RSA Conference: Assessing online threats

I'm attending the RSA Conference in San Francisco—billed as the "world's largest security conference and expo"—where security software maker Symantec today revealed a few of the latest online threats, and U.S. Department of Homeland Security Secretary Michael Chertoff offered a few insights into what the federal government is doing to protect U.S. cyberspace.

The biggest threat to your personal data, according to Symantec, comes from the loss of laptops, hard drives, and USB drives, which accounted for 57 percent of the data loss outlined in the company's latest Internet Security Threat Report, released today. In addition, 70 percent of the malicious code unleashed in the last six months of 2007 was meant to steal confidential information. Finally, the creation of malicious software is now outpacing the creation of "good" programs, said Steve Trilling, vice president of Symantec Research Labs.

All this stolen information ends up in an underground marketplace that works just like a legitimate economy, Trilling said. Stolen eBay accounts go for about $8, e-mail passwords for $30, credit cards for as little as 40 cents, and bank accounts for up to $1,000 or so, depending on how much money is in the account. Interestingly, the virtual world is one of the most lucrative. A stolen World of Warcraft account can be worth 100 times more than a credit card.

Threats to the nation's cybersecurity are "one of the critical concerns we have to address in this country," according to Chertoff, who said cyberattacks could cause "human and economic consequences very much on a par with the events of September 11, 2001."

To that end, the government operates U.S. CERT, a 24-hour early warning system for the federal infrastructure. But, said Chertoff, "the time has come to take a quantum leap forward." President Bush recently signed a directive to implement a national cybersecurity initiative that Chertoff likened to the Manhattan Project. The DHS is devoting $115 million to cybersecurity this year, he added.

Chertoff also acknowledged that the federal government needs to take initiative to help individual users to protect themselves. "We need to give people the information they can use to protect themselves," he said. "We're not going to sit on individual computers or invade their computers. It's an educational process."

—Donna Tapellini