Intelligence analysis for internet security: ideas, barriers, and possibilities

The amazing growth of the Internet, both in size and in influence on our society has lead to increased risks of its exploitation by criminal and terrorist groups. As of now, this exploitation has been relatively limited, at least with respect to the likely activity in the years to come. There is a need to act now to develop and put into place intelligence methodologies to aid analysis of Internet-based national security and criminal threats and to augment existing Internet security practices. These methodologies cannot be a purely technically based, or the true societal significant of Internet activity will be overlooked. They cannot be a purely localized activity, or the divergent needs of various regions and organizations will not be represented. They cannot be simply responsive to incidents, such as viruses or system attacks, or the advantage will remain with the intruders. They cannot be centrally controlled or performed, or the need for rapid `Internet- speed' response will not be met. Internet security threats are distributed, ongoing and multifaceted, so the strategy for dealing with them must be distributed ongoing and multifaceted.