The list is long and the perimeter vast: the cyber crime extends its range of action in all ganglia of public and private life. There seems to be no safe place to store one's personal or business data, one's memory, one's political choices or one's inventions. All values, or rather data, deemed immaterial have become goods of exchange, blackmail, improper and illegitimate use. How do businesses and institutions respond?
Last week took place in Rome at the La Sapienza University, the presentation of theItalian CyberSecurity Report 2016, created by CIS-Sapienza and the National Cyber Security Laboratory, where the situation on the country's IT security was made. First of all the news of the last 60 days: the current year begins with the Piramid Eye affair, with investigations still underway, and highlights the now consolidated use of malware aimed at intruding into the e-mails and servers of well-known personalities from politics and the economy. A few days later, the authoritative British newspaper The Guardian reveals that the Italian Foreign Minister's emails were under attack for at least four months in 2016.
In mid-February, the German Tlc Authority decided to withdraw a doll from the market because it was considered dangerous for privacy, effectively lifting the lid on the fragility of the Internet of Things (IOT). Also in mid-February, the Italian Government updates the DpCm on the country's IT security, trying to rationalize and update the previous Monti Decree on the operations of the institutional structures set up to supervise Cyber Crime. Among other things, the new Decree integrates with the recent Community provisions – the Network and Information Security Directive – elaborated precisely to make the European information space more secure. On February 22, the Clusit 2016 Report is presented by the Italian Association for IT Security, where, among other things, we read that our country is fully among the top ten in the world in the ranking of Cyber Crime targets.
But the real news, now emerging with particular evidence, is that the battlefield is no longer just that of large institutions or companies, when instead the goal is the backbone of the national economy: medium and small, or even micro, enterprises size. It is precisely in this area that the majority of illicit cyber attacks are concentrated, precisely where the levels of risk awareness, reaction capacity, updating and staff training are lowest. In essence: the culture of physical, logical and organizational security of corporate ICT systems in our country is substantially poor.
There is a scarcity of data, also because it often involves attacks with low economic values (the ransom demand varies in proportion to the extent of the theft, we are talking about hundreds or a few thousand euros), bearable by small companies which, although not to suffer the damage, they pay and are silent. While the news of an attack on an institutional office or a large company makes more noise in the media. According to sources from the Milan Polytechnic, the Italian turnover of Information Security in 2016 grew by 5% compared to the previous year but it concerned only large companies which are interested in 74% of the approximately 980 million invested in the sector. The most affected sectors concern healthcare, large-scale distribution, the banking and finance sector in third place.
The simplest and most well-known attachment mechanism consists of a ransomware (the best known are known as Cerber and Zeus) that enters the memories and appropriates the files present in the systems. Once the attack has been carried out, the information is encrypted and the victim is asked for a ransom to get his data back. The principle that considers an investment in Security as a certain expense in the face of an uncertain possibility is often considered well founded and, with this criterion, the door is left open for cybercriminals who are well aware that, precisely in small and medium-sized companies , in most cases, it is still convinced that a good antivirus is sufficient to avoid the attack. According to Kaspersky Lab, a company engaged in the CyberSec front, this phenomenon in 2016 had a significant surge on the mobile phone front where, in the previous 12 months, mobile malware has tripled its reach, also as a result of the failure to update the operating systems.
Returning to last week's meeting at the Sapienza University of Rome, the Cis Report proposed a sort of IT security memorandum aimed precisely at those companies that have not yet developed a sufficient degree of attention on the subject. It's about 15 Essential CyberSecurity Checks able to activate all the procedures necessary to protect their data, their economic image and identity. But, as Roberto Baldoni who presented the report argued, this grid is effective the more companies are aware of being a target of aggressive IT activities.
Finally, during the same appointment, news of particular importance and significance was given: the University of Rome La Sapienza has activated the first master's degree course in Cybersecurity of this kind present in Italy. As stated by Prof. Luigi Mancini, it is the first interdisciplinary academic response capable of training high-level personnel able to effectively face the challenges of cyber security. According to Forbes magazine, if in 2016 there were over one million workers in the sector, an increase of up to six million is expected for the next three years, just to confirm that the IT space has increasingly become a competitive advantage for countries that are able to secure their assets of data and sensitive information.
