8Cybercriminality: Introduction

Cybercrime or computer crime is any criminal activity involving computers and networks. It can range from fraud to unsolicited emails (spam). These crime cases include attacks against computer data and systems, identity theft, the distribution of child sexual abuse images, internet auction fraud, the penetration of online financial services, as well as the deployment of viruses, botnets, and various email scams such as phishing.

One of the best ways to avoid being a victim of cybercrimes and protecting the sensitive information is by making use of impenetrable security that uses a unified system of software and hardware to authenticate any information that is sent or accessed over the Internet.

Cybercrimes are defined as: "Offences that are committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm to the victim directly or indirectly, using modern telecommunication networks such as Internet and mobile phones (SMS/MMS)". Such crimes may threaten the security and financial health of a state. Issues surrounding these types of crime have become high-profile, particularly those surrounding cracking, copyright infringement, child pornography, and child grooming. There are also problems of privacy when confidential information is lost or intercepted, lawfully or otherwise.

It is important to be conscious that is quite impossible to recognize every cyber criminal activity before it affects the targeted entities. For this reason, it is crucial to have a mature approach to cyber security that emphasizes the aspects of early detection and recovery.

An effective incident response procedure includes the following steps:

- Identification of the threat agent which hit the infrastructure.
- Containment of the threat, preventing it from moving laterally within the targeted infrastructure.
- Forensic investigation to identify the affected systems and the way the threat agent has penetrated the computer system.
- Remediate/Recover by restoring IT infrastructure back online and in production once forensics investigation are complete.
- Report and share threat data to higher management and share the data on the incident through dedicated platforms that allow rapid sharing of threat data with law enforcement and other companies.

Unfortunately, the process described is rarely followed. Up until now, the containment and remediation process has been a primary manual human process that makes it non-responsive and inefficient.