Cybercrime-fighting tools still lacking.

Information-security trade shows abound with products promising to solve any cybersecurity problem from blocking hackers to tracking malicious insiders. But most of these vendors are aiming their products at IT professionals, not law enforcement investigators charged with fighting incidents of cybercrime.

[ILLUSTRATION OMITTED]

To help bridge the chasm between commercial infosec products and those needed to fight cybercrime, the Institute for Security Technology Studies (ISTS), a Dartmouth College think-tank, has released the Gap Analysis Report, a paper that looks at the needs of investigators and maps them against available software tools. It analyzes these needs and looks at more than 200 existing and in-development products to see what is missing.

The report is the second of three ISTS papers on this subject. The first was a national needs assessment that examined the types of challenges that cyberinvestigators face and the kinds of tools they need. (See "Wanted: Tools, Expertise to Fight Cybercrime," "Tech Talk," September 2002.) The third report, Research and Development Agenda, is slated for release later this year. Data for the reports comes from national surveys, law enforcement interviews, and ISTS-led workshops.

In the case of the Gap Analysis Report, researchers created a list of existing tools and their functions and presented it to a prioritization working group comprising investigators from the public, private, and academic sectors. This group was asked to vet the list of technology solutions to see whether it was complete and whether existing needs were addressed by these solutions. They were also asked to prioritize any remaining needs that were not addressed. The resulting matrix shows where there are no, few, or many tools to meet each need.

The analysis revealed needs in areas such as data collection, log analysis, and Internet protocol (IP) tracing. The report showed generally that the "needs of cyberattack investigators have not been met by the available technology solutions."

Andrew MacPherson, technical program coordinator for the ISTS Technical Analysis Group, says one of the common themes of the report is that often tools "don't do things quickly enough, they don't automate the process." Speed is of the essence in any investigation, and without automated data collection tools, cyberinvestigators cannot meet the challenge of collecting data from ISPs and other resources before the trail goes cold.

An appendix presents the eighteen most critical needs requiring additional research and development. Encryption was the first problem area. And perhaps the most challenging. Law enforcement agencies are not likely to obtain the tools to crack encryption for another decade or two, if at all, MacPherson says. But, he adds, perhaps the report will spark "the entrepreneurial spirit to apply scientific advances to unique problems of our criminal justice system."

@ Law Enforcement Tools and Technologies for Investigating Cyber Attacks: Gap Analysis Report is at SM Online.