Magazine menu Close Magazine menu

Editor’s pick

data security metaverse

Why brands must get ahead on metaverse privacy and security

Tech experts and brands see the metaverse bringing a new level of immersive consumer experience. But it also brings tough security and privacy challenges.

  • Emerging tech
  • min read
    • While there's much buzz around the metaverse, few conversations focus on its security, privacy and safety. But these challenges may be even bigger in this emerging space than in the rest of the digital world. I spoke with several experts who agree organizations wanting to embrace this new medium must think about the challenges now – not when the metaverse gains full steam. What is the metaverse? The metaverse is an immersive three-dimensional world where people engage in social and commercial activities through digital avatars. Users can access it on many kinds of connected devices, but it's most immersive when used with a virtual reality (VR) headset. There are many metaverses, including that being developed by Meta, formerly Facebook, Horizon Worlds. Some call it the future of the internet. In this metaverse future, our physical and virtual spaces and lives may converge seamlessly. It could create a common place to work, shop and socialize. Some put this future closer than we might think. Global analysts Gartner predict 25 percent of people will spend at least one hour in the metaverse by 2026. Market Research Future says the metaverse market will grow by 45 percent annually until 2030. By contrast, they expect the Internet of Things (IoT) to grow by just 26 percent each year. Little focus on metaverse security and safety "The metaverse's attack surface [possible entry points for malicious actors] is bigger, and it's also a new technology space," says Nick Donarski, co-founder and chief technology officer at blockchain company ORE System. "Developers don't have the experience, technical resources and exposure for long-term understanding of its security and how it applies to organizations." Al Pascual, senior vice president of enterprise risk solutions at identity security provider Sontiq, thinks we can easily get 'ahead of our skis' when it comes to security. "We invent new ways to give people experiences and products using old security paradigms and have to clean up the mess later," he says. "We must think about security before we start deploying the metaverse to everyone." Securing the 'Wild West' "The metaverse is like the Wild West right now. There aren't even any standards yet," says Aarti Dhapte, senior research analyst at Market Research Future and an author of its metaverse market forecast reports. "You can't even regulate it well because everybody doesn't define the metaverse the same way." Gartner defines the metaverse as "a collective virtual space created by the convergence of virtually enhanced physical and digital reality" that's "device-independent and not owned by a single vendor" with "an independent virtual currency." Other definitions include fully immersive experiences, a three-dimensional overlay on the physical world and a persistent collection of universes we can traverse with digital identities and assets. Despite its early stage, many security experts expect the metaverse will see familiar security threats: Social engineering, phishing, identity theft and more. "Cybercriminals' methods are rarely new. More often, they use the same methods in a new channel," says Pascual, whose fraud prevention career includes working for global banks. Adding blockchain to the mix Many think blockchain will play a central role in the metaverse because of the need to decentralize the space and enable the various worlds within it to interoperate. Cryptocurrency, which uses blockchain, is the natural candidate for metaverse ecommerce. The metaverse could use smart contracts – digital transactions stored on blockchain that self-execute under certain conditions – to implement rules. Also a new technology, blockchain adds complexity and security challenges to the metaverse. And while many think its immutability makes it more secure, recent attacks on blockchain highlight its security shortcomings. Virtual currencies, whether cryptocurrency or non-fungible tokens (NFTs,) are also hard to navigate, especially for a big metaverse user group – children. "It's risky for kids and teens to understand handling virtual money in all forms and can lead to big losses," Dhapte says. People still the weakest link Malicious actors most often use people manipulation to attack. For example, Verizon's 2022 Data Breach Investigations Report says 82 percent of data breaches involve a human element. The metaverse's human element is similarly exploitable. The metaverse will also magnify data privacy concerns. Artur Kane, vice president at secure remote access company GoodAccess, says that since the metaverse is a "world attacking even more of our senses," tech giants can use it to make more money with better-targeted advertising. That means tracking even more of our behavior online. "We give away much more information in the metaverse," says Kane, a frequent privacy speaker at industry events. "Companies can learn much about us – like race, sexual interest, potential health issues." He mentions recent research showing how attackers could exploit hardware and application weaknesses to violate privacy. They set up a benign-looking VR escape room game and inferred many participants' attributes, from height to age to location, with high accuracy using just minutes of gameplay. Regulation far behind Lagging data privacy and security regulation adds to the metaverse's Wild West feel. "We're giving away so much more data than we realize," says Kane. "There's huge potential for data breaches and leaks in a new environment where legislation doesn't restrict much." Blockchain regulation is also lacking, which Dhapte thinks could mean greater chance of fraud. "Since various countries don't have fixed regulations for blockchain, tracking fraudulent activities would be a real challenge for governments." User risks in immersive environments The metaverse is a rich playground for abuse – from sexual harassment to virtual assaults. "Any vulnerable group, especially children, faces higher risk as non-consensual contact and communication might be more intrusive and targeted, given how immersive the experience is," Kane says. A survey by global think tank Wunderman Thompson Intelligence found 66 percent of parents familiar with the metaverse have child safety concerns. Fears are not unfounded – one media investigation found behaviors like racist comments and sexually explicit content directed at children. Pascual of Sontiq says metaverse participants exchange little of monetary value today, "But in ten to 20 years, the potential for financial transactions is huge, especially as digital properties gain value. Thefts will become more meaningful." In the meantime, users still risk fraud. Pascual says scams draw kids looking for cryptocurrency and virtual swag. "We've seen evidence of predators targeting children in open worlds like Roblox. Parental oversight, education and control on who children can engage with and what they can see will be key." An investigation as part of Tomorrow Unlocked's hacker:HUNTER video series found rife hacking in children's games like Roblox, for example stealing hard-won digital items. These hacks had considerable impact on the child gamers. It's harder for parents to monitor children consuming content using VR headsets because they can't look over kids' shoulders as with a computer or phone. That gives brands launching metaverse experiences a greater responsibility to protect users. Protecting business in the metaverse For teams responsible for metaverse experiences, security experts like Pascual emphasize the need for moderation. He sees danger for brands in platforms ineffectively moderated. "Brand trust will be critical, so there's a need for moderation, including monitoring to ensure brands aren't easily imitated," he says. Moderation may not be easy. Tech giant Meta's chief technical officer said moderating user behavior "at any meaningful scale is practically impossible." Still, some experts think self-scrutiny by brands, alongside industry collaboration, will be a business imperative in the metaverse. The good news is security concepts are roughly the same in the metaverse, according to Donarski of ORE Systems. "The fundamental security practices carry over because the architecture is the same. It still runs on a server, you have databases on the backend, user and password management, and so on." It may take a while, but the metaverse will likely become a reality. Companies must consider security and privacy before that reality takes shape – whichever version of the metaverse unfolds.
digital presenteism

Presenteeism threatens flexible work gains. Here’s how to beat it.

  • Remote working
  • min read
    • The pandemic forced many businesses to make a swift move to enable      remote work. But it's not just the threat of infection that recommends this shift – remote work can often mean reduced costs and improved productivity. Flexible hours have significant benefits too, like improved talent-attraction and employee health. Despite the promised benefits, businesses offering remote work and flexible hours may still see 'presenteeism' – a greater emphasis on being 'at work' than being effective. Qatalog and Gitlab's Killing Time At Work report found workers spend an extra 67 minutes online every day just to show their colleagues and managers they're 'working'. Why does presenteeism happen? Tony Jamous, founder and chief executive officer of Oyster HR, says, "For many years, [we sat] at a screen for eight hours a day with few breaks. Now, because of increased remote work flexibility, employees are adopting 'non-linear' workdays. These empower employees to do the school run, take a gym break or adjust their schedules to find their optimal focus time." Back when manufacturing drove many economies, workers had to be on site to create output. As office-based work grew, output was less tangible, so we started to equate longer hours with productivity. What makes us productive and effective at work? Tariq Rauf, founder and chief executive officer of Qatalog says, "Someone could be visible and present online for 60 hours a week and achieve little. Whereas, the next person might work for half that time, at different times of the day, and be phenomenally productive." Contrary to popular belief, people who work most effectively are not necessarily those most disciplined, but those who speak to themselves with kindness and self-compassion. Georgetown University professor Cal Newport links peak productivity with deep work, meaning "working for extended periods with full concentration on a single task free from distraction." When it comes to distraction, constant app notifications are a big culprit – knowledge workers receive notifications from an average of 6.2 different apps or tools. Productivity's enemies include stress, anxiety and mental and physical fatigue. Psychotherapist Roxy Rhodes told me, "Mental and physical tiredness compound mistakes, which could negatively impact your career progression. Working through illness also means you may need longer to recover, increasing burnout risk." Dr. Wladislaw Rivkin, associate professor in organizational behavior at Trinity College Dublin agrees that working through illness – even digitally – is a bad idea. H     is research found working when unwell "has a knock-on effect for remote workers' performance on the next day as [it] drains employees' psychological energy, which cannot be fully recovered after work." Business impact of presenteeism Presenteeism can be more detrimental than absenteeism. An "always-on" communication expectation can hamper productivity and cause anxiety. Remote work was meant to level the playing field for employees with disabilities, but if workers feel forced to show up for the sake of it, that benefit is lost. Employee digital surveillance further corrodes trust, and brings challenges of its own making by reducing contextual performance and morale and increasing stress. Workers feel drained, fear their employer is 'out to get them' or retaliate using the likes of mouse jigglers – software or devices that simulate      mouse movements to prevent computer sleep mode from activating, giving the impression the employee is working. "Having to prove you're working by using mouse jigglers or clicking the screen every few minutes indicates a toxic culture. When we hire people, we look for candidates who will take ownership of their work. How long it takes them to accomplish a project is up to them, as long as the output is delivered. We don't need employee tracking software to see output," says Bhavya Arora, talent management and culture partner for sales engagement platform Outplay. Young workers and juniors in a team are more susceptible to practicing presenteeism. Some organizations position choosing your own working hours as a privilege earned by those higher up the career ladder, and junior workers worry their work ethic may be seen as lacking even if they're absent even for a few minutes. How to switch off "always on" culture 1.    Measure performance by output not hours "We don't believe someone's commitment to work or their performance should be measured by how many hours they've worked," says Outplay's Arora. Qatalog founder Rauf agrees, "Organizations should implement an output-driven culture that focuses on the work people do, rather than worrying about when they do it and how long they're at their desk." 2.    Use tools that suit asynchronous work Communication tools that send notifications can reinforce an "always on" culture and mean workers find it hard to switch off. Encouraging 'asynchronous' instead means finding ways for colleagues to work together even when not logged in at the same time. Tariq Rauf, founder and chief executive officer of Qatalog says, "Asynchronous work lets people with caregiving responsibilities fit work around their life." Qatalog tries to enable asynchronous working with their platform, which centralizes knowledge, processes and resources in their platform. Asynchronous communication tools, like Loom for video messaging, CloudApp for screen recording, Yac, which claims voice messaging can eliminate meetings, and Hypercontext for meeting management, aim to provide for effective, high-fidelity communication      for asynchronous work. "With the right technology, you can break down silos and provide visibility across an entire organization," says Rauf. "Once you can see what everyone is working on, with decisions made transparently, trust is much easier to build. It's not a silver bullet, but it's a strong foundation." 3.    Build trust and lead by example Asynchronous communication tools must feed into a culture of trust and empathy. Leaders should hire employees they trust to get the work done, so there's no need to be logged in at the same time. Psychotherapist Rhodes says, "You're setting a precedent for what's expected of your employees – if a staff member sees their boss showing up to work sick, they'll likely feel pressure to do the same." Small but thoughtful changes in how you communicate can also build trust: Don't send employees texts or emails outside work hours. Let team members control their availability, honoring 'do not disturb' statuses. Segment communication channels, for example, using Slack for regular communication but mobile messaging apps only for emergencies. Rhodes also recommends, "Having a non-contact way for employees to announce sickness is effective in some companies. Staff feel anxious about "phoning in sick" and having to have a conversation where they feel they have to justify how ill they are." Management consultancy McKinsey's 2022 report found 40 percent of workers value flexibility so much, it drives their decision to stay in a job or look for a new one. If workers can't do their best work, employers will lose them. Productivity is in work delivered, not hours worked or how fast employees respond to messages. No workplace benefits from performed productivity, and presenteeism can strip remote work of its benefits. Businesses must make sure they give employees the tools and freedom to work in the way that best suits them.
data ethics interview

How data ethicists are helping tech business be better

  • Tech for good
  • min read
    • Using data responsibly is a hot topic. Tech companies must ensure they don't cause harm, for example, by breaching consumer privacy or reinforcing bias through automated decisions. It's a moral and legal question, but it may be unclear how businesses and governments should approach their data responsibilities despite increased regulation. We still see egregious data use practice. Alice Thwaite is technology ethicist and responsible owner for ethics at OmniGOV, MG OMD, working with the UK government on communications and advertising. We chat about what data ethics means in practice. Gemma: What does it mean to be a data ethicist today? Alice: Ethics is the study of how to live. An ethicist takes a theory of how humans want to be treated and how we should interact with the wider world, and thinks about how an action or technology could contribute to that goal. We use ethical methodologies and knowledge about the consequences of a technology or business model to transform the business into one that prioritizes ethics. Businesses have always operated in the realm of ethics, but usually without a systematic approach. Ethicists co-create frameworks with stakeholders like customers, colleagues and wider society so that an organization's values become critical in business decisions. What does that look like in practice? First, we help organizations understand where they're making ethical decisions and show how they'll need a more systematic process to reach their ethical goals. Second, we educate organizations on ethical methodology and issues. Third, we assess practice to understand what the company wants to prioritize and how current practice meets ethical goals, making suggestions like 'ethical pilots.' Finally, we implement and measure ethical pilots so they can become policy. We don't work in a vacuum – we must be in constant contact with various communities. For example, before establishing diversity, equity and inclusion (DEI) initiatives, a company might think racial equality is important but have no roadmap to get there. With an influence campaign, education, auditing and an implementation program, they may still have a way to go. But they're now measuring ethnicity pay gap and thinking about inclusive work environments for different people. They can keep following the 'influence, educate, assess, implement' process to fruition. Where do organizations start? What tips do you have for those keen to start doing ethics? Hire someone to build an ethical program and link them with a sponsor who can ensure the organization implements their recommendations. They may have a degree in philosophy, international relations, social science or community work experience. Ensure they can learn as much as possible about business ethics and support their attempts to transform the culture. Those in data security or compliance should recognize an ethicist has different processes. The goals may be similar, but the process aligns more with social science and humanities methods. What questions should organizations wanting a data ethicist ask? Are we committed to change? Do we want a world prioritizing human values like democracy, dignity and freedom? Are we prepared for the discomfort that comes with changing procedures? If you're prepared to change, write a job description incorporating things I've mentioned and encourage your team members to apply. Opinions reflect those of the expert. Interview edited for clarity.
cyber future interview

How business can use cyber futurism to see what comes next

  • Emerging tech
  • min read
    • With new technologies like the metaverse arriving regularly, how can business leaders and cybersecurity professionals know what new threats to expect? Futurism – analyzing future scenarios to inform today's decision-making – is one way. Victoria Baines is professor of information technology at UK's Gresham College and a former Facebook executive and Europol officer. She uses future scenarios to understand technology today and how we should prepare for threats to come. We chat about what these scenarios reveal about our world today, what might happen with new technologies like the metaverse and what business can do to keep users safe. Gemma: What does it mean to explore the future of cybersecurity through scenarios? Victoria: Scenarios are not predictions, but if you do them right, they tell you as much about your situation now as what might happen in future. It's not just threats – it's how the world's changed, and what the tipping points may be. The pandemic was a tipping point for remote and hybrid working, but many find hybrid work just means doing all the things, all the time – the expectation they'll be available constantly for online and physical meetings. We'd been working up to that for a long time. Reliance on email was a compelling signal we needed to find something better, quieter, with less churn. I think we'll see something like that with the metaverse. We've now got the ultimate business case for it because Zoom and Teams aren't enough to feel like we're really working with people – we're still just on a call. Futures methodology is as much about exploring our present and spotting things in the past. What have you found out about the metaverse through your cyber futures work? Although there's hype and uncertainty around the metaverse, we have certainties about how it will develop. For example, Apple will probably bring out, or at least announce, a mixed-reality headset next year. However expensive, people want to use whatever Apple brings out. So we'll see people wanting Apple's mixed-reality headset in a way they haven't wanted other virtual reality (VR) headsets like Hololens or Oculus. This will significantly speed up metaverse adoption. The metaverse is less of a tipping point and more of an evolution. Roblox, Fortnight and Second Life are already metaverses. They use the feeling of presence and co-presence, and there's old research on this – academics like Mel Slater and Ralph Schroder showed us that being together virtually is emotional – it brings about positive reinforcement. We'll need AI-powered synthetic individuals to bump into in online social spaces because we need to feel like we're interacting with people – shaking hands, having sex and so on. We'll probably need 6G to power and connect all that technology, particularly if we want to use it when out and about. What security implications have you identified in the metaverse? Nothing's 100 percent secure – we must assume there'll be technical and human vulnerabilities in every aspect of VR, augmented reality (AR) and other metaverse-enabling technologies. In these scenarios, we look at all those vulnerabilities. We have signals already, like the panic around 'zoombombing' – hackers interrupting video conferencing with obscene and violent material. It happened because people shared their passwords on the open internet. We needn't panic – basic security measures would deal with it. But it shows that exploitation and infiltration will also play out in VR and AR. Are there new cyberthreats for the metaverse and related immersive technologies, or is it the same threats in new spaces and technologies? Much of it comes back to basic digital hygiene like patching, updating, and installing antivirus software. Basic 'handwashing' can do much to prevent ransomware infections. In that way, the new stuff isn't new, but we haven't given it enough attention. We've viewed online harm as less impactful – as it's not physical abuse, we treat it less seriously. With metaverse technologies, you can physically sense resistance and impact, which means opportunities for physical assault. That has an operational impact for information security and cybersecurity. What implications do these threats have for cybersecurity leaders today? Technical information and security aspects become more important in addressing psychological and physical harms in these connected spaces. Pacemaker interference with medical internet of things (IoT) signals that. We already have people walking around with internet-connected medical devices like defibrillators, insulin pumps and continuous glucose monitors. If those don't function properly, and if somebody dies, the question of responsibility arises. If it hasn't already happened, Chief Information Security Officers will be asked, 'What did the data say about any interference with that pacemaker? Was the firmware up to date?' We can see something similar playing out in the metaverse. Everyone will say it's someone else's responsibility – those who make the hardware will say it's the experience developer's responsibility, they'll say it's the user's responsibility, and so on. People used to thinking only about data security and network security must now consider users' physical safety.
returnship programs

How return-to-work programs boost retention for women in tech

  • Women and diversity
  • min read
    • Mothers returning to work after a career break to raise children face many challenges, from closed doors to employers penalizing resumé gaps to being expected to take a backward step for a more family-friendly role. Research by the Association of British Insurers in 2018 found having children leads to women earning 20 percent less than men long-term. UK charity Pregnant then Screwed's data shows around 62 percent of women returners work fewer hours, change jobs or stop working because of high childcare costs. Support in returning to work How can companies support women to thrive in the workforce while closing the gender pay gap? Harvard Business Review names "returnships," or return-to-work programs, as one of the top five ways. PWC research shows better supporting returners could raise UK women's earnings 1.1 billion British pounds (around 1.5 billion US dollars) while boosting the UK economy 1.7 billion British pounds ($2.3 billion US dollars.) Meta, formerly Facebook, launched its returnships program. People who've been away from work for two years or more and want to re-enter full time are eligible for the 16-week, immersive, paid program. If you show ability to succeed after training and mentorship, you're considered for a full-time position. Returning without starting from scratch With a nearly four-year resumé gap after having two children, IT professional Zandra Otubamowo anticipated picking up her career where she'd left it. But after a string of rejections, she had to consider starting from scratch. She says, "I had many mixed feelings, but the one that stands out was the frustration of trying to get something you know you want, but it's not coming, and you don't know what else to do." Otubamowo continues, "In that gap, it's not like I was sitting at home, just taking care of my family. I was still learning about the technical world, doing training and connecting with people. So what didn't I have? I felt like the gap was the reason." A friend told Otubamowo about Meta's Return to Work program. She applied immediately and started her role as Technical Program Manager in September 2020. Meta hopes its Return-to-Work initiative will help double female employees globally by 2026 – women are currently around 37 percent of their workforce. "The support in the program was like being put into a bubble to protect us, which you don't get when you just come in normally," Otubamowo says. "From my manager to my mentor and my buddy, there were so many people put in place for me to make sure I succeed. You're coming into a space where things are moving so quickly, but in the program, people help you move at your pace. I don't think I could have survived otherwise." "We need more women to feel comfortable coming back into the workforce and not feel like they have to take a paycut or fall behind – that you are going to be given what you deserve," says Otubamowo. Bridging the gender gap Financial services group Nomura launched its Returners Program in 2019 as part of a plan to increase numbers of women in the business. The program gives 12 weeks' induction, training and coaching to anyone who's had a career break of 18 months or more, after which candidates can apply for positions at the company. Most succeed. Nomura is aiming for 33 percent female employees and has so far reached 31 percent. They want 19 percent working at senior level and have reached 14 percent. After a seven-year career break to care for two young daughters, Rachael Grieve recalls jumping back into the job market in 2019 and finding nothing but despair. The yawning gap in her resumé left her with few opportunities that suited her experience and ideal schedule. After a failed interview for an office manager position, "I went home and burst into tears, thinking, "That's it – I'm done." It felt like all these doors were closed. I still remember that desperation and fear, especially after interviews destroy your confidence. You find yourself stuck as to where to go." Soon after, a chance conversation with a friend who still worked at her previous employer, Nomura, led to Grieve returning and setting up the company's Returners Program. Shereen Peeroo Finney, a cybersecurity architect, joined Nomura in 2019 through the program after taking two years away to reassess her career direction and retrain. "We had resumé advice, practice interviews, external mentoring and a 90-day plan. The program helps you regain confidence a lot faster," Peeroo Finney says. Securing the right support and partners for success Tackling gender inequality isn't easy, admits Grieve, now Nomura's global head of learning and development for technology. She feels strongly about leading this program, so it becomes a standard part of Nomura's diversity, equality and inclusion strategy. "Our Chief Information Officer from day one was 100 percent supportive," Grieve says. "It made a massive difference to be given the platform and sponsorship. I also made sure all senior managers understood the caliber of candidates we were getting through it." Specialist firm Inclusivity Partners helps run Nomura's returnship program and similar programs for Shell and Virgin Money. Inclusivity Partners founder Stephanie Dillon says, "If you want to make the difference for women, they need a job. They need pension contributions. They need financial independence. With return programs, you're providing a job opportunity. Now [when the candidate is] back in the market, other companies think, "that's a good candidate," rather than fixating on the career break."

Popular episodes

View all series

Trending stories

neurodiversity interview nicola whiting

How cybersecurity businesses are welcoming neurodiverse talent

  • Women and diversity
  • min read
    • Neurodiversity's importance in organizations is gaining steam, with many large, tech-rich enterprises like Ford, IBM and Microsoft reforming their HR processes to ensure they recruit and retain neurodiverse talent. Neurodivergent people have conditions that mean they think differently than others, for example, autism, attention deficit hyperactivity disorder (ADHD) and dyslexia. I asked Nicola Whiting MBE, co-owner of Titania Group and NeuroCyber board member,  why neurodiversity matters in cybersecurity and how businesses can be more inclusive and supportive of neurodivergent employees. Gemma: Why is neurodiversity important? Nicola: Neurodiversity – where you have many different thinking styles and perspectives – increases the range of ideas in a business, which means competitive advantage in innovation and resilience. It's the opposite of groupthink – when everyone has similar ideas, so businesses stagnate and make poor decisions. More personally, being autistic, I'm saddened by how many brilliant neurodivergent people struggle to get jobs in our industry, despite the known skills gap. JPMorgan Chase reported in 2021 that neurodivergent employees in certain tech roles may be up to 140 percent more productive than neurotypical colleagues. However, businesses still struggle to build inclusive practices that let all neurotypes thrive. I want to help change that. You're on NeuroCyber's advisory board. What are its aims? NeuroCyber's founder and CEO, Mike Spain, has a neurodivergent son. He saw too few opportunities for neurodivergent people in cybersecurity and wanted to change that. NeuroCyber believes in inclusion at every level – over half the board are neurodivergent. We're driven to improve career outcomes for neurodivergent colleagues, enriching the sector and reducing the UK's cyber skills gap. Why does the cybersecurity industry especially benefit from neurodiversity? In cybersecurity, everything we do is either innovation – creating new things – or resilience against attack and business threat. Neurodiversity is essential for both. For example, if you follow the principle 'to defeat an attacker, you must be able to think like an attacker,' you need a variety of neurotypes because attackers are similarly varied. What about in leadership? Should boards and C-suites consider neurodiversity? Absolutely. Boards should be especially wary of groupthink. Many innovative, well-known entrepreneurs are neurodivergent, like Richard Branson, who is dyslexic, and Elon Musk, who is autistic. There are also many neurodivergent industry leaders who don't disclose the fact because they fear stigma. Which cyber organizations are 'doing it right' with neurodiversity? One organization I admire is Genius Within, founded by Dr. Nancy Doyle. They believe in creating inclusive workplaces, allowing neurodivergent people to thrive and maximize their talents and strengths. What's your advice for companies that want to become more diverse and inclusive of neurodiversity? Follow the principle of 'nothing about us without us' (NAUWU.) Teams that can drive their processes and practices are more engaged and have better outcomes. You should also acknowledge that people have unconscious bias that draws them to prefer working with people that look and think like themselves. You can see it in the questions we prioritize in recruitment like, "Will this person fit with the team?" rather than, "What new skills and talents will they bring, and how will we support them?" There's plenty of fantastic advice on reducing bias in hiring and retaining team members, much of which is free. Companies needn't look far to learn how to improve their processes, practices and culture for greater diversity and inclusion. What will organizations gain if they take action on neurodiversity? Taking action on neurodiversity can mean benefits in terms of growth, innovation and resilience to risk. You'll also gain the personal benefits of inclusive, welcoming work environments. It always pays to diversify. Opinions reflect those of the expert. Interview has been edited for clarity.
digital presenteism

Presenteeism threatens flexible work gains. Here’s how to beat it.

  • Remote working
  • min read
    • The pandemic forced many businesses to make a swift move to enable      remote work. But it's not just the threat of infection that recommends this shift – remote work can often mean reduced costs and improved productivity. Flexible hours have significant benefits too, like improved talent-attraction and employee health. Despite the promised benefits, businesses offering remote work and flexible hours may still see 'presenteeism' – a greater emphasis on being 'at work' than being effective. Qatalog and Gitlab's Killing Time At Work report found workers spend an extra 67 minutes online every day just to show their colleagues and managers they're 'working'. Why does presenteeism happen? Tony Jamous, founder and chief executive officer of Oyster HR, says, "For many years, [we sat] at a screen for eight hours a day with few breaks. Now, because of increased remote work flexibility, employees are adopting 'non-linear' workdays. These empower employees to do the school run, take a gym break or adjust their schedules to find their optimal focus time." Back when manufacturing drove many economies, workers had to be on site to create output. As office-based work grew, output was less tangible, so we started to equate longer hours with productivity. What makes us productive and effective at work? Tariq Rauf, founder and chief executive officer of Qatalog says, "Someone could be visible and present online for 60 hours a week and achieve little. Whereas, the next person might work for half that time, at different times of the day, and be phenomenally productive." Contrary to popular belief, people who work most effectively are not necessarily those most disciplined, but those who speak to themselves with kindness and self-compassion. Georgetown University professor Cal Newport links peak productivity with deep work, meaning "working for extended periods with full concentration on a single task free from distraction." When it comes to distraction, constant app notifications are a big culprit – knowledge workers receive notifications from an average of 6.2 different apps or tools. Productivity's enemies include stress, anxiety and mental and physical fatigue. Psychotherapist Roxy Rhodes told me, "Mental and physical tiredness compound mistakes, which could negatively impact your career progression. Working through illness also means you may need longer to recover, increasing burnout risk." Dr. Wladislaw Rivkin, associate professor in organizational behavior at Trinity College Dublin agrees that working through illness – even digitally – is a bad idea. H     is research found working when unwell "has a knock-on effect for remote workers' performance on the next day as [it] drains employees' psychological energy, which cannot be fully recovered after work." Business impact of presenteeism Presenteeism can be more detrimental than absenteeism. An "always-on" communication expectation can hamper productivity and cause anxiety. Remote work was meant to level the playing field for employees with disabilities, but if workers feel forced to show up for the sake of it, that benefit is lost. Employee digital surveillance further corrodes trust, and brings challenges of its own making by reducing contextual performance and morale and increasing stress. Workers feel drained, fear their employer is 'out to get them' or retaliate using the likes of mouse jigglers – software or devices that simulate      mouse movements to prevent computer sleep mode from activating, giving the impression the employee is working. "Having to prove you're working by using mouse jigglers or clicking the screen every few minutes indicates a toxic culture. When we hire people, we look for candidates who will take ownership of their work. How long it takes them to accomplish a project is up to them, as long as the output is delivered. We don't need employee tracking software to see output," says Bhavya Arora, talent management and culture partner for sales engagement platform Outplay. Young workers and juniors in a team are more susceptible to practicing presenteeism. Some organizations position choosing your own working hours as a privilege earned by those higher up the career ladder, and junior workers worry their work ethic may be seen as lacking even if they're absent even for a few minutes. How to switch off "always on" culture 1.    Measure performance by output not hours "We don't believe someone's commitment to work or their performance should be measured by how many hours they've worked," says Outplay's Arora. Qatalog founder Rauf agrees, "Organizations should implement an output-driven culture that focuses on the work people do, rather than worrying about when they do it and how long they're at their desk." 2.    Use tools that suit asynchronous work Communication tools that send notifications can reinforce an "always on" culture and mean workers find it hard to switch off. Encouraging 'asynchronous' instead means finding ways for colleagues to work together even when not logged in at the same time. Tariq Rauf, founder and chief executive officer of Qatalog says, "Asynchronous work lets people with caregiving responsibilities fit work around their life." Qatalog tries to enable asynchronous working with their platform, which centralizes knowledge, processes and resources in their platform. Asynchronous communication tools, like Loom for video messaging, CloudApp for screen recording, Yac, which claims voice messaging can eliminate meetings, and Hypercontext for meeting management, aim to provide for effective, high-fidelity communication      for asynchronous work. "With the right technology, you can break down silos and provide visibility across an entire organization," says Rauf. "Once you can see what everyone is working on, with decisions made transparently, trust is much easier to build. It's not a silver bullet, but it's a strong foundation." 3.    Build trust and lead by example Asynchronous communication tools must feed into a culture of trust and empathy. Leaders should hire employees they trust to get the work done, so there's no need to be logged in at the same time. Psychotherapist Rhodes says, "You're setting a precedent for what's expected of your employees – if a staff member sees their boss showing up to work sick, they'll likely feel pressure to do the same." Small but thoughtful changes in how you communicate can also build trust: Don't send employees texts or emails outside work hours. Let team members control their availability, honoring 'do not disturb' statuses. Segment communication channels, for example, using Slack for regular communication but mobile messaging apps only for emergencies. Rhodes also recommends, "Having a non-contact way for employees to announce sickness is effective in some companies. Staff feel anxious about "phoning in sick" and having to have a conversation where they feel they have to justify how ill they are." Management consultancy McKinsey's 2022 report found 40 percent of workers value flexibility so much, it drives their decision to stay in a job or look for a new one. If workers can't do their best work, employers will lose them. Productivity is in work delivered, not hours worked or how fast employees respond to messages. No workplace benefits from performed productivity, and presenteeism can strip remote work of its benefits. Businesses must make sure they give employees the tools and freedom to work in the way that best suits them.
data ethics interview

How data ethicists are helping tech business be better

  • Tech for good
  • min read
    • Using data responsibly is a hot topic. Tech companies must ensure they don't cause harm, for example, by breaching consumer privacy or reinforcing bias through automated decisions. It's a moral and legal question, but it may be unclear how businesses and governments should approach their data responsibilities despite increased regulation. We still see egregious data use practice. Alice Thwaite is technology ethicist and responsible owner for ethics at OmniGOV, MG OMD, working with the UK government on communications and advertising. We chat about what data ethics means in practice. Gemma: What does it mean to be a data ethicist today? Alice: Ethics is the study of how to live. An ethicist takes a theory of how humans want to be treated and how we should interact with the wider world, and thinks about how an action or technology could contribute to that goal. We use ethical methodologies and knowledge about the consequences of a technology or business model to transform the business into one that prioritizes ethics. Businesses have always operated in the realm of ethics, but usually without a systematic approach. Ethicists co-create frameworks with stakeholders like customers, colleagues and wider society so that an organization's values become critical in business decisions. What does that look like in practice? First, we help organizations understand where they're making ethical decisions and show how they'll need a more systematic process to reach their ethical goals. Second, we educate organizations on ethical methodology and issues. Third, we assess practice to understand what the company wants to prioritize and how current practice meets ethical goals, making suggestions like 'ethical pilots.' Finally, we implement and measure ethical pilots so they can become policy. We don't work in a vacuum – we must be in constant contact with various communities. For example, before establishing diversity, equity and inclusion (DEI) initiatives, a company might think racial equality is important but have no roadmap to get there. With an influence campaign, education, auditing and an implementation program, they may still have a way to go. But they're now measuring ethnicity pay gap and thinking about inclusive work environments for different people. They can keep following the 'influence, educate, assess, implement' process to fruition. Where do organizations start? What tips do you have for those keen to start doing ethics? Hire someone to build an ethical program and link them with a sponsor who can ensure the organization implements their recommendations. They may have a degree in philosophy, international relations, social science or community work experience. Ensure they can learn as much as possible about business ethics and support their attempts to transform the culture. Those in data security or compliance should recognize an ethicist has different processes. The goals may be similar, but the process aligns more with social science and humanities methods. What questions should organizations wanting a data ethicist ask? Are we committed to change? Do we want a world prioritizing human values like democracy, dignity and freedom? Are we prepared for the discomfort that comes with changing procedures? If you're prepared to change, write a job description incorporating things I've mentioned and encourage your team members to apply. Opinions reflect those of the expert. Interview edited for clarity.
cyber future interview

How business can use cyber futurism to see what comes next

  • Emerging tech
  • min read
    • With new technologies like the metaverse arriving regularly, how can business leaders and cybersecurity professionals know what new threats to expect? Futurism – analyzing future scenarios to inform today's decision-making – is one way. Victoria Baines is professor of information technology at UK's Gresham College and a former Facebook executive and Europol officer. She uses future scenarios to understand technology today and how we should prepare for threats to come. We chat about what these scenarios reveal about our world today, what might happen with new technologies like the metaverse and what business can do to keep users safe. Gemma: What does it mean to explore the future of cybersecurity through scenarios? Victoria: Scenarios are not predictions, but if you do them right, they tell you as much about your situation now as what might happen in future. It's not just threats – it's how the world's changed, and what the tipping points may be. The pandemic was a tipping point for remote and hybrid working, but many find hybrid work just means doing all the things, all the time – the expectation they'll be available constantly for online and physical meetings. We'd been working up to that for a long time. Reliance on email was a compelling signal we needed to find something better, quieter, with less churn. I think we'll see something like that with the metaverse. We've now got the ultimate business case for it because Zoom and Teams aren't enough to feel like we're really working with people – we're still just on a call. Futures methodology is as much about exploring our present and spotting things in the past. What have you found out about the metaverse through your cyber futures work? Although there's hype and uncertainty around the metaverse, we have certainties about how it will develop. For example, Apple will probably bring out, or at least announce, a mixed-reality headset next year. However expensive, people want to use whatever Apple brings out. So we'll see people wanting Apple's mixed-reality headset in a way they haven't wanted other virtual reality (VR) headsets like Hololens or Oculus. This will significantly speed up metaverse adoption. The metaverse is less of a tipping point and more of an evolution. Roblox, Fortnight and Second Life are already metaverses. They use the feeling of presence and co-presence, and there's old research on this – academics like Mel Slater and Ralph Schroder showed us that being together virtually is emotional – it brings about positive reinforcement. We'll need AI-powered synthetic individuals to bump into in online social spaces because we need to feel like we're interacting with people – shaking hands, having sex and so on. We'll probably need 6G to power and connect all that technology, particularly if we want to use it when out and about. What security implications have you identified in the metaverse? Nothing's 100 percent secure – we must assume there'll be technical and human vulnerabilities in every aspect of VR, augmented reality (AR) and other metaverse-enabling technologies. In these scenarios, we look at all those vulnerabilities. We have signals already, like the panic around 'zoombombing' – hackers interrupting video conferencing with obscene and violent material. It happened because people shared their passwords on the open internet. We needn't panic – basic security measures would deal with it. But it shows that exploitation and infiltration will also play out in VR and AR. Are there new cyberthreats for the metaverse and related immersive technologies, or is it the same threats in new spaces and technologies? Much of it comes back to basic digital hygiene like patching, updating, and installing antivirus software. Basic 'handwashing' can do much to prevent ransomware infections. In that way, the new stuff isn't new, but we haven't given it enough attention. We've viewed online harm as less impactful – as it's not physical abuse, we treat it less seriously. With metaverse technologies, you can physically sense resistance and impact, which means opportunities for physical assault. That has an operational impact for information security and cybersecurity. What implications do these threats have for cybersecurity leaders today? Technical information and security aspects become more important in addressing psychological and physical harms in these connected spaces. Pacemaker interference with medical internet of things (IoT) signals that. We already have people walking around with internet-connected medical devices like defibrillators, insulin pumps and continuous glucose monitors. If those don't function properly, and if somebody dies, the question of responsibility arises. If it hasn't already happened, Chief Information Security Officers will be asked, 'What did the data say about any interference with that pacemaker? Was the firmware up to date?' We can see something similar playing out in the metaverse. Everyone will say it's someone else's responsibility – those who make the hardware will say it's the experience developer's responsibility, they'll say it's the user's responsibility, and so on. People used to thinking only about data security and network security must now consider users' physical safety.
next level speedgamers

Featured series

Can gamers be hackers?

Next Level, the new installment from hacker:HUNTER real cybercrime series, explores real-life stories of hackers in the gaming industry and discovers if hacking can be a force for good.

Choose a topic

Business

Cybersecurity

Technology

Latest stories

paper dead shredder

Is paper dead?

  • Digital transformation
  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
cybersecurity predictions

What a year of changing cyberthreats can tell business

  • Threat intelligence
  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
neurodiversity interview nicola whiting

How cybersecurity businesses are welcoming neurodiverse talent

  • Women and diversity
  • min read
    • Neurodiversity's importance in organizations is gaining steam, with many large, tech-rich enterprises like Ford, IBM and Microsoft reforming their HR processes to ensure they recruit and retain neurodiverse talent. Neurodivergent people have conditions that mean they think differently than others, for example, autism, attention deficit hyperactivity disorder (ADHD) and dyslexia. I asked Nicola Whiting MBE, co-owner of Titania Group and NeuroCyber board member,  why neurodiversity matters in cybersecurity and how businesses can be more inclusive and supportive of neurodivergent employees. Gemma: Why is neurodiversity important? Nicola: Neurodiversity – where you have many different thinking styles and perspectives – increases the range of ideas in a business, which means competitive advantage in innovation and resilience. It's the opposite of groupthink – when everyone has similar ideas, so businesses stagnate and make poor decisions. More personally, being autistic, I'm saddened by how many brilliant neurodivergent people struggle to get jobs in our industry, despite the known skills gap. JPMorgan Chase reported in 2021 that neurodivergent employees in certain tech roles may be up to 140 percent more productive than neurotypical colleagues. However, businesses still struggle to build inclusive practices that let all neurotypes thrive. I want to help change that. You're on NeuroCyber's advisory board. What are its aims? NeuroCyber's founder and CEO, Mike Spain, has a neurodivergent son. He saw too few opportunities for neurodivergent people in cybersecurity and wanted to change that. NeuroCyber believes in inclusion at every level – over half the board are neurodivergent. We're driven to improve career outcomes for neurodivergent colleagues, enriching the sector and reducing the UK's cyber skills gap. Why does the cybersecurity industry especially benefit from neurodiversity? In cybersecurity, everything we do is either innovation – creating new things – or resilience against attack and business threat. Neurodiversity is essential for both. For example, if you follow the principle 'to defeat an attacker, you must be able to think like an attacker,' you need a variety of neurotypes because attackers are similarly varied. What about in leadership? Should boards and C-suites consider neurodiversity? Absolutely. Boards should be especially wary of groupthink. Many innovative, well-known entrepreneurs are neurodivergent, like Richard Branson, who is dyslexic, and Elon Musk, who is autistic. There are also many neurodivergent industry leaders who don't disclose the fact because they fear stigma. Which cyber organizations are 'doing it right' with neurodiversity? One organization I admire is Genius Within, founded by Dr. Nancy Doyle. They believe in creating inclusive workplaces, allowing neurodivergent people to thrive and maximize their talents and strengths. What's your advice for companies that want to become more diverse and inclusive of neurodiversity? Follow the principle of 'nothing about us without us' (NAUWU.) Teams that can drive their processes and practices are more engaged and have better outcomes. You should also acknowledge that people have unconscious bias that draws them to prefer working with people that look and think like themselves. You can see it in the questions we prioritize in recruitment like, "Will this person fit with the team?" rather than, "What new skills and talents will they bring, and how will we support them?" There's plenty of fantastic advice on reducing bias in hiring and retaining team members, much of which is free. Companies needn't look far to learn how to improve their processes, practices and culture for greater diversity and inclusion. What will organizations gain if they take action on neurodiversity? Taking action on neurodiversity can mean benefits in terms of growth, innovation and resilience to risk. You'll also gain the personal benefits of inclusive, welcoming work environments. It always pays to diversify. Opinions reflect those of the expert. Interview has been edited for clarity.
cyber future interview

How business can use cyber futurism to see what comes next

  • Emerging tech
  • min read
    • With new technologies like the metaverse arriving regularly, how can business leaders and cybersecurity professionals know what new threats to expect? Futurism – analyzing future scenarios to inform today's decision-making – is one way. Victoria Baines is professor of information technology at UK's Gresham College and a former Facebook executive and Europol officer. She uses future scenarios to understand technology today and how we should prepare for threats to come. We chat about what these scenarios reveal about our world today, what might happen with new technologies like the metaverse and what business can do to keep users safe. Gemma: What does it mean to explore the future of cybersecurity through scenarios? Victoria: Scenarios are not predictions, but if you do them right, they tell you as much about your situation now as what might happen in future. It's not just threats – it's how the world's changed, and what the tipping points may be. The pandemic was a tipping point for remote and hybrid working, but many find hybrid work just means doing all the things, all the time – the expectation they'll be available constantly for online and physical meetings. We'd been working up to that for a long time. Reliance on email was a compelling signal we needed to find something better, quieter, with less churn. I think we'll see something like that with the metaverse. We've now got the ultimate business case for it because Zoom and Teams aren't enough to feel like we're really working with people – we're still just on a call. Futures methodology is as much about exploring our present and spotting things in the past. What have you found out about the metaverse through your cyber futures work? Although there's hype and uncertainty around the metaverse, we have certainties about how it will develop. For example, Apple will probably bring out, or at least announce, a mixed-reality headset next year. However expensive, people want to use whatever Apple brings out. So we'll see people wanting Apple's mixed-reality headset in a way they haven't wanted other virtual reality (VR) headsets like Hololens or Oculus. This will significantly speed up metaverse adoption. The metaverse is less of a tipping point and more of an evolution. Roblox, Fortnight and Second Life are already metaverses. They use the feeling of presence and co-presence, and there's old research on this – academics like Mel Slater and Ralph Schroder showed us that being together virtually is emotional – it brings about positive reinforcement. We'll need AI-powered synthetic individuals to bump into in online social spaces because we need to feel like we're interacting with people – shaking hands, having sex and so on. We'll probably need 6G to power and connect all that technology, particularly if we want to use it when out and about. What security implications have you identified in the metaverse? Nothing's 100 percent secure – we must assume there'll be technical and human vulnerabilities in every aspect of VR, augmented reality (AR) and other metaverse-enabling technologies. In these scenarios, we look at all those vulnerabilities. We have signals already, like the panic around 'zoombombing' – hackers interrupting video conferencing with obscene and violent material. It happened because people shared their passwords on the open internet. We needn't panic – basic security measures would deal with it. But it shows that exploitation and infiltration will also play out in VR and AR. Are there new cyberthreats for the metaverse and related immersive technologies, or is it the same threats in new spaces and technologies? Much of it comes back to basic digital hygiene like patching, updating, and installing antivirus software. Basic 'handwashing' can do much to prevent ransomware infections. In that way, the new stuff isn't new, but we haven't given it enough attention. We've viewed online harm as less impactful – as it's not physical abuse, we treat it less seriously. With metaverse technologies, you can physically sense resistance and impact, which means opportunities for physical assault. That has an operational impact for information security and cybersecurity. What implications do these threats have for cybersecurity leaders today? Technical information and security aspects become more important in addressing psychological and physical harms in these connected spaces. Pacemaker interference with medical internet of things (IoT) signals that. We already have people walking around with internet-connected medical devices like defibrillators, insulin pumps and continuous glucose monitors. If those don't function properly, and if somebody dies, the question of responsibility arises. If it hasn't already happened, Chief Information Security Officers will be asked, 'What did the data say about any interference with that pacemaker? Was the firmware up to date?' We can see something similar playing out in the metaverse. Everyone will say it's someone else's responsibility – those who make the hardware will say it's the experience developer's responsibility, they'll say it's the user's responsibility, and so on. People used to thinking only about data security and network security must now consider users' physical safety.
data ethics interview

How data ethicists are helping tech business be better

  • Tech for good
  • min read
    • Using data responsibly is a hot topic. Tech companies must ensure they don't cause harm, for example, by breaching consumer privacy or reinforcing bias through automated decisions. It's a moral and legal question, but it may be unclear how businesses and governments should approach their data responsibilities despite increased regulation. We still see egregious data use practice. Alice Thwaite is technology ethicist and responsible owner for ethics at OmniGOV, MG OMD, working with the UK government on communications and advertising. We chat about what data ethics means in practice. Gemma: What does it mean to be a data ethicist today? Alice: Ethics is the study of how to live. An ethicist takes a theory of how humans want to be treated and how we should interact with the wider world, and thinks about how an action or technology could contribute to that goal. We use ethical methodologies and knowledge about the consequences of a technology or business model to transform the business into one that prioritizes ethics. Businesses have always operated in the realm of ethics, but usually without a systematic approach. Ethicists co-create frameworks with stakeholders like customers, colleagues and wider society so that an organization's values become critical in business decisions. What does that look like in practice? First, we help organizations understand where they're making ethical decisions and show how they'll need a more systematic process to reach their ethical goals. Second, we educate organizations on ethical methodology and issues. Third, we assess practice to understand what the company wants to prioritize and how current practice meets ethical goals, making suggestions like 'ethical pilots.' Finally, we implement and measure ethical pilots so they can become policy. We don't work in a vacuum – we must be in constant contact with various communities. For example, before establishing diversity, equity and inclusion (DEI) initiatives, a company might think racial equality is important but have no roadmap to get there. With an influence campaign, education, auditing and an implementation program, they may still have a way to go. But they're now measuring ethnicity pay gap and thinking about inclusive work environments for different people. They can keep following the 'influence, educate, assess, implement' process to fruition. Where do organizations start? What tips do you have for those keen to start doing ethics? Hire someone to build an ethical program and link them with a sponsor who can ensure the organization implements their recommendations. They may have a degree in philosophy, international relations, social science or community work experience. Ensure they can learn as much as possible about business ethics and support their attempts to transform the culture. Those in data security or compliance should recognize an ethicist has different processes. The goals may be similar, but the process aligns more with social science and humanities methods. What questions should organizations wanting a data ethicist ask? Are we committed to change? Do we want a world prioritizing human values like democracy, dignity and freedom? Are we prepared for the discomfort that comes with changing procedures? If you're prepared to change, write a job description incorporating things I've mentioned and encourage your team members to apply. Opinions reflect those of the expert. Interview edited for clarity.
digital presenteism

Presenteeism threatens flexible work gains. Here’s how to beat it.

  • Remote working
  • min read
    • The pandemic forced many businesses to make a swift move to enable      remote work. But it's not just the threat of infection that recommends this shift – remote work can often mean reduced costs and improved productivity. Flexible hours have significant benefits too, like improved talent-attraction and employee health. Despite the promised benefits, businesses offering remote work and flexible hours may still see 'presenteeism' – a greater emphasis on being 'at work' than being effective. Qatalog and Gitlab's Killing Time At Work report found workers spend an extra 67 minutes online every day just to show their colleagues and managers they're 'working'. Why does presenteeism happen? Tony Jamous, founder and chief executive officer of Oyster HR, says, "For many years, [we sat] at a screen for eight hours a day with few breaks. Now, because of increased remote work flexibility, employees are adopting 'non-linear' workdays. These empower employees to do the school run, take a gym break or adjust their schedules to find their optimal focus time." Back when manufacturing drove many economies, workers had to be on site to create output. As office-based work grew, output was less tangible, so we started to equate longer hours with productivity. What makes us productive and effective at work? Tariq Rauf, founder and chief executive officer of Qatalog says, "Someone could be visible and present online for 60 hours a week and achieve little. Whereas, the next person might work for half that time, at different times of the day, and be phenomenally productive." Contrary to popular belief, people who work most effectively are not necessarily those most disciplined, but those who speak to themselves with kindness and self-compassion. Georgetown University professor Cal Newport links peak productivity with deep work, meaning "working for extended periods with full concentration on a single task free from distraction." When it comes to distraction, constant app notifications are a big culprit – knowledge workers receive notifications from an average of 6.2 different apps or tools. Productivity's enemies include stress, anxiety and mental and physical fatigue. Psychotherapist Roxy Rhodes told me, "Mental and physical tiredness compound mistakes, which could negatively impact your career progression. Working through illness also means you may need longer to recover, increasing burnout risk." Dr. Wladislaw Rivkin, associate professor in organizational behavior at Trinity College Dublin agrees that working through illness – even digitally – is a bad idea. H     is research found working when unwell "has a knock-on effect for remote workers' performance on the next day as [it] drains employees' psychological energy, which cannot be fully recovered after work." Business impact of presenteeism Presenteeism can be more detrimental than absenteeism. An "always-on" communication expectation can hamper productivity and cause anxiety. Remote work was meant to level the playing field for employees with disabilities, but if workers feel forced to show up for the sake of it, that benefit is lost. Employee digital surveillance further corrodes trust, and brings challenges of its own making by reducing contextual performance and morale and increasing stress. Workers feel drained, fear their employer is 'out to get them' or retaliate using the likes of mouse jigglers – software or devices that simulate      mouse movements to prevent computer sleep mode from activating, giving the impression the employee is working. "Having to prove you're working by using mouse jigglers or clicking the screen every few minutes indicates a toxic culture. When we hire people, we look for candidates who will take ownership of their work. How long it takes them to accomplish a project is up to them, as long as the output is delivered. We don't need employee tracking software to see output," says Bhavya Arora, talent management and culture partner for sales engagement platform Outplay. Young workers and juniors in a team are more susceptible to practicing presenteeism. Some organizations position choosing your own working hours as a privilege earned by those higher up the career ladder, and junior workers worry their work ethic may be seen as lacking even if they're absent even for a few minutes. How to switch off "always on" culture 1.    Measure performance by output not hours "We don't believe someone's commitment to work or their performance should be measured by how many hours they've worked," says Outplay's Arora. Qatalog founder Rauf agrees, "Organizations should implement an output-driven culture that focuses on the work people do, rather than worrying about when they do it and how long they're at their desk." 2.    Use tools that suit asynchronous work Communication tools that send notifications can reinforce an "always on" culture and mean workers find it hard to switch off. Encouraging 'asynchronous' instead means finding ways for colleagues to work together even when not logged in at the same time. Tariq Rauf, founder and chief executive officer of Qatalog says, "Asynchronous work lets people with caregiving responsibilities fit work around their life." Qatalog tries to enable asynchronous working with their platform, which centralizes knowledge, processes and resources in their platform. Asynchronous communication tools, like Loom for video messaging, CloudApp for screen recording, Yac, which claims voice messaging can eliminate meetings, and Hypercontext for meeting management, aim to provide for effective, high-fidelity communication      for asynchronous work. "With the right technology, you can break down silos and provide visibility across an entire organization," says Rauf. "Once you can see what everyone is working on, with decisions made transparently, trust is much easier to build. It's not a silver bullet, but it's a strong foundation." 3.    Build trust and lead by example Asynchronous communication tools must feed into a culture of trust and empathy. Leaders should hire employees they trust to get the work done, so there's no need to be logged in at the same time. Psychotherapist Rhodes says, "You're setting a precedent for what's expected of your employees – if a staff member sees their boss showing up to work sick, they'll likely feel pressure to do the same." Small but thoughtful changes in how you communicate can also build trust: Don't send employees texts or emails outside work hours. Let team members control their availability, honoring 'do not disturb' statuses. Segment communication channels, for example, using Slack for regular communication but mobile messaging apps only for emergencies. Rhodes also recommends, "Having a non-contact way for employees to announce sickness is effective in some companies. Staff feel anxious about "phoning in sick" and having to have a conversation where they feel they have to justify how ill they are." Management consultancy McKinsey's 2022 report found 40 percent of workers value flexibility so much, it drives their decision to stay in a job or look for a new one. If workers can't do their best work, employers will lose them. Productivity is in work delivered, not hours worked or how fast employees respond to messages. No workplace benefits from performed productivity, and presenteeism can strip remote work of its benefits. Businesses must make sure they give employees the tools and freedom to work in the way that best suits them.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries