Stephen Cobb

Independent Research

This article presents four assertions: (1) going online exposes us to a lot of crime, (2) high crime environments are unhealthy, (3) governments and companies that make us go online may be breaching their duty of care, (4) there is an urgent need to reduce cybercrime and support cybercrime victims. The case for these assertions brings together, in...

Pervasive criminal abuse of information and communication technologies has increased the demand for people who can take on the task of securing organizations against the increasing scope and scale of threats. With demand for these cybersecurity professionals growing faster than the supply, a problematic "cybersecurity skills gap" threatens the abil...

The goal of this paper is to advance efforts to improve cybercrime metrics, measures of the scale and impact of cybercrime that are widely considered to be an essential part of any comprehensive enforcement strategy against cybercriminals.

Accurate assessment of risk is vital for effective cybersecurity, yet numerous studies show that perceptions of risk vary considerably, between demographic groups and along gender lines. Leveraging established research in areas like cultural theory of risk perception, plus original research by the authors, this session presents evidence of a “white...

This white paper evaluates claims that there are not enough people in the world with the necessary cybersecurity knowledge, skills, and abilities to meet current demand. Frequently quoted estimates of this global “cyber skills gap” range from 1 million today, to 1.5 million by 2020. If accurate, these numbers have serious implications for the work...

The Health Insurance Portability and Accountability Act (HIPAA) became law 20 years ago this summer. You would think that by now everyone would have figured out all of the ways HIPAA could impact their organizations. Sadly, the word from the front line is that numerous HIPAA liabilities remain overlooked. The best excuse is that the exploitation of...

Over the last four decades, the privacy of personal data has been the subject of legislation and litigation in both the US and the EU. Protection of personal data privacy under the law has been shaped by the interests of multiple constituencies: individuals, commercial organizations, government agencies, law enforcement, and national security servi...

Cybercrime certainly feels like a major threat to the security of networked systems upon which so much of daily life depends in the world today. Criminals routinely use digital networks to steal data, defraud companies and consumers, and disrupt normal business operation in both public and private sectors. But just how big a threat is cybercrime? F...

This chapter discusses different aspects of penetration of computer systems and networks. Both technical and nontechnical aspects come into play when people attempt to penetrate security systems. Penetration of information systems is possible by means of a wide range of methods, some of which are very hard to defend against. People responsible for...

This chapter outlines the threats posed by spam, phishing, and Trojans, and discusses mitigation of those threats. Each of these threats is quite different from the other in some respects, but all three have some important elements in common. They all use deception, prey on the gullibility of computer users and achieve their ends more readily when...

This chapter presents an overview of the hardware elements of computer security. Computer hardware has always played a major role in computer security. Over the years, that role has increased dramatically, due to both the increases in processing power, storage capacity, and communications capabilities as well as the decreases in cost and size of co...

This chapter explains encryption technology and describes its application in areas such as file encryption, message scrambling, authentication, and secure Internet transactions. The ability to transform data so that they are accessible only to authorized persons is just one of the many valuable services performed by the technology commonly referred...

The allure of malware, with its tremendous potential to infiltrate and disrupt digital systems, is understandable. Criminally motivated malware is now directed at all levels and corners of the cyber domain, from servers to endpoints, laptops, smartphones, tablets, and industrial control systems. A thriving underground industry today produces ever-i...

A detailed look at the limitations of satellite-based internet connections, currently being sold as a solution to the broadband needs of rural communities. This paper argues that current satellite internet offerings - with their massive latency, tight usage caps, and high costs - are not a viable option for rural broadband.

This paper addresses the problem of unwanted email, known as spam, which may be commercial or malicious in nature. Unwanted email threatens to overwhelm legitimate email traffic—the messages that people want to receive—and is often used by criminals as a means to sell illegal goods or compromise systems and confidential data (phishing). Reforming e...

The goal of this book is to help businesses and their employees learn what they need to know about privacy as it relates to company Web sites and email.

550 page book on all aspects of personal computer and local area network security in 3 parts. Parts 2 and 3 are available at scobbs.blogspot.com

One in five respondents to an Information Week/Ernst and Young Security Survey admitted that intruders had broken into, or had tried to break into, their corporate networks, via the Internet, during the preceding twelve months. Unfortunately, there is a growing impression that all of the security problems associated with internetworking can be fixe...

For many companies, Internet commerce means taking credit card orders from customers shopping electronic catalogs on the World Wide Web. For others Internet commerce means dealing electronically with clients and suppliers, as an alternative to private, leased-line electronic document interchange (EDI) over value added networks or VANs). This use of...

The Point-to-Point Protocol (PPP) (1) provides a standard method for transporting multi-protocol datagrams over point-to-point links. PPP defines an extensible Link Control Protocol and a family of Network Control Protocols (NCPs) for establishing and configuring different network-layer protocols. This document extends the NCP for establishing and...