Taking Action against Attacks

How far should we go in defending our networks? Is it enough to stiffen our defenses and patch vulnerabilities, or should we actively pursue (through legal means, of course) those who work to usurp network resources and steal information? For a growing number of organizations, strengthening the bulwarks is no longer enough--it's time to treat network attackers like criminals.

In the course of the last week, I've had three separate conversations on this topic. One was with the executive director of a new organization called CIDDAC. They're trying to gather the data that law enforcement will require to go after phishing, re-direction, and other attacks. The other two conversations were with executives at Microsoft. The two, coming from different aspects of the security whole, had different takes on what their customers and partners were doing towards actively pursuing the attackers.

I think that we're going to hear more and more about companies and organizations teaming with law enforcement to pursue those who attack networks and customers. Take a listen to the podcast and let me know what you think.