Magazine menu Close Magazine menu

Enterprise cybersecurity

Latest stories

cross cloud world

With complex data storage now the norm, how can business stay secure?

  • min read
    • While firms in every line of business are planning increased cloud use, defending against the increased range of digital dangers needn't be time-consuming or expensive, even in a multicloud world. Almost nine in ten companies use multicloud – multiple cloud storage and processing providers – to power IT and store business-critical information. A whopping 80 percent use both public and private cloud. While these complex storage setups bring advantages, they make life harder for IT professionals. Recent Kaspersky research found IT complexity is becoming a top challenge for businesses, particularly securing these networked environments. How can leaders make sure it's all secure and manageable? Defending growing data worlds The number of employee and customer digital touchpoints that must be secured in the average enterprise is ballooning. Networks are getting more complex and the amount of data gathered skyrocketing. That data can be enormously valuable – if it doesn't get lost completely in the crowd of, well, more data. Meanwhile, high-severity cybersecurity incidents grew by half in just a year. Hackers keep finding new ways to breach defenses. "Cloud and online IT complexity expand each year as the magnitude of cyberthreats grow," Tim Rosato, head of trend forecasting firm Silver Lion Group, told me in a phone interview. "User accounts, information and logins are also traveling across more cloud networks, apps and virtual desktop environments." New solutions for multicloud enterprise This growing complexity has sent many companies the way of investing in automated endpoint detection and response (EDR) platforms. These proactively scan for and eliminate threats. They're also implementing more specialist security products for hybrid cloud with controls that let you centralize security. It's all about greater network visibility and faster threat response across online workloads, software development and third-party apps. "We live in a multicloud environment. Our research shows malicious actors can take advantage of any unprotected cloud, gaining unauthorized access to the whole infrastructure. New solutions can help protect assets and remediate different kinds of attacks", says Marc Rivero, senior security researcher at Kaspersky's Global Research and Analysis Team (GReAT.) New digital identity management tools also help identify and authenticate users as they travel across apps, networks and cloud providers. You'll also want to routinely scan code and applications, networked systems and connected devices for potential points of compromise, closing loopholes before they get used. Simple actions can also lower odds of compromise further, like adopting zero-trust security and multi-factor authentication. And you can't go past promoting security awareness regularly among staff, with training every three to six months. Back up data offline every 24 hours and test security teams' reaction times using exercises based on real-world cyber incidents. Data-mapping tools that track how information flows across your business, and which users have or control access to this data, can also strengthen your cloud defenses. They help you classify and cordon off data by sensitivity level, which may also be useful in regulatory compliance. Many clouds certainly don't make light work, but the growth of multicloud and hybrid cloud is here to stay. For enterprises, the challenge is making sure their security is up to scratch for this complex environment. The increasing adoption of solutions that use automation and AI, and those designed for convoluted cloud settings, show many are taking heed. But no matter how many clouds or endpoints, remember your people must be the heart of your cybersecurity strategy.
enterprise cyberthreats 2022

Five indispensable cyberthreat insights for enterprises

  • min read
    • Cyberthreats and cybercriminals' methods change all the time. Each year, we see things we've never seen before. Understanding what cyber researchers are finding can help your enterprise stay ahead of evolving cyberthreats, preventing costly data breaches and malicious damage. Kaspersky has the biggest global network of cybersecurity research and analyst teams, collaborating closely with product research and development. With expert researchers distributed across the globe, we see can escalate and respond to local situations fast. Here, we share some of our recent observations your business can act on today. 1. Ransomware is stepping it up a notch Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team (GReAT,) Latin America, says: "This year, ransomware is no less active. Cybercriminals keep threatening retailers and enterprises worldwide. Watching these tendencies gives us threat intelligence to fight cybercrime today and helps us prepare for what we may see in the months to come. "Our research groups ransomware into three big trends: Ransomware that adapts to be able to infect different platforms, ransomware becoming more "industrialized" and cybercriminals taking sides in geopolitical conflicts. But despite its ever-increasing sophistication and targeting, there's still much enterprises can do to stay safe." What to do: Find out about the five best steps your business can take to fight ransomware – from keeping software up to date, to ensuring your Security Operations team has access to the latest threat intelligence. 2. Advanced Persistent Threats are coming out of the woodwork An Advanced Persistent Threat (APT) involves sneaky, sophisticated hacking techniques. It may hide malicious software in your system for a long time, stealing information or waiting for the moment to cause maximum damage. Kaspersky tracks more than 900 groups of APTs. David Emm, Principal Security Researcher, GReAT Global, says: "We became aware of a firmware-level APT compromise through our firmware scanner logs. The attackers had modified a single component to intercept the machine's boot sequence and introduce a sophisticated infection chain. The chain leaves no traces on the hard drive, as its components operate in memory only – a fileless attack with a small footprint." The researchers named the new ATP MoonBounce and have linked it to a known threat actor. What to do: Arm employees with the knowledge they need to protect your organization. Get APT threat reports on SecureList. 3. Apps can make Internet of Things devices even more vulnerable The Internet of Things (IoT) is a fast-growing ecosystem – forecasts predict we'll use more than 75 billion IoT devices by 2025. Among these, companion apps for internet-connected cars have attracted special attention. In early 2022, a 19-year-old hacker shared how he had accessed and controlled more than a dozen Tesla cars through their apps. The vulnerability of IoT devices, increasingly part of manufacturing and industry processes, has long been known. Our interest in transparency recently spurred Kaspersky analysts to look at car-controlling apps, finding their security and openness often lacking. What to do: Dan Demeter, Senior Security Researcher, GReAT Europe, Middle East and Africa says: "For an ongoing well-established security perimeter, we recommend periodic checks and updates for all applications used withing the perimeter, whether it's a consumer or a business environment. Remove any obsolete or not used apps from these environments as soon as possible." Demeter also highlights better practice among some vehicle companion apps. "Some use specially designed solutions from automakers, which, for example, make it impossible to unlock the doors remotely. With access to the vehicle's data through the manufacturer's website, there's no need to give credentials to an app, and users can revoke access any time." 4. Geopolitical tensions are raising denial-of-service risk Distributed Denial of Service (DDoS) attacks are cybercriminals' go-to targeted attack. They overwhelm a server, service or network with a flood of traffic, so you can't give your customers reliable online service. The Russia-Ukraine conflict has triggered a spate of DDoS attacks in both countries, targeting critical infrastructure, media and state-run services. Hacktivist groups have instigated some of these attacks, distributing apps, software and even games which can teach cybercrime skills to those with other aims, like extortion. Kaspersky researchers have noted a sharp rise in DDoS attacks across the board. What to do: Researchers advise businesses and nation states to prepare for DDoS attacks before they happen, through investing in suitable security controls and preparing defensive strategies with national internet service providers (ISPs.) Maher Yamout, Senior Security Researcher, GReAT Middle East, Turkey and Africa, says: "Deploy cyber defenses in advance. When an attack comes, it's too late. You never know when an emergency will happen, so today's the day to take care of your anti-DDoS protection." Threat intelligence also plays an important role in preventing DDoS attacks. Kaspersky is the only global threat intelligence provider with a major presence and expertise in Russia, where most advanced persistent threats and attacks originate. Security teams should subscribe to Kaspersky SecureList to stay up-to-date. 5. Malware keeps upping the ante Malware is common and costly. Over the past year, Kaspersky software prevented at least one malware attack on 20 percent of our users. Recently we've seen plenty of new and rehashed techniques aimed at disguising malware or letting it do more damage. Dr Amin Hasbini, Unit Head of GReAT Middle East, Turkey and Africa, says: "Since its discovery in 2014, we've seen the malware Emotet – originally designed to steal banking credentials – in many other forms, like as a delivery system for other malware and and botnet executable, using small employee mistakes to create big incidents. It mostly spreads nowadays through malicious email spam." What to do: Malware attacks often start with an employee making a small error of judgment, like clicking a link in a dodgy email, so one of the best ways to stay safe is to thoroughly educate all your staff in cybersecurity. Kaspersky research in partnership with Longitude, a Financial Times company, found leaders whose cybersecurity training programs can keep pace with the threat landscape say their companies are better prepared for a cyberattack. Immersive cybersecurity training is a powerful way to engage your workforce with learning in an age when there is much competition for their attention. Advanced cyberthreats are common. They have a big impact on business reputation and bottom line. When business leaders take cybersecurity action, they avoid spending more time later mopping up a cyberattack's damage. When choosing your cybersecurity vendor, look for those that participate in third-party tests and reviews, win awards and achieve top scores in independent tests. What's clear is that advanced threats are ever-changing, so having the most up-to-date threat intelligence will always be crucial for your business.
cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
behind screen heathrow airport

Why cybersecurity education is taking off at Heathrow Airport

  • min read
    • You might not think of cybersecurity first when it comes to airport safety, but Jasvinder Pham, Head of Cyber Development and Assurance and Matthew Bourne, Cyber Security Manager, believes it's at the heart of London Heathrow's safety practice. And education is their most important protective gear against cybercriminals that use psychological tricks, also known as social engineering, on their staff. In Tomorrow Unlocked's video Next Departure: Fighting Cybercrime, Pham and Bourne outline how they're helping Heathrow staff see through cybercriminals' mind games. What is social engineering? And Pham says it's a common tactic. "Nine out of ten breaches are done through social engineering. At Heathrow, we tend to get scattergun emails across the whole estate. We call that phishing. They'll ask a user to enter login and password details or click a link." Learning to recognize the mind tricks Where phishing emails are a scattergun approach, the Heathrow cybersecurity team responds with carefully targeted cybersecurity education. They use internal advertising to raise staff awareness of social engineering techniques, then send out their own phishing-style test emails to see who takes the bait. It's part of a wider cybersecurity education program based on identifying those who can benefit most from the learning. Bourne says, "We've turned training courses on their head by asking the questions first. If you answer them all correctly, you don't need the training. If you don't, you can sometimes complete training in less than 10 minutes." Bourne believes cybersecurity training should resemble real-world cyberthreat situations. "We've started using live actors to get a bigger impact and bring it to the context of the airport." Customers are ready for better security Pham says Heathrow wants to be on the cutting edge of security technology, but it's not always easy. "We want to stay one step ahead, but I feel like we're one step behind." But Pham believes one thing on their side is staff and customer readiness to embrace the latest security features. "People use services like WhatsApp and multi-factor authentication in their home. They want more, so we need to make sure we don't miss out."
heathcare emotet

How could hospitals be better protected from cyberattacks?

  • min read
    • "In wartime, a red cross on a hospital's roof protects it from bombing. But in cyberwar, there's no convention to protect hospitals," says Professor Dr. Harald Dormann, Head Emergency Room Physician at Germany's Klinikum Fürth hospital. With thousands of networked computers and medical devices crucial to patient care, Klinikum Fürth's quick thinking turned a malware attack into an unlucky day for cybercriminals. Tomorrow Unlocked's video, Malware: A New Virus in the Hospital, tracks how Klinikum Fürth's actions stopped the ransomware attack in its tracks and likely saved lives. How do cybercriminals use malware against hospitals? The first hint of an attack was when Klinikum Fürth's IT support team started receiving strange emails from users – a hallmark of the dangerously effective malware Emotet. Emotet also uses Wi-Fi networks to spread. If infected, a wirelessly connected device scans nearby networks and infects other devices using a password list. Klinikum Fürth found 65 systems infected with computer viruses and malware. Thanks to acting fast, they isolated the malware before it encrypted data and held it for ransom – usually the Emotet attack's goal. Malware is common. From March to June 2021, Kaspersky software blocked 1.7 billion malware attacks. It's also becoming more dangerous, with cybercriminals using particularly damaging malware like Emotet for fraud and ransomware attacks. The hospital's surgical cyberdefense Professor Dr. Dormann recounts how hospital staff stepped up when they learned of the cyberattack. "When our CEO told us what had happened, some were nervous. Some were pale. But all were motivated to act." First, they began diverting new patients to nearby hospitals. Then they disconnected the hospital from the internet to reduce the risk of infecting other institutions. They put together taskforces of clinicians, administrators and IT staff to analyze the problem. Then, prioritizing the most critical medical devices, they checked for malfunctions. Extra staff were brought in to help switch to paper-based working. How to stop and prevent malware attacks Klinikum Fürth's story offers many lessons. Their fast response shows why organizations should plan what they'll do if attacked. Cybersecurity education can help staff get wiser to threats like Emotet's use of spoofed emails. Strong passwords help defend against malware that uses Wi-Fi networks to spread. Read more about how to prevent and reduce the impact of ransomware attacks.
financial times report csuite collaboration

How to bring the C-suite and cybersecurity team close

  • min read
    • With cyberattacks growing more frequent and ever more complex, company leaders can no longer leave corporate security to the IT team. The C-suite (senior leadership) must get in the loop. Global professional services giant Accenture found cyberattacks were up by 31 percent globally in 2021. Protecting against attacks must be a priority for leaders. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found that when companies have strong links between their C-suites and cybersecurity teams, they report being better prepared for attacks. For example, 64 percent say they could deal comfortably with a cybersecurity threat created accidentally through employee error, compared to 47 percent of the rest of respondents. Two ways to ensure C-suite integration 1. Share perspectives at the top Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky, believes the increased security risks with remote work have captured leaders' attention since the pandemic began. They realized employees were more likely to be exposed to threats outside the office environment. This, coupled with recent rises in cybercrime, has opened leaders' eyes to the threats they face. "There was a switch — a really obvious switch — in their minds," Naumova says. "They understood that it's not just something to observe from afar — it needs to be top of their minds. Companies that did not have a chief information security officer (CISO) or tech expert on their boards of directors were promoting roles because now they understood they could lose their business in one day to an attack." By drawing on the experience and insights of the wider leadership team, CISOs and chief information officers (CIOs) can gain a broader perspective that could create more effective, 360-degree protection for the business. Graeme Watt, CEO of UK IT giant Softcat, says responsibility for risk ultimately rests with the CEO – but he acts based on his CIO's input. "I have a CIO who reports directly to me, and the information security team sits under them," Watt says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity threats." 2. Ensure effective cybersecurity training and collaboration Integration between C-suite and cybersecurity teams starts with building a deeper understanding of the issues at hand. This can be achieved with the right training for senior leadership. "Training for the C-suite has an additional goal of advocacy – turning managers into leaders of an organization's cyber-awareness culture," says Kaspersky's Naumova. "Training using gamification and simulations of real attacks are particularly useful. First, they are more engaging, and second, they allow the C-suite to observe the results of their decisions instantly." Ricardo Lafosse, CISO at multinational food company Kraft Heinz, says the company promotes a culture of constant collaboration and communication between its cybersecurity team and wider leadership. Lafosse continues, "A great example is marketing. From a privacy and cybersecurity perspective, we have a very close collaboration on how we manage data before we launch a marketing campaign. That shows the importance of cybersecurity as a business enabler." A welcome side-effect of promoting the importance of cybersecurity across the business is that employees at every level of the team feel more valued by the company. This is likely to improve retention rates – an important consideration, given the research found that one-third (34 percent) of company leaders believe the cybersecurity skills shortage will become critical in the next two years. C-suite integration is consistent across the world The research shows attitudes to greater alliances between cybersecurity teams and the C-suite are consistent globally. The most positive is Latin America, where half of enterprises (51 percent) say closer integration between the C-suite and cybersecurity teams will be very important in the next two years. The lowest is in North America, at 42 percent. This is encouraging for enterprises with a multinational presence, as it's important they embed and maintain their culture consistently across global operations. Kraft Heinz's Lafosse says C-suite integration at his company is part of a broader positive and proactive cybersecurity approach. "Culturally, the organization respects and responds to cybersecurity events, and we champion great people in the team," he says. "The whole company also understands how reliant we are on cybersecurity." There are clear advantages in building strong links between senior leadership and cybersecurity teams. Any company seeking protection against ever-sophisticated cyber threats should nurture and value this relationship.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries