How hackers find their targets

experian.com

The rash of large-scale data breaches in the news this year begs many questions, one of which is this: how do hackers select their victims?

The answer: research.

Hackers do their homework; in fact, an actual hack typically takes place only after many hours of first studying the target.

Here’s an inside look at a hacker in action:

1. Using search queries through such resources as Google and job sites, the hacker creates an initial map of the target’s vulnerabilities. For example, job sites can offer a wealth of information such as hardware and software platform usage, including specific versions and its use within the enterprise.
2. The hacker fills out the map with a complete intelligence database on your company, perhaps using public sources such as government databases, financial filings and court records. Attackers want to understand such details as how much you spend on security each year, other breaches you’ve suffered, and whether you’re using LDAP or federated authentication systems.
3. The hacker tries to identify the person in charge of your security efforts. As they research your Chief Security Officer or Chief Intelligence Security Officer (who they report to, conferences attended, talks given, media interviews, etc.) hackers can get a sense of whether this person is a political player or a security architect, and can infer the target’s philosophical stance on security and where they’re spending time and attention within the enterprise.

More...

And, Speaking of Spies....2011 Espionage Research Institute Conference

2011 Espionage Research Institute Conference

This week marks the annual ERI conference in Reston, VA.

The Espionage Research Institute is dedicated to collecting and promulgating information on hostile espionage activity. That is done through the process of accepting, screening and editing reports of hostile activity as they are received from ERI Associates and its Advisors.

The motto of ERI is: "The Biggest Mistake That We Can Make Would Be To Miss The Changes". That expresses the basic reason that ERI exists. It attempts to keep all informed on hostile espionage activity that is directed against business and industry.

Stay tuned later this week for some interesting reports.... ~JDL

Double-O Who? Meet history's unsung spies

telegraph.co.uk

Ask most people to name a spy and they will say James Bond. If they are a little more cerebral they might say George Smiley, the spymaster who, having been immortalised by Sir Alec Guinness on the small screen, this Friday comes to the big screen in one of the most eagerly anticipated films of the autumn. In the latest version of John le Carré’s Tinker, Tailor, Soldier, Spy, Gary Oldman is taking on the role of Smiley, with a supporting cast that includes John Hurt and Colin Firth.

But back to our question, which was name a spy. Such is the potency of literature that most people have long since blurred in their imaginations the difference between fictional spies and real-life ones. This is partly because some of the best spy novels were written by former spies, notably Ian Fleming, Graham Greene and, of course, John le Carré.

So let us phrase the question more clearly. Name a real-life spy… Most people will go with the big three: Philby, Burgess and Maclean. Others that pole-vault to mind are Anthony Blunt, George Blake, Dame Stella Rimington, Mata Hari, Eddie Chapman (Agent Zig-Zag), and Peter “Spycatcher” Wright. Those wishing to put the vaulting bar a little higher might also name Guy Liddell, Oleg Gordievsky, Vera Atkins, Melita Norwood, the atomic spy Klaus Fuchs, Richard Sorge and that notorious Soviet spy Harold Wilson.

But what do all these real-life spies have in common?

More...