29 WTF kosten Cyber-Angriffe?

Die ganzen Ransomware-Gangs da draussen verdienen ja richtig Geld.
Darkside verlangte nette 4 Millionen Dollar vom Betreiber der
Colonia Pipeline. Aber was kostet eigentlich so ein Cyber-Angriff
in der Durchführung? Was sind die laufenden Kosten für
Cyber-Operationen? Was kostet Personal? Wie teuer ist die
Entwicklung von Schadsoftware? Über all diese Fragen wissen wir in
der Forschung ziemlich wenig. Kriminelle und Cyberkommandos sind
wenig gesprächig, wenn es um das Thema Kosten geht. Aus dem
Staatshaushalt kann man das auch nicht rauslesen. Deswegen näheren
wir uns in dieser Folge mal dem Thema an und machen Reverse
Engineering: Wir definieren ein paar Grundannahmen und gucken
darüber, welche Komponenten Cyber-Operationen so brauchen und
welchen Einfluss bestimmte Aspekte wie Dauer, Teamgröße und Auswahl
von Schadsoftware auf den Preis hat. Um das ganze etwas besser
nachzuvollziehen hat ein Kollege von mir ein Tool gebaut, mit dem
man die Kosten für verschiedene Angriffskampagnen modellieren kann.
Viel Spaß damit! Shownotes Cyber Attack Cost Calculator:
https://percepticon.de/material/open-data/cost-of-cyber-attack-calculator/
Ablon, Lillian, and Andy Bogart. 2017. Zero Days, Thousands of
Nights: The Life and Times of Zero-Day Vulnerabilities and Their
Exploits. Research report RR-1751-RC. Santa Monica, Calif: RAND.
Accessed May 26, 2020.
https://www.rand.org/pubs/research_reports/RR1751.html Ablon,
Lillian, Martin C. Libicki, and Andrea A. Golay. 2014. “Markets for
Cybercrime Tools and Stolen Data: Hackers' Bazaar.” Barzashka,
Ivanka. 2013. “Are Cyber-Weapons Effective?” The RUSI Journal 158
(2): 48–56. https://doi.org/10.1080/03071847.2013.787735 Browning,
Kellen. 2021. “Hundreds of Businesses, from Sweden to U.S.,
Affected by Cyberattack.” The New York Times, July 2, 2021.
https://www.nytimes.com/2021/07/02/technology/cyberattack-businesses-ransom.html
Collier, Kevin. 2021. “Luxury Cars and $100 Bills: Police Bust
Ransomware Gang in Ukraine.” Accessed June 17, 2021.
https://www.nbcnews.com/tech/security/ransomware-gang-busted-authorities-ukraine-rcna1199
CompTIA. 2017. “Your Next Move: Cybersecurity Engineer.” Accessed
June 17, 2021.
https://www.comptia.org/blog/your-next-move-cybersecurity-engineer
Cybernews. 2021. “Million-Dollar Deposits and Friends in High
Places: How We Applied for a Job with a Ransomware Gang.”
Cybernews, April 21, 2021.
https://cybernews.com/security/how-we-applied-to-work-with-ransomware-gang/
Deloitte. 2018. “Black-Market Ecosystem. Estimating the Cost of
"Pwnership".” Accessed July 01, 2021.
https://www2.deloitte.com/content/dam/Deloitte/us/Documents/risk/us-risk-black-market-ecosystem.pdf
Jobilize. 2021. “Exploit Developer with Security Clearance Job in
Columbia.” Accessed June 17, 2021.
https://www.jobilize.com/job/exploit-developer-security-clearance-columbia-mount-indie-united-states;jsessionid=e_xYHPefDaUpLRbiI3PaD0IzWOp2-vLK3nILfB0J.web01?src=drblsrch
Lindsay, Jon R. 2013. “Stuxnet and the Limits of Cyber Warfare.”
Security Studies 22 (3): 365–404.
https://doi.org/10.1080/09636412.2013.816122 Malone, Patrick J.
2012. “Offense-Defense Balance in Cyberspace: A Proposed Model.”
Monterey, California. Naval Postgraduate School.
https://calhoun.nps.edu/handle/10945/27863 Payscale. 2021.
“Security Operations Engineer Salary in the United States.”
Accessed June 17, 2021.
https://www.payscale.com/research/US/Job=Security_Operations_Engineer/Salary
Pomerleau, Mark. 2017. “Here’s How DoD Organizes Its Cyber
Warriors.” Accessed June 17, 2021.
https://www.fifthdomain.com/workforce/career/2017/07/25/heres-how-dod-organizes-its-cyber-warriors/
Smeets, Max. 2016. “How Much Does a Cyber Weapon Cost? Nobody
Knows.” Council on Foreign Relations, November 21, 2016.
https://www.cfr.org/blog/how-much-does-cyber-weapon-cost-nobody-knows
Whitney, Lance. 2020. “How Cybercrime Will Cost the World $1
Trillion This Year.” TechRepublic, December 7, 2020.