Incident Response

About the Bad Guys

Anyone can be the source of or a participant in an information security incident: disgruntled insiders, business competitors, foreign nations, nongovernment groups with a common unifying cause, cybercriminal gangs, white-collar criminals, and even the unwitting end user who clicks Reply-To-All and propagates a virus-bearing email message to everyone inside a corporation, and many others as well. Many times people are involved in an incident and don’t even realize it!

Although the media, government, and Hollywood tend to characterize every incident as being caused by a “hacker,” this book takes exception to that sensational generalization. Instead, this book uses terms like “adversary,” “bad guys,” “attackers,” or “crackers” to describe those malicious folks that cause incidents to happen. Where relevant, more specific terms (e.g., “script kiddie”) is used to describe a particular type of adversary. For more information on the nomenclature associated with the computer security underground, consult the New Hackers’ Dictionary located at http://www.jargon.8hz.com/jargon_toc.html.

Script Kiddie

A script kiddie is someone employing easy-to-use automated attack or exploit tools (that require little or no knowledge) to conduct online attacks, that although noticeable, have little real impact on the victim. However, these tools are constantly evolving, and may soon pose a significant threat to unprepared organizations.