Magazine menu Close Magazine menu

Author

Secure Futures Editor

Produced by the editorial team for Secure Futures by Kaspersky magazine

Latest stories by Secure

AI looks at itself in a mirror and sees a biological human

Reaching the technological singularity: What will happen when machines become smarter than us?

  • Technology
  • min read
    • Picture a world where machines have long since passed the Turing Test. When people can't tell the difference between artificial and human intelligence. In this world, will humans become obsolete, like the floppy disk? Or is it a world where artificial and human intelligence merge to usher in the next step of our evolution? That's the technological singularity, the theoretical time in the future where technological development outpaces our abilities to maintain control over it. For better or worse, it's undoubtedly something that will result in never seen changes to our world. When will we reach technological singularity? Join any discussion about business technology, and it won't be long before someone mentions artificial intelligence (AI). The amount of digital data in the world has already surpassed our abilities to manage it, a development, which has made clear the need for algorithms to do the job for us. But algorithms and AI aren't the same things. They're not even close. An algorithm is a computer program that parses data from sets too large for human interpretation, whereas true AI is capable of thinking for itself, making its own decisions, and having free will. True artificial intelligence doesn't exist. Yet. The explosion of AI has long been a popular trope of science fiction, but the reality is edging ever closer. Ray Kurzweil, world-renowned futurist and Google's Director of Engineering, believes technological singularity is going to happen before 2045. Take note: so far, an impressive 86 percent of his predictions made since the '90s have become a reality. But even if that sounds optimistic (or pessimistic, depending on how you look at it), it's the logical next step in the evolution of technology. Once computers can learn for themselves without being taught and trained with data that we've collected, we can expect profound society changes on a scale never before seen. How can we keep up with technology? The emergence of an artificial superintelligence would bring us greater inventive and problem-solving skills than humans are capable of. This might lead to the creation of a new 'species,' one which might not necessarily have human interests at its heart. But so far, we're nowhere near developing machines with human-level intelligence and the ability to make decisions independently. Now we can enhance human intelligence and capabilities with tools and technology. Indeed, that's precisely what we've been doing for hundreds of thousands of years, ever since our ancestors figured out how to light fires. But today, the stakes are much higher with projects like brain-to-computer interfaces as active areas of research. This may, in turn, lead to radical developments like mind uploading, in which you entire consciousness can be uploaded to and stored on a machine. At least, it could be useful for those millennia-long interstellar voyages. Such developments might sound dystopian since they have the potential to transform what it means to be human ultimately. At the same time, the convergence of technology and humanity, an area of study known as transhumanism, appears to be the only way we can keep up with the constant pace of change. It's either that or the machines eventually outpace our natural evolution and take over. The survival instinct If we can't keep up, and technological evolution ends up outpacing our capability of keeping control over it, then we could face profound risks to security. Each of the seven characteristics that define every biological organism comes together to form a singular goal – survival. Technological singularity occurs when AI matches our desire and capability to survive as a species, and there's little reason to think that AI would have any evolutionary motivation to be friendly to humans. Today, machines are programmed by us to create the outcomes we want. But what happens when they're capable of programming themselves? Time for Humanity 2.0? Imagine you're an expert on machine learning, working on an artificial intelligence algorithm that will be able to create other AIs by itself. Are you merely training your replacement, or have you become an architect of your obsolescence? Welcome to Humanity 2.0, where the human condition is no longer about our biological form. It's a time when machines become an integral part not just of our societies, but also ourselves. Conversely, this could also lead to newer and deeper social class divisions than we've ever seen, as people are separated into those who are augmented by technology and those who are not. There's a safety benefit of not being physically augmented by technology – no one will be able to hack into your mind. How humans could remain our biggest threat Perhaps it isn't machines that we should be worrying about at all. Assuming we'll always be able to control artificial intelligence, we could end up transforming it into a deadly weapon. It's already happening. The proliferation of social media, for example, is one of the most significant security and privacy concerns this century. That's not so much down to vulnerabilities in the technology, but because it's a highly effective medium for conducting social engineering attacks. Coupled with the rise of AI, cybercriminals will be better equipped to analyze social media conversations to emulate users' writing styles and craft more convincing messages to their victims. Even before we reach the era of true AI, the ability of algorithms to parse enormous amounts of data is already misused. On the one hand, algorithms can perform many useful tasks to improve our world, such as climate modeling and disaster prediction, while things like neural interfaces can help victims of spinal cord injuries. On the other, the ability of humans to interfere with information systems makes them a more significant threat than the technology itself. Perhaps it would be better if we just let the machines take over in the hope they'd nurture us like the irresponsible children we are. To fear or not to fear Ray Kurzweil has a more positive outlook than most about the singularity. He claims it's an opportunity for humankind to improve by making us smarter and better at all the things we value. Other science and technology leaders, including Elon Musk, Bill Gates and the late Stephen Hawking, are not so sure. But one thing's for sure – there will come a time when our augmented descendants look back on us as rather quaint and exotic creatures. While we're still decades away from the singularity, it presents itself as the next big step in the evolution of technology. Emerging tech, like autonomous vehicles and facial recognition, are already paving the way. True artificial intelligence is coming sooner or later, which is why it's time for the business world to start taking AI ethics and security issues seriously. It's no longer the concern of generations far in the future. This article reflects the opinion of its author.
Small man wearing clothes associated with crime climbs into a trapdoor in another man's head

What does the rise of deepfakes mean for the future of cybersecurity?

  • Technology
  • min read
    • Imagine you're holding a video conference with a colleague or business partner in another city. You're discussing sensitive matters, like the launch of a new product or the latest unpublished financial reports. Everything seems to be going well, and you know who you're talking to. Maybe you've even met them before. Their appearance and voice are as you expected, and they seem to be pretty familiar with their jobs and your business. It might sound like a routine business call, but what if the person you thought you were talking to is actually someone else? They might seem genuine, but behind the familiar imagery and audio is a social engineering scammer fully intent on duping you into surrendering sensitive corporate information. In a nutshell, this is the disturbing world of deepfakes, where artificial intelligence is the new weapon of choice in the scammer's arsenal. What exactly are deepfakes? Among the newest words on the technology block, 'deepfake' is a portmanteau of 'deep learning' and 'fake.' The term has been around for two years, when it first appeared on a Reddit community of the same name. The technology uses artificial intelligence to superimpose and combine both real and AI-generated images, videos and audio to make them look almost indistinguishable from the real thing. The apparent authenticity of the results is rapidly reaching disturbing levels. https://www.youtube.com/watch?v=cQ54GDm1eL0 One of the most famous deepfakes of all was created by actor and comedian Jordan Peele, who made this video of Obama delivering a PSA about fake news. While this one was made for the sake of humor and to raise awareness to this rapidly emerging trend, deepfake technology has, unsurprisingly, been misappropriated since the very beginning. Its implications for credibility and authenticity have placed it squarely in the spotlight. The worrying consequences of deepfakes Wherever there's technology innovation, there's nearly always pornography, so it's little surprise that the first deepfakes to make waves on Reddit were videos which had been manipulated to replace the original actresses' faces with somebody else's – typically a well-known celebrity. Reddit, along with many other networks, has since banned the practice. However, as actress Scarlett Johansson said of deepfake pornography, while celebrities are largely protected by their fame, the trend poses a grave threat to people of lesser prominence. In other words, those who don't take steps to protect their identities could potentially end up facing a reputational meltdown. That brings me to the political consequences of deepfakes. So far, attempts to masquerade as well-known politicians have been carried out largely in the name of research or comedy. But the time is coming when deepfakes could become realistic enough to cause widespread social unrest. No longer will we be able to rely on our eyes and ears for a firsthand account of events. Imagine, for example, seeing a realistic video of a world leader discussing plans to carry out assassinations in rival states. In a world primed for violence, the implications of deepfake technology could have devastating consequences. Purveyors of fake news seeking to make a political impact are just one side of the story. The other is the form of social engineering that business leaders are all too familiar with. As the video conference example illustrates, deepfakes are a new weapon for cybercriminals. The world's first deepfake-based attack against a corporation was reported in August 2019, when a UK energy firm was duped by a person masquerading as the boss of its German parent company. The scammer allegedly used AI to impersonate the accent and voice patterns of the latter's CEO, someone the victim was familiar with, over a phone call. The victim suspected nothing and was duped out of $243,000. These uses of deepfake technology might seem far-fetched, but it's important to remember that social engineering scammers have been impersonating people since long before the rise of digital technologies. Criminals no longer have to go to such lengths as studying targets in great depth and even hiring makeup artists to disguise themselves; they now have emerging technologies on their side, as businesses do for legitimate purposes. Previously, successfully impersonating a VIP was much more difficult. Now, the ability to create deepfake puppets of real people using publicly available photos, video and audio recordings is within everyone's grasp. Can you protect your business from deepfakes? The common misassumption, that synthetic impersonation can never be nearly as convincing as the real thing, is the biggest danger of all. We live in a world where it's getting harder to tell fact from fiction. From the hundreds of millions of fake social media profiles to the worrying spread of fake news and the constant rise of phishing attacks – it's never been more important to think twice about what you see. Perhaps, after all, there is a case for a return of face-to-face meetings behind closed doors when discussing important business matters. Fortunately, there are other ways you can prepare your business for the inevitable rise of deepfakes without placing huge barriers in the way of innovation. To start with, 'seeing is believing' is a concept you'll increasingly want to avoid when it comes to viewing video or listening to audio, including live broadcasts. To untrained eyes, deepfakes are getting harder to tell apart from the real thing, but there are, and likely always will be, some signs due to the fundamental way AI algorithms work. When a deepfake algorithm generates new faces, they are geometrically transformed with rotation, resizing and other distortions. It's a process that inevitably leaves behind some graphical artifacts. While these artifacts will become harder to identify by sight alone, AI itself can also be used as a force for good – it can detect whether a video or stream is authentic or not. The science of defending against deepfakes is a battle of wills: as deepfakes increase in believability, cybersecurity professionals need to invest more in seeking the truth. A team of researchers in China recently published a method for using AI itself to expose deep fakes in real time. Another paper published by the same team figured out a way to proactively protect digital photos and videos from being misappropriated by deepfake algorithms by adding digital noise, invisible to the human eye. As the threat of deepfakes edges ever nearer, we can hopefully expect more countermeasures to follow suit. This article represents the personal opinion of the author.
Person wearing augmented reality (AR) glasses reaches out and touches a virtual version of themselves.

Does virtual and augmented reality mean augmented cybercrime too?

  • Technology
  • min read
    • Not so long ago, augmented reality (AR) and virtual reality (VR) were the stuff of science fiction. Now they've become more than just niche experimental technologies. They're rapidly entering the mainstream, particularly in the consumer world of interactive media. But it's not just things like video games that are being transformed by the rise of VR platforms – there are some promising business cases for AR and VR too. In fact, some experts estimate that they will become indispensable technologies in the business world by as early as 2025. What is augmented and virtual reality? Although augmented and virtual reality are closely related, they're not the same thing. AR 'augments' the real world around the user by adding digital elements to the real-world view. Perhaps the most familiar example is the mobile game Pokémon Go, as well as less successful products like the infamous Google Glass. VR, by contrast, provides a far more immersive experience, since it relies on shutting out the physical world entirely. Popular VR devices include gaming platforms like HTC Vive and Oculus Rift, as well as lower-tech and more affordable experiences like those offered by Google Cardboard. Another term you'll encounter is mixed reality (MR), which refers to experiences that combine elements of both VR and AR. One of the best-known examples is Microsoft HoloLens, an MR platform designed specifically for business applications. What are the business applications of augmented and virtual reality? Rapid prototyping One of the most promising applications is product prototyping, a process which involves creating a complete digital model of a product (or, a so-called digital twin) and merging it with a VR experience. This allows for extensive testing and ideation without the high costs of developing multiple physical prototypes. Employee training Another popular business application, and one that's already entering mainstream use, is employee training. By applying VR or AR to training programs, it's possible to build a safe and highly interactive simulated environment with real-time feedback. Similarly, AR and VR can help improve workplace safety, especially in hazardous environments, be they workshop floors or nuclear reactors. AR can also help workers assemble, operate and maintain complex machines by providing real-time information overlaid onto their headsets. These are just a few of the exciting applications of augmented and virtual reality. And, though they might still sound like science fiction to the layperson, they're actually not. Companies like Ford, Airbus and Sotheby's are already using them. The wearable camera problem Augmented reality headsets depend on their abilities to understand the local environment, which means cameras are often essential components and they can pose a security risk. Ever since the first Google Glass prototype was released to much fanfare back in 2013 (only to fail miserably by 2015), there have been growing concerns around privacy and security. The launch of Google Glass even gave rise to the colorful term 'glasshole', which refers to those people who behaved inappropriately while using the device (such as by spying on others and taking photos without their knowledge). But edgy names aside, this has serious implications in fields such as healthcare where organizations are subject to strict compliance regulations like HIPAA to protect patient privacy. A new frontier for social engineering Aside from privacy concerns, AR and VR devices are connected like any other. They're part of a rapidly growing global network that's often dubbed the Internet of Things (IoT). And, like any connected device, they handle the transmission and storage of data, which might be misappropriated by hackers. When it comes to the immersive experiences of AR and VR, this has especially worrying potential in corporate espionage and social engineering. When technology can reach the point of convincing the brain it's somewhere where it's not, the opportunities for taking advantage of human vulnerabilities are enormous. As with any technology, the weakest link is normally the users themselves, which makes AR and VR a unique target for exploiting people. For example, attackers might inject features into VR platforms designed to mislead users into giving away personal information. There are also new implications for ransomware, in which attackers could sabotage platforms and interrupt important meetings before asking for a ransom. VR and AR experiences are only going to get more immersive and more realistic. On the one hand, this might make them more engaging and widely used. On the other, it makes them more dangerous. Fake identities, or so-called 'deepfakes' generated by machine-learning technologies, for example, allow for the manipulation of voices and videos to the extent they still look like genuine footage. If a hacker could access the motion-tracking data from a VR headset, they could potentially use it to create a digital replica. They could then superimpose this on someone else's VR experience, such as an immersive business conference, to carry out a social engineering attack. With people interacting more and more through avatars, this brings an entirely new dimension to the disturbing world of cybercrime. Data breach risks Aside from potentially providing cybercriminals with new ways to manipulate their victims, VR and AR present all the classic cybersecurity risks too. As systems that transmit and store data, they're fair game for anyone wanting to get their hands on the most valuable commodity in the world: personal data. They're also possible targets for denial of service attacks (DDos), which could have very serious implications for those depending on AR in critical situations such as surgical procedures or when operating dangerous machinery. Mitigating the risks isn't as hard as you think To address the risks associated with AR and VR, it's best to start with the core principles of information security – the very same ones that should be governing the wider IT infrastructure across the organization. Although attacks against AR and VR systems manifest themselves in different ways, the technological and administrative measures used to safeguard them are similar to other forms of connected technology. They use the same protocols as any other connected device, so all the standard rules apply – include them in your risk assessments, keep firmware up to date and encrypt any sensitive data. And never take security for granted. Most AR and VR devices don't encrypt data by default, and they may integrate with third-party apps which themselves have dubious security. On top of all the standard measures, AR and VR present some unique challenges, particularly when it comes to physical security and safety. One of the biggest problems with VR specifically is that it completely blocks off a user's visual and auditory connection to the outside world. It's always important to evaluate the physical safety and security of the user's environment first. This also applies to AR, in which it's important for users to maintain a high degree of situational awareness, particularly in more immersive environments. And, it should go without saying, but don't run around in a busy workspace wearing a VR headset! Although identity and access management are central to any information security strategy and concern any device, this is an area that's often overlooked when it comes to the adoption of AR and VR systems. You might, for example, be able to identify other people you're working with by their avatars, but there's also the potential risk of the avatar being copied and used by an unauthorized party. Fortunately, used in the right way, AR and VR can potentially improve identity and access management with multifactor authentication (MFA) – for example using eye-tracking sensors to verify your identity before you can access the rest of the system. While the challenges are undeniable, so is the potential of adopting augmented and virtual reality into the workplace.
cloud computing

Dispelling the myths and misconceptions: Is the public and hybrid cloud really secure?

  • Safer business
  • min read
    • There's no denying that securing applications and data across an increasingly diverse range of computing environments is challenging. On the one hand, today's business leaders are under constant pressure to innovate and keep up with a rapidly evolving market. On the other, security presents a constant thorn in their sides in an age when major data breaches make headlines almost every day. But, while the naysayers might dismiss cloud technologies as disruptive and inherently less secure than traditional in-house computing, they're missing an important point. The reality is that it's generally not the cloud itself that's the problem. As with almost all data breaches, the human element is usually to blame. This might include factors such as inefficient risk assessments, mismanaged access controls, poor data redundancy and a variety of other threats, most of which stem from within the organization. The common misconception that the cloud is the source of these challenges is why software-as-a-service has yet to become an established and trusted way of doing business in many parts of the world. Dispelling the myth of cloud (in)security Let's get one thing straight: the world's major cloud data centers – operated by the likes of Amazon, Google and Microsoft – are some of the most secure environments on the planet. This really shouldn't come as a surprise, since these companies are some of the most powerful in the world. They have access to the financial resources, expertise and bleeding-edge tech on a level that few organizations could ever dream of having. Not only do they have 24/7 physical controls like security guards, video surveillance and perimeter fencing akin to that of a maximum-security prison, they also offer administrative and technical controls to safeguard the data in their care from hackers. Information security and integrity are at the very core of what these major technology providers do, hence they strive to eliminate every single point of failure with built-in redundancies and automated rollovers. They distribute data across many different machines in many different locations to protect it from threats like natural disasters and hardware failures. The cloud potentially offers improved security from an administrative perspective by reducing the need for customer-controlled security layers. Some cloud providers and server colocation vendors also offer a fully outsourced security operations center (SOC), which is ideal for smaller businesses, who are often targeted en masse by threats like phishing scams and malicious advertising. Even in cases where migrating to the cloud doesn't provide improved information security, the greatly reduced capital expenses can offer more financial control to invest in security. So, where do the threats come from? Now, I'm not saying that the world's biggest data centers are impenetrable fortresses – but they're the closest thing to it. Why is it then, that major data breaches targeting cloud-hosted digital business assets are always making headlines? The weakest link isn't the technology – it's the people. This is often the case when managing complex, hybrid cloud environments in which businesses use a blend of public infrastructures (like Amazon Web Services (AWS)) and an on-premises or hosted private cloud consolidated across a wide-area network (WAN). However, with the right approach, the hybrid cloud brings multiple benefits, such as decreased capital costs and greater flexibility. Here are the main threats to hybrid cloud security you need to overcome: Mismanaged access rights One of the greatest advantages of cloud-hosted resources is they're accessible from any device with an internet connection. This can also be its greatest drawback in an age when social engineering attacks dominate the world of cybercrime. After all, cybercriminals aren't always stereotypical hackers staring at lines of code whizzing across a monitor. Instead, they increasingly rely on tactics of subterfuge and manipulation to encourage their victims to surrender confidential information, such as login details. Social engineering tactics are often used to put their malicious code to work. To overcome these risks, IT administrators must enforce multifactor authentication (MFA) to reduce reliance on passwords. This way, those accessing the system, particularly from an unknown device or network, will need to verify their identities with a secondary authentication method. This might be a fingerprint scan or a temporary security token like an SMS code. Because the secondary verification method is dynamic, or an innate characteristic of the user (like a retinal scan or fingerprint), it's far better protected from social engineering attacks. Unprotected APIs Hybrid cloud deployments depend on application programming interfaces (APIs) to ensure the interoperability between different infrastructures – such as in-house data centers, public cloud resources and hosted private clouds. These serve as conduits for ensuring the seamless flow of data between the two systems to provide an uninterrupted experience for end users. But when unprotected, these API endpoints can leave sensitive data exposed. This vulnerability is often exploited when data is being transmitted across insecure devices and connections. Other attacks may exploit misconfigured APIs to coerce the system into doing something that would lead to its compromise. For example, attackers started exploiting misconfigured Kubernetes APIs to issue commands to it; in doing so, they downloaded and launched a malicious payload from outside. Since APIs are effectively gateways – access points into a public cloud application or service – IT administrators need to take extra steps to secure the data that flows through them. The easiest way to protect it is to ensure that data never leaves an endpoint unencrypted. This way, even if a hacker does get their hands on data exposed by a vulnerability in the API, it will be unusable to them. Today's AES-256 encryption algorithms would take 3×1051 years to crack without knowing the encryption key, by which time even the youngest and most patient hacker might just give up. Insecure third parties In hybrid cloud environments, your vendors are an additional source of risk. 181 third-party vendors access the average business network every week, leading to two-thirds of companies experiencing data breaches linked to one of their vendors. Unfortunately, some cloud vendors are vague when it comes to critical factors like data ownership and governance. They may not have the necessary controls in place to ensure that your data is safe during its migration to the cloud or when it's hosted on their own servers. To reduce the substantial risks posed by third parties, businesses must carefully vet any cloud vendors they choose to work with. Enterprise managers must always verify data ownership and security controls and ensure that everything is clearly defined in their service level agreements (SLAs). They need to know exactly what the provider does with their data, which access controls and permissions they have in place, and which resources they provide if something goes wrong. Any agreement should ideally be reviewed by an attorney before signing. Breaches of regulatory compliance Even if you have all available security measures in place when migrating data to the public cloud, there's still the matter of compliance. Many data-processing regulations, for example, require data belonging to citizens of a particular country to be stored in the same territory. In some ways, this contradicts the very ethos of the cloud as a decentralized and distributed computing environment. To further complicate matters, most cloud providers cannot guarantee the physical location of your data, although there are some exceptions: AWS, for example, can work in regional mode to avoid moving your data out of the territory. Fortunately, hybrid cloud deployments are ideally suited to highly regulated industries, since they provide more control over where data is physically stored. For example, a healthcare provider subject to HIPAA and HITECH regulations might keep patient health information (PHI) in a private cloud such as an in-house data center or server collocation facility. A GDPR-compliant company might do the same to ensure that customer data remains in the EU, while business applications are moved to the cloud. In the end, the hybrid model gives you more control over where your data is stored and how it's protected. Hybrid cloud computing – the first step towards innovating at scale The key to successful hybrid cloud deployment is a security-first approach that provides IT administrators with full visibility into their digital assets. With the right management solutions and software layers, enterprises can build a single cohesive environment that incorporates the best of both worlds. A hybrid cloud deployment is no more or less secure than on-premises virtualization, but with the right approach, it can become even more secure. All it takes to get started is to select a cloud security product that's scalable and adaptable to your needs.
dark web monitoring

Can dark web monitoring move you one step ahead of cybercriminals?

  • Cybersecurity
  • min read
    • Imagine if it didn't take an average of 190 days to identify a data breach and then a further 57 days to contain it. Imagine if instead you could cut down those times to just a few days or even a few hours, mitigating the effects of a data breach and minimize long-term damage to your organization. It all starts with understanding how cybercriminals work and knowing what they do with stolen data. The dark web plays an important role, since that's where most hackers and scammers go to trade their ill-gotten gains. This mysterious counterpart of the public internet is home to stolen information and wanton criminality. But what does that mean for protecting your business, and is there really any value in using dark web monitoring services? What exactly is the dark web? https://www.youtube.com/watch?v=H7-pJiC-N-g By now, most of us have heard of the hidden version of the public internet known as the dark web, but few other than cybercriminals and the law enforcement agencies tasked with tracking them down really know much about it. Firstly, it's important to explain what the dark web isn't. It exists separately from the public internet for a start, and neither is it the same thing as the deep web. The deep web is the part of the web we spend a lot of our time on already, since it includes everything that's hidden behind a login page, such as our email, intranet and bank accounts. It's everything online that isn't indexed by search engine crawlers, and remains inaccessible to those without the right account credentials. Although the two are commonly confused, the dark web is an entirely different beast. While it uses the same infrastructure as the public internet, the dark web is an overlay network that requires specialized software to access it, such as the popular Tor browser. Servers connected to the dark web hide behind multiple layers of security and anonymity. This makes it notoriously difficult for law enforcement agencies to track down their location and the people who maintain them. Also, criminals invariably use cryptocurrencies like Bitcoin to hide their transactions, which is why ransomware payments are never demanded in US dollars or other mainstream currencies. Another common misconception about the dark web is its legality. Although a lot of content on the dark web is illegal, the network itself isn't. In fact, it does have its legitimate uses, at least in theory. For example, journalists may use it to allow their sources to remain anonymous, and citizens of oppressive regimes may turn to it as a platform for free speech. As far as companies are concerned though, it's primarily a hotbed of criminality. Why is the dark web so dangerous? Naturally, the fact that people think they get away with just about anything on the dark web, whether that's hiring an assassin or selling ransomware as a service, has made it the medium of choice for all manner of criminals. Perhaps the most poignant example of all was the Silk Road marketplace, a darknet market that mostly sold drugs. Despite being the first and biggest illegal darknet marketplace, it took the FBI in the US three years to track down its founder Ross Ulbricht, who is now facing life imprisonment without the possibility of parole. The site, along with its successors, have now been closed down. While you might think that the Silk Road's takedown would set an example, it hasn't had much of an impact on darknet criminality. Despite the past couple of years seeing a significant uptick in dark web law-enforcement, thanks to Operation Onymous by Europol and the multinational Operation Bayonet, many illegal marketplaces are alive and well – and growing fast. Most transactions now take place over darknet forums and smaller marketplaces, since many of the big names like AlphaBay, Wall Street and Dream Market have been taken down. But that hasn't made the dark web any less of a threat to businesses. Cybercriminals most often carry out their attacks for financial gain. That means they need a place to sell their ill-gotten gains, and the dark web presents the perfect marketplace. In other cases, victims may be held to ransom, with attackers claiming they'll publicly disseminate their stolen data, which might include anything from explicit photos to bank account details, if they don't pay up. A lot of stolen data, however, ends up on the dark web. For example, 'fullz' is dark-web lingo for full packages of identifying information, which is sold to identity thieves for use in credit card fraud. If these records are stolen in a data breach that targets your business, then that's likely where they'll end up. Help or hype – are dark web monitoring services worth the money? Dark web monitoring services have received a lot of hype in the in the last two years, following the catastrophic data breach that befell the Equifax consumer credit reporting agency, which exposed private information belonging to 147 million people. Rival agency Experian saw this as a market opportunity, so it quickly launched its dark web monitoring service in the US. It touts it as an identity theft protection product, although it does also let you freeze your assets to stop unauthorized individuals opening new lines of credit in your name. Many companies are now offering dark web monitoring services, but there's still a widespread misunderstanding about how they work, or even if they work at all. For a start, they don't scan the entirety of the dark web, since doing so would be practically impossible. And neither can they initiate takedown proceedings against stolen records or intellectual property. The reality is that, once something ends up on an underground marketplace, there's often nothing you can do to prevent it from being sold or misused. Dark web monitoring services can only detect information that's publicly available. Just like the search engine crawlers can't see anything that's hidden behind a login or paywall, dark web scanners can't access anything that's being shielded from scraping software. Instead, they're looking out for big data dumps containing leaked personal information like passwords and payment card details. If your business suffers a data breach, and the stolen records have ended up on the dark web, then a dark web monitoring service will inform you, but only provided they could get their hands on it in the first place. Fortunately, there are many more effective ways to protect your business from the dangers of the dark web, such as by staying away from it, ensuring all data is encrypted and educating your employees of the dangers. But if you've had a breach, it's time to face facts – your data has already been stolen. If a massive data dump containing sensitive information pertaining to your business, employees or customers ends up on the dark web, then having the means to monitor it may allow you to identify the breach and act faster to alert anyone whose information has been stolen and lock down any compromised accounts. But it's not a fool-proof solution, and neither will it protect you from the worst effects of identity theft. However, in addition to helping you react quicker, dark web monitoring does offer some proactive value by helping keep business decision makers informed about trends and developments in these underground communities that might compromise their security. For example, if there's chatter about targeting a particular company in dark web forums, a monitoring service could reveal it, giving you a chance to brace for an attack. How else can you find out if you've been hacked? As dark web monitoring isn't a fool-proof option, many business leaders are looking for other, more reliable, ways to tell if they've been hacked. Some methods don't even require you to invest a monthly fee. For example, individuals and businesses can quickly find out if their email addresses or any accounts associated with it have been compromised on Have I Been Pwned. In the end, the only truly reliable way to find out if you've been hacked is to keep full audit trails of all activity across your network and every device connected to it. Today's security solutions go far beyond the limited capabilities of conventional antivirus software and firewalls to search for suspicious activities rather than just detect known threats. These might include unusual computing activities, strange network connections or unwanted software installations. Remember that no information security infrastructure is 100 percent effective. But if your organization does fall victim to a data breach, then the sooner you learn about it, the more time you'll have to prevent unacceptable losses. That's why a multi-layered, proactive approach to cybersecurity that provides full, real-time visibility into all your digital assets, is the only proven solution for keeping your business and your customers safe.
small business cybersecurity

How to protect your small business from cyber-threats

  • Cybersecurity
  • min read
    • When you've worked so hard to build your company and your brand, you can't afford to let digital security take a back seat. And nor can you afford to let threats prevent you from innovating in a time when businesses of all sizes face constant pressure to adapt to rapid change. Gaining control over information security means more control over the future success of your business. According to recent research by Kaspersky, the average cost of a security compromise for a small- to medium-size business (SMB) weighs in at US$108,000. Approximately half of this stems from damage to information and infrastructure, the rest resulting from disruption to normal operations. If you're a business owner, that's a statistic you can't afford to ignore. Not only can the costs of a cybersecurity incident be catastrophic – they're often notoriously difficult to quantify. On top of the more obvious and direct costs, you also have to factor in brand damage which could have deeper consequences. For example, 60 percent of businesses close within six months following a major attack. Why should business owners care about cybersecurity? According to Kaspersky's Andrey Dankevich: Many business owners may think they aren't attractive targets, and that it's not worth investing significant financial, human and technical resources into bolstering defenses. The belief is that cybercriminals would rather go after big targets, which is little surprise as its data breaches from brands like Yahoo! and Marriott that tend to make the headlines. But big businesses are more likely to have cutting-edge security measures in place, or at least that's the common thinking among cybercriminals. They're perceived as being lucrative but extremely challenging targets. Most cybercriminals are opportunists. Instead of targeting big enterprises, they go after easy money – some 36 percent of small businesses have suffered a data breach. What's more, around a quarter of companies only use consumer-grade products to protect themselves, and of those who have had breaches, more than one in four don't have appropriate IT solutions or internal expertise. Every organization, no matter its size or industry, has something that cybercriminals want. That might include payment data, personally identifiable information or intellectual property, to name a few. Small businesses are collecting more valuable data than ever before, so they're becoming even more attractive targets. At the same time, their cybersecurity infrastructure is often lacking – smaller business may have no IT specialists on site and rely on managed service providers (MSPs), or even just basic consumer tech know-how to get by. With the lack of infrastructure and expertise necessary to protect the so-called crown jewels (your most valuable data), attackers have many avenues to exploit. On a brighter note, it's possible to build a robust small business cybersecurity infrastructure without having to choose between breaking the bank and jeopardizing your efforts to innovate. Strong cybersecurity begins and ends with people Information security is commonly perceived as a technical challenge. Ask almost any office employee, "Who in the business is responsible for cybersecurity?" and they'll probably point at the folks in IT. Or, if there isn't a dedicated IT team, they'll likely point to management. The truth is, regardless of company culture, cybersecurity is everyone's responsibility. That's because it's largely a human problem rather than a technological one – around 90 percent of cyberattacks involve a human element. Cybercriminals prey on human error, simply because it's far easier than exploiting technology. For example, it's much easier for an attacker to manipulate someone into giving away login credentials than to break encryption or use a brute-force attack which could theoretically take longer than the projected lifespan of the universe. In fact, most cybercriminals don't know any more about the inner workings of technology than the average layperson. Instead, they rely on social engineering tactics and malware-as-a-service (often purchased on the dark web) where cybercriminals recruit others as affiliates, in many ways mirroring the processes used by legitimate businesses. The only real way to mitigate human error is to ensure your employees are at least as aware of the cybersecurity landscape as those who would exploit it. While you can't expect people in accounts or HR to understand the complexities of things like encryption and security protocols, you can train them to better recognize social engineering threats like phishing emails and common security risks like weak passwords. Everyone must be included in an ongoing and interactive security awareness training program that prepares people for the risks. You won't just be doing your business a favor – you'll be helping everyone who works for you to stay safe in their personal lives too. Protect your perimeter Perimeter defense is the basic, foundational level of protection. Analogous to the walls of a medieval castle, its sole purpose is to keep the bad stuff out and the valuable stuff in. One of the biggest challenges is establishing where the perimeter exists in the first place. It's not just about protecting internal networks with firewalls and antivirus software like it used to be. Far from data systems being restricted to in-house servers and workstations, business leaders now need to think about mobile devices being used for work (including those owned by employees) and cloud-hosted resources. But conventional perimeter defense is no longer enough. The amount of data in your care typically extends far beyond the physical boundaries of your premises. That's why protecting your online accounts must be a top priority. Hardware is becoming increasingly meaningless in small business environments, which are transitioning to cloud computing and managed services. All of these devices, known as endpoints, need to be protected. Getting protected is not as daunting as it may at first seem. To complement in-house IT managers or replace them, small businesses often partner with managed service providers (MSPs) who can offer a suite of security services to meet your needs including managing antivirus software, installing firewalls and protecting email from malicious content. How layered security helps protect the crown jewels Back to the castle analogy, there's more than mere walls protecting what's inside. Many castles are built on hills to provide a defensive advantage. Others have moats or ditches to offer an additional layer of defense. And, even if an attacking army does get through the walls, there's usually a garrison to provide a last line of defense. The same methodology applies to information security, where perimeter defense is simply the first barrier serving to stop attackers from getting into the system. But if that's all there is, it's a single point of failure which leaves your business extremely vulnerable. Multilayered security is based on the concept of using multiple security solutions together to guard the crown jewels – your highly valuable and sensitive data. For example, a firewall helps prevent malicious code from reaching your network, antivirus software protects each individual device connected to the network, and encryption protects data both in storage and when it's being sent across the internet. These are all technical and administrative controls, both of which are relatively easy and cheap to implement given that they're now standard with many business-grade IT systems. But, while they do help protect your business, they're not a substitute for training and expertise. Adding value with better information security It's time for business owners to take information security seriously, but that doesn't mean it should become a burden on resources or a blocker of innovation. Rather, it can add value to your business in a time when customers consider data privacy and security to be top priorities when choosing which organizations to do business with. With a combination of the right policies and cutting-edge technology, you can bring your business closer to achieving immunity from cyber-threats.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries