Ross Anderson Rainer B¨ohme Richard Clayton Tyler Moore Disclaimer In August 2007, the European Network and Information Security Agency (ENISA) tendered a study related to the overall subject matter of “Barriers and Incentives for network and information security (NIS) in the Internal Market for e-Communication.” Views and opinions expressed in this report do not necessarily reflect those of ENISA. 2 Security Economics and The Internal Market 1 Executive Summary Network and information security are of significant and growing economic importance. The direct cost to Europe of protective measures and electronic fraud is measured in billions of euros; and growing public concerns about information security hinder the de- velopment of both markets and public services, giving rise to even greater indirect costs. For example, while we were writing this report, the UK government confessed to the loss of child-benefit records affecting 25 million citizens. Further revelations about losses of electronic medical information and of data on children have called into question plans for the development of e-health and other systems. Information security is now a mainstream political issue, and can no longer be con- sidered the sole purview of technologists. Fortunately, information security economics has recently become a live research topic: as well as collecting data on what fails and how, security economists have discovered that systems often fail not for some technical reason, but because the incentives were wrong. An appropriate regulatory framework is just as important for protecting economic and other activity online as it is offline. This report sets out to draw, from both economic principles and empirical data, a set of recommendations about what information security issues should be handled at the Member State level and what issues may require harmonisation – or at least coordination. In this executive summary, we draw together fifteen key policy proposals. We held a consultativemeetinginDecember2007whichestablishedthatalmostalloftheseproposals havewidestakeholdersupport. Webelievetheywillprovideasoundbasisforfutureaction by ENISA and the European Commission. Recommendations 1: There has long been a shortage of hard data about information security failures, as many of the available statistics are not only poor but are collected by parties such as security vendors or law enforcement agencies that have a vested interest in under- or over-reporting. Crime statistics are problematic enough in the traditional world, but things are harder still online because of the novelty and the lack of transparency. For example, citizens who are the victims of fraud often have difficulty finding out who is to blame because the incidents that compromised their personal data may have been covered up by the responsible data controllers. These problems are now being tackled with some success in many US states with security-breach reporting laws, and Europe needs one too. We recommend that the EU introduce a comprehensive security-breach noti- fication law. 2: Our survey of the available statistics has led us to conclude that there are two partic- ularly problematic ‘black holes’ where data are fragmentary or simply unavailable. These are banks and ISPs. On the banking side, only the UK publishes detailed figures for elec- 3 tronic fraud, broken down by the typs of attack. Similar figures are probably available to regulators in other Member States but are not published. We recommend that the Commission (or the European Central Bank) regulate to ensure the publication of robust loss statistics for electronic crime. 3: On the ISP front, it is widely known in the industry that well-run ISPs are diligent about identifying and quarantining infected machines, while badly-run ISPs are not. We recommend that ENISA collect and publish data about the quantity of spam and other bad traffic emitted by European ISPs. 4: People who leave infected machines attached to the network, so that they can send spam, host phishing websites and distribute illegal content, are polluting the digital en- vironment, and the options available are broadly similar to those with which governments fight environmental pollution (a tax on pollution, a cap-and-trade system, or private ac- tion). Rather than a heavyweight central scheme, we think that civil liability might be tried first, and suggest We recommend that the European Union introduce a statutory scale of dam- ages against ISPs that do not respond promptly to requests for the removal of compromised machines, coupled with a right for users to have disconnected machines reconnected if they assume full liability. 5: A contentious political issue is liability for defective software. The software industry has historically disclaimed liability for defects, as did the motor industry for the first sixty years of its existence. There have been many calls for governments to make software vendors liable for the harm done by shoddy products and, as our civilisation comes to depend more and more on software, we will have to tackle the ‘culture of impunity’ among software developers. We take the pragmatic view that software liability is too large an issue to be dealt with in a single Directive, because of the large and growing variety of goods and services in which software plays a critical role. Our suggested strategy is that the Commission take a patient and staged approach. There are already some laws that impose liability regardless of contract terms (for example, for personal injury), and it seems prudent for the time being to leave standalone embedded products to be dealt with by regulations on safety, product liability and consumer rights. Networked systems, however, can cause harm to others, and the Commission should start to tackle this. A good starting point would be to require vendors to certify that their products are secure by default. We recommend that the EU develop and enforce standards for network- connected equipment to be secure by default. This need not mean Common-Criteria certification of consumer electronics; it would be quite sufficient for vendors to self-certify. However, the vendor should be liable if the certification later turns out to have been erroneous. Thus if a brand of TV set is widely compromised and becomes used for hosting phishing and pornography sites, the ISPs who paid penalty charges for providing network connectivity to these TV sets should be 4 able to sue the TV vendor. In this way the Commission can start to move to a more incentive-compatible regime, by relentlessly reallocating slices of liability in response to specific market failures. 6: There has been controversy about vulnerability disclosure and patching. Recent re- search has shown that the approach favoured by the US Computer Emergency Response Team (US CERT) – namely responsible disclosure – gets better results than nondisclos- ure or open disclosure. However, some firms still take a long time to issue patches for vulnerabilities, and we believe that liability would help them along. We recommend that the EU adopt a combination of early responsible vul- nerability disclosure and vendor liability for unpatched software to speed the patch-development cycle. 7: Vendors also dissuade people from patching by bundling patches with upgrades and with disfeatures such as digital rights management. We recommend security patches be offered for free, and that patches be kept separate from feature updates. Likely future steps include making end-users liable for infections if they turn off auto- mated patching or otherwise undermine the secure defaults provided by vendors. A useful analogy is that it’s the car maker’s responsibility to provide seat belts, and the motorist’s responsibility to use them. 8: The next set of issues concern consumer rights. At present, the ability of consumers to get redress when they are the victims of fraud varies considerably across Member States. This issue was fudged during the preparation of the Payment Services Directive but now needs to be brought back on to the agenda. The European Union should harmonise procedures for the resolution of dis- putes between customers and payment service providers over electronic trans- actions. 9: Some companies use marketing techniques that break various EU laws and/or exploit variousloopholesinwaysthatshouldbebannedorthatprovidecoverforcriminalactivity. We need to abolish the business exemption for spam, criminalise firms who buy botnet services through third parties, and criminalise firms that install spyware on consumer computers without full user consent and without providing easy uninstallation. We recommend that the European Commission prepare a proposal for a Dir- ective establishing coherent regime of proportionate and effective sanctions against abusive online marketers. 10: The flip side of this is consumer protection, which will over time become much more complex than just a matter of payment dispute resolution. We already have an Unfair Contract Terms Directive, but stakeholders have raised other issues as well. Consumer protection in the broad sense is too wide for this report but will need attention. ENISA should conduct research, coordinated with other affected stakehold- 5 ers and the European Commission, to study what changes are needed to consumer-protection law as commerce moves online. 11: The IT industry has tended towards dominant suppliers. As systems become increas- ingly interconnected, a common vulnerability could trigger cascading failures. Diversity, then, can be a security issue as well as a competitive one. We recommendthatENISAshouldadvisethecompetitionauthoritieswhenever diversity has security implications. 12: Asforcriticalnationalinfrastructure,oneparticularproblemisthelackofappropriate incentives to provide resilience in competitive network markets. We recommend that ENISA sponsor research to better understand the effects of Internet exchange point (IXP) failures. We also recommend they work with telecomms regulators to insist on best practice in IXP peering resilience. 13: As well as providing the right incentives for vendors and service providers, and protection for consumers, it is important to catch cyber-criminals, who at present act with near impunity thanks to the fragmentation of law-enforcement efforts. In order for the police to prosecute the criminals they catch, cyber-crimes must be offences in all Member States. We recommend that the European Commission put immediate pressure on the 15 EU Member States that have yet to ratify the Council of Europe Convention on Cybercrime. 14: Furthermore, as nearly all cyber-crimes cross national borders, cooperation across jurisdictions must be improved. Joint operations and mutual legal assistance treaties have so far proved inadequate. We recommend the establishment of an EU-wide body charged with facil- itating international co-operation on cyber crime, using NATO as a model. 15: Finally, a number of regulations introduced for other purposes have caused problems for information security researchers and vendors – most notably the dual-use regulation 1334/2000, which controls cryptography with a keylength in excess of 56 bits, and the implementations of the cybercrime convention in some Member States that have crimin- alised the possession of ‘hacking tools’ (which can also catch security researchers). The security industry needs a ‘friend at court’. We recommend that ENISA champion the interests of the information security sector within the European Commission to ensure that regulations introduced for other purposes do not inadvertently harm security researchers and firms. 6 Contents 1 Executive Summary 3 2 Introduction 9 2.1 The online criminal revolution . . . . . . . . . . . . . . . . . . . . . . . . . 9 2.2 Regulatory context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 2.3 Security economics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.4 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 3 Existing economic barriers to security 18 4 Information asymmetries 22 4.1 Security breach disclosure laws . . . . . . . . . . . . . . . . . . . . . . . . . 22 Recommendation 1: Breach notification . . . . . . . . . . . . . . . . . . . . . 26 4.2 Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 4.2.1 What are the statistics for? . . . . . . . . . . . . . . . . . . . . . . 27 4.2.2 What statistics are already being collected? . . . . . . . . . . . . . 28 4.2.3 Case studies of security statistics . . . . . . . . . . . . . . . . . . . 29 4.2.4 How should statistics be collected? . . . . . . . . . . . . . . . . . . 33 4.2.5 Metrics derived from market price information . . . . . . . . . . . . 37 4.3 Information sharing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40 4.3.1 Costs and benefits of sharing . . . . . . . . . . . . . . . . . . . . . . 40 4.3.2 Examples of information sharing . . . . . . . . . . . . . . . . . . . . 43 4.4 Information sharing recommendations . . . . . . . . . . . . . . . . . . . . . 44 Recommendation 2: Electronic crime statistics . . . . . . . . . . . . . . . . . 45 Recommendation 3: Bad traffic statistics . . . . . . . . . . . . . . . . . . . . 46 5 Externalities 47 5.1 Fixing externalities using carrots . . . . . . . . . . . . . . . . . . . . . . . 47 5.2 Fixing externalities using sticks . . . . . . . . . . . . . . . . . . . . . . . . 49 5.2.1 Control points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 5.2.2 Policy options for coping with externalities . . . . . . . . . . . . . . 50 Recommendation 4: Removal of compromised machines . . . . . . . . . . . . . 54 6 Liability assignment 55 6.1 Analogy with car safety . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 6.2 Competition policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 6.3 Product liability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 6.4 Software and systems liability options . . . . . . . . . . . . . . . . . . . . . 59 Recommendation 5: Secure equipment by default . . . . . . . . . . . . . . . . . 60 6.5 Patching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 6.5.1 Challenge 1: Speeding up patch development . . . . . . . . . . . . . 62 Recommendation 6: Responsible disclosure and fast patching . . . . . . . . . . 64 6.5.2 Challenge 2: Increasing patch uptake . . . . . . . . . . . . . . . . . 64 Recommendation 7: Free and separate security patches . . . . . . . . . . . . . 65 6.6 Consumer policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 7 6.6.1 Fair contract terms . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Recommendation 8: Electronic payment dispute resolution . . . . . . . . . . . . 66 6.6.2 Protection against abusive practices . . . . . . . . . . . . . . . . . . 67 Recommendation 9: Sanction abusive online marketers . . . . . . . . . . . . . 68 6.6.3 Consumer protection in general . . . . . . . . . . . . . . . . . . . . 68 Recommendation 10: Consumer-protection law . . . . . . . . . . . . . . . . . 70 7 Dealing with the lack of diversity 71 7.1 Promoting logical diversity . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Recommendation 11: Advise competition authorities . . . . . . . . . . . . . . . 73 7.2 Promoting physical diversity in critical national infrastructure . . . . . . . 73 7.2.1 Common mode failures and single points of failure . . . . . . . . . . 73 7.2.2 Internet exchange points . . . . . . . . . . . . . . . . . . . . . . . . 74 7.2.3 Hacking the critical national infrastructure . . . . . . . . . . . . . . 76 7.2.4 Policy options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 Recommendation 12: Study IXP failures . . . . . . . . . . . . . . . . . . . . . 77 8 Fragmentation of legislation and law enforcement 78 8.1 Criminal law . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78 Recommendation 13: Ratification of Cybercrime Convention . . . . . . . . . . 79 8.2 Improving co-operation across jurisdictions . . . . . . . . . . . . . . . . . . 79 8.2.1 Defining the problem . . . . . . . . . . . . . . . . . . . . . . . . . . 79 8.2.2 Methods for co-operation . . . . . . . . . . . . . . . . . . . . . . . . 80 Recommendation 14: EU-wide co-operation on cyber crime . . . . . . . . . . . 81 9 Other issues 82 9.1 Cyber-insurance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 9.2 Security research and legislation . . . . . . . . . . . . . . . . . . . . . . . . 87 Recommendation 15: Champion information security research . . . . . . . . . . 88 10 Conclusions 89 List of Figures 90 List of Tables 90 List of Acronyms 91 References 93 A Information society indicators on security 104 B Internet exchange points 111 C Methodology 113 8 2 Introduction Until the 1970s, network and information security were largely the concern of national governments. Intelligence agencies used eavesdropping and traffic analysis techniques against rival countries, largely in the context of the Cold War, and attempted to limit in- sofar as was practicable the penetration of their own countries’ networks by rival agencies. A legacy of this period is that in many Member States, the national technical author- ity for information security is an intelligence agency (such as GCHQ/CESG in Britain). There are still national defence concerns entwined with information security, such as the protection of critical national infrastructure. As the Internet becomes fundamental to the provision of ever-more goods and services, a nation or region that suffered a prolonged loss or degradation of network service could face serious consequences. These would not just be the ‘obvious’ problems, such as the dependence on networks of emergency services and of critical services such as healthcare. Logistics are nowadays so automated that within a week or two deliveries of food to supermarkets might start to become erratic. However, as we will discuss in this report, the provision of resilience and assurance to critical infrastructures is no longer a problem that can be solved at the national level alone. Our countries have grown so interdependent that some action is also needed at the community level. From the 1970s until about 2004, however, the centre of gravity in information se- curity shifted from governments to companies. As firms became ever more dependent on networked computer systems, the prospect of frauds and failures has increasingly driven investment in research and development. (The EU market for add-on information secur- ity products and services amounts to some EUR 4.6 billion.) Although there has been much publicity given to incidents of ‘hacking’ in which outsiders – often bored juveniles – penetrated company systems, the real centre of gravity in corporate information secur- ity has been preventing abuse by insiders. In a well-run company, information security mechanisms are only one component of a much larger system of internal control and risk management. This system extends from technical access controls and audit trails through staff training and other cultural aspects to insurance and money-laundering controls; it aims largely at preventing frauds by the company’s own staff. Of course there is some interaction between national-security and corporate concerns; economic espionage may target key companies as well as governments, and much of the critical infrastructure is now in private rather than public management. However the perspectives and incentives of private firms and public agencies are different. 2.1 The online criminal revolution Since about 2004, volume crime has arrived on the scene. All of a sudden, criminals who were carrying out card fraud and attacks on electronic banking got organised, thanks to a small number of criminal organisations and a number of chat-rooms and other electronic fora where criminals can trade stolen card and bank account data, hacking tools and other services. Previously, a card fraudster had to run a vertically-integrated business: he might, for example, buy a card encoding machine, then get a job in a shop where he could take extra copies of customers’ bank cards, and go out at night to draw cash from ATMs using card clones. Similarly, an electronic banking fraud might involve a corrupt 9 “crimeware-book” — 2007/11/5 — 14:14 — page 36 — #36 36 OverviewofCrimeware Chapter1 “crimeware-book” — 2007/11/5 — 14:14 — page 42 — #42 42 OverviewofCrimeware Chapter1 Figure 1.6. A screenshot from web trojan configurator. This partFiciugluarreco1n.8-. Ascreenshotofadatatheftcrimewareconfigurationinterfacewhere figuratorallowstheattackertospecifythesiteforwhichafakelogintihsedfiislpeslaayreedkeptinstandardlocations. Theattackercanspecifydifferenttypesof (Yahoo!,FAOigLu, MreSN1,:orWHoetbmatil)r.oWjahnengaeunseerrvaistitosrthienstiteercfoanficgecuor(nedlfiedbefyntt)tiahlaednatdatodaaccteasstanhdeafntemcariilmadderwessatroewhiinchttehrisfianfcoerm(atriiognhshto)ul.dbe attacker,theuserwillbepresentedwithafakeloginwindowthatoversleanyts.oOnncteoptheconfigurationtoolisrun,theattackerwillseektoplacetheresulting ofthereaSlolouginrcwein:do[4w.3D]ataenteredintothefakewindowwillbetracnrsimmeitwtaedretionstanceonthevictim’smachine. theattacker. bank employee at a call center collecting password data for use by an accomplice. Such crimes were local and inefficient. The emergence of criminal networks has changed that. Someone who can collect elec- tronic banking passwords, or bank card and PIN data, can sell them online to anonymous brokers; and brokers sell them on to cashiers who specialise in money laundering. The money-laundering step becomes further specialised, with spammers recruiting mules who are duped into accepting bank payments and sending them onwards to third countries via Western Union. The collection of bank passwords has become further specialised as phishermen operate websites that appFieguarre1t.o9. bAescrgeeensnhuotionfeadbataanthkeftwcriembewsairteecson,figaunradtionhiinrteerfatcehwehere theusercanspecifyanyarbitraryfileandhaveitsentoverinstantmessenger. spammers to drive bank customers to them. Both the spammers and the phishermen use malware writers, who create the hacking tools that compromise millions of machines. A new profession, the botnet herder, has arisen – the man who manages a large collection of compromised PCs and rents them out to the spammers and phishermen. On occasion, botnets can be used for even more sinister purposes, such as by blackmailers who threaten to take down bookmakers’ websites just before large sporting events – and, in the case of Estonia, to attack a Member State’s infrastructure as a political protest. In the eighteenth century, rapid specialisation by artisans led to the Industrial Re- volution. Adam Smith describes how a pin factory became more efficient by having one worker cutting the wire, another sharpening the pins, and so on; the last few years have seen an online criminal revolution driven along very similar lines. Hacking has turned from a sport into a business, and its tools are becoming increas- ingly commoditised. There has been an explosion of crimeware – malicious software used to perpetrate a variety of online crimes. Crimeware used to require skill to create, but now it’s available almost as a consumer product. Keyloggers, data theft tools and even phishing sites can be constructed using toolkits complete with sophisticated graphical user interfaces. Figure 1 gives screenshots from two such tools. On the left is a web Trojan generator, which creates fake login pages for Yahoo!, AOL, Hotmail and others to be automatically overlaid on the authentic login pages. On the right is a tool for automatically scraping sensitive data from infected computers, such as the Internet Ex- 10