Magazine menu Close Magazine menu

Author

Suraya Casey

Suraya Casey is a freelance writer and editor based in New Zealand. Her interests include sustainability, energy, reforestation, statistics, healthcare and the arts.

Get in touch with Suraya

Latest stories by Suraya

supply chain attacks, retail, Austin, air conditioning

How your air conditioning could start a cyberattack

  • Safer business
  • min read
    • Many big businesses know they could be cybercrime targets and invest in defenses like software and training. That's why cybercriminals are increasingly attacking through smaller suppliers who don't have the same knowledge and resources. It's called a supply chain attack. In Tomorrow Unlocked's second episode in the hacker:HUNTER Behind the Screens series, Eliza-May Austin, CEO and co-founder of th4ts3cur1ty.company (That Security Company,) explains how US retail giant Target was attacked through a most unexpected device – the air conditioning. We ask Austin how businesses can prepare for supply chain attacks and how she thinks things are going for women in cybersecurity careers. In Tomorrow Unlocked's Hacker: HUNTER Behind the Screens video, you talk about the supply chain attack on Target in 2013. Why is this attack so important? Businesses must work with other businesses, which makes us all susceptible to a certain degree of risk. Take an airplane, for example. To go from concept to in the air involves hundreds of businesses, contractors and applications. It takes just one breach to compromise that trusted ecosystem. It's something we should all take seriously. Your business th4ts3cur1ty.company (That Security Company) helps companies large and small harden their supply chains. How do you do that? There are many things businesses can do to defend against supply chain attacks. For example, we run penetration testing, consult on governance, risk and compliance and importantly, logging, monitoring and vulnerability management. Are businesses becoming more aware of supply chain attacks and responding appropriately? I can't confidently say yes, which is why I'm vocal on the issue. I recently asked a small-to-medium company (SMB) that supplies services to the medical sector if they'd considered how an attack would impact their clients' security. I was met with such bemusement you'd think I'd asked for a sandwich. What's the most common problem making businesses vulnerable to supply chain attacks? Not knowing how prevalent it is. But also, some businesses that do understand the issue's scale get overwhelmed by it. These attacks aren't always sophisticated – simple measures can go a long way. How did you get into cybersecurity? I moved from a degree in forensic science to a degree in digital forensics, did some internships and the rest is history. You don't need a degree to be in cybersecurity. Is the industry giving women equal opportunities to enter and succeed yet? I think this industry, like any, is what you make of it. Cybersecurity is a fantastic career choice for women and should be promoted as such. What could employers do today to attract and retain more women? I get asked this a lot, so I wrote 15 ways to attract more women to your technical cybersecurity team. I've included simple, practical things like considering the physical environment. For example, if employees have to crawl around on the floor to plug in a laptop, that may feel degrading when wearing a skirt. I also recommend being more open-minded about what kind of people you need: What is Ladies Hacking Society (LHS) and why did you found it? LHS is an awesome community of women who come together to learn from one another and teach each other hacking. I wanted to create a technical option for women because I found mixed events were not really mixed (mainly men) whereas women's events revolved around governance or high-level theory. It's a lot of fun and a great bunch of people. Which is the most important lesson from your 11 leadership lessons from terrible managers, and why? Lesson 3: A sense of humor matters. People tend to take themselves too seriously. Encouraging people to laugh and joke does wonders for team morale and gets people through stressful times. Let's all calm down and have a giggle.  
Digital voting, democracy, privacy

Is digital voting secure enough for national elections?

  • Tech for good
  • min read
    • 2020 is a big year for democracy. There's a US presidential election, 100 years of US women's suffrage and policymakers around the world considering how to make elections safer in a pandemic. As COVID-19 has brought rising unemployment in most countries, maintaining stability means maintaining – or better, improving – trust in government. With voter turnout down around the globe, policymakers should also be asking how they can re-engage citizens in democracy. You've probably not seen that question answered quite so cluelessly as my local council in the run-up to its 2019 election, by sticking giant poo emojis all over town. Surprise – it didn't work. Voter turnout fell six percentage points on the previous election. Among the Facebook fury that called the poo emoji campaign tasteless and patronizing, a lone voice suggested another way to achieve the campaign's aim. "I filled in my voting papers a couple of weeks ago, but it's sitting in its envelope still, ready to be posted. When I get the chance to swing by a post box, I will, but it's not something I do these days. Bring voting into the click-of-a-button digital world, and you will have voters." Could it possibly be that simple? Voter turnout is falling in almost every country – a trend that started around 1990. When we've fought life-and-death battles to vote, could inconvenience really put people off something so important? It's certainly plausible –  behavioral science shows small changes in environment can make a big difference to what people choose to do. I asked democracy campaigners and commentators in several countries where they stand on digital voting. Do they think it will soon be feasible for national elections? Proportional representation may be fairer, but does it get us voting? Josiah Mortimer of the UK Electoral Reform Society dismisses digital voting entirely. "There are more pressing problems with the voting system than going to a polling station or getting a postal vote. Major privacy, accuracy and trust concerns have not been dealt with, and we feel the issue is a distraction from the real democratic crisis. The priority is ensuring every vote counts – in the UK by switching to proportional representation, modernizing voter registration and improving citizenship education." Proportional representation describes any electoral system that ensures the proportion of representatives elected matches their party's share of the overall vote. That's distinct from non-proportional systems like first-past-the-post or electoral college, where winning certain areas can see a party less popular overall gaining power. Proportional representation has received renewed attention in the UK since its 2019 election returned what Jack Blumenau and Simon Hix described as "the most disproportionate outcome of any election in the post-war era" in a London School of Economics blog post. Proportional representation might make for fairer results, but could it reverse declining voter turnout? After New Zealand adopted proportional representation in 1993, voter turnout fell for many years, to an all-time low in 2011. Then, it started rising again, with their October 2020 election seeing the highest turnout in many years. Whatever drives New Zealand's election turn-out, there's more to it than proportional representation. For its "privacy, accuracy and trust" concerns around digital voting, Electoral Reform Society pointed me to a 2015 article, Why we can't vote online. It describes designing online systems that match the secrecy, accuracy and verifiability of paper as "incredibly hard," referencing flaws found in Estonia's election system in 2014. The article's arguments may have been fair and accurate at the time, but what about today? Five years is a long time in technology, and in the number of eligible voters who expect to do everything digitally. Ballot secrecy is the heart of the issue Lawrence Norden, Director for Election Reform and Democracy at the US's Brennan Center for Justice, often writes on security and electronic voting. He's optimistic online voting could one day be secure enough to rely upon, but cautions against 'too much, too soon' as COVID-19 puts the pressure on to find safer ways to vote. "Election officials shouldn't be left on their own to figure out whether a system is secure and reliable. It is possible that one day, we can develop such a system. But currently, there are no generally accepted benchmarks to evaluate the security of online voting pilots." Norden places safeguarding electronic voting suppliers in his top two priorities. "We need a federal certification framework for election system vendors and their products. Hackers targeted vendors in 2016. We have little insight into vendors' internal cybersecurity practices, who works for them and who owns them. This is more of a security risk than we should be willing to accept." This makes sense, given supply chain attacks are common. Norden thinks ballot secrecy is the big challenge for voting online. "When we rely on software to provide us with election totals, as in the US, we must have a way to confirm the totals are accurate. The best way, while maintaining ballot secrecy, is to check the paper record against the electronic totals. There is no such record in paperless electronic machines or online ballots. If a hacker changes a vote transmitted over the internet, we might not know." Norden highlights voters can still do a lot to protect their vote from cyberattack. "They should check their voter registration online. They could volunteer to work on election day. They can learn the rules for how and when to vote early – the earlier people vote, the less chance a cyberattack can interfere with their ability to cast a ballot that will count." What does secure digital voting look like? Dr. Muhammad Rizwan Asghar, Senior Lecturer, School of Computer Science at the University of Auckland, is another frequent commentator on digital voting. Does he think online voting could be secure enough to be the election standard sooner, later or never? "One might argue if Estonia can do online voting, any country can, but this might not be true. There have been reported vulnerabilities on the voter and voting server ends. Even if we assume there are no issues with existing online voting systems, Estonia is a tech-oriented country with a population of just 1.3 million. "Addressing security risk for online voting means mitigating cybersecurity challenges at the user, communication and server levels. An online voting system needs a form of vote integrity, so votes can be tallied while ensuring voter privacy. Cryptographic schemes achieve this. Each voter encrypts her vote. Using a public bulletin board, voters can see the votes they cast. Once all the votes are cast, they're summed using homomorphic encryption, then the final sum decrypted. The decryption key is split among a set of trusted authorities who must collaborate to reveal the final result. It's promising, but not enough on its own. Some cybersecurity experts say there will never be anything safer than in-person voting with paper slips, but Dr. Asghar points out, "Each approach has its issues. In paper-based elections, people can be prevented from reaching polling booths. They can be harassed or coerced. A returning officer can spoil ballots. We can address most of these concerns using online voting. It could also make voting more accessible and help get results faster. But recent reports show voting servers are an attractive target for state-sponsored attackers. They can make servers unavailable using Denial of Service (DoS) or Distributed DoS (DDoS) attacks." What should any authority considering online voting learn from Estonia? "Estonia has made their system's source code public to foster trust and minimize the potential attack surface. They have internet and computer training programs for voters. If a voter has been coerced, they can go back later and change their vote or even vote in person on election day." Despite his optimism for the future of online voting, Dr. Asghar says it's hard to imagine online voting being ready for national-level elections in the next few years. "Not only is developing the system highly challenging, there must also be training in how to use it." Can blockchain help make digital voting secure enough? National-level elections are always a high-risk environment for interference, whether people tamper with papers in person or nation state-sponsored cybercriminals attack digitally. So it follows we're seeing promising innovations in secure voting technology like Polys used first in low-risk, closed-group settings, like workplaces, universities and local government. Polys uses blockchain and encryption to make a tight voting system. "Encryption built on top of a blockchain system makes every vote like a 'black box' – no one can see how any person voted," explains Alexander Sazonov, Head of Product at Polys."We identify voters using unique email and SMS codes, or third-party identification, checking they're entitled to vote and that they are whom they say they are. The database is distributed among participants, making it almost impossible to change. It's hard to hack because you'd need to access multiple distribution points at the same time." Polys took off with companies and organizations that can't hold in-person elections because their people are distributed around a large area. Soon, European Youth Parliament, Russian Supreme Court and numerous university elections were using it. Several Russian regions now use Polys to consult citizens on budget expenditure decisions. Sazonov further explains Polys' security features. "People make mistakes when counting paper votes, but with Polys, every server on the blockchain independently counts votes. They then synchronize with each other. If the results match, the vote is closed and declared accurate. If there's a discrepancy, the administrator can launch an investigation. No system is completely un-hackable, but ours is transparent enough that hacking can be detected and investigated, while voters stay anonymous." How will we come to trust digital voting? British political philosopher Baroness Onora O'Neill speaks in her lecture series, A Question of Trust, of how public institutions should aim, rather than to be trusted, to be trustworthy. She argues it is being trustworthy that creates trust. The same may be true of electronic voting. For the public to trust it, it must prove itself trustworthy. Many of the risks of digital voting exist with paper-based voting and are as hard to detect in that setting. Secure, digital voting would offer voters protection paper cannot. The Brennan Center's Lawrence Norden makes sense when he says digital democracy shouldn't be rushed because of COVID-19. But even without the pandemic, it seems high time to trial digital voting alongside existing options for lower-risk, local elections. In the face of plummeting voter engagement and likely global recession, the need to re-engage voters can't be put aside – trust in government depends on it. Policymakers must acknowledge technology has changed everything about how voters live. It must inevitably change how we vote.
unexpected data collection, GDPR, regulations

The one data privacy principle no one talks about

  • Data and privacy
  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
paper dead shredder

Is paper dead?

  • Digital transformation
  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
cybersecurity predictions

What a year of changing cyberthreats can tell business

  • Threat intelligence
  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
threats outer space

How criminals could use space junk to attack any business

  • Emerging tech
  • min read
    • A powerful way cybercriminals can cause catastrophic damage on Earth is to attack in space. It may sound like science fiction, but now we all rely on space infrastructure to do business, any organization could be affected. Space enthusiast and Distinguished Chair of the cybersecurity program at Middle East Institute Chris Kubecka explains a little-known space disaster scenario we should be more aware of in Tomorrow Unlocked's video Threats in Outer Space. Smash-ups in space Although space exploration has brought many world-changing advances, it's left orbit like many places on Earth – littered. From obsolete satellites to rocket parts and chips of paint, space junk circles the Earth at high speeds, threatening to collide with useful things, like working satellites and the International Space Station. Collisions could be deadly or cause irreparable damage to expensive equipment. Any smash-up creates more space junk, raising the risk to other orbiting objects. For a sense of just how much 'stuff' there is up there, see known space objects tracked in real-time on StuffIn.Space, some known only as 'debris' or 'unknown.' The 'black swan' of space crashes One of the most serious consequences of a space collision is Kessler Syndrome. Kubecka describes it: "A big enough collision would create a chain reaction, causing space junk to smash into each other all over orbit, forming a dust cloud." An accident or deliberate attack could trigger a Kessler Syndrome event. Kubecka explains, "It's now so cheap to build 'attack CubeSats' or even larger satellites. You could cause collisions." She also points to the growing use of Internet of Things (IoT) devices in space tech. "If IoT goes rogue, that's a big problem." As wealthy business people become more visible in space exploration, the potential for huge media attention will attract cybercriminals to attack their space systems and use them to create chaos in space – and so, chaos on Earth. Preventing a 'Kessler' event As well as protecting space systems from cyberattack through the best available methods, like cyber immunity – building systems in a way that makes them almost impossible to compromise – we must take out the space trash. As part of the Securing Space initiative, Kaspersky supports fledgling innovators StartRocket as they develop a new way to remove space debris from orbit – with foam.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries