Magazine menu Close Magazine menu

Enterprise cybersecurity

Latest stories

behind the screens

Zero-day: Birth of a new threat

  • min read
    • They're inside your system but no one knows how they got there – or how to stop them. These destructive attacks are called zero-day threats, because your security team will have zero days to prepare. Zero-day attacks involve cybercriminals using vulnerabilities no one knows about. They're hard to detect and can go on for years. Zero-day: Birth of a New Threat is Tomorrow Unlocked's latest film in the hacker:HUNTER Behind the Screens series. Michael Gregg, CEO of Managed Service Provider Catalyst Network Solutions, discusses these attacks and his clever way to trick cybercriminals into giving up their secrets. He also shares ways to spot these sometimes-subtle attacks. Understanding zero-day attacks While you may not have heard of zero-day attacks, some of the most well-known cyberattacks fall into this category, such as WannaCry and BlueKeep. But what does it mean? Software developers are always looking out for vulnerabilities hackers could use to gain access to systems through their software. When you receive software updates, these often include 'patches' for recently discovered security holes. "It's called zero-day because that's exactly how long you've had to prepare for it," says Gregg. Zero-day attacks might include reaching a vulnerable system using phishing – manipulative emails to users aiming to convince them to open a file or visit a malicious site. That action downloads the attacker's malware, which infiltrates user files. It can take time for developers to find the vulnerability that allowed the attack. In recent years, hackers have become faster at exploiting vulnerabilities soon after discovery. Zero-day attacks are especially dangerous because only attackers know about them. Once they have access through a zero-day vulnerability, criminals can attack immediately or wait for the best time. What is a Managed Service Provider (MSP?) Gregg's company, Catalyst Network Solutions, is a Kaspersky partner Managed Service Provider (MSP.) MSPs offer cybersecurity-as-a-service. Rather than or as well as an inhouse cybersecurity team, businesses hire MSPs to take care of their cybersecurity. Using MSPs makes it easier for businesses to have a range of cybersecurity expertise on-hand in a market where hiring cyber experts can be challenging. MSPs typically provide services to multiple companies and organizations, giving them broad-based knowledge of cyberthreats and cyber solutions. With the wide range of business tech that needs securing today – from light switches to security cameras to fridges – the value of wide-ranging experience is rising by the day. Tricking cybercriminals with their own tricks The data tricks cybercriminals into using, and so revealing, their zero-day methods. This has allowed Gregg's team to prevent and stop attacks faster. Preventing zero-day attacks As soon as a zero-day threat is understood, software developers will release updates to patch it, so your business should ensure it always installs updates promptly. If you can't stop a zero-day attack happening, there are ways to ensure it's caught early. Gregg advises "There's never a call that's not worth making," when it comes to cybersecurity. Signs of zero-day attacks can be subtle. "If your mouse is moving in a weird way, you're getting out-of-place keystrokes or your computer's running slowly," let the cyber professionals know – whether you have an internal team or a Managed Service Provider.
Cybersecurity expert Eliza-May Austin speaking while seated in a lecture theatre

How your air conditioning could start a cyberattack

  • min read
    • Many big businesses know they could be cybercrime targets and invest in defenses like software and training. That's why cybercriminals are increasingly attacking through smaller suppliers who don't have the same knowledge and resources. It's called a supply chain attack. In Tomorrow Unlocked's second episode in the hacker:HUNTER Behind the Screens series, Eliza-May Austin, CEO and co-founder of th4ts3cur1ty.company (That Security Company,) explains how US retail giant Target was attacked through a most unexpected device – the air conditioning. We ask Austin how businesses can prepare for supply chain attacks and how she thinks things are going for women in cybersecurity careers. In Tomorrow Unlocked's Hacker: HUNTER Behind the Screens video, you talk about the supply chain attack on Target in 2013. Why is this attack so important? Businesses must work with other businesses, which makes us all susceptible to a certain degree of risk. Take an airplane, for example. To go from concept to in the air involves hundreds of businesses, contractors and applications. It takes just one breach to compromise that trusted ecosystem. It's something we should all take seriously. Your business th4ts3cur1ty.company (That Security Company) helps companies large and small harden their supply chains. How do you do that? There are many things businesses can do to defend against supply chain attacks. For example, we run penetration testing, consult on governance, risk and compliance and importantly, logging, monitoring and vulnerability management. Are businesses becoming more aware of supply chain attacks and responding appropriately? I can't confidently say yes, which is why I'm vocal on the issue. I recently asked a small-to-medium company (SMB) that supplies services to the medical sector if they'd considered how an attack would impact their clients' security. I was met with such bemusement you'd think I'd asked for a sandwich. What's the most common problem making businesses vulnerable to supply chain attacks? Not knowing how prevalent it is. But also, some businesses that do understand the issue's scale get overwhelmed by it. These attacks aren't always sophisticated – simple measures can go a long way. How did you get into cybersecurity? I moved from a degree in forensic science to a degree in digital forensics, did some internships and the rest is history. You don't need a degree to be in cybersecurity. Is the industry giving women equal opportunities to enter and succeed yet? I think this industry, like any, is what you make of it. Cybersecurity is a fantastic career choice for women and should be promoted as such. What could employers do today to attract and retain more women? I get asked this a lot, so I wrote 15 ways to attract more women to your technical cybersecurity team. I've included simple, practical things like considering the physical environment. For example, if employees have to crawl around on the floor to plug in a laptop, that may feel degrading when wearing a skirt. I also recommend being more open-minded about what kind of people you need: What is Ladies Hacking Society (LHS) and why did you found it? LHS is an awesome community of women who come together to learn from one another and teach each other hacking. I wanted to create a technical option for women because I found mixed events were not really mixed (mainly men) whereas women's events revolved around governance or high-level theory. It's a lot of fun and a great bunch of people. Which is the most important lesson from your 11 leadership lessons from terrible managers, and why? Lesson 3: A sense of humor matters. People tend to take themselves too seriously. Encouraging people to laugh and joke does wonders for team morale and gets people through stressful times. Let's all calm down and have a giggle.  
chatGPT cybersecurity regulation

With ChatGPT’s vast innovative potential, regulators must take care

  • min read
    • ChatGPT and other artificial intelligence (AI) chatbot applications are major technological milestones with far-reaching benefits for many industries. But with each advance comes unintended consequences. With ChatGPT in its fourth iteration, and its underlying technologies growing fast, it's time to take stock of the policy landscape to understand its implications. What is ChatGPT, and how are businesses using it? ChatGPT is an AI chatbot made by OpenAI. It uses natural language processing (NLP) to create human-like text responses. Users can ask ChatGPT almost anything and receive relatively natural-sounding responses. It can write outputs like programming code, social media posts, summarize complex topics or almost anything text. ChatGPT is an example of generative AI: Artificial intelligence that learns to generate original content like images, music and text by identifying underlying patterns in existing examples. "Its primary objective is to create interactive and realistic conversations with users, making it a powerful tool for chatbots, virtual assistants and customer support applications," says AWS Solutions Architect Ragu Kuppannan. Many top companies are using ChatGPT. For example, travel outlet Expedia wants customers to be able to book a holiday in a way that feels like having a chat with a travel agent. Microsoft, a major investor in OpenAI, says ChatGPT already powers its search engine, Bing, and plans to add it to Word and Excel. ChatGPT could be promising for any application where natural, conversational interaction between people and tech would be beneficial. Risks of ChatGPT Critiques of ChatGPT and other chatbot applications generally focus on its potential to disrupt human employment, produce incorrect information or poor practice in training algorithms to identify harmful content. The underlying cybersecurity risks get less attention. Kaspersky's specialist threat intelligence teams have identified three main risk areas. First, ChatGPT can provide advice, even detailed guides, to help prospective attackers plan and target victims. Second, it can develop code and even create entire coding projects for those with little knowledge of software development. While ChatGPT has restrictions and safeguards to avoid abuse, they're fairly easily bypassed. Third, ChatGPT produces convincing and accurate text that can be used in phishing or spearphishing. To some extent, these three areas represent theoretical risks or outlier scenarios that don't represent how people and businesses usually use ChatGPT. Policy perspective beyond risks Policy should aim to be technology-blind – taking a similar approach to all related technology that might emerge in the future, rather than creating a unique approach for one of today's concerns. It should build the best possible defenses against the worst human intentions and applications. Practically speaking, there may be no way to prevent or limit use of tech like ChatGPT. And to limit an emerging technology's potential means being left behind in a global digital economy. While policy discussions usually focus on outputs – the material ChatGPT produces – its inputs (the data it's trained with) may be a bigger threat. Data-driven tools like ChatGPT are only as good or accurate as their training datasets. As chatbot systems may become the most common way to use the internet, issues will have wide impact. Ensuring balance in training data is a growing challenge as disinformation expands. Bad actors can influence what users see and read in ways that have global consequences. Datasets, devices and systems must be secure and accurate. How nations are regulating AI In our public policy work, Kaspersky advocates public-private partnerships. We think partnerships combining global private-sector expertise with policymakers' local needs will be the best defense. It's a middle-ground approach that avoids too much or too little caution. These partnerships in cybersecurity maximize the advantages of emerging technologies like ChatGPT, while safeguarding against risks. United Arab Emirates (UAE) is a role model for inclusive public-private partnerships. They've taken a progressive and collaborative stance on partnerships with international tech firms. Initiatives and forums like the Dubai Chamber of Digital Economy and the UAE Cybersecurity Council aim to safely and securely advance technological growth for short- and long-term benefit. In May 2023, Brazil was considering a Bill to regulate AI. It requires "systems [to] undergo a preliminary assessment carried out by the suppliers themselves, to determine whether they can be classified as being of high or excessive risk," according to OneTrust Data Guidance. It also restricts exploitative AI uses, like subliminal techniques that could cause harmful behavior or target vulnerabilities in older and disabled people. The Center for Strategic and International Studies says Japan looked at the European Union's sterner approach to AI regulation and had "concern that the burden of compliance and the ambiguity of regulatory contents may stifle innovation." Instead, Japan is adopting a "human-centered" approach based on seven principles – among them, privacy protection, security and innovation. They regulate AI through several laws. The Digital Platform Transparency Act, for example, requires fair and transparent practice from large online stores and digital advertising businesses, including disclosing how they decide search rankings. Values are the key to balanced regulation ChatGPT and other generative AI fit a model of technological development we've seen throughout history – it disrupts human lives and businesses with exciting potential but also serious risks that need policymakers' attention. UAE, Brazil and Japan have regulatory approaches that are values-led and aim for a middle ground: A balance between too much and too little caution. Alongside, partnerships between the public and private sector hold promise to let business embrace innovation while adequately managing risk.
future cybersecurity jobs

7 new roles we’ll soon see keeping business secure

  • min read
    • Technology penetrates every sphere of our lives, and more devices mean more cybersecurity challenges. How we protect systems is evolving with technology and threats: Routine work like monitoring and response is being automated. But cybersecurity isn't getting less complex – businesses will soon need new, more creative, more diverse roles. While they may seem futuristic, some already exist in one form or another. Given long-term trends, leaders should start planning to recruit for these new roles, coming soon. 1.  AI mentor The rise of AI-based technologies like ChatGPT and voice assistants like Siri and Alexa made new tech more accessible while bringing new concerns around privacy and security. AI's control, regulation and monitoring requirements go beyond product management and development expertise. William Gibson's 1984 science fiction book Neuromancer imagined we'd one day have 'Turing Police' to control AI and AI-based systems, stopping them evolving and becoming independent. Turing refers to famed UK mathematician and computer scientist Alan Turing's test to distinguish humans from machines. A need for firm limits on AI is little disputed among experts, with a range of tech leaders, including Elon Musk, signing a open letter asking for a pause in AI development in March 2023. AI Mentors will assess and control AI technology. They may also teach AIs, control access to data and constrain evolution – you might call it, being AI's parent. As AI's complexity and sophistication grows, there will be growing demand for such experts. AI mentors could also develop 'stop' buttons to prevent systems operating on their own. They may also develop protection against malfunction and alternative rescue plans if computers are out of service. 2.  Digital footprint consultant Leaks and breaches negatively affect any brand. Cybercriminals often use threats of reputational damage to extort money from companies once inside systems. A digital footprint consultant will work to protect your brand. However, there's no need to wait for a digital footprint consultant to come on board before you develop strategies to restore your brand reputation after a data leak. 3.  Cyber immunity developer Cybersecurity will change as businesses are forced to rethink how they develop new tech. Embedding cybersecurity principles from the start makes cyber immunity possible – systems so secure that the cost of hacking them isn't worth the reward. Demand for cyber-immune products will see employees scrambling to hire designers and developers with security-first skills. 4.  Threat endurance manager 2022 was a costly year for cyberattacks, with high-profile big tech names like Twitter, Uber and Rockstar Games all hit. Cybercriminals don't shy away from attacking public services and life-saving institutions either, with several universities, the UK's National Health Service and the Red Cross among those attacked. Cyberattacks interrupt production and business processes, pose reputational risks and lead to big financial losses. Health insurance giant Medibank reported a ransomware attack cost them 26 million US dollars. They'll be responsible for business continuity and protect companies by controlling IT systems, responding to cyberattacks and managing software and human errors. 5.  Cyber investigator Cyber investigators already exist, but their work will become more complex and diverse as digital systems get more sophisticated and automated. These specialists normally manage the aftermath of a security breach, covering the whole investigation and eliminating the threat. At Kaspersky, they collect evidence about an incident by analyzing log files and network events, finding indicators of compromise and more. New-generation cyber investigators will be generalists with skills in programming and hacking, but also psychology and decision-making in volatile conditions. They'll also understand robotics and AI, as they must work with emerging systems. 6.  Digital bodyguard Like bodyguards in the physical world, we'll want to hire consultants to protect our digital identities. These bodyguards will protect against doxing – when attackers publish personal data online for revenge – and cyberstalking. They'll clean our accounts and digital history, and guide and support our virtual lives. Pew Research Center found more than 40 percent of US adults experienced online harassment in 2020. Sometimes, online harassment is linked with offline harassment and even violence. Digital bodyguards will help protect us from these kinds of threats, and disrupt and identify the offender when they happen. They may also give victims emotional support. Businesses that provide digital technologies must consider how they'll facilitate digital bodyguards' work protecting their clients. 7.  Space cybersecurity engineer Satellites are the most conspicuous piece of space technology in daily life, used in communications, navigation systems, broadcast media and more. Our reliance on satellites makes them attractive to threat actors. The space industry needs dedicated specialists to prevent attacks, particularly securing operational systems like navigation, engine control and life support. With the advent of space tourism, asteroid mining and new space stations, there'll be rising demand for out-of-this-world cybersecurity experts. What does it all mean for business? The cybersecurity landscape is complex and always changing, giving rise to new roles like these predicted. It's easy for businesses to get left behind. Examples of expensive data breaches at big-name institutions suggest those who invest in top cybersecurity will save time and money long-term. For those developing future technologies, embedding cyber immunity is becoming necessary, especially if your tech will be used in critical services like healthcare and infrastructure.
cross cloud world

With complex data storage now the norm, how can business stay secure?

  • min read
    • While firms in every line of business are planning increased cloud use, defending against the increased range of digital dangers needn't be time-consuming or expensive, even in a multicloud world. Almost nine in ten companies use multicloud – multiple cloud storage and processing providers – to power IT and store business-critical information. A whopping 80 percent use both public and private cloud. While these complex storage setups bring advantages, they make life harder for IT professionals. Recent Kaspersky research found IT complexity is becoming a top challenge for businesses, particularly securing these networked environments. How can leaders make sure it's all secure and manageable? Defending growing data worlds The number of employee and customer digital touchpoints that must be secured in the average enterprise is ballooning. Networks are getting more complex and the amount of data gathered skyrocketing. That data can be enormously valuable – if it doesn't get lost completely in the crowd of, well, more data. Meanwhile, high-severity cybersecurity incidents grew by half in just a year. Hackers keep finding new ways to breach defenses. "Cloud and online IT complexity expand each year as the magnitude of cyberthreats grow," Tim Rosato, head of trend forecasting firm Silver Lion Group, told me in a phone interview. "User accounts, information and logins are also traveling across more cloud networks, apps and virtual desktop environments." New solutions for multicloud enterprise This growing complexity has sent many companies the way of investing in automated endpoint detection and response (EDR) platforms. These proactively scan for and eliminate threats. They're also implementing more specialist security products for hybrid cloud with controls that let you centralize security. It's all about greater network visibility and faster threat response across online workloads, software development and third-party apps. "We live in a multicloud environment. Our research shows malicious actors can take advantage of any unprotected cloud, gaining unauthorized access to the whole infrastructure. New solutions can help protect assets and remediate different kinds of attacks", says Marc Rivero, senior security researcher at Kaspersky's Global Research and Analysis Team (GReAT.) New digital identity management tools also help identify and authenticate users as they travel across apps, networks and cloud providers. You'll also want to routinely scan code and applications, networked systems and connected devices for potential points of compromise, closing loopholes before they get used. Simple actions can also lower odds of compromise further, like adopting zero-trust security and multi-factor authentication. And you can't go past promoting security awareness regularly among staff, with training every three to six months. Back up data offline every 24 hours and test security teams' reaction times using exercises based on real-world cyber incidents. Data-mapping tools that track how information flows across your business, and which users have or control access to this data, can also strengthen your cloud defenses. They help you classify and cordon off data by sensitivity level, which may also be useful in regulatory compliance. Many clouds certainly don't make light work, but the growth of multicloud and hybrid cloud is here to stay. For enterprises, the challenge is making sure their security is up to scratch for this complex environment. The increasing adoption of solutions that use automation and AI, and those designed for convoluted cloud settings, show many are taking heed. But no matter how many clouds or endpoints, remember your people must be the heart of your cybersecurity strategy.
enterprise cyberthreats 2022

Five indispensable cyberthreat insights for enterprises

  • min read
    • Cyberthreats and cybercriminals' methods change all the time. Each year, we see things we've never seen before. Understanding what cyber researchers are finding can help your enterprise stay ahead of evolving cyberthreats, preventing costly data breaches and malicious damage. Kaspersky has the biggest global network of cybersecurity research and analyst teams, collaborating closely with product research and development. With expert researchers distributed across the globe, we see can escalate and respond to local situations fast. Here, we share some of our recent observations your business can act on today. 1. Ransomware is stepping it up a notch Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team (GReAT,) Latin America, says: "This year, ransomware is no less active. Cybercriminals keep threatening retailers and enterprises worldwide. Watching these tendencies gives us threat intelligence to fight cybercrime today and helps us prepare for what we may see in the months to come. "Our research groups ransomware into three big trends: Ransomware that adapts to be able to infect different platforms, ransomware becoming more "industrialized" and cybercriminals taking sides in geopolitical conflicts. But despite its ever-increasing sophistication and targeting, there's still much enterprises can do to stay safe." What to do: Find out about the five best steps your business can take to fight ransomware – from keeping software up to date, to ensuring your Security Operations team has access to the latest threat intelligence. 2. Advanced Persistent Threats are coming out of the woodwork An Advanced Persistent Threat (APT) involves sneaky, sophisticated hacking techniques. It may hide malicious software in your system for a long time, stealing information or waiting for the moment to cause maximum damage. Kaspersky tracks more than 900 groups of APTs. David Emm, Principal Security Researcher, GReAT Global, says: "We became aware of a firmware-level APT compromise through our firmware scanner logs. The attackers had modified a single component to intercept the machine's boot sequence and introduce a sophisticated infection chain. The chain leaves no traces on the hard drive, as its components operate in memory only – a fileless attack with a small footprint." The researchers named the new ATP MoonBounce and have linked it to a known threat actor. What to do: Arm employees with the knowledge they need to protect your organization. Get APT threat reports on SecureList. 3. Apps can make Internet of Things devices even more vulnerable The Internet of Things (IoT) is a fast-growing ecosystem – forecasts predict we'll use more than 75 billion IoT devices by 2025. Among these, companion apps for internet-connected cars have attracted special attention. In early 2022, a 19-year-old hacker shared how he had accessed and controlled more than a dozen Tesla cars through their apps. The vulnerability of IoT devices, increasingly part of manufacturing and industry processes, has long been known. Our interest in transparency recently spurred Kaspersky analysts to look at car-controlling apps, finding their security and openness often lacking. What to do: Dan Demeter, Senior Security Researcher, GReAT Europe, Middle East and Africa says: "For an ongoing well-established security perimeter, we recommend periodic checks and updates for all applications used withing the perimeter, whether it's a consumer or a business environment. Remove any obsolete or not used apps from these environments as soon as possible." Demeter also highlights better practice among some vehicle companion apps. "Some use specially designed solutions from automakers, which, for example, make it impossible to unlock the doors remotely. With access to the vehicle's data through the manufacturer's website, there's no need to give credentials to an app, and users can revoke access any time." 4. Geopolitical tensions are raising denial-of-service risk Distributed Denial of Service (DDoS) attacks are cybercriminals' go-to targeted attack. They overwhelm a server, service or network with a flood of traffic, so you can't give your customers reliable online service. The Russia-Ukraine conflict has triggered a spate of DDoS attacks in both countries, targeting critical infrastructure, media and state-run services. Hacktivist groups have instigated some of these attacks, distributing apps, software and even games which can teach cybercrime skills to those with other aims, like extortion. Kaspersky researchers have noted a sharp rise in DDoS attacks across the board. What to do: Researchers advise businesses and nation states to prepare for DDoS attacks before they happen, through investing in suitable security controls and preparing defensive strategies with national internet service providers (ISPs.) Maher Yamout, Senior Security Researcher, GReAT Middle East, Turkey and Africa, says: "Deploy cyber defenses in advance. When an attack comes, it's too late. You never know when an emergency will happen, so today's the day to take care of your anti-DDoS protection." Threat intelligence also plays an important role in preventing DDoS attacks. Kaspersky is the only global threat intelligence provider with a major presence and expertise in Russia, where most advanced persistent threats and attacks originate. Security teams should subscribe to Kaspersky SecureList to stay up-to-date. 5. Malware keeps upping the ante Malware is common and costly. Over the past year, Kaspersky software prevented at least one malware attack on 20 percent of our users. Recently we've seen plenty of new and rehashed techniques aimed at disguising malware or letting it do more damage. Dr Amin Hasbini, Unit Head of GReAT Middle East, Turkey and Africa, says: "Since its discovery in 2014, we've seen the malware Emotet – originally designed to steal banking credentials – in many other forms, like as a delivery system for other malware and and botnet executable, using small employee mistakes to create big incidents. It mostly spreads nowadays through malicious email spam." What to do: Malware attacks often start with an employee making a small error of judgment, like clicking a link in a dodgy email, so one of the best ways to stay safe is to thoroughly educate all your staff in cybersecurity. Kaspersky research in partnership with Longitude, a Financial Times company, found leaders whose cybersecurity training programs can keep pace with the threat landscape say their companies are better prepared for a cyberattack. Immersive cybersecurity training is a powerful way to engage your workforce with learning in an age when there is much competition for their attention. Advanced cyberthreats are common. They have a big impact on business reputation and bottom line. When business leaders take cybersecurity action, they avoid spending more time later mopping up a cyberattack's damage. When choosing your cybersecurity vendor, look for those that participate in third-party tests and reviews, win awards and achieve top scores in independent tests. What's clear is that advanced threats are ever-changing, so having the most up-to-date threat intelligence will always be crucial for your business.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries