Until today, Jo Stewart-Rattray remains wary of Internet banking.
"I personally do not recommend it," she told ZDNet Australia recently. When asked what keeps her awake at night, she said: "The idea of acceptable risk in the banking and finance sector when it comes to online and credit card transactions!"
As director of Information Security at Vectra, an Australia-based security consultancy and IT specialist, Stewart-Rattray is more than qualified to talk. She has extensive experience in IT security, providing corporate clients with strategic and technical information security services, vulnerability assessments and business risk guidance throughout the Asia-Pacific region.
The $18 million company caters to a variety of enterprises which hail from banking and finance, transport, manufacturing, retail, health and government sectors.
When and how did your career in computer crime
investigation/forensics begin?
Stewart-Rattray: Whilst I was working in the utilities sector I
was involved in investigating potential misuse of corporate IT
services together with tracking down a cyber stalker and an
identity thief!
What's a normal day at work like?
Stewart-Rattray: Not entirely sure that I know what a normal day
is!
I spend a lot of time educating senior management about the
dangers of the Net and the need for low level in-house forensics
capability. Much of my day is spent liaising with and I guess
interpreting for technical resources and translating their output
into management speak.
What is the most challenging crime you've ever
pursued/still pursuing?
Stewart-Rattray: The most emotionally draining was the case of a
cyber stalker. A lot of my psych skills were required.
This case also required us to be squeaky clean because of the
potential legal ramifications.
Who, in your opinion, is the most dangerous cybercriminal
and why?
Stewart-Rattray: Anyone who uses people and exploits natural
human conditions can be extremely dangerous. A social engineer is
of course a good example of this. These people do not use
technology to gain access to sensitive information in the first
instance but rather use any organisation's weakest link to gain
access …its people.
Which group/gang is the most dangerous online and
why?
Stewart-Rattray: Any group in it for the ego trip ... hacking,
cracking, or indeed, phreaking, simply because they can.
The damage in terms of leaked information can be immense costing
organisation's their reputations along the way.
How is your work performance measured?
Stewart-Rattray: As my consulting team is engaged by corporations
to track down internal issues or external attacks, our success is
measured by our ability to secure their environment or our
ability to prevent the environment from being breached.
Describe, in-length if possible, your most successful
bust?
Stewart-Rattray: One I would prefer not to answer.
We've read stories about criminal gangs allegedly
blackmailing online betting companies, threatening denial of
service attacks unless they pay up ... is this a common
occurrence and if not, do you see this type of activity
increasing? Any idea who's behind this or where these gangs
originate from? Is it advisable for victims to report such
activity if they're threatened?
Stewart-Rattray: Any such activity should be reported to the
e-crime unit of the police service in each state. It's commonly
thought that such activity emanates from behind the old Iron
Curtain. These are not, according to police statistics, a common
occurrence in Australia at present.
In terms of ranking, list your top 5 cybercrime
categories
Stewart-Rattray: According to local eCrime statistics for
computer-related crimes, they are:
- Porn (24 percent)
- Fraud (19 percent)
- Drugs (16 percent)
- Sex (11 percent)
- Assault/Harassment (8 percent)
- Homicide (5 percent)
- Larceny (4 percent)
- Identity (3 percent)
- Terrorism (1 percent)
- Access (1 percent)
In working with local and international law enforcement
agencies, what do you find most challenging? Red tape? Language
barriers?
Stewart-Rattray: Jurisdictional issues!
What more needs to be done to fight cybercrime?
Stewart-Rattray: Ensure that law enforcement agencies have the
staffing and technical levels required to fight the growing
number of computer-related and computer-assisted crimes.
Organisations need also to be aware of their responsibilities in
relation to good governance practices with regard to information
security.
Which area of law enforcement requires the most funding to
fight cybercrimes and why?
Stewart-Rattray: State police services have little funding. A lot
of funding is allocated to the federal sector and for research
into policing methodology however, at state level, e-crime units
seem to be under staffed and have a great deal of trouble keeping
people with good technical skills as they are often poached by
the private sector. This issue relates directly to salary
discrepancies in the public and private sectors.
The youth of today are brought up in an environment
surrounded by computers and high-tech gadgets. Do you forsee a
time when the number of computer crimes will exceed traditional
crimes (such as petty theft, mugging, bank robberies
etc)?
Stewart-Rattray: Not everyone is going to want to sit up nights
in a darkened room by themselves playing at being a super nerd.
There will always be crimes that include blood and guts and
manual means.
What keeps you up at night?
Stewart-Rattray: The idea of acceptable risk in the banking and
finance sector when it comes to online and credit card
transactions!
Would you recommend Internet Explorer or other browsers
such as Firefox and Opera for financial transactions over the
Net?
Stewart-Rattray: I personally do not recommend Internet banking.
As for transactions such as purchases over the Net ... there is
always a risk involved, the idea is to minimise it. Currently
Firefox is picking up momentum in this space.
Is Linux really more secure than Windows?
Stewart-Rattray: More holes are being found in Linux every day.
It should be remembered, that in the world of hacking, where
there's a will there's always going to be a way!
Updated 3 August 2005 7:00PM
this is awesome! well done!