The Other Shoe Drops on Cybersecurity Legislation

With all the discussion about #cybersecurity legislation this week, a small but important story has gone largely ignored.  On Thursday, the European Parliament called the development of global standards for cybersecurity regulation ending the current "ad hoc" international efforts http://bit.ly/buNBkC

The idea is to create broader legislation and regulation outside of the European union.  This represents an aggressive approach to controlling the many challenges around this issue including global regulation and cooperation rarely seen or suggested. "Despite the borderless nature of the #Internet, international regulation of #online security does not yet exist, resulting in a multiple abuses from small-scale theft and identity fraud to espionage and mass attacks that shut down a business or utility."

Meanwhile crucial piece of US #cybersecurity legislation is moving closer to becoming law after being approved during a Commerce, Science & Transportation Committee hearing Wednesday. 

The #Cybersecurity Act, S. 773, aimed at protecting critical U.S. network infrastructure against cybersecurity threats by fostering collaboration between the federal government and the private sector (#public/private partnership) firms that maintain that infrastructure, is now on its way to the Senate floor.


The Cybersecurity Act calls for a revision of cybersecurity processes and oversight in government, the facilitation of public-private partnerships on keeping computer systems safe, the funding of cybersecurity research, and the hiring of more cybersecurity specialists.  Companion legislation that would create the national cybersecurity adviser position -- the National Cybersecurity Advisor Act, S.778 -- is still pending before the Senate Committee on Homeland Security and Government Affairs.

This past February saw the passage of House cybersecurity bill called the Cybersecurity Enhancement Act of 2009 (HR 4061), first introduced by Rep. Daniel Lipinski (D-IL) last year. That bill funds research and development for a comprehensive cybersecurity plan that would involve the cooperation of several federal agencies http://nyti.ms/bEQpCk

So where is this conversation going?   Global I think but with the United States and Europe leading.  Perhaps they have the most to fear and/or protect.  After all it appears these governments have biggest target on their backs. This will take a while to wind itself through the legislative processes that be, but the future is clear.  Governments have finally heeded the alarm bells, and they are responding.

Why San Diego and Maryland Should Work Together on a National Cybersecurity Effort

Recently Maryland stepped publicly to say that they want to become "the Silicon Valley of cybersecurity". In a report published by the the state, Governor Martin O'Malley says that Maryland has the assets, including a "cluster" of required IT capabilities, to support the federal government's growing cybersecurity requirements.

The report, titled "CyberMaryland," cites Maryland's higher education, R&D, technology workforce, and base of businesses and government agencies as reasons it's well suited to play a central role in cybersecurity.

I applaud Maryland's proactive approach and suggest that San Diego become part of this dialog. Instead of competing with Maryland, I suggest that we reach out and Partner with the state to support their efforts while bolstering our own prospects as a West Coast beacon on cybersecurity. In combating the problem of cyber security, many cities and states must emerge as leaders of cyber and Maryland and San Diego have first mover advantages.

San Diego is well suited to lead cyber from the West Coast, nationally and even internationally due to it's unique characteristics as a community. Collaborative law enforcement, military presence, world class universities focusing on cyber, a border with Mexico and many other factors favor San Diego as a center of cyber excellence.

Governor O'Malley says that "Maryland is poised to lead the nation's war on cyber crime," O'Malley serves co-lead on homeland security for the National Governors' Association Public Safety Task Force and on the U.S. Homeland Security Advisory Council.

Included in the Maryland report is a proposal to establish, via federal funding and a public-private partnership, a National Center of Excellence for Cybersecurity in the Maryland. Potential components will include a "new technology incubator, testing labs, education, and training."

The report also recommends aligning Maryland's cybersecurity initiatives with those of the Obama Administration and developing the state's "brand" as a cybersecurity epicenter.

Maryland does have several advantages in this pursuit. The state is home to more than 50 federal facilities and a dozen military installations. Several government agencies involved in cybersecurity are headquartered in Maryland or have facilities there, including the National Security Agency, Intelligence Advanced Research Projects Activity, and National Institute of Standards and Technology. The DOD's Defense Information Systems Agency plans to relocate to Fort Meade in Maryland next year.

Defense Secretary Robert Gates issued an order last June to establish the U.S. Cyber Command, with a purpose of centralizing the U.S. military's cybersecurity operations. At the time, Gates indicated that Maryland was a preferred location.

While Maryland is well positioned on the East Coast, San Diego is well positioned to serve the needs of the West Coast. We also have a cluster of IT related technologies but our real strength comes in the form of collaboration.

In helping the organize San Diego around cyber as part of the ESET's Securing Our eCity "Model City" project www.securingourecity.org, I have seen stakeholders from government, private and non-profit, education, military step up to support San Diego's need to organize around cyber.

Securing Our eCity "Model City" Stakeholders Meeting Attracts 100 Leaders from Around the US

We are excited to share an near overwhelming and positive response from private and public entities from San Diego, the State of California and Washington DC regarding our Securing Our eCity – Model City Project meeting being held this Wednesday, January 27th at the SDSU Alumni Center in San Diego.

We have over 100 high level stakeholder participants already confirmed. Representatives from the U.S. Department of Homeland Security; Secretary of Emergency Management Agency for the State of California, Mr. Matt Bettenhausen; State of California, Chief Security Information Officer, Mark Weatherford; Attorney General, Karen Hewitt, The Honorable Mayor of San Diego, Jerry Sanders and Industry leaders including representatives from AT&T, Sempra Energy, SAIC, Barney and Barney, Intuit and many more, will be present for our interactive discussion on San Diego becoming a model cyber secure city.

We see SOeC Model Cyber City Project as foundational to the national success of community based cyber security initiatives in 2010. During the first week of December 2009, the Securing Our eCity (SOeC) and National Cyber Security Alliance (NSCA) we held seventeen meetings and touched twenty-nine organizations in San Diego. Fundamentally, we have gained support from the five segments that comprise a city and will allow us, with their engagement, to build out a model cybersecure city template which can be rolled out across North America. The five groups include:

· Government
· Law enforcement
· Education
· Industry
· Community

All key stakeholders have agreed to meet in January and further build the foundation for the model cyber city. We have another twenty to twenty-five organizations that our current stakeholders recommended that we reach out to and potentially invite to join our stakeholder meeting.

We are very excited that you and fellow leaders from the federal, state and local agencies, industry, non-profit associations, law enforcement and our greater San Diego community are able to join us at the Securing Our eCity – Model City Project meeting on 27 January 2010.

We look forward to the participation of all these public and private groups this week in an interactive discussion about how to make San Diego a "model" for cyber security awareness, preparedness and education throughout the nation.

Meeting details:
Securing Our eCity – Model City Project
SDSU Alumni Center
55th Street and Hardy, San Diego, CA
Grand Ballroom

Noon – 5PM
Reception following immediately until 6:30PM

Third Time is a Charm - 3rd APWG/NCSA Online Messaging Convention Meeting

Recently I attended the 3rd APWG/NCSA Online Consumer Messaging Convention meeting in Seattle, WA. This meeting with graciously sponsored by Microsoft. The focus on this working group has been to meet the important challenge laid out by the Obama Administration, http://preview.tinyurl.com/n9jobu

The Online Consumer Messaging Convention was formed as a public/private partnership to craft and propagate essential online safety messages for the general public. Like the "Smokey the Bear" and "Friends Don't Let Friends Drive Drunk" campaigns, a new cyber security ad campaign will seek to create broad awareness and education among the US population about the importance of cyber security best practices.

The Coalition continues to expand to include new members keen on creating a unified cyber security message. The Coalition includes private companies such as Microsoft, Google, Facebook, MySpace, Intuit, SAIC, Paypal, Verisign, Symantec, McAfee, ESET, RSA, Costco, Wal-mart, and association and government members such as National Cyber Security Alliance, Anti Phishing Working Group (the primary organizers of this effort), American Banking Association, US Chamber of Commerce, FTC, IRS, Department of Homeland Security and The White House.

At this meeting, we focused on selecting a quality organization to help lead the development of the actual unified message for cyber. Several RFPs were collected by companies interested in creating the message on behalf of the organization. Proposals were presented and verbally supported by the 3 finalists groups.

While the first 2 working meetings have focused on group organization, establishment of a clear and concise agenda and education of Coalition members about the issues involved, this meeting is getting to the key work the Coalition set out to do.

This has included educational presentations about cyber security education by Carnegie Melon University http://preview.tinyurl.com/66lvtt and Palo Alto Research center http://www.parc.com/, legal advisement around legal entity and IP matters, and cause marketing by The Ad Council http://preview.tinyurl.com/dandg7

The next meeting will take place at the end of RSA in San Francisco on March 5th. This group continues to be a strong example of he power of public/private partnership in addressing the complex issues around making the US a cyber safe nation.

2nd APWG/NCSA Online Consumer Messaging Convention

Last week I attended the 2nd APWG/NCSA Online Consumer Messaging Convention meeting in Washington DC. Rising to an important challenge laid out by the Obama Administration, http://preview.tinyurl.com/n9jobu the Online Consumer Messaging Convention has formed a public/private partnership to craft and propagate essential online safety messages for the general public. Like the "Smokey the Bear" and "Friends Don't Let Friends Drive Drunk" campaigns, a new cyber security ad campaign will seek to create broad awareness and education among the US population about the importance of cyber security best practices.

The Coalition believes that this education is essential to secure and make safe our governmental, military, financial and banking, healthcare and other corporate IT infrastructures and use of the Internet.The Coalition includes private companies such as Microsoft, Google, Facebook, MySpace, Intuit, SAIC, Paypal, Verisign, Symantec, McAfee, ESET, RSA, Costco, Wal-mart, and association and government members such as National Cyber Security Alliance, Anti Phishing Working Group (the primary organizers of this effort), American Banking Association, US Chamber of Commerce, FTC, IRS, Department of Homeland Security and The White House.

The context of this Coalition is wholly agnostic and nonpartisan. The group is working actively to add members to raise our profile in a "big tent" approach that will ensure the Coalition's success and therefore the benefits the general public.

The first 2 working meetings have focused on group organization, establishment of a clear and concise agenda and education of Coalition members about the issues involved. This has included educational presentations about cyber security education by Carnegie Melon University http://preview.tinyurl.com/66lvtt and Palo Alto Research center http://www.parc.com/, legal advisement around legal entity and IP matters, and cause marketing by The Ad Council http://preview.tinyurl.com/dandg7

The next meeting will take place at Microsoft's offices in Seattle in early to mid November of this year.

ESET Secures | San Francisco Rats, Bugs

ESET Secures | San Francisco Rats, Bugs & Maggots | ESET Ads in SF

Posted using ShareThis

Unified Messaging Meeting Held in Los Angeles

I had the opportunity to be part of a very interesting meeting recently in Los Angeles. Held at the offices, of Myspace (part of the News Corp's Fox Interactive Media Group), a group of 25+ companies gathered to discuss the need for unified messaging for cyber security education.

The companies in attendance included Myspace, Facebook, Microsoft, Google, RSA, Costco, Wal-Mart, Intuit, Symantec, McAfee, Trend Micro, AVG and my company ESET. Background and educational lectures where provided by experts from Carnegie Mellon and Palo Alto Research Center.

The mission of this group was to develop an action to develop unified messaging as part of a a national umbrella awareness campaign similar to the 1970s "Give a hoot, don't pollute" http://preview.tinyurl.com/dlt9ku anti-pollution campaign and the Smokey the Bear "Only you!" http://www.smokeybear.com/ a campaign which is now 65 years old.

On May 29th, 2009, President Obama's in his "Remarks by the President on Securing our Nation's Infrastructure" http://preview.tinyurl.com/n9jobu called for a public/private partnership to develop a national campaign. I think our group is working to rise to the occassion.

The next step's for our working group is meet in August in Washington D.C. to meet with government leaders from the Department of Homeland Security and a number of other stakeholders such as the US Chamber of Commerce to enroll their support for the initiative.

12th Annual 2009 NYS Cyber Security Conference

I particpated in excellent panel discussion on June 3-4 in Albany, New York at 12th Annual Cyber Security Conference. The event brought together top experts in cyber security (see presenter bios) http://www.cscic.state.ny.us/security/conferences/security/2009/call.cfm

The 2009 Conference was co-sponsored by the NYS Office of Cyber Security and Critical Infrastructure Coordination (CSCIC) and the University at Albany's School of Business and College of Computing and Information. CSCIC's has been leading and coordinating New York State's cyber security efforts and the University's academic excellence in information assurance combine made it a must-attend event.

The event has become New York State's premier cyber security conference, and attendance has increased five-fold since it began.

I participated with Securing The Perimeter: A Public-Private Sector Discussion on Cyber Security with a number of other panelists including:

Perry Blanchard , Albany CountyThomas Duffy , Deputy Director, NYS Office of Cyber Security and Critical Infrastructure CoordinationMatthew Eggers , Manager, National Security and Emergency Preparedness Department, U.S. Chamber of CommerceCarlos Kizzee, Director, Strategic Initiatives, Critical Infrastructure Cyber Protection and Awareness, National Cyber Security Division, U.S. Department of Homeland SecurityAlan MacQuoid , Associate, Booz Allen Hamilton

The panel discussion focused on the fact that business leaders must not overlook the importance of cyber security as a national concern and policy issue. Last year, federal prosecutors cracked one of the largest cyber crime operations ever committed. They charged nearly a dozen people from five different countries with identity theft and credit card fraud. Also, U.S. members of Congress reported that hackers gained access to Congressional office computers over a period of several months. Both incidents, and several others more recently, indicate a need for greater urgency to protect U.S. communications and information systems.

The U.S. Chamber of Commerce and the U.S. Department of Homeland Security have been visiting several cities in recent months to increase businesses' awareness of, and investments in, cyber security from an enterprise risk management perspective. The Chamber-DHS partnership allows leading experts from federal, state and local government, and industry to bring cyber security practices to the wider business community.

Through its network of state and regional partners, Chamber is coordinating grassroots outreach to business owners and operators and incorporating participation from government stakeholders. In short, the partnership aims to increase greater awareness of the potential consequences from a cyber attack, and to underscore the importance of integrating cyber security into enterprise risk management, emergency management, and business continuity planning, preparedness, and training initiatives.

Obama Grappling with the Politics of Cyber Security

Defense Secretary Robert Gates sent a memo to the Pentagon last week creating a new military command dedicated to cyber security. Gates' memo mandates that the National Security Agency (NSA) is to lead this effort, at least as it pertains to matters of national defense.

Gates' approach signals the Obama Administration’s plans to centralize and elevate cyber security as a major national-security issue. Obama was quick to point out later in the week that Gates' memo intended to set policy for military related issues only, including the use of both defensive and offensive weapons to counteract cyber threats.

This approach still leaves the matter of what the government's role in protection and hardening the public Internet will be, though it's widely known that the NSA will not be able to successfully accomplish its mission without some regulation or control of the public Internet.

Mr. Gates said that he intends "to recommend that Lt. Gen. Keith Alexander, director of the National Security Agency, take on the additional role as commander of the Cyber Command with the rank of a four-star general."

There was no comment from the Melissa Hathaway camp. Hathaway is currently the acting senior director of cyber-security for the National Security and Homeland Security Councils.

In late April Hathaway spoke about a public-private collaboration and threats to national information security at the annual 2009 RSA Conference in San Francisco. Her plans at the time were less than concrete and some speculate that there was some displeasure inside the Obama Administration about Hathaway 60-day review of the plans, programs, and activities throughout the government that address the US' communications and information infrastructure (i.e., cyberspace).

A white house blog on March 2nd stated that "the purpose of the review is to develop a strategic framework to ensure that our initiatives in this area are appropriately integrated, resourced and coordinated both within the Executive Branch and with Congress and the private sector."

The Obama Administration appears to be a bit perplexed about how to manage privacy advocates who are leery of NSA leadership in cyber security vs. the Dept. of Homeland Security which has never fully built competency to handle the many complex technical and infrastructure related issues.

Reuters Story about ESET's "Securing Our eCity" Initative

ESET is sponsoring an important new educational campaign called Securing Our eCity. Launched initially in San Diego, this progam seeks to provide cyber security training to businesses across the nation.

You can find the full story at http://www.reuters.com/article/pressRelease/idUS203859+20-May-2009+BW20090520

An excerpt follows:

The Securing Our eCity initiative was developed as a way to educate and protectconsumers and businesses from the growing threat of cybercrime. The regionalevents will include discussions about online risk factors, including today`sfive biggest online threats, the various ways computer users can fall victim tocybercrime and real-life San Diego cybercrime case studies. Attendees will alsoreceive tips on how to stay safe online and will learn about technologies andtools that help reduce and/or prevent cybercrime.

When/Where:

* Wednesday, May 27, 2009, 12:15 - 1:15 p.m. PTSan Diego State University, Arts & Letters (AL) 101, 5500 Campanile Dr., SanDiego, Calif. 92182*

Thursday, May 28, 2009, 7:30 - 8:30 a.m. PTSan Diego State University, Geology, Math & Computer Science (GMCS) 313, 5500Campanile Dr., San Diego, Calif. 92182

* Thursday, May 28, 2009, 12:15 - 1:15 p.m. PTSan Diego State University, Geology, Math & Computer Science (GMCS) 313, 5500Campanile Dr., San Diego, Calif. 92182

* Friday, May 29, 2009, 5 - 6 p.m. PTSan Diego Chamber of Commerce, Golden Boardroom, 402 West Broadway, San Diego,Calif. 92101

* Monday, June 1, 2009, 8 - 9 a.m. PTUniversity of California, San Diego Extension Sorrento Mesa Center, Room 116,6925 Lusk Blvd., San Diego, Calif. 92121

* Tuesday, June 2, 2009, 8 - 9 a.m. PTUniversity of California, San Diego Extension Mission Valley Center, Ste. 102,404 Camino Del Rio South, San Diego, Calif. 92108

* Wednesday, June 3, 2009, 12 - 1 p.m. PTSan Diego Chamber of Commerce, Golden Boardroom, 402 West Broadway, San Diego,Calif. 92101

* Thursday, June 4, 2009 6 - 7 p.m. PTBonita Library, 4375 Bonita Rd., Bonita, Calif. 91902To register for the event, please visit www.securingourecity.org/news.php, and,to find out how you can become involved in the initiative, please visitwww.securingourecity.org.

I was recently interviewed as part of a cyber security expert roundtable by The San Diego Transcript. Note that I have included the entire article below as viewing at the source requires a paid subscription.

Roundtable discussion
The Daily Transcript
Panel: San Diego could become cyber security leader

By ERIN BRIDGES
Monday, May 11, 2009

San Diego could become the primary hub for cyber security, according to participants of a recent Daily Transcript roundtable.

As cyber security becomes an ever-more important aspect in daily life, local companies could establish themselves and this region as the leaders.
Benito Hobson, corporate relations manager for Integrits Corp., said he thinks the military concentration in the San Diego area makes it a good option.
“You have the military industrial complex, which has spent a lot of time, effort and energy gearing up for the cyber war,” he said. “Years ago we were saying it’s the next frontier. It’s today’s frontier. I think the uniqueness of having that level of concentration right here in such a small and lovely geographic region really helps us.”
Four areas were named as possible leaders -- Boston; Silicon Valley; the Washington, D.C. area; and San Diego.

Roundtable participants discussed the current state of cyber security and the way cyber warfare is developing and changing. They agreed it is becoming an increasingly greater threat that must be thwarted at all levels.

Some participants speculated that with the San Diego defense industry’s efforts in the realm of cyber security and cyber warfare already established, it gives the region a competitive edge.
“San Diego has a very strong core in defense, far more than Silicon Valley, which you could argue is more technical,” said Eric Basu, president of Sentek Consulting. “We also have a strong basis in health care. So I think what we need to do is take a lot of what we’re doing in defense, become the best in that and become known as the area for cyber warfare, for defending defense contractors, and then we apply that to other areas like biotech and health care as well.
“I think if we focus on that, we can target some of the stimulus funds.”
There is money in cyber security and cyber warfare right now, making it an attractive area to do business. And if San Diego can become the center for all things cyber, it will bring that funding into the area and provide a boost to the economy.

Darin Andersen, chief operating officer of ESET, said he thinks cyber security is becoming a more commonly discussed issue on many levels from top government agencies down to the average technology user. And the more it affects individuals’ lives, the more support the industry will get.“I think, because it can have a lot of economic benefit and be something that helps San Diego come out of the current economic doldrums, there’s going to be a lot of economic interest -- people at the chamber and so forth that want to get involved in that,” Andersen said.

“We should be actively competing for that cyber security mind share throughout the world.”

ESET Sponsors Major National Cyber Security Initiative “Securing Our eCity”

“The economy may be weak, but cybercrime has never been stronger” is reason that ESET created an important cyber security initiative aimed at educating business and home users acalled Securing Our eCity. The Securing Our eCity initiative is designed to address cyber security on a global scale through educational programs, tools and technologies, and coordination with legislative and law enforcement agencies. The first phase of Securing Our eCity has already begun on a local level with a series of regional educational events organized with the U.S. Chamber of Commerce. The most recent event, entitled, “Securing the Perimeter: A Public-Private Sector Discussion on Cyber Security,” took place on April 10 at San Diego State University and brought together more than 100 technology and security experts to address the topic of cyber security.

The initiative’s website at www.securingourecity.org also includes educational resources developed by cyber security experts to help users better understand cybercrime and how to protect themselves. Available tools include educational videos, podcasts, articles and best practices guides.

In announcing the initiative nationally at RSA earlier this month, ESET’s CEO, Anton Zajac said that “As a member of the global community, ESET is dedicated to helping computer users understand and protect themselves from the growing risks associated with online activity. We believe that education starts in our own backyard, and in leading this initiative, we aim to educate and promote best practices for cyber security. We would like to help make the U.S. the world’s safest online nation.”

Securing Our eCity was created to educate computer users about online risk factors, including the various ways they could fall victim to cybercrime, and how to protect themselves. Additional objectives include:

Developing resources and funding for cybercrime prevention.
Introducing home and business computer users to technologies and tools that help reduce and or prevent cybercrime.
Develop a voice of advocacy which encourages legislative engagement at the local, state and national levels

“We are proud to live in one of America’s most wired cities,” said Ruben Barrales, president of the San Diego Chamber of Commerce. “But as we all know, with that Internet connection comes risks. We are thrilled to support ESET’s Securing Our eCity initiative, as it provides the education and advocacy needed to encourage legislative engagement around this important and topical issue.”

As the program expands, our goal will be to create elements that our business partners can use to educate their employees, business partners and customers. Stay tuned for more . . .

Experts to Discuss Threat of Massive Cyber Assault

I was recently interviewed by the San Diego Business Journal for an article on Cybersecurity:

By BRAD GRAVES
San Diego Business Journal Staff
It’s more than just protecting your personal computer from a rampaging software worm.
Cybersecurity — as it relates to personal security and national security — will be the topic on the table at a panel discussion April 10 at San Diego State University.
An assault on the nation’s computer networks could be "the next way that the bad guys are going to get at us," said Darin Andersen, chief operating officer of ESET, a San Diego maker of anti-virus software.

Click here to read the rest of the article.

Malware Numbers Prove Cybercrime on the Rise

The lastest numbers support growing awareness that cybercrime is on the rise. We have just learned that the US economy has officially fell into recession in late 2007. This means that recession is already 4 quarters old. It is well known that cybercrime tends to rise during recessionary times as more people turn to a less than honest means to make a living.

A recent online study supports the growth of malware and cybercrime. Microsoft Windows users face an unprecedented number of virus and othe malware threats from a widening variety of sources. New virus and spyware programs are appearing at an alarming rate. In September 2008, Kaspersky Lab reported that the number of virus, adware, Trojan, and other malicious programs tripled during the first six months of 2008 versus the previous six months. In all, the lab’s statistics indicate that some 440,311 new malware programs appeared from January through June, compared to just 136,953 for the preceding six months.

Malware programs continue to mutate; many take advantage of social networking sites, which make it easier to distribute infections via simple e-mail messages supposedly sent by trusted friends. From dangerous rootkits to continually evolving viruses and spyware, Windows users require an anti-malware application that provides effective protection without robbing a system of its computing capacity. Of course, no single program or application is capable of completely protecting a Windows user from all threats, but some applications are better than others.

Private and public entities will need to begin pooling resources to stave off this growing threat. Nearly 10% of all retail purchases are made online. This represents billions of dollars worth of e-Commerce which may be threatened if people begin to distrust online shoppoing and buying.

Cybercrime on the Rise

Computer crime is any criminal activity involving the use of information technology such as a desktop, laptop or server computer. Cybercrime is committed on these networks when they are used for unauthorized access or illegal interception, data or systems interference, misuse of computing and related devices, forgery and phishing (ID theft), electronic fraud and abusive behavior.

A recent PCMag.com article predicts that “cybercrime is likely to wreak as much havoc as the credit crisis in the coming years…” According to Kilian Strauss, a computer security expert from the Organization for Security and Cooperation in Europe (OSCE), cybercrime will cause over $100 billion in financial damage annually on a worldwide basis. In August of this year, the US Department of Justice brought charges against several men (mostly foreign nationals) operating an international stolen credit and debit card distribution ring operating globally from the United States, Ukraine, Balarus, Estonia, China, the Philippines and Thailand. The cybercrime ring successfully generated over $20 million of ill gained revenue.

The current effort to stop cybercrime has been largely uncoordinated. Home and business computer users lack the most basic information about cybercrime threats, let alone time sensitive or emerging and evolving threats. A coalition of public and private stakeholders, including consumer advocates, businesses, governmental agencies (law enforcement and legislative bodies) must be formed to better educate and protect the public against this growing threat to the world economy. Organizations such as the International Multilateral Partnership Against Cyber-Terrorism (IMPACT) http://www.impact-alliance.org are beginning to fill the void.

Only a coordinated effort that includes cybercrime awareness and prevention training, aggressive legislative action and enforcement and the deployment of the latest security technologies will begin to turn back the rapid growth of cybercrime. Security software such as ESET NOD32 and ESET Smart Security is a big part of the solution, but more is needed.

Cybercrime Looms Large on the Horizon

It appears clear that the global economy has slipped into recession. Weak financial and housing markets have begun to translate into delayed IT projects and orders for new equipment, software and related services. This represents the first wave of a slowing business climate and this trend is likely to worsen. Several projects will be canceled and companies will begin to slow pay their bills as a way to conserve cash or worse yet make payroll. We can expect layoffs across all industries which will create opportunity for companies who are still in growth mode.

I believe that these forces are supporting the "Perfect Storm" for Cybercrime. Big clouds are forming on he horizon. An article in today's USA Today reaffirms my belief (USA TODAY) http://www.usatoday.com/money/industries/technology/2008-11-11-thieves-cyber-corporate-data_N.htm

Successful proof of concept that cybercrime is technically and financnially viable using currently available technology is on the rise. This flames of this trend will be fanned by a lack of governmental organization and coorindation and declining econonmic conditions all point toward the onslaught and rapidly increasing cybercriminal activity over the next 5 years.

Software as Service or Cloud Based Solutions?

What are the "real" differences between software as service and cloud based security solutions? Which will predominate going forward? Larry Ellison recently commented that cloud computing will be a failed idea, yet most AV and malware security companies such as Symantec, Trend Micro and McAfee are moving in this direction.

Marketing & Sales Roundtable: Tough Times Sales Strategies

I will be representing ESET on a panel of experts at the AeA Marketing & Sales Roundtable meeting on November 13th. The panel of technology sales executives will discuss how they are combating the effects of tough economic times with innovative direct and indirect sales strategies, campaigns and programs. Investing time in designing and implementing targeted, high-payoff sales approaches is key to both protecting sales and gaining market share at the competitors' expense.discuss ways to keep sales performance within expectations during uncertain economic times. Industry leaders from Websense, Indyme Solutions and The Sales Alliance will also participate on the panel which will be hosted at UCSD.

Champions Rise to the Occassion

We have arrived this year to ESET’s North American Partner’s Conference at a time of global financial and political uncertainty. Likely, some of us are wondering what impact these factors will have on our businesses in the coming months. Historically, a slowing economy has dictated decreased IT spending. In the past, when IT budgets shrink, security budgets usually have taken an even larger percentage hit than IT overall.

Despite our historical experience, I’d like to present several current trends which indicate that spending on IT security may remain constant or even increase during the downturn. Factors driving this change include the growing global threat of cybercrime, greater global awareness about the importance of IT security and the growing regulatory environment. ESET is particularly well positioned in this environment due to the strength of its proactive technology, our strong VAR network and our growing global brand awareness, marketing and customer support.

One likely impact of worsening economic times will be a rise in cybercrime. Several studies show that that during the last three global economic downturns (early 1980s, 1990s, and 2000s) theft and robbery crimes were at their highest rates.(1) Among these statistics were crimes committed against businesses such as data and IP theft on a worldwide basis. These crimes are increasingly perpetrated with the use of computers making intrusion and data protection and data loss prevention top IT priorities. There is a growing awareness by IT professionals and business leaders that cyber threats (including a 10 fold increase in malware objects in 2008) are rapidly expanding in both scale and scope.

Many IT Managers and C-level executives see security and especially malware protection as an insurance policy which protects critical personal and corporate information against the risk of loss or corruption. Companies, like individuals, have been highly resistant to cancelling insurance coverage of any sort during economic downturns. They tend instead to “tighten the belt” by delaying new projects or forgoing luxury purchases. An additional factor to consider is the proliferation of compliance/regulations (SOX, PCI, HIPAA, etc.). These regulations compel organizations to focus significant time, energy and budget on IT security.

Given current trends and taking ESET’s strong product and global presence into account, it is likely that ESET Partners will experience a less severe impact than other players in the market. In a worst case scenario, companies will pull back into “maintenance mode” and some new projects may be delayed. Still we may expect that renewal rates from existing customers will remain steady. Customers are unlikely to forgo protection of their data assets given the current threat and regulatory environment as described. ESET’s commitment to product quality, new feature enhancements coupled with strong customer support will keep us ahead of the market.

1.Montez, Brown, “How to Recession Proof Cyber-Espionage”, September 3, 2008, http://www.webupon.com/writers/Montez%20Brown.68641

Uncertain Times Means Opportunity for ESET

While many continue to debate whether the global economy is in recession now or will be soon, most key economic indicators point to tougher times ahead. Historically, a slowing economy has dictated decreased IT spending. When IT budgets shrink, security budgets usually take an even larger percentage hit than IT overall. In many cases security gets lost or put on hold.

Despite our historical experience, several current trends indicate that spending on IT security may remain constant or even increase during the downturn. Factors driving this change include the growing global threat of cybercrime, greater global awareness about the importance of IT security and the growing regulatory environment. ESET is particularly well positioned in this environment due to the strength of its proactive technology, our strong partner network and our growing global brand awareness, marketing and customer support.

One likely impact of worsening economic times will be a rise in cybercrime. Several studies show that that during the last three global economic downturns (early 1980s, 1990s, and 2000s) theft and robbery crimes were at their highest rates1. This included crimes committed against businesses such as data and IP theft. Since such crimes are increasingly perpetrated with the use of computers, intrusion prevention and data protection are more critical than ever to security managers. This has been especially true in many rapidly developing economies including Eastern Europe, Asia Pacific and Latin American.

One additional factor to consider is the proliferation of compliance/regulations (SOX, PCI, HIPAA, etc.) which are being mirrored by many countries around the world. These regulations compel organizations to focus significant time, energy and budget on IT security. Also, many public and larger companies have stringent reporting requirements; a trend which is likely to continue.

Given current trends and taking ESET’s strong product and global presence into account, it is likely that we will experience a less severe impact than other players in the market. In a worst case scenario, companies will pull back into “maintenance mode” and some new projects may be delayed. Still we may expect that renewal rates from existing customers will remain steady. Customers are unlikely to forgo protection of their data assets given the current threat and regulatory environment as described. ESET’s commitment to product quality, new feature enhancements coupled with strong customer support will keep us competitive in the current market.

The opinions and information presented here are my personal views and not those of ESET.

1.Montez, Brown, “How to Recession Proof Cyber-Espionage”, September 3, 2008. On the web at http://www.webupon.com/writers/Montez%20Brown.68641