Magazine menu Close Magazine menu

Scale your business

Latest stories

blockchain hamlet

To blockchain or not to blockchain? How to know whether it’s right for your business

  • min read
    • Blockchain – you might associate it with cryptocurrencies and the infamous Bitcoin. But there's more to it than that. Especially when it comes to using it for business. But how does it work? And more importantly, how can it help you? First, let's make an important distinction: distributed ledger technology vs blockchain. Less of a conflict, more of an origins story. Blockchain – the golden child Distributed ledger technology (DLT) is an umbrella term used to describe technologies that store data transactions between users digitally. They are decentralized databases where these transactions – from purchases of cryptocurrency to supply chain interactions – are trusted, and can't be tampered with. Essentially, they are watertight ledgers. As the first fully-functional DLT, blockchain rose to fame for its use in cryptocurrency purchasing chains. But within the last decade, the benefits of using blockchain for business – ultimately managing data and business processes more efficiently and securely – is taking center stage. Let's explore blockchain's two categories: public and private. What are public and private blockchains? In a public system, anyone can join the network, they can both read and write transactions. These systems are decentralized, meaning no user has sole control. Once data is validated on the system it can't be changed. Public blockchains are popular for cryptocurrencies. Unlike public blockchains, private systems place restrictions on who's allowed to participate. Users are authorized with credentials, issued by a certification authority. Users are then allowed different privileges, whether that's read-only, or whether they can input transactions on the data chain. For businesses, private blockchain systems have huge benefits – whether it's accelerating bookkeeping or accounting, reducing indirect costs of manufacturing processes and large-scale software, or just guaranteed authentic data transactions. And they're becoming more and more popular by the minute. According to the IDC Worldwide Blockchain 2018-22 forecast, total spending in private blockchain will reach $US 12.4b by 2022. But who is set to benefit? Private blockchain in action The financial industry is leading the way for private blockchain uptake. A major benefit is reducing the cost of cross-border transactions, which accounted for 27 percent of global transaction revenue in 2017, according to McKinsey. UBS and Barclays are experimenting with blockchain to streamline back office functions and settlement, which some in the industry think could save up to $20B. According to CB Insights, a raft of industries will benefit from blockchain, including managing music rights, ride sharing, and even controlling the source and sale of cannabis. It's clear that many companies are realizing the positive impact blockchain systems can have on their operations. Here's what the Chief Information Officer for Poste Italiane said: Hyperledger is a collection of platforms, hosted by the Linux Foundation, designed to solve business problems using DLT, they include Fabric, Indy and Sawtooth to name a few. Components of the Hyperledger platforms are built around the confidentiality, integrity and availability (CIA) security triad model – which makes them very effective. It's one of the oldest security frameworks connected to blockchain structure and it helps organizations structure their security strategy, especially when it comes to protecting important information. In a nutshell, Hyperledger encrypts certain types of data within DLT. It uses cryptographic hashing – a method of coding that converts any form of data into a unique string of text – which means you can stop people tampering with information through impenetrable encryptions. And it has a decentralized nature, which means you'll always have timely and reliable access to data. But like all new technologies, there are risks if it's not protected correctly. The risks of using DLT There are still some things that can go wrong with DLT. Notably, encryption can't protect your data transactions from corruption against software bugs and configuration errors. Similarly, data can be tampered with when there are security network breaches. Ultimately, having a DLT in place will make your data processes safer and more efficient, but if you don't have the right endpoint products to protect them, you could still face trouble. DLT risks and how to stop them DLT risks exist in three separate areas: 1.    Infrastructure This is where operating systems, databases and containers live. These components inherently have vulnerabilities, so the big thing here is making sure your system software is watertight. Notably, make sure everything is configured properly – including remote access for your employees – firewalls are up and running and finally run a vulnerability scan from external and internal network perimeters. 2.    Business logic This is where your chaincode is located. Essentially, chaincode is the 'smart contract,' – an agreement between two participants in the form of computer code. They can't be changed, and can be executed without a third party (intermediate). The main thing is that chaincode needs to be executed in exactly the same way by every participant (also known as a node) of the network to avoid an inconsistency (indeterminacy) among execution results. A simple example here is a use of random numbers which will produce different results every time a contract is run, so it's best to avoid such situations and should you need a random number within your contract, supply it from outside the contract environment. 3.    Applications Applications are the various software development applications interacting with your DLT. These are usually end-user applications, which are vulnerable to all kinds of human-related threats like phishing or malware. When thinking about how these applications are interacting with your DLT, it's important to invest in endpoint protection, like an anti-virus software. It's also important to perform application security assessments, like penetration testing, to see how cyber-secure your system really is. So that's the benefits and the potential risks of DLTs. So you're probably asking yourself… … to blockchain, or not to blockchain? To DLT, or not to DLT? Yes. If your business can justify using a DLT, and the use case is right for it, then go ahead. You'll be able to store data transactions safely, hiding them from unauthorized users and making them hacker-proof with encryptions. Just remember: to feel the benefits you need to protect your DLT with the right security software.
enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
new normal business covid19

Be the architect of your ‘new normal’ in business

  • min read
    • When COVID-19 spread across the globe, it demanded urgent action from every business. For many, working from home was mandated overnight. Others were sent home on paid leave. Spending slowed drastically. It even disrupted the disruptors: Monzo, Deliveroo and WeWork announced devastating job cuts. It also sparked a time of self-reflection. Environmental impact came into sharp focus, and a conversation about work-life balance erupted. According to leading market intelligence agency Mintel, its consumer and social media trends expert Gabrielle Lieberman says coronavirus didn't create behavior shifts. It accelerated them. Global trends in wellbeing, identity and experiences slated for 2030 are on a fast track to being adopted sharpish. Businesses can't slow down. They must grab the opportunity to create a 'new normal' that works for them. There's no place like home unless it's for months on end Flexible working seemed 'solved' as tech giants like Spotify, Facebook and Google implemented longer-term work-from-home policies. Job done, right? Not so fast. It wasn't long before Zoom calls got old, loneliness took hold and employees started to fear taking a break under the eye of productivity monitoring. Parents faced a crisis as their home and work life collided. Flexible working has proven benefits. It means different things to different people. Definitions include remote work, compressed hours (working longer days but a shorter week) and split hours (for example, working early morning to afternoon, then again in the evening.) It's hard to pin down because it means work designed around an individual to optimize their balance and productivity. Most people want to keep working flexibly post-COVID-19, according to the World Economic Forum's July 2020 research. They want more autonomy and want to split their time between the office and remote work. Senior managers agreed flexible working has benefits but stressed the importance of face-to-face meetings. Where those face-to-faces aren't possible, collaborative tools like Slack and Microsoft Teams can build positive vibes with dedicated channels for humor and memes as well as work-related chat. Workplace design can make us healthier To help companies prepare their workspaces for life with COVID-19, the International WELL Building Institute (IWBI) created a WELL health-safety rating. It's an "evidence-based, third-party verified rating" for new and existing buildings and spaces focused on "operational policies, maintenance protocols, emergency plans and stakeholder engagement strategies." But can businesses go further with their office spaces and use them to improve employee health and wellbeing? IWBI also works with companies to help them meet the WELL Building Standard. This rating system recognizes that buildings, and everything in them, can enhance people's health and wellbeing. It encourages organizations to pay more attention to things like light, nourishment and biophilic design: Interior planting with species that improve indoor air quality and filter pollutants. Just as flexibility benefits both business and employees, remember flexible office space can liberate the budget. For example, having a more compact office with hot desks, workshop spaces and meeting rooms can reduce costs. Retain more people by building leaders' emotional intelligence To help teams cope with change, World Economic Forum research shows empathetic, supportive team leaders are more important than ever. And we're not there yet – more than half of managers need training in skills to support employee mental health. And it might just turn out to be a staff retention boon: Employees don't leave companies, they leave managers. Dr. Joti Samra, R.Psych, founder of MyWorkplaceHealth, a consultancy helping businesses make their workplace more psychologically healthy, puts communication at the center of the empathy and support team leaders can give. She says, "Have one-to-ones with direct reports more often to understand their stress points. It may be money, children or caring for an elderly relative. Adapt expectations to each person's needs. I'm asking my managers to have more contact to find out who's OK and who's struggling, so we can give them early support." The flex appeal of freelancers Tapping into the global freelance market can be a cost-efficient way to scale up or down, reacting to the market quickly. Steve Folland, host of the Being Freelance podcast, has seen his community grow in numbers and strength. On the best ways to work with freelance talent, Folland recommends, "Give clear briefs, realistic deadlines and listen to their advice. When it's all done, pay promptly. Bring freelancers on with as much notice as possible. You'll get the best results that way. As with all relationships, communication is key." Owning the Zoom Knowing your way around video chat software has proven essential if you accidentally turn yourself into a potato. Employees thrown into the deep end during the COVID-19 pandemic with software like Slack, Trello and Asana are keen to keep developing their knowledge. Invest in learning and development, including when it's best not to Zoom and when to take a digital detox, helps retain talent and make your business more resilient. Remote working is a big change in the way people work and caries serious cybersecurity risks. To keep data secure, train freelancers and staff working remotely to be cybersafe. People, planet, profit Overnight changes in reaction to COVID-19 gave many of us time to reflect on our environmental impact. While the pandemic initially presented us with clearer skies and cleaner waterways, the focus on hygiene has derailed the war on single-use plastic. Businesses shouldn't wait to use their corporate influence for environmental change. As well as looking at processes across your company, including the services and products you buy and organizations and non-profits you partner with, look at how you can reduce your company's IT carbon footprint. The UN Global Compact also has frameworks, resources and guidance on how to improve your business practices for a better future. Amongst uncertainty, it's natural to feel conservative and cautious. But for visionaries, it's time to rip up the rulebook and embrace the opportunity to create a new normal that works for your business. It's time to be the architect of your future.
manage data leak

Infographic: Five vital steps to deal with a data breach

  • min read
    • Things can be frantic when you're dealing with a data breach. While swiftly diagnosing the problem and communicating clearly with everyone who needs to know, it's easy to miss something that could have serious consequences later. Use these five pointers to make sure you've done the right thing after a data breach. 1.  Assess the situation First, assess the data breach's risk to customers. Risk assessment lets you decide the next steps, including whether to report the breach. If it's a high risk to customers, you must inform them without undue delay, perhaps even before reporting to authorities. 2.  Be transparent and helpful Don't try to cover up the breach or hide details from those affected. If you hide things, you may see customers losing trust in your business on top of negative news coverage. When you tell customers what happened, give them advice on what to do next. 3.  Document everything Document every data breach, even if you don't have to report it. Record what happened, the steps you took and why the breach was reported or not reported. 4.  Learn from it Once you identify the cause, fix it. Next, make sure all staff receive training in how to prevent future breaches. Human error causes most data breaches. 5.  Make sure you notify everyone affected If you're processing data for other organizations, don't forget to tell them about the breach. They will have steps they must take too. Using these five pointers after a data breach will help your business get back on its feet sooner rather than later. Communicating swiftly and clearly with customers and partners is all-important in limiting the breach's impact on your business. It may happen to even the most cybersecurity-conscious organizations, but there's still a lot you can do to prepare. Equipping your employees with cybersecurity skills and knowledge is crucial to ensuring your customers' data stays safe in future.
cyberthreats as a physical stronghold

Whether protecting the physical or the cyber world, savvy security works the same way

  • min read
    • There's not much difference between an advanced cyberattack and a thief breaking into your company's premises. A corporate building has a fence, entrances, corridors, offices and server rooms. IT infrastructure is similar, only here we have a network, workstations, servers, virtual machines and so on. If someone wants to steal from, spy on or disrupt a business, they must sneak into its territory or its network. Judging by the massive security breaches that have dominated the headlines in the past year, attackers favor the latter these days. Fighting targeted cyberattacks has a lot in common with physical protection. Let's consider the three fundamental principles for dealing with a physical breach, and see how these can improve a company's cyber defenses. 1.    Realize you're under attack Before dealing with any attack, you need to know you're under attack. That means noticing suspicious activity and linking it to a plot. Let's say you're at the office late in the evening, and the alarm system goes off on the second floor. A security officer goes to find out what's wrong. At the same time, a pizza delivery person arrives and hands a pizza over to someone from accounting, gets their money and leaves. That's all perfectly normal, but if you look closer, you may notice a string of coincidences. The alarm went off at about the same time a few days ago, accountants (unlike IT staff) don't typically order pizza, and this one usually complains about gluten intolerance. Putting these clues together, a perceptive security officer might ask some questions. The same principle applies to detect cyberattacks. Separate activities inside the network might not, on face value, show an organization is under attack. But look at the bigger picture, and it might suddenly seem critical to investigate. Threat management and defense do just that: automatically detects and flags malicious patterns behind separate, simpler, seemingly unrelated activities in the network. 2.     Start investigating Coming back to our mystery pizza scenario, to begin investigations, the security officer could go to the camera room and look through the recordings. She would know there are smart cameras all around, letting her see any corner of the office at any time, and the records can't be erased. On the footage, the security officer sees the pizza delivery person jumped out of a black minivan… not the usual vehicle for pizza delivery, right? The gluten-intolerant accountant didn't order a pizza; he ordered spy equipment that he's planning to plant under the CEO's desk. Like smart cameras, anti-targeted attack software reviews network traffic for security purposes. Endpoint Detection and Response (EDR) software watches for cyber-threats too. It sees what's going on at end-user devices (desktops, laptops, mobile devices) and gives the retrospective data needed for an investigation, even when devices are compromised, or when cybercriminals have destroyed or encrypted data to cover their tracks. 3.     Know where to look To spot the right things at the right time, you need to know where to look. That's why it's so crucial that security teams in large corporations get the right training and experience. There's also information. Access to police reports and databases is helpful in physical corporate security. In the scenario I've described, the security guard could run the minivan license plate numbers through the police system to see if it's been stolen or used in similar operations. And once again, the same applies to investigate cybersecurity incidents. You can use threat intelligence data tailored to your industry or location, and you can get specialized training for your IT security team; you can even outsource cyberthreat protection to an experienced third party. Build your cyber fortress We've seen that in many respects, you can use the basics of protecting your premises when building your cyber fortress. With these solutions and services combined, your teams will get ahead of the cybersecurity agenda. You will always have the answer to even the most advanced attacks.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries