Securing the future of information technology

A DTI Global Watch Mission from the UK to the US brought back a valuable contemporary view of emerging threats and solutions to help the UK overcome these risks and capitalise on business opportunities.

Last year, 18 percent of UK businesses suffered security breaches and nine percent reported staff obtaining or misusing confidential information.

With just one incident capable of costing smaller companies tens of thousands of pounds, millions in a recent case involving one UK bank, the threats posed by increasingly sophisticated cyber scams are requiring the rapid development of robust solutions.

‘We are moving from a world of ‘script-kiddies' - hackers who cause problems for personal fame - to theft, organised extortion and even threats to national security,' said Tom Wills-Sandford, Deputy Director General of Intellect, the mission's co-ordinating body.

Keeping pace with these developments is vital - lessons have been learnt in the wake of phishing and spyware, which largely caught the research establishment unaware.

As the international community battles with the latest threats, such as botnets - a network of infected computers which can launch mass denial-of-service and credit card number theft attacks - it is also looking at future potential and real threats.

The mission to Silicon Valley and Seattle is part of the UK's determined efforts to be prepared by knowing what threats are on the horizon, how technology can tackle them and what commercial opportunities there are for UK companies.

These efforts also include a new Cyber Security Knowledge Transfer Network and DTI's Information Security Breaches Survey, which was launched at the Infosecurity Europe conference earlier this year.

Having visited academic bodies, law enforcement agencies, start-ups, major systems and software players and information security companies, the mission team agreed that the US is addressing the issues with vigour, commitment and imagination.

The mission report written by the team, representing the BBC, BeCrypt, BT, Deepnet Technologies, Intellect, Nexor, QinetiQ, Smart 421 and the University of Leeds, details the roles played in threat awareness and prevention by issues such as legislation, training and information protection.

Here we highlight some of the mission's key findings.

Pre-empting problems

The team visited two think-tank style bodies which are working to prevent future problems. The Cyber Defense Technology Experimental Research project (DETER) at Team for Research in Ubiquitous Secure Technology (TRUST) at UC Berkeley, whose goal is to develop better defences against malicious attacks on networking infrastructures, is building a 1/64th scale model of the internet for realistic testing.

The University of California's Collaborative Center for Internet Epidemiology and Defense (CCIED), is working to improve defence mechanisms against internet malware. Among other technologies, honeypots are being used to determine how malware spreads through the internet at ever increasing speed.

Forensic centres

'Radical changes in the information environment have exposed a requirement for significant changes in the way law enforcement organisations address the ever-higher workloads brought about by the increasing use of technology in all areas of crime,' said Dr Andrew Jones of BT.

‘The US has created a total of 10 Regional Computer Forensic Laboratories led by the FBI which act as a one-stop, full-service, fast-turnaround forensics laboratory and training centre devoted entirely to the examination of digital evidence in support of criminal investigations.'

Secure software

It is accepted that one of the most important long-term security solutions is to ensure that software is designed and developed to a quality and standard that allows for fewer vulnerabilities.

According to the team, Microsoft's threat model is particularly noteworthy, as it is a genuine attempt to make threats generic so this knowledge can be fed back into the development life cycle and security can be built in from the start.

The team was also impressed by Fortify Software's Static Code Analyzer, an interesting product which takes source code and analyses its vulnerabilities.

Dynamic start-ups

‘The start-up culture is extraordinary, with many being led by serial entrepreneurs and developing a very particular ‘point' information security solution,' said Peter Jaco, formerly of BeCrypt.

‘Start-ups are often then bought by larger companies which incorporate the new solution into their other product lines. Many start-ups are looking to meet demand for low-cost, user-friendly authentication as industries such as banking move to two-factor authentication systems.

BioPassword is one of these - it has a novel ‘keystroke dynamics' authentication product based on the user's typing pattern.'

Further information

The mission report, Changing nature of information security - a UK perspective on US experiences, can be downloaded at www.globalwatchservice.com/misreps

To find out more about technology partnering opportunities in software in the US, please contact Adrian Rowland DTI International Technology Promoter.t: 01664 501551,e: adrian.rowland@pera.com,www.globalwatchservice.com/itp

For more information about technology transfer in information security, visit the Cyber Security KTN websitewww.cybersecurity-ktn.com

futureinformationofsecuringsecuritytechnologythe