Criminals grasp the metrics of information value

Identity theft has matured into a full-time criminal activity with plenty of lucrative opportunities for those trading in stolen identities.

The lure of big profits is driving this industry, according to Gartner Fellow, vice president and author Richard Hunter, who says the risk of arrest is extremely low.

"Cybercrime now has better odds of success and profit than kidnapping in Columbia," he said.

"The chance of an ID thief being arrested and prosecuted for the crime is one in 700 - that is better odds than kidnapping in Columbia."

As a result 'cybercrime for profit' attacks are at an all-time high, he said, adding that the number of victims is also at an all-time high.

"We expect this to continue at least on the same level for the next few years," Hunter added.

"If you go to a CFO of a corporation and ask what is their information worth they cannot tell you, but you can go up to a criminal on the street and buy a credit history. One case in the US wholesaled 30,000 credit card records at $US30 a piece which is the equivalent of $900,000.

"The confederates on the street then wholesaled those records at about $US1.8 million and criminal metrics are actually precise indicators," he said.

"A credit card number unsupported by any other documentation is worth about $10 in the US, a credit history retails for $US60 and wholesales for around $30 and Internet-based markets are well established."

Frost & Sullivan security analyst James Turner warns enterprises against using similar metrics when attempting to ascertain a dollar value to identities held on their database.

Turner said such street value estimates offer a "wow" factor to the problem of identity theft, but in terms of minimizing exposure and mitigating threat it is not the most helpful way of calculating risk.

"It is an interesting perspective for people making decisions but not bedrock," Turner said.

"Data maybe worth 'X' amount on the Internet for criminals, but when it comes to loss/expectancy calculations it is all to do with the exposure factor.

"The true risk analysis calculation for exposure is asset value times the exposure factor (as a percent) equals your company's single loss expectancy (SLE), then the SLE times the annual rate of occurrence will give you your annualized loss expectancy."

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email Computerworld
• Follow Computerworld on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark