Magazine menu Close Magazine menu

Editor’s pick

insight story smart grids

As bills rise, smart businesses are saving with smart energy tech

Two business leaders explain how they’re applying smart energy tech to save big on energy bills and reduce emissions.

  • Emerging tech
  • min read
    • Alongside emissions reduction goals, energy prices have hoisted reducing energy consumption to the top of business agendas. In the UK, between 2022 and 2023, electricity prices rose 67 percent and gas prices 129 percent. In the US, energy prices are up as much as 40 percent. It's no longer a case of, should businesses cut their energy use, but how? Many organizations are looking for technologies that can help them better control their power use and use more renewable energy. As I wrote in this primer on electricity's history, a shocking 13 percent of the world's population, mostly in sub-Saharan Africa, have no access to electricity. Could more business investment in renewables help to bridge the gap? Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using the tech. Episode 2 looks at smart energy. I speak with Feroz Koor, Group Head of Sustainability at Woolworths Holdings. South Africa and Singapore-based Nilesh Jadhav, Founder and CEO of BtrLyf creators Qi Square, and former Programme Director, EcoCampus initiative, Nanyang Technological University. BtrLyf is an "AI-enabled assessment and marketplace platform to plan and achieve super-low energy, net zero and green certified buildings, quickly and at super-low costs." It creates 'digital twins' that let businesses model a range of energy conservation measures to find out what will work best.  Slashing grocery energy bills Woolworths has some 1,400 stores in Sub-Saharan Africa, Australia and New Zealand selling groceries, clothing, homeware and more. "Retail food businesses have a large energy footprint," says Feroz. Sustainability data science experts ESource says energy costs make up around 15 percent of food retail overheads. Feroz's company opted for smart tech to become more energy-efficient. "We've sub-metered all our stores with smart meters. There are different meters for lighting, refrigeration and air conditioning for example, so we can see what's driving consumption." The tech isn't cheap but paid for itself fast. Feroz recounts a huge discovery: "After metering one store in a new shopping center, we found we were being billed for other stores' electricity – the meters paid for themselves on the first day by proving it. We often use smart meter data to challenge incorrect billing – you'd be surprised how common it is." Meanwhile, the meters helped identify small changes that could save a lot of power. From smarter stores to smarter buildings Nilesh Jadhav, Founder of Qi Square who created BtrLyf, says, "Our customers want to improve their energy efficiency and reduce reliance on imported energy. Our platform makes the data available. So far, we've made digital models of 20,000 buildings in Singapore." Modeling their buildings gives businesses an approachable window on a daunting task. "If businesses can do an initial assessment of how they could save energy today, then how they could go to net zero [greenhouse gas emissions,] they can see the bigger picture." Woolworths is approaching a similarly daunting task – to use 100 percent sustainable energy by 2030. Feroz says, "We've made the commitment because it's the right thing to do, but we've got our work cut out for us. We have several options, like self-generation at shopping center level or sourcing from independent bulk producers. We're looking at wheeling, where you buy energy from a producer who then 'wheels' it through a distribution network. " From smarter buildings to smarter energy grids Increasingly nations and energy companies are making electricity smarter at grid level, aiming to reduce emissions and improve energy security. Smart grids can detect and react to customer use patterns, empower consumers to be more energy efficient and encourage renewable energy production by buying excess. All this can maximize renewable energy use and minimize the use of fossil fuel to generate electricity. Nilesh continues, "Microgrids take it to a system level using central energy management software and batteries to manage fluctuations." Smart grids also enable a market that incentivizes renewable energy production. Nilesh says, "If you can't put solar panels on your roof but your neighbor can, you could make a power purchase agreement (PPA). Singapore also has a market for renewable energy credits: You can buy these credits instead of buying electricity directly. If I want renewable energy but can't pay upfront for solar panels, buying renewable energy credits encourages third parties to invest, then sell the power." Securing smarter energy solutions Fabio Assolini, Head of Kaspersky Global Research and Analysis Team for Latin America, advises companies and nations to approach smart energy tech with due caution. "We've seen destructive attacks on civilian energy infrastructure – not just power grids, but their systems too." Fabio says over the years, these kinds of attacks are increasing. In 2021, a ransomware attack shut down a major US fuel pipeline. The same year, IBM reported energy was the third most attacked sector. Kaspersky threat predictions for 2023 foresee hacker groups carrying out high-profile cyberattacks on civilian infrastructure – such as energy grids and public broadcasting – using advanced persistent threats (APTs.) Critical infrastructure makes an attractive target for cybercriminals because of how much disruption successful attacks cause. Fabio suggests businesses pay attention to the security of their in-house energy infrastructure, as it may be particularly vulnerable. "Corporate and personal power grids are not as well protected as national infrastructure. They're often connected to the internet using older, more vulnerable hardware, and software not readily updated. Do a full security audit before launching a microgrid or smart grid." The future of smart energy for business Nilesh sees smart energy tech evolving through user participation. "On the tech side, I hope it'll go the same way as the smartphone: More resources for companies and innovators to make applications that sit on a central platform. Users could then adopt energy management tech faster. Over time, you'll see more participation from consumers." On the energy side, he thinks peer-to-peer energy sales are the future. "More people will be 'prosumers:' Consuming and producing energy and being paid for excess. Everyone will have better energy-buying options." Feroz has simple advice for businesses wanting to reduce their energy footprint. "Start now. The sooner you start doing something, whether it's just understanding your footprint or what your needs are, the better." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
insight story extended reality

How virtual and extended reality are transforming business

  • Emerging tech
  • min read
    • Between virtual reality (VR,) augmented reality (AR) and assisted reality – or their catch-all names mixed reality and extended reality (XR) – you might feel like you're losing your grip on all of them. But many businesses are reaching out to these emerging technologies to help solve tough problems like getting the team together remotely and hands-on training. On Kaspersky's new podcast, Insight Story, Episode 6, I look at extended reality with Dr. Paul Tennent (UK,) Associate Professor, Mixed Reality Lab, University of Nottingham and David Kim (South Korea,) Business Development Manager for Soma virtual office by Zigbang. Insight Story unpacks emerging tech trends with global specialists and businesses successfully applying the technology. VR, AR, XR – what are the different realities? These technologies all fall somewhere on the virtuality-reality continuum, according to Paul. "We've got these two ends – virtuality and reality. All the way along this spectrum are these technologies. They're generally about replacing our senses with something else – for example, our vision with a screen close to our eyes, hearing with headphones or touch with haptics. Augmented reality (AR) involves putting digital things in the real world. Assisted reality involves telepresence. Mixed and extended reality (XR) are catch-alls for everything from virtual reality to assisted reality to telepresence." Business has applied these technologies for over a decade. The IKEA app uses AR to let you superimpose their furniture on your room. Chat video filters that make your face look like a cute dog are also AR. While we're familiar with these kinds of consumer uses, businesses are increasingly using XR in their work with other businesses (B2B.) Paul has seen engineering companies make good use of assisted reality. "You can support on-site engineers with assisted reality, having somebody sitting behind them, watching what they're doing." "If you were installing a heat pump, it's useful to see a geothermal survey of the area before you drill a big hole. AR can add that layer of data onto real life," says Paul. An engineer could see the extra data layer by pointing a smartphone or tablet at what they're working on. One award-winning use of haptics – technology that transmits tactile information like vibration, feel and force – in training vets often provokes laughs but helps solve a serious problem. "A virtual, haptic simulation of a cow's back end helps vets-in-training feel different contexts, like something cancerous or moving a calf. With virtual glasses, it looks like a real cow. We see similar uses in medicine, with point-based haptic systems imitating a scalpel cutting through skin." Virtually solving the remote collaboration problem Few businesses need to teach how to deliver a calf, but almost all are looking for ways to better facilitate collaboration in remote and hybrid work. Proptech startup Zigbang started creating virtual office Soma during the pandemic. David says, "When our company went remote, we did what everyone did – endless Zoom calls where you fall into Zoom fatigue. A missing core element was togetherness – small conversations that turn into bigger ideas. We wondered if there's a way to better go about this remote thing." Zigbang's existing work creating 3D models of apartments sparked an idea. "We thought, why don't we create an office we could go into together? We started testing it with developers and thought it was good enough to bring in the whole company." In Soma, avatars represent colleagues, with their device's camera feed over the avatar's head. Like in real life, if you're far from someone, you can't see or hear them. As you walk closer, you start to see them and, when really close, hear their audio and see them clearly. David says, "We wanted to create that instantaneous communication – being able to walk up to someone and ask, did you get that email?" If, like me, you enjoy the solitude of remote working, and find the idea of your boss's avatar stealthily approaching and interrupting you unappealing, there's a middle way. Soma lets staff ensure they're left alone to do deep work. "We designed spaces for people to get away from others and get work done – bookable conference rooms and 'pods' – by walking into a pod, you're saying, I don't want to be disturbed." David also has ideas to address some of the challenges for office-less businesses. "Employees who don't have enough space or privacy to work at home may prefer to be in the office where everything's set up, and companies pay for air conditioning, electricity and internet. There are different ways to handle that – one is a stipend to help staff set up a home office. We've also set up lounges across the city where employees can go to work." The shared office space market is booming – expected to be worth 123 billion US dollars by 2028. Reducing cybersecurity risk with realities Kaspersky's Fabio Assolini sees several privacy and cybersecurity risks for businesses using extended reality tech. "During the pandemic, we saw the rise of so-called Zoombombing – when someone accesses a conference call without permission and shows obscene or violent material. It can affect VR devices too." How Zoombombing happens isn't high-tech. Fabio says, "People openly share passwords. Employees must be trained not to." Meanwhile, VR headsets are in a league of their own for privacy concerns. Meta's Quest Pro headset has four front-facing cameras, three on each controller and several to track eyes and facial expressions. These devices could give deep insight into users' activity, read emotional reactions to ads and make inferences from your home interior — from what colors you like to how many pets and children you have. But none of this should deter businesses from exploring what immersive tech can do as a training aid. "The tech is already in use to help people learn about security problems or cyberattacks," says Fabio. Kaspersky Interactive Protection Simulation sees teams, including technical staff and leaders, protecting a virtual business from cyberattacks. Players use a limited budget and a moderator's input to build an optimal protection strategy. It helps managers and directors understand cybersecurity budgets better. Realities' future Asked where extended reality might go next, Paul predicts "a shift slightly away from VR towards AR. We're headed for a fluid reality, which is part physical and part digital." David urges businesses to get on board with these technologies. "Things are changing now in the realm of work. Companies more willing to look into and implement changes early will be the ones that succeed down the line." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
future cybersecurity jobs

7 new roles we’ll soon see keeping business secure

  • Future tech
  • min read
    • Technology penetrates every sphere of our lives, and more devices mean more cybersecurity challenges. How we protect systems is evolving with technology and threats: Routine work like monitoring and response is being automated. But cybersecurity isn't getting less complex – businesses will soon need new, more creative, more diverse roles. While they may seem futuristic, some already exist in one form or another. Given long-term trends, leaders should start planning to recruit for these new roles, coming soon. 1.  AI mentor The rise of AI-based technologies like ChatGPT and voice assistants like Siri and Alexa made new tech more accessible while bringing new concerns around privacy and security. AI's control, regulation and monitoring requirements go beyond product management and development expertise. William Gibson's 1984 science fiction book Neuromancer imagined we'd one day have 'Turing Police' to control AI and AI-based systems, stopping them evolving and becoming independent. Turing refers to famed UK mathematician and computer scientist Alan Turing's test to distinguish humans from machines. A need for firm limits on AI is little disputed among experts, with a range of tech leaders, including Elon Musk, signing a open letter asking for a pause in AI development in March 2023. AI Mentors will assess and control AI technology. They may also teach AIs, control access to data and constrain evolution – you might call it, being AI's parent. As AI's complexity and sophistication grows, there will be growing demand for such experts. AI mentors could also develop 'stop' buttons to prevent systems operating on their own. They may also develop protection against malfunction and alternative rescue plans if computers are out of service. 2.  Digital footprint consultant Leaks and breaches negatively affect any brand. Cybercriminals often use threats of reputational damage to extort money from companies once inside systems. A digital footprint consultant will work to protect your brand. However, there's no need to wait for a digital footprint consultant to come on board before you develop strategies to restore your brand reputation after a data leak. 3.  Cyber immunity developer Cybersecurity will change as businesses are forced to rethink how they develop new tech. Embedding cybersecurity principles from the start makes cyber immunity possible – systems so secure that the cost of hacking them isn't worth the reward. Demand for cyber-immune products will see employees scrambling to hire designers and developers with security-first skills. 4.  Threat endurance manager 2022 was a costly year for cyberattacks, with high-profile big tech names like Twitter, Uber and Rockstar Games all hit. Cybercriminals don't shy away from attacking public services and life-saving institutions either, with several universities, the UK's National Health Service and the Red Cross among those attacked. Cyberattacks interrupt production and business processes, pose reputational risks and lead to big financial losses. Health insurance giant Medibank reported a ransomware attack cost them 26 million US dollars. They'll be responsible for business continuity and protect companies by controlling IT systems, responding to cyberattacks and managing software and human errors. 5.  Cyber investigator Cyber investigators already exist, but their work will become more complex and diverse as digital systems get more sophisticated and automated. These specialists normally manage the aftermath of a security breach, covering the whole investigation and eliminating the threat. At Kaspersky, they collect evidence about an incident by analyzing log files and network events, finding indicators of compromise and more. New-generation cyber investigators will be generalists with skills in programming and hacking, but also psychology and decision-making in volatile conditions. They'll also understand robotics and AI, as they must work with emerging systems. 6.  Digital bodyguard Like bodyguards in the physical world, we'll want to hire consultants to protect our digital identities. These bodyguards will protect against doxing – when attackers publish personal data online for revenge – and cyberstalking. They'll clean our accounts and digital history, and guide and support our virtual lives. Pew Research Center found more than 40 percent of US adults experienced online harassment in 2020. Sometimes, online harassment is linked with offline harassment and even violence. Digital bodyguards will help protect us from these kinds of threats, and disrupt and identify the offender when they happen. They may also give victims emotional support. Businesses that provide digital technologies must consider how they'll facilitate digital bodyguards' work protecting their clients. 7.  Space cybersecurity engineer Satellites are the most conspicuous piece of space technology in daily life, used in communications, navigation systems, broadcast media and more. Our reliance on satellites makes them attractive to threat actors. The space industry needs dedicated specialists to prevent attacks, particularly securing operational systems like navigation, engine control and life support. With the advent of space tourism, asteroid mining and new space stations, there'll be rising demand for out-of-this-world cybersecurity experts. What does it all mean for business? The cybersecurity landscape is complex and always changing, giving rise to new roles like these predicted. It's easy for businesses to get left behind. Examples of expensive data breaches at big-name institutions suggest those who invest in top cybersecurity will save time and money long-term. For those developing future technologies, embedding cyber immunity is becoming necessary, especially if your tech will be used in critical services like healthcare and infrastructure.
digital trust

Customers’ trust in tech is changing. What should business do?

  • Transparency
  • min read
    • Of course, businesses need customer trust, but understanding what trust means in a digital world is becoming more important. Digital trust is users' confidence that tech, people and processes they engage with are secure and private. Recent research suggests how customers decide where to place their digital trust is changing, so some businesses are changing their approach. As Minter Dial wrote before in Secure Futures, the 2022 Edelman Trust Barometer report shows eroding trust in institutions while remarkably, our trust in business remains. Now, there's an opportunity for business to use integrity, empathy, and privacy and ethics around new tech like artificial intelligence (AI) and customer relationships management (CRM,) to lead the way. Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using new tech. In Episode 4, I discuss what digital trust means and how organizations can grow it with Müge Fazlioglu (US,) Principal Researcher, International Association of Privacy Professionals (IAPP), Malek Ben Salem (US,) emerging tech security expert and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. Unpacking digital trust Digital trust covers much ground, Malek Ben Salem says. "It's about data integrity, technology, people and processes. It's our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with. It's also about how much we trust the information we get as users." Müge Fazlioglu says trust is notoriously hard to pin down. "Our trust when we may or may not share data depends on many things, like our perception of the party we're sharing with, our data's value to them and us. We also weigh the data's sensitivity – what might happen if it were revealed." Trust can make or break a purchase IAPP's March 2023 Privacy and Consumer Trust Report shows privacy concerns influence consumer purchasing decisions. Müge says, "Many people take steps to protect their privacy, like deleting an app or withholding some personal information." So paying more attention to trust could pay dividends. "Organizations gain credibility by taking steps to enhance privacy and data protection. We're now seeing some big brands featuring privacy-related messaging in their advertising and marketing of web browsers and smart home devices," recounts Müge. Trust concerns also make brands hit the headlines for the wrong reasons. Amazon's recent purchase of robot vacuum cleaner brand iRobot triggered privacy objections from consumer and civil rights groups, then an EU investigation. How companies help (and harm) trust Tech research consultancy McKinsey's 2022 Digital Trust report said while 70 percent of people trust companies to protect their privacy, most companies aren't living up to the expectation. So what should companies do? Müge says much best practice is around transparency. "Few consumers have a good grasp of how companies use their information – what they collect, and if they follow good practice. So companies need to ensure they write a simple, clear privacy policy and have an easy-to-use page for people to manage their privacy settings." Regulators also think easy-to-adjust privacy settings matter. The US Federal Trade Commission (FTC) recently fined the company that makes the game Fortnite for its hard-to-use privacy settings. Müge thinks regulators, businesses and consumers can all play a role in improving communication around privacy. "How a company communicates its data practices affects trust – the duty should not be on customers to make daily decisions based on lengthy and complicated legal agreements. Regulators have an important role in raising awareness and providing education. Some, like the FTC and European Union data protection authorities, are starting to do that." Müge also recommends being prepared for how you'll handle a data leak. "Responding slowly means more consumer loyalty lost. Have an incident response plan for the inevitable." Data leaks are common but often have a big impact on business. Kaspersky's 2022 IT Security Economics report found that among 3,230 businesses surveyed, data leaks were the most commonly encountered security issue, with 55 percent considering them the most challenging incidents. Malek points to one business leading in digital trust. "Apple stands out in how it uses privacy-preserving technology to train artificial intelligence (AI) on mobile phones. Devices keep data locally and use it to train user speech-recognition and auto-complete models. Then the models are used to update a central model that can be applied to many users. So the data is not shared or uploaded, but still used to improve the AI." Using cybersecurity to build trust 29 percent of businesses with 500 to 999 employees have experienced a cybersecurity incident, according to Kaspersky's 2022 Small-to-Medium Business Cyber Resilience report.  As your business scales into a larger enterprise, so does the likelihood of a cyberattack or data leak. Malek thinks investing in cybersecurity is vital to protect customer trust. "To build secure infrastructure and allow for secure transactions, you need a cybersecurity strategy and proper governance, and you must hire the right talent. More importantly, be transparent." Or, as Müge says, "Shine a bright light on what you're doing." New technologies are evolving cybersecurity's contribution to digital trust. Malek sees many applications of AI in security tech: "It helps identify who is accessing a system by profiling user behavior. It can detect and respond to security incidents. It can classify unstructured data like business documents, so we don't need people to read them to know what's sensitive or confidential." A relatively new approach to security, zero trust, is influencing what we'll see next. "People will own their full identity and use pieces as needed. For instance, if I want to buy something that requires proof of age, I can share just my age without information the seller doesn't need, like full birth date. Zero-trust principles mean allowing access only to the information needed." But Kaspersky's Fabio Assolini says businesses may not be able to adopt these good practices overnight. "Many networks need adapting for zero-trust principles. It's a challenge for administrators, but it's important they understand how it works and prepare corporate networks for it." He also highlights the value of transparency, not just between businesses and customers, but between businesses and suppliers. "You must be able to trust your cybersecurity providers, especially as we're seeing many targeted attacks that abuse cybersecurity software or infrastructure. Security vendors could be more transparent about their technologies. At Kaspersky, we let customers review our code at transparency centers. We'd like to see other companies doing that." He adds, "Training is also important. Sometimes cybercriminals send a phishing attack to just one employee, so it matters that each employee is trained in identifying attack attempts." Asked for one key recommendation for business in building digital trust, Malek says, consider cybersecurity part of your environmental, social and governance (ESG) framework because "it elevates the discussion." Müge says, "Keep in mind all the smart technology you use. It uses many different kinds of information. Use the privacy features and regularly monitor data sharing." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.

Popular episodes

View all series

Trending stories

technological singularity

Reaching the technological singularity: What will happen when machines become smarter than us?

  • Technology
  • min read
    • Picture a world where machines have long since passed the Turing Test. When people can't tell the difference between artificial and human intelligence. In this world, will humans become obsolete, like the floppy disk? Or is it a world where artificial and human intelligence merge to usher in the next step of our evolution? That's the technological singularity, the theoretical time in the future where technological development outpaces our abilities to maintain control over it. For better or worse, it's undoubtedly something that will result in never seen changes to our world. When will we reach technological singularity? Join any discussion about business technology, and it won't be long before someone mentions artificial intelligence (AI). The amount of digital data in the world has already surpassed our abilities to manage it, a development, which has made clear the need for algorithms to do the job for us. But algorithms and AI aren't the same things. They're not even close. An algorithm is a computer program that parses data from sets too large for human interpretation, whereas true AI is capable of thinking for itself, making its own decisions, and having free will. True artificial intelligence doesn't exist. Yet. The explosion of AI has long been a popular trope of science fiction, but the reality is edging ever closer. Ray Kurzweil, world-renowned futurist and Google's Director of Engineering, believes technological singularity is going to happen before 2045. Take note: so far, an impressive 86 percent of his predictions made since the '90s have become a reality. But even if that sounds optimistic (or pessimistic, depending on how you look at it), it's the logical next step in the evolution of technology. Once computers can learn for themselves without being taught and trained with data that we've collected, we can expect profound society changes on a scale never before seen. How can we keep up with technology? The emergence of an artificial superintelligence would bring us greater inventive and problem-solving skills than humans are capable of. This might lead to the creation of a new 'species,' one which might not necessarily have human interests at its heart. But so far, we're nowhere near developing machines with human-level intelligence and the ability to make decisions independently. Now we can enhance human intelligence and capabilities with tools and technology. Indeed, that's precisely what we've been doing for hundreds of thousands of years, ever since our ancestors figured out how to light fires. But today, the stakes are much higher with projects like brain-to-computer interfaces as active areas of research. This may, in turn, lead to radical developments like mind uploading, in which you entire consciousness can be uploaded to and stored on a machine. At least, it could be useful for those millennia-long interstellar voyages. Such developments might sound dystopian since they have the potential to transform what it means to be human ultimately. At the same time, the convergence of technology and humanity, an area of study known as transhumanism, appears to be the only way we can keep up with the constant pace of change. It's either that or the machines eventually outpace our natural evolution and take over. The survival instinct If we can't keep up, and technological evolution ends up outpacing our capability of keeping control over it, then we could face profound risks to security. Each of the seven characteristics that define every biological organism comes together to form a singular goal – survival. Technological singularity occurs when AI matches our desire and capability to survive as a species, and there's little reason to think that AI would have any evolutionary motivation to be friendly to humans. Today, machines are programmed by us to create the outcomes we want. But what happens when they're capable of programming themselves? Time for Humanity 2.0? Imagine you're an expert on machine learning, working on an artificial intelligence algorithm that will be able to create other AIs by itself. Are you merely training your replacement, or have you become an architect of your obsolescence? Welcome to Humanity 2.0, where the human condition is no longer about our biological form. It's a time when machines become an integral part not just of our societies, but also ourselves. Conversely, this could also lead to newer and deeper social class divisions than we've ever seen, as people are separated into those who are augmented by technology and those who are not. There's a safety benefit of not being physically augmented by technology – no one will be able to hack into your mind. How humans could remain our biggest threat Perhaps it isn't machines that we should be worrying about at all. Assuming we'll always be able to control artificial intelligence, we could end up transforming it into a deadly weapon. It's already happening. The proliferation of social media, for example, is one of the most significant security and privacy concerns this century. That's not so much down to vulnerabilities in the technology, but because it's a highly effective medium for conducting social engineering attacks. Coupled with the rise of AI, cybercriminals will be better equipped to analyze social media conversations to emulate users' writing styles and craft more convincing messages to their victims. Even before we reach the era of true AI, the ability of algorithms to parse enormous amounts of data is already misused. On the one hand, algorithms can perform many useful tasks to improve our world, such as climate modeling and disaster prediction, while things like neural interfaces can help victims of spinal cord injuries. On the other, the ability of humans to interfere with information systems makes them a more significant threat than the technology itself. Perhaps it would be better if we just let the machines take over in the hope they'd nurture us like the irresponsible children we are. To fear or not to fear Ray Kurzweil has a more positive outlook than most about the singularity. He claims it's an opportunity for humankind to improve by making us smarter and better at all the things we value. Other science and technology leaders, including Elon Musk, Bill Gates and the late Stephen Hawking, are not so sure. But one thing's for sure – there will come a time when our augmented descendants look back on us as rather quaint and exotic creatures. While we're still decades away from the singularity, it presents itself as the next big step in the evolution of technology. Emerging tech, like autonomous vehicles and facial recognition, are already paving the way. True artificial intelligence is coming sooner or later, which is why it's time for the business world to start taking AI ethics and security issues seriously. It's no longer the concern of generations far in the future. This article reflects the opinion of its author.
Digital voting, democracy, privacy

Is digital voting secure enough for national elections?

  • Tech for good
  • min read
    • 2020 is a big year for democracy. There's a US presidential election, 100 years of US women's suffrage and policymakers around the world considering how to make elections safer in a pandemic. As COVID-19 has brought rising unemployment in most countries, maintaining stability means maintaining – or better, improving – trust in government. With voter turnout down around the globe, policymakers should also be asking how they can re-engage citizens in democracy. You've probably not seen that question answered quite so cluelessly as my local council in the run-up to its 2019 election, by sticking giant poo emojis all over town. Surprise – it didn't work. Voter turnout fell six percentage points on the previous election. Among the Facebook fury that called the poo emoji campaign tasteless and patronizing, a lone voice suggested another way to achieve the campaign's aim. "I filled in my voting papers a couple of weeks ago, but it's sitting in its envelope still, ready to be posted. When I get the chance to swing by a post box, I will, but it's not something I do these days. Bring voting into the click-of-a-button digital world, and you will have voters." Could it possibly be that simple? Voter turnout is falling in almost every country – a trend that started around 1990. When we've fought life-and-death battles to vote, could inconvenience really put people off something so important? It's certainly plausible –  behavioral science shows small changes in environment can make a big difference to what people choose to do. I asked democracy campaigners and commentators in several countries where they stand on digital voting. Do they think it will soon be feasible for national elections? Proportional representation may be fairer, but does it get us voting? Josiah Mortimer of the UK Electoral Reform Society dismisses digital voting entirely. "There are more pressing problems with the voting system than going to a polling station or getting a postal vote. Major privacy, accuracy and trust concerns have not been dealt with, and we feel the issue is a distraction from the real democratic crisis. The priority is ensuring every vote counts – in the UK by switching to proportional representation, modernizing voter registration and improving citizenship education." Proportional representation describes any electoral system that ensures the proportion of representatives elected matches their party's share of the overall vote. That's distinct from non-proportional systems like first-past-the-post or electoral college, where winning certain areas can see a party less popular overall gaining power. Proportional representation has received renewed attention in the UK since its 2019 election returned what Jack Blumenau and Simon Hix described as "the most disproportionate outcome of any election in the post-war era" in a London School of Economics blog post. Proportional representation might make for fairer results, but could it reverse declining voter turnout? After New Zealand adopted proportional representation in 1993, voter turnout fell for many years, to an all-time low in 2011. Then, it started rising again, with their October 2020 election seeing the highest turnout in many years. Whatever drives New Zealand's election turn-out, there's more to it than proportional representation. For its "privacy, accuracy and trust" concerns around digital voting, Electoral Reform Society pointed me to a 2015 article, Why we can't vote online. It describes designing online systems that match the secrecy, accuracy and verifiability of paper as "incredibly hard," referencing flaws found in Estonia's election system in 2014. The article's arguments may have been fair and accurate at the time, but what about today? Five years is a long time in technology, and in the number of eligible voters who expect to do everything digitally. Ballot secrecy is the heart of the issue Lawrence Norden, Director for Election Reform and Democracy at the US's Brennan Center for Justice, often writes on security and electronic voting. He's optimistic online voting could one day be secure enough to rely upon, but cautions against 'too much, too soon' as COVID-19 puts the pressure on to find safer ways to vote. "Election officials shouldn't be left on their own to figure out whether a system is secure and reliable. It is possible that one day, we can develop such a system. But currently, there are no generally accepted benchmarks to evaluate the security of online voting pilots." Norden places safeguarding electronic voting suppliers in his top two priorities. "We need a federal certification framework for election system vendors and their products. Hackers targeted vendors in 2016. We have little insight into vendors' internal cybersecurity practices, who works for them and who owns them. This is more of a security risk than we should be willing to accept." This makes sense, given supply chain attacks are common. Norden thinks ballot secrecy is the big challenge for voting online. "When we rely on software to provide us with election totals, as in the US, we must have a way to confirm the totals are accurate. The best way, while maintaining ballot secrecy, is to check the paper record against the electronic totals. There is no such record in paperless electronic machines or online ballots. If a hacker changes a vote transmitted over the internet, we might not know." Norden highlights voters can still do a lot to protect their vote from cyberattack. "They should check their voter registration online. They could volunteer to work on election day. They can learn the rules for how and when to vote early – the earlier people vote, the less chance a cyberattack can interfere with their ability to cast a ballot that will count." What does secure digital voting look like? Dr. Muhammad Rizwan Asghar, Senior Lecturer, School of Computer Science at the University of Auckland, is another frequent commentator on digital voting. Does he think online voting could be secure enough to be the election standard sooner, later or never? "One might argue if Estonia can do online voting, any country can, but this might not be true. There have been reported vulnerabilities on the voter and voting server ends. Even if we assume there are no issues with existing online voting systems, Estonia is a tech-oriented country with a population of just 1.3 million. "Addressing security risk for online voting means mitigating cybersecurity challenges at the user, communication and server levels. An online voting system needs a form of vote integrity, so votes can be tallied while ensuring voter privacy. Cryptographic schemes achieve this. Each voter encrypts her vote. Using a public bulletin board, voters can see the votes they cast. Once all the votes are cast, they're summed using homomorphic encryption, then the final sum decrypted. The decryption key is split among a set of trusted authorities who must collaborate to reveal the final result. It's promising, but not enough on its own. Some cybersecurity experts say there will never be anything safer than in-person voting with paper slips, but Dr. Asghar points out, "Each approach has its issues. In paper-based elections, people can be prevented from reaching polling booths. They can be harassed or coerced. A returning officer can spoil ballots. We can address most of these concerns using online voting. It could also make voting more accessible and help get results faster. But recent reports show voting servers are an attractive target for state-sponsored attackers. They can make servers unavailable using Denial of Service (DoS) or Distributed DoS (DDoS) attacks." What should any authority considering online voting learn from Estonia? "Estonia has made their system's source code public to foster trust and minimize the potential attack surface. They have internet and computer training programs for voters. If a voter has been coerced, they can go back later and change their vote or even vote in person on election day." Despite his optimism for the future of online voting, Dr. Asghar says it's hard to imagine online voting being ready for national-level elections in the next few years. "Not only is developing the system highly challenging, there must also be training in how to use it." Can blockchain help make digital voting secure enough? National-level elections are always a high-risk environment for interference, whether people tamper with papers in person or nation state-sponsored cybercriminals attack digitally. So it follows we're seeing promising innovations in secure voting technology like Polys used first in low-risk, closed-group settings, like workplaces, universities and local government. Polys uses blockchain and encryption to make a tight voting system. "Encryption built on top of a blockchain system makes every vote like a 'black box' – no one can see how any person voted," explains Alexander Sazonov, Head of Product at Polys."We identify voters using unique email and SMS codes, or third-party identification, checking they're entitled to vote and that they are whom they say they are. The database is distributed among participants, making it almost impossible to change. It's hard to hack because you'd need to access multiple distribution points at the same time." Polys took off with companies and organizations that can't hold in-person elections because their people are distributed around a large area. Soon, European Youth Parliament, Russian Supreme Court and numerous university elections were using it. Several Russian regions now use Polys to consult citizens on budget expenditure decisions. Sazonov further explains Polys' security features. "People make mistakes when counting paper votes, but with Polys, every server on the blockchain independently counts votes. They then synchronize with each other. If the results match, the vote is closed and declared accurate. If there's a discrepancy, the administrator can launch an investigation. No system is completely un-hackable, but ours is transparent enough that hacking can be detected and investigated, while voters stay anonymous." How will we come to trust digital voting? British political philosopher Baroness Onora O'Neill speaks in her lecture series, A Question of Trust, of how public institutions should aim, rather than to be trusted, to be trustworthy. She argues it is being trustworthy that creates trust. The same may be true of electronic voting. For the public to trust it, it must prove itself trustworthy. Many of the risks of digital voting exist with paper-based voting and are as hard to detect in that setting. Secure, digital voting would offer voters protection paper cannot. The Brennan Center's Lawrence Norden makes sense when he says digital democracy shouldn't be rushed because of COVID-19. But even without the pandemic, it seems high time to trial digital voting alongside existing options for lower-risk, local elections. In the face of plummeting voter engagement and likely global recession, the need to re-engage voters can't be put aside – trust in government depends on it. Policymakers must acknowledge technology has changed everything about how voters live. It must inevitably change how we vote.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • Cybersecurity
  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
QR codes, history, predictions

COVID-19 made QR codes huge, but what’s their future?

  • Opinions
  • min read
    • If you've visited a restaurant or store recently, chances are you've seen and used the ubiquitous small squares that make up a QR code. Our exposure to these codes has never been higher than since the COVID-19 pandemic, nor their value clearer. But how did we get here? Why are QR codes today's technology of choice for navigating our lives? Let's step back to Japan, 1994. Where QR codes began Automotive components manufacturer Denso Wave had a frustrating problem on their supply line. They were using bar codes on their components that workers had to scan for information they needed. But bar codes became limiting for the company because of the small amount of information each could hold. The company gave one of their young engineers, Hara Masahiro, the task of developing a solution. Bar codes are one-dimensional (read along one axis,) but Masahiro's creation was two-dimensional: Read horizontally and vertically. It increased the information held from just 20 characters to 7,000. The speed these new codes introduced to manufacturing created its own problem. Technologist Simon Raik-Allen explained it to me like this: "Imagine a conveyor belt with all the products going past. You want a camera to see which products are where. If they go too fast, the camera won't read it." Since then, eagerness to adopt QR codes in business and personal lives has varied. Asia has been the keenest adopter, with QR codes playing a central role in digital payments. In China, consumers use WeChat or Alipay apps to make some 90 percent of mobile payments, and both use QR codes to facilitate the transaction. In Africa, M-Pesa has started to incorporate QR codes into its text message banking service. In Europe and North America, uptake had been less enthusiastic – until now. A 2015 TechCrunch article called QR codes "frustrating" and a "laughing stock." Brands eager to plaster QR codes wherever they could and the likes of QR code tattoos led to perception the codes were a gimmick. The user needing to download a QR code scanning app may have contributed to this sense of needless novelty. In 2017 things changed. Phone manufacturers began incorporating QR code scanners into camera apps so users didn't need to download an app. Improvements in mobile technology letting scanned links open more quickly also played a part, according to Joe Waters, author of QR Codes for Dummies. These improvements planted the seed that allowed the technology's quick adoption in the pandemic when the need became clear. Waters says, "People now want as little contact as possible with everyday objects that may spread germs." This poses a novel question: Will our newfound familiarity with QR codes lead to new uses in the coming months and years? How should business and tech leaders be thinking about QR codes? The Future of QR codes Large retailers like Amazon have started experimenting with QR codes to track and for payment in their physical stores. But opportunities are opening for retailers of all sizes, especially around demonstrating sustainability and environmental credentials. Fashion label Another Tomorrow uses QR codes on labels to give consumers more information on the clothing item's sustainability. Provenance uses blockchain to make supply chains transparent, with QR codes for consumers to see evidence of what the brand claims. The 2021 'right to repair' EU law means consumer electronics manufacturers must add a QR code for more information on the product, like how loud it is. Securing QR code-reading for business Data security is a pressing concern with widespread adoption of QR codes. Consumers and businesses may not have known the security risks as they rapidly adopted the technology in the past 12 months. David Emm, Principal Security Researcher at Kaspersky, says "A tainted QR code might ask a user to download a malicious app containing malware. The malware could then steal personal information." Businesses can reduce their risk by using a reputable, up-to-date QR code scanner. It also pays to raise awareness among staff and customers of malicious QR codes, for example, advising they consider whether a code looks tampered with before scanning it. The battle for a new technology's acceptance is won when the audience understands what it does that no other technology can do. The pandemic gave the QR code a chance to show it was no gimmick. Business should expect to see QR codes used more widely and creatively, and consider how those game-changing 7,000 characters could help them do business better.
next level speedgamers

Featured series

Can gamers be hackers?

Next Level, the new installment from hacker:HUNTER real cybercrime series, explores real-life stories of hackers in the gaming industry and discovers if hacking can be a force for good.

Choose a topic

Business

Cybersecurity

Technology

Latest stories

cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • Cybersecurity
  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
behind the screens

Zero-day: Birth of a new threat

  • Threat intelligence
  • min read
    • They're inside your system but no one knows how they got there – or how to stop them. These destructive attacks are called zero-day threats, because your security team will have zero days to prepare. Zero-day attacks involve cybercriminals using vulnerabilities no one knows about. They're hard to detect and can go on for years. Zero-day: Birth of a New Threat is Tomorrow Unlocked's latest film in the hacker:HUNTER Behind the Screens series. Michael Gregg, CEO of Managed Service Provider Catalyst Network Solutions, discusses these attacks and his clever way to trick cybercriminals into giving up their secrets. He also shares ways to spot these sometimes-subtle attacks. Understanding zero-day attacks While you may not have heard of zero-day attacks, some of the most well-known cyberattacks fall into this category, such as WannaCry and BlueKeep. But what does it mean? Software developers are always looking out for vulnerabilities hackers could use to gain access to systems through their software. When you receive software updates, these often include 'patches' for recently discovered security holes. "It's called zero-day because that's exactly how long you've had to prepare for it," says Gregg. Zero-day attacks might include reaching a vulnerable system using phishing – manipulative emails to users aiming to convince them to open a file or visit a malicious site. That action downloads the attacker's malware, which infiltrates user files. It can take time for developers to find the vulnerability that allowed the attack. In recent years, hackers have become faster at exploiting vulnerabilities soon after discovery. Zero-day attacks are especially dangerous because only attackers know about them. Once they have access through a zero-day vulnerability, criminals can attack immediately or wait for the best time. What is a Managed Service Provider (MSP?) Gregg's company, Catalyst Network Solutions, is a Kaspersky partner Managed Service Provider (MSP.) MSPs offer cybersecurity-as-a-service. Rather than or as well as an inhouse cybersecurity team, businesses hire MSPs to take care of their cybersecurity. Using MSPs makes it easier for businesses to have a range of cybersecurity expertise on-hand in a market where hiring cyber experts can be challenging. MSPs typically provide services to multiple companies and organizations, giving them broad-based knowledge of cyberthreats and cyber solutions. With the wide range of business tech that needs securing today – from light switches to security cameras to fridges – the value of wide-ranging experience is rising by the day. Tricking cybercriminals with their own tricks The data tricks cybercriminals into using, and so revealing, their zero-day methods. This has allowed Gregg's team to prevent and stop attacks faster. Preventing zero-day attacks As soon as a zero-day threat is understood, software developers will release updates to patch it, so your business should ensure it always installs updates promptly. If you can't stop a zero-day attack happening, there are ways to ensure it's caught early. Gregg advises "There's never a call that's not worth making," when it comes to cybersecurity. Signs of zero-day attacks can be subtle. "If your mouse is moving in a weird way, you're getting out-of-place keystrokes or your computer's running slowly," let the cyber professionals know – whether you have an internal team or a Managed Service Provider.
supply chain attacks, retail, Austin, air conditioning

How your air conditioning could start a cyberattack

  • Safer business
  • min read
    • Many big businesses know they could be cybercrime targets and invest in defenses like software and training. That's why cybercriminals are increasingly attacking through smaller suppliers who don't have the same knowledge and resources. It's called a supply chain attack. In Tomorrow Unlocked's second episode in the hacker:HUNTER Behind the Screens series, Eliza-May Austin, CEO and co-founder of th4ts3cur1ty.company (That Security Company,) explains how US retail giant Target was attacked through a most unexpected device – the air conditioning. We ask Austin how businesses can prepare for supply chain attacks and how she thinks things are going for women in cybersecurity careers. In Tomorrow Unlocked's Hacker: HUNTER Behind the Screens video, you talk about the supply chain attack on Target in 2013. Why is this attack so important? Businesses must work with other businesses, which makes us all susceptible to a certain degree of risk. Take an airplane, for example. To go from concept to in the air involves hundreds of businesses, contractors and applications. It takes just one breach to compromise that trusted ecosystem. It's something we should all take seriously. Your business th4ts3cur1ty.company (That Security Company) helps companies large and small harden their supply chains. How do you do that? There are many things businesses can do to defend against supply chain attacks. For example, we run penetration testing, consult on governance, risk and compliance and importantly, logging, monitoring and vulnerability management. Are businesses becoming more aware of supply chain attacks and responding appropriately? I can't confidently say yes, which is why I'm vocal on the issue. I recently asked a small-to-medium company (SMB) that supplies services to the medical sector if they'd considered how an attack would impact their clients' security. I was met with such bemusement you'd think I'd asked for a sandwich. What's the most common problem making businesses vulnerable to supply chain attacks? Not knowing how prevalent it is. But also, some businesses that do understand the issue's scale get overwhelmed by it. These attacks aren't always sophisticated – simple measures can go a long way. How did you get into cybersecurity? I moved from a degree in forensic science to a degree in digital forensics, did some internships and the rest is history. You don't need a degree to be in cybersecurity. Is the industry giving women equal opportunities to enter and succeed yet? I think this industry, like any, is what you make of it. Cybersecurity is a fantastic career choice for women and should be promoted as such. What could employers do today to attract and retain more women? I get asked this a lot, so I wrote 15 ways to attract more women to your technical cybersecurity team. I've included simple, practical things like considering the physical environment. For example, if employees have to crawl around on the floor to plug in a laptop, that may feel degrading when wearing a skirt. I also recommend being more open-minded about what kind of people you need: What is Ladies Hacking Society (LHS) and why did you found it? LHS is an awesome community of women who come together to learn from one another and teach each other hacking. I wanted to create a technical option for women because I found mixed events were not really mixed (mainly men) whereas women's events revolved around governance or high-level theory. It's a lot of fun and a great bunch of people. Which is the most important lesson from your 11 leadership lessons from terrible managers, and why? Lesson 3: A sense of humor matters. People tend to take themselves too seriously. Encouraging people to laugh and joke does wonders for team morale and gets people through stressful times. Let's all calm down and have a giggle.  
chatGPT cybersecurity regulation

With ChatGPT’s vast innovative potential, regulators must take care

  • Safer business
  • min read
    • ChatGPT and other artificial intelligence (AI) chatbot applications are major technological milestones with far-reaching benefits for many industries. But with each advance comes unintended consequences. With ChatGPT in its fourth iteration, and its underlying technologies growing fast, it's time to take stock of the policy landscape to understand its implications. What is ChatGPT, and how are businesses using it? ChatGPT is an AI chatbot made by OpenAI. It uses natural language processing (NLP) to create human-like text responses. Users can ask ChatGPT almost anything and receive relatively natural-sounding responses. It can write outputs like programming code, social media posts, summarize complex topics or almost anything text. ChatGPT is an example of generative AI: Artificial intelligence that learns to generate original content like images, music and text by identifying underlying patterns in existing examples. "Its primary objective is to create interactive and realistic conversations with users, making it a powerful tool for chatbots, virtual assistants and customer support applications," says AWS Solutions Architect Ragu Kuppannan. Many top companies are using ChatGPT. For example, travel outlet Expedia wants customers to be able to book a holiday in a way that feels like having a chat with a travel agent. Microsoft, a major investor in OpenAI, says ChatGPT already powers its search engine, Bing, and plans to add it to Word and Excel. ChatGPT could be promising for any application where natural, conversational interaction between people and tech would be beneficial. Risks of ChatGPT Critiques of ChatGPT and other chatbot applications generally focus on its potential to disrupt human employment, produce incorrect information or poor practice in training algorithms to identify harmful content. The underlying cybersecurity risks get less attention. Kaspersky's specialist threat intelligence teams have identified three main risk areas. First, ChatGPT can provide advice, even detailed guides, to help prospective attackers plan and target victims. Second, it can develop code and even create entire coding projects for those with little knowledge of software development. While ChatGPT has restrictions and safeguards to avoid abuse, they're fairly easily bypassed. Third, ChatGPT produces convincing and accurate text that can be used in phishing or spearphishing. To some extent, these three areas represent theoretical risks or outlier scenarios that don't represent how people and businesses usually use ChatGPT. Policy perspective beyond risks Policy should aim to be technology-blind – taking a similar approach to all related technology that might emerge in the future, rather than creating a unique approach for one of today's concerns. It should build the best possible defenses against the worst human intentions and applications. Practically speaking, there may be no way to prevent or limit use of tech like ChatGPT. And to limit an emerging technology's potential means being left behind in a global digital economy. While policy discussions usually focus on outputs – the material ChatGPT produces – its inputs (the data it's trained with) may be a bigger threat. Data-driven tools like ChatGPT are only as good or accurate as their training datasets. As chatbot systems may become the most common way to use the internet, issues will have wide impact. Ensuring balance in training data is a growing challenge as disinformation expands. Bad actors can influence what users see and read in ways that have global consequences. Datasets, devices and systems must be secure and accurate. How nations are regulating AI In our public policy work, Kaspersky advocates public-private partnerships. We think partnerships combining global private-sector expertise with policymakers' local needs will be the best defense. It's a middle-ground approach that avoids too much or too little caution. These partnerships in cybersecurity maximize the advantages of emerging technologies like ChatGPT, while safeguarding against risks. United Arab Emirates (UAE) is a role model for inclusive public-private partnerships. They've taken a progressive and collaborative stance on partnerships with international tech firms. Initiatives and forums like the Dubai Chamber of Digital Economy and the UAE Cybersecurity Council aim to safely and securely advance technological growth for short- and long-term benefit. In May 2023, Brazil was considering a Bill to regulate AI. It requires "systems [to] undergo a preliminary assessment carried out by the suppliers themselves, to determine whether they can be classified as being of high or excessive risk," according to OneTrust Data Guidance. It also restricts exploitative AI uses, like subliminal techniques that could cause harmful behavior or target vulnerabilities in older and disabled people. The Center for Strategic and International Studies says Japan looked at the European Union's sterner approach to AI regulation and had "concern that the burden of compliance and the ambiguity of regulatory contents may stifle innovation." Instead, Japan is adopting a "human-centered" approach based on seven principles – among them, privacy protection, security and innovation. They regulate AI through several laws. The Digital Platform Transparency Act, for example, requires fair and transparent practice from large online stores and digital advertising businesses, including disclosing how they decide search rankings. Values are the key to balanced regulation ChatGPT and other generative AI fit a model of technological development we've seen throughout history – it disrupts human lives and businesses with exciting potential but also serious risks that need policymakers' attention. UAE, Brazil and Japan have regulatory approaches that are values-led and aim for a middle ground: A balance between too much and too little caution. Alongside, partnerships between the public and private sector hold promise to let business embrace innovation while adequately managing risk.
IT executives 2040

8 ways Generation Z will transform the future workplace

  • Leadership
  • min read
    • Generation Z (Gen Z) – those born between 1997 and 2012, now in their teens and early twenties – is making an impact on the world. Many brands have aligned their products and communication with the generation's tastes and preferences. Employers are adjusting their business processes to accommodate their arrival. Kaspersky welcomes hundreds of Gen Z interns annually, sparking curiosity about what tech industry leaders might be like in 2040. Here's how we think Gen Z will transform the future workplace. 1.   Exploring vast information efficiently Gen Z is the first generation surrounded by tech and the internet since birth. Information on smartphones is their natural experience and knowledge. They effortlessly navigate and integrate torrents of information. They don't mind not knowing things because they can swiftly find the answer. 2.   Developing deeper analytical skills The inclination to dive into pools of information may also lead to shallow and fragmented thinking. Without a critical approach, it could challenge Gen Z as future tech industry leaders. Gen Z must balance leveraging vast information with deep, analytical thinking to become well-rounded and effective in their work. 3.   Moving away from vertical hierarchy As future managers, Gen Z may establish companies with horizontal management structures. In these organizations, transparency, trust and teamwork will take center stage. By prioritizing these principles, Gen Z leaders will build businesses that empower employees and promote collaboration, where each individual's voice is heard and respected. This shift towards more inclusive management could pave the way for more innovative and progressive workplaces. 4.   Valuing own and others' personal boundaries Gen Z places high value on healthy work-life balance. They firmly believe work should bring similar satisfaction to socializing or leisure. It's crucial to allow distance and dedicate time for relaxation. One way to achieve this is refraining from sending messages outside work hours and respecting their boundaries. 5.   Ever-evolving leaders with backgrounds in multiple career fields These young people don't show the same rigid preferences or brand loyalty as previous generations. They can imagine more possibilities, so they fearlessly explore new opportunities and embrace change. They don't hesitate to switch companies and even transition between different career fields. While the average person may change professions three to seven times in their lifetime, Gen Z may have some 10 to 15 different careers over their working lives. Wide expertise and experience open the door for innovative approaches and the creation of novel cross-platform products across different industries. 6.   Being proactive Many managers observed that Gen Z's proactivity stands out. They readily propose creative and innovative ideas that transcend the boundaries of their roles and departments. 7.   Building unique tech startups What's more striking is their willingness to embrace mistakes as part of learning. Unlike previous generations, Gen Z won't wait for the perfect moment to launch a product. They act in the present and don't fear making mistakes. Gen Z will likely lead the charge as CEOs of numerous tech startups, fueled by unconventional product ideas. 8.   Becoming the youngest generation of leaders This boldness and decisiveness will mean a significant drop in the average age of startup CEOs. Young people and even teenagers are already proving successful in running businesses. Generation Z is the future of the IT industry. The hundreds of young people we welcome into internships at Kaspersky each year gain an opportunity to unlock leadership qualities. They already possess the essential traits – we nurture their potential, refining soft skills and technical know-how. Participating in international student competitions, like Kaspersky's Secur'IT Cup or education and internship programs, can be instrumental in the journey of these young people. With determination and support, they will shape the industry and leave a lasting impact on the world.
Digital voting, democracy, privacy

Is digital voting secure enough for national elections?

  • Tech for good
  • min read
    • 2020 is a big year for democracy. There's a US presidential election, 100 years of US women's suffrage and policymakers around the world considering how to make elections safer in a pandemic. As COVID-19 has brought rising unemployment in most countries, maintaining stability means maintaining – or better, improving – trust in government. With voter turnout down around the globe, policymakers should also be asking how they can re-engage citizens in democracy. You've probably not seen that question answered quite so cluelessly as my local council in the run-up to its 2019 election, by sticking giant poo emojis all over town. Surprise – it didn't work. Voter turnout fell six percentage points on the previous election. Among the Facebook fury that called the poo emoji campaign tasteless and patronizing, a lone voice suggested another way to achieve the campaign's aim. "I filled in my voting papers a couple of weeks ago, but it's sitting in its envelope still, ready to be posted. When I get the chance to swing by a post box, I will, but it's not something I do these days. Bring voting into the click-of-a-button digital world, and you will have voters." Could it possibly be that simple? Voter turnout is falling in almost every country – a trend that started around 1990. When we've fought life-and-death battles to vote, could inconvenience really put people off something so important? It's certainly plausible –  behavioral science shows small changes in environment can make a big difference to what people choose to do. I asked democracy campaigners and commentators in several countries where they stand on digital voting. Do they think it will soon be feasible for national elections? Proportional representation may be fairer, but does it get us voting? Josiah Mortimer of the UK Electoral Reform Society dismisses digital voting entirely. "There are more pressing problems with the voting system than going to a polling station or getting a postal vote. Major privacy, accuracy and trust concerns have not been dealt with, and we feel the issue is a distraction from the real democratic crisis. The priority is ensuring every vote counts – in the UK by switching to proportional representation, modernizing voter registration and improving citizenship education." Proportional representation describes any electoral system that ensures the proportion of representatives elected matches their party's share of the overall vote. That's distinct from non-proportional systems like first-past-the-post or electoral college, where winning certain areas can see a party less popular overall gaining power. Proportional representation has received renewed attention in the UK since its 2019 election returned what Jack Blumenau and Simon Hix described as "the most disproportionate outcome of any election in the post-war era" in a London School of Economics blog post. Proportional representation might make for fairer results, but could it reverse declining voter turnout? After New Zealand adopted proportional representation in 1993, voter turnout fell for many years, to an all-time low in 2011. Then, it started rising again, with their October 2020 election seeing the highest turnout in many years. Whatever drives New Zealand's election turn-out, there's more to it than proportional representation. For its "privacy, accuracy and trust" concerns around digital voting, Electoral Reform Society pointed me to a 2015 article, Why we can't vote online. It describes designing online systems that match the secrecy, accuracy and verifiability of paper as "incredibly hard," referencing flaws found in Estonia's election system in 2014. The article's arguments may have been fair and accurate at the time, but what about today? Five years is a long time in technology, and in the number of eligible voters who expect to do everything digitally. Ballot secrecy is the heart of the issue Lawrence Norden, Director for Election Reform and Democracy at the US's Brennan Center for Justice, often writes on security and electronic voting. He's optimistic online voting could one day be secure enough to rely upon, but cautions against 'too much, too soon' as COVID-19 puts the pressure on to find safer ways to vote. "Election officials shouldn't be left on their own to figure out whether a system is secure and reliable. It is possible that one day, we can develop such a system. But currently, there are no generally accepted benchmarks to evaluate the security of online voting pilots." Norden places safeguarding electronic voting suppliers in his top two priorities. "We need a federal certification framework for election system vendors and their products. Hackers targeted vendors in 2016. We have little insight into vendors' internal cybersecurity practices, who works for them and who owns them. This is more of a security risk than we should be willing to accept." This makes sense, given supply chain attacks are common. Norden thinks ballot secrecy is the big challenge for voting online. "When we rely on software to provide us with election totals, as in the US, we must have a way to confirm the totals are accurate. The best way, while maintaining ballot secrecy, is to check the paper record against the electronic totals. There is no such record in paperless electronic machines or online ballots. If a hacker changes a vote transmitted over the internet, we might not know." Norden highlights voters can still do a lot to protect their vote from cyberattack. "They should check their voter registration online. They could volunteer to work on election day. They can learn the rules for how and when to vote early – the earlier people vote, the less chance a cyberattack can interfere with their ability to cast a ballot that will count." What does secure digital voting look like? Dr. Muhammad Rizwan Asghar, Senior Lecturer, School of Computer Science at the University of Auckland, is another frequent commentator on digital voting. Does he think online voting could be secure enough to be the election standard sooner, later or never? "One might argue if Estonia can do online voting, any country can, but this might not be true. There have been reported vulnerabilities on the voter and voting server ends. Even if we assume there are no issues with existing online voting systems, Estonia is a tech-oriented country with a population of just 1.3 million. "Addressing security risk for online voting means mitigating cybersecurity challenges at the user, communication and server levels. An online voting system needs a form of vote integrity, so votes can be tallied while ensuring voter privacy. Cryptographic schemes achieve this. Each voter encrypts her vote. Using a public bulletin board, voters can see the votes they cast. Once all the votes are cast, they're summed using homomorphic encryption, then the final sum decrypted. The decryption key is split among a set of trusted authorities who must collaborate to reveal the final result. It's promising, but not enough on its own. Some cybersecurity experts say there will never be anything safer than in-person voting with paper slips, but Dr. Asghar points out, "Each approach has its issues. In paper-based elections, people can be prevented from reaching polling booths. They can be harassed or coerced. A returning officer can spoil ballots. We can address most of these concerns using online voting. It could also make voting more accessible and help get results faster. But recent reports show voting servers are an attractive target for state-sponsored attackers. They can make servers unavailable using Denial of Service (DoS) or Distributed DoS (DDoS) attacks." What should any authority considering online voting learn from Estonia? "Estonia has made their system's source code public to foster trust and minimize the potential attack surface. They have internet and computer training programs for voters. If a voter has been coerced, they can go back later and change their vote or even vote in person on election day." Despite his optimism for the future of online voting, Dr. Asghar says it's hard to imagine online voting being ready for national-level elections in the next few years. "Not only is developing the system highly challenging, there must also be training in how to use it." Can blockchain help make digital voting secure enough? National-level elections are always a high-risk environment for interference, whether people tamper with papers in person or nation state-sponsored cybercriminals attack digitally. So it follows we're seeing promising innovations in secure voting technology like Polys used first in low-risk, closed-group settings, like workplaces, universities and local government. Polys uses blockchain and encryption to make a tight voting system. "Encryption built on top of a blockchain system makes every vote like a 'black box' – no one can see how any person voted," explains Alexander Sazonov, Head of Product at Polys."We identify voters using unique email and SMS codes, or third-party identification, checking they're entitled to vote and that they are whom they say they are. The database is distributed among participants, making it almost impossible to change. It's hard to hack because you'd need to access multiple distribution points at the same time." Polys took off with companies and organizations that can't hold in-person elections because their people are distributed around a large area. Soon, European Youth Parliament, Russian Supreme Court and numerous university elections were using it. Several Russian regions now use Polys to consult citizens on budget expenditure decisions. Sazonov further explains Polys' security features. "People make mistakes when counting paper votes, but with Polys, every server on the blockchain independently counts votes. They then synchronize with each other. If the results match, the vote is closed and declared accurate. If there's a discrepancy, the administrator can launch an investigation. No system is completely un-hackable, but ours is transparent enough that hacking can be detected and investigated, while voters stay anonymous." How will we come to trust digital voting? British political philosopher Baroness Onora O'Neill speaks in her lecture series, A Question of Trust, of how public institutions should aim, rather than to be trusted, to be trustworthy. She argues it is being trustworthy that creates trust. The same may be true of electronic voting. For the public to trust it, it must prove itself trustworthy. Many of the risks of digital voting exist with paper-based voting and are as hard to detect in that setting. Secure, digital voting would offer voters protection paper cannot. The Brennan Center's Lawrence Norden makes sense when he says digital democracy shouldn't be rushed because of COVID-19. But even without the pandemic, it seems high time to trial digital voting alongside existing options for lower-risk, local elections. In the face of plummeting voter engagement and likely global recession, the need to re-engage voters can't be put aside – trust in government depends on it. Policymakers must acknowledge technology has changed everything about how voters live. It must inevitably change how we vote.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries