About what percentage of the thousands of Identity Theft victims each year actually know their attacker? If you listen to the media and the InfoSec Gurus, you might think that virtually all the Identity Theft incidents are committed by cloaked assailants somewhere beyond the Great Divide, phishing and targeting the masses.
There are two reasons this couldn't be further from the truth: First, the incidents that qualify as "actionable Identity Theft" are restricted to tangible monetary losses, and therefore most attacks go unreported and ignored. This has lead us to a woefully narrow definition of what counts for Identity Theft.
Second, the current popular mindset about Identity Theft does not acknowledge the startling success rate of attackers who know their victims. Between 50-80% of Identity Theft victims know their assailant. While a stranger can only have monetary goals, an attacker who is inside the "trusted network" may have multiple motivations. The proximity a friend, family member, or colleague has to their target enhances their likelihood of success dramatically. While we find comfort in the thought that members of our trusted network will not try to attack us, people sometimes do fall out of favor. Whether it's an ex-employee or an ex-girlfriend, the important issue to realize is that trust is dictated by actions.
At Security Bsides in Las Vegas, July 29th, Elizabeth Wharton and I will give you the tools and tricks to recognize those "skeletons in the closet" that may still be part of your trusted network, and show you how to make them just a memory.
1 comment:
Great! Post the slides from the talk and a paper if you have it... missing BSides but this is a great topic. Having gone through this with a few friends and helping them work through it - I know you're not just shooting BS. Make sure your word is heard!
Post a Comment