A new cyber crime study about  targeted and politically inspired attacks on countries, was reported on in the NY Times today here. My first reaction was to just sort of shrug...this sort of attack has been going on for a while, last fall saw similar attacks on the White House itself, and the Obama and McCain campaigns. The actual research papers (there are two related papers, one that addresses the targeted attacks on Tibet and the Dalai Lama is here, and a much broader study is available here), have a lot of interesting details- worthwhile reading.

The Dalai Lama attacks were pretty sophisticated, and highly targeted. Attack vectors included malware via targeted e-mails to influential people in the "free tibet" movement, and keystroke loggers which would transfer files and data out via HTTP. In addition, the study found that some of the computing practices in use contributed to the breaches (users storing files and data that was deemed sensitive on local machines that were used to open e-mail, and browse the internet.)

I am encouraged though by what seems to be a more serious look at cyber security by the new US administration. Putting additional healthcare security provisions in the recovery act, to bolster security/privacy ahead of healthcare IT advances such as Electronic Health Records, and health information networks is welcome and needed.

The 90 day Hathaway cyber security review seems promising as well, as does the prospect of bringing cyber security under the direct responsibility and control of a White House official.

Obviously the stakes are pretty high, and whether the attackers are profit motivated or politically motivated, their capabilities are getting pretty scary. As the Shishir Nagaraja/Ross Anderson study points out, the typical enterprise wouldn't stand a chance against this kind of determined attack.

Jim