Fighting Digital Crime: Evolving Police Methods

The increasing number of cyber-attacks propagated by everyone from nation-state actors to average criminals is blurring lines between cyber-security and public safety, ultimately causing a shift in the role of government and law enforcement in protecting against these threats.
 
Verizon's 2017 Data Breach Investigations Report notes, "In addition to catching criminals in the act, security vendors, law enforcement agencies and organisations of all sizes are increasingly sharing threat intelligence information to help detect ransomware (and other malicious activities) before they reach systems."
 
Using their own behind-the-scenes collaboration venues, threat actors have also become increasingly well-armed and well informed. This can be countered by defenders through better sharing of information tied to trending campaigns, changes in attack vectors, and the emergence of new tools. 
Foreign enemies become domestic enemies from thousands of miles away, calling for not only a deeper investment in cyber-security skills and technologies but a broader framework for timely dissemination of intelligence across all global industry segments, both public and private.
 
Hackers Best Practice 
Cyber-criminal activity has seen an uptick in recent years as new tools and methods for hacking become more accessible. Frameworks and platforms sold in underground forums enable low-skilled attackers to evade defensive barriers, becoming today's petty criminals. 
For example, ransomware-as-a-service has emerged as an attack vector, allowing average Joes with little-to-no cyber knowledge to target both people and businesses using DIY ransomware. Additionally, the sophistication of new technologies used by hackers, such as artificial intelligence, makes malicious advances more difficult to detect.
Traditionally, law enforcement has played a role in cybercrime only after significant damage has been done, for example, when systems are held hostage by ransomware or significant corporate or personal data is stolen. 
However, as attacks become more frequent and the impact increasingly devastating, law enforcement, even on a local level, has a new obligation to establish an effective framework for digital crime-fighting.
 
Get Your Vaccine
According to Verizon's report, information sharing can "act like a vaccine" against cyber-attacks. The report states that the spread of threat information goes beyond "just the indicators of compromise (malware hashes, YARA rules and such), but also [includes] working with law enforcement to investigate and bring the perpetrators to justice. 
It also requires sharing the more general context of cyber-security incidents to inform prioritisation of cyber-security actions and law enforcement efforts to counter particularly damaging threats."
 
Using timely threat intelligence, law enforcement can alert both businesses and consumers of known and suspected attacks, helping them to take proper precautions to "immunise" themselves against the spread of things like malware. This means that as hacking tools and techniques become more widely available, critical threat information that can improve defenses must also become more broadly accessible.
 
So, how can law enforcement begin engaging more broadly in information sharing?
• Tools and communities: There are a number of resources immediately available, including intelligence industry initiatives like information sharing and analysis centers and open source threat feeds that provide relevant cyber-threat data and insights.
• Diversifying expertise: Developing the right expertise on staff, whether that means changing an existing employee's role or hiring an in-house threat analyst, can provide a more direct connection to the intelligence community, and help law enforcement agencies maximize the information they have.
• Establishing the right partners: Threat intelligence partners can range from security vendors to local DHS fusion centers. These partners can provide common indicators and historical context that help prevent attacks, as well as best practices for incident response in the event a breach occurs.
• Focus on forensic data: Leveraging in-house or external digital forensics and incident response resources as sources for key bits of data either during or after cyber-attacks can yield valuable information in the fight against cyber-criminals. 
Sharing information gathered with other law enforcement entities, organisations specialising in post-breach forensics and incident response, companies that have their own incident response resources, and government institutions can create a collective of expert knowledge that is a formidable counter to cyber-criminal activity.
 
Although it is impossible to prevent cyber-criminals from attempting attacks, organisations that properly take advantage of threat information can detect adversaries before they can do damage. Law enforcement plays an important role in this collaboration. 
 
By following best practices for threat intelligence sharing and taking a proactive approach, law enforcement can help pass along important information quickly, and thus enable organisations across all sectors to make better judgments and stop the bad guys in their tracks.
 
Dark Reading
 
You Might Also Read:
 
German Police To Hack Suspect Devices:
 
London Police Hampered By Encryption:
 
Police Can’t Reduce Cybecrime:
« N. Korea Will Unleash Cyber Attacks On The US
Loss Of Cyber Expertise Is A Problem For Trump »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Checkmarx

Checkmarx

Checkmarx provides state-of-the-art application security solutions with static code analysis software.

Cybersixgill

Cybersixgill

Cybersixgill was founded with a single mission: to protect organizations against malicious cyber attacks that come from the deep and dark web, before they materialize.

Valtori

Valtori

Government ICT Centre Valtori provides sector-independent ICT services for the central government, while taking into account the special requirements related to security and preparedness.

Lynx

Lynx

Lynx provides high added value services in the area of information systems security and ICT infrastructure building.

Padlock

Padlock

Padlock is a trusted platform with an intimate knowledge of the cybersecurity industry that connects businesses with freelance professionals

Seekurity

Seekurity

Seekurity is an information security consulting firm specialized in all areas of Cyber Security including Penetration Testing, Vulnerability Assessments and Risk Management.

SIS Certifications (SIS CERT)

SIS Certifications (SIS CERT)

SIS Certifications is an ISO certification body serving more than 10,000 clients in over 15 countries worldwide.

Voxility

Voxility

Voxility provides Infrastructure-as-a-Service in the biggest Internet hubs in the world.

TekSek Cyber Security

TekSek Cyber Security

Preparing you for tomorrow's security threats.

Interos

Interos

Interos is the operational resilience company — reinventing how companies manage their supply chains and business relationships — through a breakthrough AI SaaS platform.

Syracom

Syracom

syracom is a consultancy firm specialized in development of efficient business processes. With our expertise and IT competence, we develop tailored solutions for customers in various industries.

Digital Silence

Digital Silence

Digital Silence is a world-class provider of information security research and consulting services.

Tech Vedika

Tech Vedika

Tech Vedika has access to technical guidance, training and resources from AWS to successfully undertake solution architecture, application development, application migration, and managed services.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.

xdr.global

xdr.global

Xdr.global is a cybersecurity consulting firm, focused on promoting and aligning Extended Detection and Response (XDR) security solutions.

SFY Information Technology

SFY Information Technology

SFY helps companies with Cyber Security and Managed IT, allowing them to focus on what really matters to them.