Growing Menace

The dynamics of the fraud scenario is changing worldwide. IT in general and

Internet in particular, is emerging as the key battleground perpetrating fraud.

Therefore, technology today, is becoming the key enabler of frauds, making it

simpler to conduct and more difficult to counter.

The variety of criminal activities, which can be committed with or against

information systems, has become surprisingly diverse in the last couple of

years.

While the worldwide scenario on cyber frauds looks bad, the situation in

India isn't better either. Though no concrete data is available, it is roughly

estimated that the cyber crime witnessed an increase of about 40-50% in 2005.

Driving Factors



According to Deepankar Sanwalka, executive director and head of Forensic at

KPMG India, IT's role in frauds has grown significantly, considering the fact

that more and more information for the corporates is residing in the IT systems

such as ERP and databases.  

The online criminal activity has also grown significantly with the increase

in software security flaws. According to California-based research company,

Cupertino, last six months (early 2006) have witnessed a record 1,862 new

software vulnerabilities. Rakesh Mittal, president and COO of Corbus feels that

security holes in Web-based programs are serious threats for businesses.

Attackers can use them to bypass security measures such as Internet firewalls.

Cyber fraudsters are now looking at exploitation of code vulnerabilities in

popular programs such as Microsoft Windows. These include 'zero-day'

attacks, which take advantage of security vulnerability on the same day that the

flaw becomes generally known.

Who's at Risk?



According to Kartik Shahani, director, Sales, India and SAARC, McAfee,

enterprises dealing with both their internal as well as customer sensitive data

would be at risk, as the information could be used for getting financial gains.

Arpinder Singh, director, Forensic at KPMG India believes that the prevalence of

cyber threats is the highest among the IT/ITeS and the financial sector. He

adds, the average age of the employees, specifically in IT and BPO, is

relatively younger and they use Internet widely. A greater technical know-how

further helps. “However, this doesn't rule out the growing cyber fraud

menace in other industry segments, especially biotech, pharma, and FMCG where

information on pricing, costing, and R&D are extremely critical and at high

risk to be prone to theft,” adds Singh.

Changing Dynamics of Cyber Frauds



According to Mittal, for the new generation of financially motivated

hackers, 2006 has brought numerous opportunities to develop more sophisticated

methods. Cyber fraud is emerging in the form of electronic vandalism, terrorism,

extortion, stealing telecommunications services, telecommunications piracy,

pornography, telemarketing fraud, electronic fund transfer crime, and electronic

money laundering. Surendra Singh, head, South East Asia and India, Websense says

businesses are now facing a new type of information security threat whose

characteristics are less widespread in number, more insidious, better-targeted,

financially-motivated, and driven by organized crime.

The trend of bot-led denial-of-service attacks has also increased at an

alarming rate. There has also been a shift towards profiting from current

events, in particular, donation scams for natural disasters. Prime examples were

sites purporting to collect donations for Tsunami or Hurricane Katrina victims.

'Virtual Social Networks' or 'Network of Friends' such as Ringo, MySpace,

Hi5, Plaxo, and Bebo etc can be used for frauds.

Identity Theft: A Growing Scourge



From the early days of 'dumpster diving' to sophisticated online fraud,

identity thieves are always on the prowl for new ways to steal information. The

growing ubiquity of digital data has resulted in an exponential increase in

identity theft over the last 2-3 years. And even, while it continues to remain

mostly under wraps with few cases being reported. Identity theft is becoming

more sophisticated.

Considering the growing complexity and economic impact of the threat, it is

time for the enterprises to graduate to primary defense mechanism such as

role-based management system (role-based access control). According to Navin

Agrawal, practice head, Security Governance, Wipro Infotech, the enterprises

need to concentrate on developing authentication tools around the application

processes, and on the back end, instituting better data-sharing practices, and

streamlining consumer reporting requirements.

Growth Statistics



If you thought that it could not happen to you, think again. Identity theft

is becoming more rampant. As reported by some surveys, the incidence of

victimization caused by identity theft increased from11% to 20% in 2001-2002 and

80% in 2002—2003. The manifold growth continues, say experts.

Experts feel that the increase in identity theft cases is being seen

in India as well. However, as Singh points out, such cases are still

highly under-reported for fear of harassment and negative publicity According to

Capt Felix Mohan, director of SecureSynergy, identity theft has become an

epidemic of frightening proportions as it becomes the number one consumer crime

in the US with someone losing ones identity every two-and-a-half seconds. “In

India concrete statistics on the extent of identity theft is not available, it

would be fair to assume a rapid escalation in identity theft and fraud with

increase in the number of net banking and e-commerce transactions,” he adds.

However, he further cautions that while the common perception is that the

largest risk of identity theft is while buying online, surveys have found that

most of the identity fraud is committed by someone who knows the victim.

Growing Threat Areas



Phishing, pharming, pretexting, skimming, card-not-present fraud, keystroke

catchers, database theft, mail theft, and stealing from residence have grown

considerably in the last 2-3 years.

Phishing is the Internet's biggest identity theft scam and is widely

prevalent in India and has emerged as the primary method used by eCriminals to

extract identities. As per Websense's Web@work survey conducted in India in

2005, almost one in four employees (23% out of the 400 surveyed) stated that

they have given out financial, personal, or confidential data, such as corporate

network passwords or social security numbers, as a result of a phishing



attack.

Effective Remedy



Lack of adequate security can lead to breach, which in turn can lead to huge

damages, both tangible and intangible, for both individuals and enterprises.

This has resulted in a growing traction towards technology tools such as

identity management to safeguard against identity theft. However, technology

tools need to be effectively complemented with the adoption of the right policy

framework for an effective prevention, say experts.

Identity management solutions include access control, directory services,

directory services, and profile update, management of identities. Elaborating on

the trends in the identity management space, Agrawal points out that access

control and profile update are among the promising new technologies in this

domain. He adds that some of the mature and widely deployed technologies

are directory services, especially those using light-weight directory

access protocol (LDAP), password management, Web access management, and Web

single sign-on. “These technologies have significant install bases in

production, and demonstrate real and measurable RoI,” he explains.

To counter identity theft and fraud at a broader and national level, Capt.

Mohan suggests the government to focus on three areas, i.e. legislating specific

provisions to counter identity theft, enabling flow of information from credit

bureaus to consumers, and implementing an identity fraud alert registry.

The IT Act 2000 in its present form does not have any specific provision to

deal with identity thefts. However, the Expert Committee on Amendments to the IT

Act 2000 (whose report is presently under consideration by the government) has

recommended insertion of new sections relating to identity theft in the Indian

Penal Code (IPC). The committee has also sought provisions

for fine and punishments.

Shipra Arora



shipraa@cybermedia.co.in