Society of Payment Security Professionals - Payment Security Blog

Cyber Thieves Making More than Drug Traffickers?

**It should be noted that the claim of cyber theft surpassing illegal drugs as a criminal enterprise has been vigorously debated.  While it has been variously reported for some time, it has also been disputed by a number of respected sources. **

CNN released an article today regarding cyber thieves targeting twitter users by embedding malicious URLs in “tweets.” The article was interesting in its own right, but what I found more interesting was a quote regarding the magnitude of the cyber theft industry. According to the article,(Digital Biz Twitter message could be cyber criminal at work,) government officials have said that cyber theft has “eclipsed illegal drugs as a criminal moneymaker.” Furthermore, according to Michael Fraser, director of the Communications Law Centre at the University of Technology Sydney in Australia, these criminal organizations are large enough to support Research & Development departments, distribution channels, customer service and other elements of “corporate structure.”

For most readers here, that will likely not come as a surprise. However, the magnitude of the illegal industry surrounding stolen data provides an object lesson for those of us working to prevent the theft of sensitive consumer information. Namely, that we are dealing with very talented, dedicated organizations, not necessarily individuals, that may be operating from a position of either ideological or financial (in some cases both) motivation. They are not likely to be dissuaded from their activities by the appearance of a properly segmented network and a PCI DSS compliant indicia on a website. While PCI DSS is a good starting point for the protection of data, it does have limitations (of particular note is the fact that the standard only addresses payment card information and not other sensitive customer data) and therefore cannot be the sole method of protection. Despite the efforts of the industry and security professionals, the FBI has reported a 33% increase in Internet Crime (this includes theft of corporate data).

Also of note, is the distribution channel of this news story. It was covered on CNN’s Headline News morning program and featured on their website. The tales of cyber thievery are now mainstream news, which again puts even more pressure on security professionals to protect 100% of the data 100% of the time. Any failure to do so puts the companies suffering breaches - not those causing them - in the sights of those looking to cast blame.