Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Trusted Source

You can lead a consumer to the Internet, but you can’t make him trust it
Page:

I don't entirely trust the Internet. I realize this is not an original sentiment, but the rapid increase in financial usage of the Internet suggests that we now trust it a lot more. Trust increases when the frequency and impact of perceived risks decrease. For the Internet, the risks fall into three categories: hackers with viruses, spams and scams with careless users and profiteers spreading fear.

Trojans took an impressive 80 percent share of the Internet threat market in 2006, defeating Windows-based worms for the second year running. It was a Trojan that cost the Swedish bank Nordea 8 million kronor over the past few months. This Trojan is available for sale and its hacker creator offers purchasers a graphical user interface, customized code scripts and software support. I wish some of my commercial applications had ease-of-use features and support like that.

Trust the banks to scan and manage my computer? That alone should ensure everyone rushes out and installs their own security software
Banks are obvious targets and have protected themselves from widespread fraud using a combination of sophisticated security systems and flat denial. This hacker says 99 percent of bank fraud is unreported to protect their image, and mentioned an Australian bank that was also hit by the same Trojan. But then, he's probably lying because we know he's a crook, whereas the banks . . .

The public generally regard bank-jacking with benign amusement since the current law largely protects us from financial loss caused by Internet fraud. So there was outrage through the community when news emerged that ASIC has been lobbied by the banking industry to make customers who were negligent liable for Internet fraud. A righteous response — except the information wasn't accurate. The reports originated from "mistaken information" in a computer security company's press release.

The company's CTO added his two cents, advising that to be secure, users must "check the fingerprint of the SSL certificate" and ensure "the DNS server is properly configured". Picture the average PC user. Mention the phrases SSL certificate fingerprint and DNS server configuration and count the microseconds before their eyes glaze over. Mention these phrases to the average CIO and marvel at an identical reaction. The CTO then suggested that the only way to overcome financial attacks would be to integrate customer PCs into the bank's security chain, and let the bank perform security health checks and scans on them. Trust the banks to scan and manage my computer? That alone should ensure everyone rushes out and installs their own security software.

Secret Password

I know that banks are very concerned about security because of the many e-mails they send me to update my password on their Web site. Being a careful user, I delete them all. However, when I received an e-mail from National Australia Bank's "High Executive Bureau", it seemed too important to ignore, so I complied and clicked the helpfully included Web address. I concluded that their Web site had a Hong Kong domain purely for offshore taxation reasons, and entered a login and password as requested. I'm not actually a NAB customer, so I had to invent a likely login before entering my usual secret password — which like countless other users is secret.

The Internet also provides personal financial gain. So many people e-mail me each week offering jobs of little effort with fantastic incomes that I've stopped bothering with any that promise less than $5000 per week. A recent development is to be offered specific positions with real companies. An Icelandic company repeatedly e-mailed me saying someone with my skills and experience is ideal for a senior job in their finance department. The Web address is indeed a company in Reykjavik and the sender's name and e-mail is that of their finance manager. That I don't speak Icelandic, have no experience in finance, don't like Bjork's music and didn't apply for a job were apparently no obstacle.

I need to be less trusting as it's possible some of these e-mails are not genuine. A South Korean woman was arrested last month for sending several trillion spam e-mails. Assuming an online population of 3.5 billion people, that's around 1000 e-mails per user from just one spammer. I calculate this online number from the population of the planet (6.5 billion), less those who can't use computers — that is, parents (0.5 billion), people with better things to do with their time (1 billion) and those who don't have access to clean water or fresh food, so broadband is less of a concern (1.5 billion).

Page:

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: ASIC, Billion, Creator, eBay, Edge Technologies, Metcalfe, NAB, National Australia Bank, Nordea, PayPal, Promise, Security Systems

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
Whitepapers
  • Forrester Research | Your Enterprise Database Security Strategy 2010
    With increasingly sophisticated attacks and rising internal data theft, database security merits a stronger focus that goes beyond traditional authentication, authorization, and access control. Learn how to secure your database - Read this strategy guide.
    Learn more »
  • Implementing Energy Efficient Data Centres
    Electrical power usage is not a typical design criterion for data centers, nor is it effectively managed as an expense. This is true despite the fact that the electrical power costs over the life of a data center may exceed the costs of the electrical power system including the UPS, and also may exceed the cost of the IT equipment. Read on.
    Learn more »
  • Spear Phishing Attacks - Why they are successful and how to stop them
    There's been a rapid shift from broad, scattershot attacks to advanced target attacks that have had serious consequences for victim organisations. The increased use of spear phishing is directly related to the fact that it works, as traditional security defences simply do not stop these types of attacks. This paper provides a detailed look at how spear phishing is used within advanced attacks and the key capabilities organisations need in order to effectively combat these emerging and evolving threats.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments