Gehen Sie mit der App Player FM offline!
29 WTF kosten Cyber-Angriffe?
Archivierte Serien ("Inaktiver Feed" status)
When? This feed was archived on October 13, 2022 20:08 (). Last successful fetch was on May 11, 2022 16:03 ()
Why? Inaktiver Feed status. Unsere Server waren nicht in der Lage einen gültigen Podcast-Feed für einen längeren Zeitraum zu erhalten.
What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.
Manage episode 302103948 series 2504976
Die ganzen Ransomware-Gangs da draussen verdienen ja richtig Geld. Darkside verlangte nette 4 Millionen Dollar vom Betreiber der Colonia Pipeline. Aber was kostet eigentlich so ein Cyber-Angriff in der Durchführung? Was sind die laufenden Kosten für Cyber-Operationen? Was kostet Personal? Wie teuer ist die Entwicklung von Schadsoftware? Über all diese Fragen wissen wir in der Forschung ziemlich wenig. Kriminelle und Cyberkommandos sind wenig gesprächig, wenn es um das Thema Kosten geht. Aus dem Staatshaushalt kann man das auch nicht rauslesen. Deswegen näheren wir uns in dieser Folge mal dem Thema an und machen Reverse Engineering: Wir definieren ein paar Grundannahmen und gucken darüber, welche Komponenten Cyber-Operationen so brauchen und welchen Einfluss bestimmte Aspekte wie Dauer, Teamgröße und Auswahl von Schadsoftware auf den Preis hat. Um das ganze etwas besser nachzuvollziehen hat ein Kollege von mir ein Tool gebaut, mit dem man die Kosten für verschiedene Angriffskampagnen modellieren kann. Viel Spaß damit!
Shownotes
Cyber Attack Cost Calculator: https://percepticon.de/material/open-data/cost-of-cyber-attack-calculator/
Ablon, Lillian, and Andy Bogart. 2017. Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits. Research report RR-1751-RC. Santa Monica, Calif: RAND. Accessed May 26, 2020. https://www.rand.org/pubs/research_reports/RR1751.html
Ablon, Lillian, Martin C. Libicki, and Andrea A. Golay. 2014. “Markets for Cybercrime Tools and Stolen Data: Hackers‘ Bazaar.”
Barzashka, Ivanka. 2013. “Are Cyber-Weapons Effective?” The RUSI Journal 158 (2): 48–56. https://doi.org/10.1080/03071847.2013.787735
Browning, Kellen. 2021. “Hundreds of Businesses, from Sweden to U.S., Affected by Cyberattack.” The New York Times, July 2, 2021. https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html
Collier, Kevin. 2021. “Luxury Cars and $100 Bills: Police Bust Ransomware Gang in Ukraine.” Accessed June 17, 2021. https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199
CompTIA. 2017. “Your Next Move: Cybersecurity Engineer.” Accessed June 17, 2021. https://www.comptia.org/blog/your-next-move-cybersecurity-engineer
Cybernews. 2021. “Million-Dollar Deposits and Friends in High Places: How We Applied for a Job with a Ransomware Gang.” Cybernews, April 21, 2021. https://cybernews.com/security/how-we-applied-to-work-with-ransomware-gang/
Deloitte. 2018. “Black-Market Ecosystem. Estimating the Cost of „Pwnership“.” Accessed July 01, 2021. https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-risk-black-market-ecosystem.pdf
Jobilize. 2021. “Exploit Developer with Security Clearance Job in Columbia.” Accessed June 17, 2021. https://www.jobilize.com/job/exploit-developer-security-clearance-columbia-mount-indie-united-states;jsessionid=e_xYHPefDaUpLRbiI3PaD0IzWOp2-vLK3nILfB0J.web01?src=drblsrch
Lindsay, Jon R. 2013. “Stuxnet and the Limits of Cyber Warfare.” Security Studies 22 (3): 365–404. https://doi.org/10.1080/09636412.2013.816122
Malone, Patrick J. 2012. “Offense-Defense Balance in Cyberspace: A Proposed Model.” Monterey, California. Naval Postgraduate School. https://calhoun.nps.edu/handle/10945/27863
Payscale. 2021. “Security Operations Engineer Salary in the United States.” Accessed June 17, 2021. https://www.payscale.com/research/US/Job=Security_Operations_Engineer/Salary
Pomerleau, Mark. 2017. “Here’s How DoD Organizes Its Cyber Warriors.” Accessed June 17, 2021. https://www.fifthdomain.com/workforce/career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors/
Smeets, Max. 2016. “How Much Does a Cyber Weapon Cost? Nobody Knows.” Council on Foreign Relations, November 21, 2016. https://www.cfr.org/blog/how-much-does-cyber-weapon-cost-nobody-knows
Whitney, Lance. 2020. “How Cybercrime Will Cost the World $1 Trillion This Year.” TechRepublic, December 7, 2020. https://www.techrepublic.com/article/how-cybercrime-will-cost-the-world-1-trillion-this-year/
Zerodium. 2021. “Zerodium Exploit Acquisition Program.” https://zerodium.com/program.html
Hinweise
Kommentare und konstruktives Feedback bitte auf percepticon.de oder via Twitter. Die Folge erscheint auf iTunes, Spotify, PocketCast, Stitcher oder via RSS Feed. Apple Podcasts unterstützt gegenwärtig kein HTML mehr, weshalb das hier alles etwas durcheinander ist.
Sound & Copyright
- Modem Sound, Creative Commons.
- © Vint Cerf, „Internet shows up in December 1975“, in: IEEE Computer Society, Computing Conversations: Vint Cerf on the History of Packets, December 2012.
- © L0pht Heavy Industries testifying before the United States Senate Committee on Governmental Affairs, Live feed from CSPAN, May 19, 1998.
- © Barack Obama, Cybersecurity and Consumer Protection Summit Address, 13 February 2015, Stanford University, Stanford, CA.
- © Michael Hayden, „We kill people based on meta-data,“ in: The Johns Hopkins Foreign Affairs Symposium Presents: The Price of Privacy: Re-Evaluating the NSA, April 2014.
- © Bruce Schneier, „Complexity is the enemy of security, in IEEE Computer Society, Bruce Schneier: Building Cryptographic Systems, March 2016.
- Beats, Bass & Music created with Apple GarageBand
Der Beitrag 29 WTF kosten Cyber-Angriffe? erschien zuerst auf Percepticon.
35 Episoden
Archivierte Serien ("Inaktiver Feed" status)
When? This feed was archived on October 13, 2022 20:08 (). Last successful fetch was on May 11, 2022 16:03 ()
Why? Inaktiver Feed status. Unsere Server waren nicht in der Lage einen gültigen Podcast-Feed für einen längeren Zeitraum zu erhalten.
What now? You might be able to find a more up-to-date version using the search function. This series will no longer be checked for updates. If you believe this to be in error, please check if the publisher's feed link below is valid and contact support to request the feed be restored or if you have any other concerns about this.
Manage episode 302103948 series 2504976
Die ganzen Ransomware-Gangs da draussen verdienen ja richtig Geld. Darkside verlangte nette 4 Millionen Dollar vom Betreiber der Colonia Pipeline. Aber was kostet eigentlich so ein Cyber-Angriff in der Durchführung? Was sind die laufenden Kosten für Cyber-Operationen? Was kostet Personal? Wie teuer ist die Entwicklung von Schadsoftware? Über all diese Fragen wissen wir in der Forschung ziemlich wenig. Kriminelle und Cyberkommandos sind wenig gesprächig, wenn es um das Thema Kosten geht. Aus dem Staatshaushalt kann man das auch nicht rauslesen. Deswegen näheren wir uns in dieser Folge mal dem Thema an und machen Reverse Engineering: Wir definieren ein paar Grundannahmen und gucken darüber, welche Komponenten Cyber-Operationen so brauchen und welchen Einfluss bestimmte Aspekte wie Dauer, Teamgröße und Auswahl von Schadsoftware auf den Preis hat. Um das ganze etwas besser nachzuvollziehen hat ein Kollege von mir ein Tool gebaut, mit dem man die Kosten für verschiedene Angriffskampagnen modellieren kann. Viel Spaß damit!
Shownotes
Cyber Attack Cost Calculator: https://percepticon.de/material/open-data/cost-of-cyber-attack-calculator/
Ablon, Lillian, and Andy Bogart. 2017. Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits. Research report RR-1751-RC. Santa Monica, Calif: RAND. Accessed May 26, 2020. https://www.rand.org/pubs/research_reports/RR1751.html
Ablon, Lillian, Martin C. Libicki, and Andrea A. Golay. 2014. “Markets for Cybercrime Tools and Stolen Data: Hackers‘ Bazaar.”
Barzashka, Ivanka. 2013. “Are Cyber-Weapons Effective?” The RUSI Journal 158 (2): 48–56. https://doi.org/10.1080/03071847.2013.787735
Browning, Kellen. 2021. “Hundreds of Businesses, from Sweden to U.S., Affected by Cyberattack.” The New York Times, July 2, 2021. https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html
Collier, Kevin. 2021. “Luxury Cars and $100 Bills: Police Bust Ransomware Gang in Ukraine.” Accessed June 17, 2021. https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199
CompTIA. 2017. “Your Next Move: Cybersecurity Engineer.” Accessed June 17, 2021. https://www.comptia.org/blog/your-next-move-cybersecurity-engineer
Cybernews. 2021. “Million-Dollar Deposits and Friends in High Places: How We Applied for a Job with a Ransomware Gang.” Cybernews, April 21, 2021. https://cybernews.com/security/how-we-applied-to-work-with-ransomware-gang/
Deloitte. 2018. “Black-Market Ecosystem. Estimating the Cost of „Pwnership“.” Accessed July 01, 2021. https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-risk-black-market-ecosystem.pdf
Jobilize. 2021. “Exploit Developer with Security Clearance Job in Columbia.” Accessed June 17, 2021. https://www.jobilize.com/job/exploit-developer-security-clearance-columbia-mount-indie-united-states;jsessionid=e_xYHPefDaUpLRbiI3PaD0IzWOp2-vLK3nILfB0J.web01?src=drblsrch
Lindsay, Jon R. 2013. “Stuxnet and the Limits of Cyber Warfare.” Security Studies 22 (3): 365–404. https://doi.org/10.1080/09636412.2013.816122
Malone, Patrick J. 2012. “Offense-Defense Balance in Cyberspace: A Proposed Model.” Monterey, California. Naval Postgraduate School. https://calhoun.nps.edu/handle/10945/27863
Payscale. 2021. “Security Operations Engineer Salary in the United States.” Accessed June 17, 2021. https://www.payscale.com/research/US/Job=Security_Operations_Engineer/Salary
Pomerleau, Mark. 2017. “Here’s How DoD Organizes Its Cyber Warriors.” Accessed June 17, 2021. https://www.fifthdomain.com/workforce/career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors/
Smeets, Max. 2016. “How Much Does a Cyber Weapon Cost? Nobody Knows.” Council on Foreign Relations, November 21, 2016. https://www.cfr.org/blog/how-much-does-cyber-weapon-cost-nobody-knows
Whitney, Lance. 2020. “How Cybercrime Will Cost the World $1 Trillion This Year.” TechRepublic, December 7, 2020. https://www.techrepublic.com/article/how-cybercrime-will-cost-the-world-1-trillion-this-year/
Zerodium. 2021. “Zerodium Exploit Acquisition Program.” https://zerodium.com/program.html
Hinweise
Kommentare und konstruktives Feedback bitte auf percepticon.de oder via Twitter. Die Folge erscheint auf iTunes, Spotify, PocketCast, Stitcher oder via RSS Feed. Apple Podcasts unterstützt gegenwärtig kein HTML mehr, weshalb das hier alles etwas durcheinander ist.
Sound & Copyright
- Modem Sound, Creative Commons.
- © Vint Cerf, „Internet shows up in December 1975“, in: IEEE Computer Society, Computing Conversations: Vint Cerf on the History of Packets, December 2012.
- © L0pht Heavy Industries testifying before the United States Senate Committee on Governmental Affairs, Live feed from CSPAN, May 19, 1998.
- © Barack Obama, Cybersecurity and Consumer Protection Summit Address, 13 February 2015, Stanford University, Stanford, CA.
- © Michael Hayden, „We kill people based on meta-data,“ in: The Johns Hopkins Foreign Affairs Symposium Presents: The Price of Privacy: Re-Evaluating the NSA, April 2014.
- © Bruce Schneier, „Complexity is the enemy of security, in IEEE Computer Society, Bruce Schneier: Building Cryptographic Systems, March 2016.
- Beats, Bass & Music created with Apple GarageBand
Der Beitrag 29 WTF kosten Cyber-Angriffe? erschien zuerst auf Percepticon.
35 Episoden
Alle Folgen
×Willkommen auf Player FM!
Player FM scannt gerade das Web nach Podcasts mit hoher Qualität, die du genießen kannst. Es ist die beste Podcast-App und funktioniert auf Android, iPhone und im Web. Melde dich an, um Abos geräteübergreifend zu synchronisieren.