NCJ Number
213525
Journal
Fraud Magazine Volume: 20 Issue: 2 Dated: March/April 2006 Pages: 20-23,45,46
Date Published
March 2006
Length
6 pages
Annotation
This article describes the nature and types of extortion attempts perpetrated through the Internet and suggests ways to counter them.
Abstract
Extortion is the threatening of a person or entity into giving up something in exchange for not being harmed in some way. Cyber extortion modernizes this traditional crime by using the Internet and computers to fashion potential harms to targets unless the target meets the extortionist's demands. Types of Internet-based extortion schemes include the extortionist's intervention into a target's computer system to make real the threat of the theft or destruction of the target's data, defacement of the target's Web site, blocking the target's ability to communicate with customers or clients over the Internet, and placing illicit material on the target's Web site. The key feature of every extortion is the extortionist's ability to penetrate and manipulate the target's Internet-based computer system, which is an essential part of the target's business. The extortionist will typically request money from the target in exchange for not harming the target's Internet-based business. Identification and specialized software are the main techniques for detecting cyber crimes, including extortion. Before attempting to detect a cyber crime, however, an incident response plan should be developed. This plan should focus on preparation, detection, containment, eradication, recovery, and followup. This article describes the features of each of these components. In addition, before a loss occurs, organizations should review their current general insurance policies. Many will find that general commercial and liability coverage excludes cyber attacks; however, many insurers now offer cyber policies that cover cyber extortion, cyber terrorism, hacking, viruses, denial of service attacks, and malicious acts by employees. The article outlines the steps and variables to consider in estimating the losses incurred from a specific cyber attack for insurance purposes. In conclusion, the article advises that continuous security, risk, and education updates are required to keep an organization's risk at an acceptable level. 17 references