindsay, Jon R. 2013. “Stuxnet and the Limits of Cyber Warfare.”
Security Studies 22 (3): 365–404.
https://doi.org/10.1080/09636412.2013.816122 Malone, Patrick J.
2012. “Offense-Defense Balance in Cyberspace: A Proposed Model.”
Monterey, California. Naval Postgraduate School.
https://calhoun.nps.edu/handle/10945/27863 Payscale. 2021.
“Security Operations Engineer Salary in the United States.”
Accessed June 17, 2021.
https://www.payscale.com/research/US/Job=Security_Operations_Engineer/Salary
Pomerleau, Mark. 2017. “Here’s How DoD Organizes Its Cyber
Warriors.” Accessed June 17, 2021.
https://www.fifthdomain.com/workforce/career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors/
Smeets, Max. 2016. “How Much Does a Cyber Weapon Cost? Nobody
Knows.” Council on Foreign Relations, November 21, 2016.
https://www.cfr.org/blog/how-much-does-cyber-weapon-cost-nobody-knows
Whitney, Lance. 2020. “How Cybercrime Will Cost the World $1
Trillion This Year.” TechRepublic, December 7, 2020.
https://www.techrepublic.com/article/how-cybercrime-will-cost-the-world-1-trillion-this-year/
Zerodium. 2021. “Zerodium Exploit Acquisition Program.”
https://zerodium.com/program.html Hinweise Kommentare und
konstruktives Feedback bitte auf percepticon.de oder via Twitter.
Die Folge erscheint auf iTunes, Spotify, PocketCast, Stitcher oder
via RSS Feed. Apple Podcasts unterstützt gegenwärtig kein HTML
mehr, weshalb das hier alles etwas durcheinander ist. Sound &
Copyright Modem Sound, Creative Commons. Vint Cerf, "Internet shows
up in December 1975", in: IEEE Computer Society, Computing
Conversations: Vint Cerf on the History of Packets,
December 2012. L0pht Heavy Industries testifying before the
United States Senate Committee on Governmental Affairs, Live feed
from CSPAN, May 19, 1998. Barack Obama, Cybersecurity and Consumer
Protection Summit Address, 13 February 2015, Stanford University,
Stanford, CA. Michael Hayden, "We kill people based on meta-data,"
in: The Johns Hopkins Foreign Affairs Symposium Presents: The Price
of Privacy: Re-Evaluating the NSA, April 2014. Bruce Schneier,
"Complexity is the enemy of security, in IEEE Computer Society,
Bruce Schneier: Building Cryptographic Systems, March 2016.Beats,
Bass & Music created with Apple GarageBand
Kommentare (0)
Melde dich an, um einen Kommentar zu schreiben.