Monday, 27 February 2012

Categorising cyber criminals

An article by Eric Chadbrow ( http://www.bankinfosecurity.com/blogs.php?postID=1206 ) prompted me to look at the different attempts at trying to slot hackers into categories as I had discussed Raoul Chiesa's Hacker Profiling Project with University students whilst teaching on Computer Security and Forensic courses. There have been a number of attempts at trying to slot hackers into categories since Landreth's book "Out of the inner circle" in 1989. I have tabulated the main attempts I found and it is interesting to see how the view on hackers has changed since 1989.

Eric Chabrow (2012)
McAfee (2011)
Roger Grimes (2011)
Marcus Rogers (2008)
Chiesa (2006)
Landreth (1989)
Script Kiddies
Script Kiddies
Cyber criminals
Novice
Wannabe lamer
Novice
Hacking Group
Black Hat Hackers
Spammers and adware spreaders
Cyber-punks
Script-kiddie
Student
Hacktivists
White Hat Hackers
Advanced persistent threat (APT) agents
Internals
Cracker
Tourist
Black Hat Professionals
Hacktivists
Corporate spies
Coders
Ethical hacker
Crasher
Organized Criminal Gangs
State Sponsored Hackers
Hactivists
Old guard hackers
Quiet paranoid and skilled hacker (QPS)
Thief
Nation States
Corporate Spy Hackers
Cyber warriors
Professional criminals
Cyber-warrior

Automated Tool *
Cyber Terrorists
Rogue hackers
Information warriors/cyber-terrorists
Industrial spy




Government agent
Military hacker

The view of hackers has moved on from the collection of computer enthusiasts at the Massachusetts Institute of Technology in the 1960's to today's mainstream use of the term to mean a person who subverts security around a computer system, whether for non-legal (Black Hat Hacker) or legal purposes (White Hat Hacker). With Eric Chabrow's list of categories it is evident that he concentrated on illegal activities of a hacker even through in his article he says "Not all that fall into the hacker category are cyber criminals" I would propose that adding a category of White Hat Professional to cover the non-governmental ethical hacker and security researcher who test computer security with the permission and blessing of the owner of the system would provide a better Taxonomy for classification of hackers.

No comments:

Post a Comment