Magazine menu Close Magazine menu

Trends

Latest stories

QR codes

COVID-19 made QR codes huge, but what’s their future?

  • min read
    • If you've visited a restaurant or store recently, chances are you've seen and used the ubiquitous small squares that make up a QR code. Our exposure to these codes has never been higher than since the COVID-19 pandemic, nor their value clearer. But how did we get here? Why are QR codes today's technology of choice for navigating our lives? Let's step back to Japan, 1994. Where QR codes began Automotive components manufacturer Denso Wave had a frustrating problem on their supply line. They were using bar codes on their components that workers had to scan for information they needed. But bar codes became limiting for the company because of the small amount of information each could hold. The company gave one of their young engineers, Hara Masahiro, the task of developing a solution. Bar codes are one-dimensional (read along one axis,) but Masahiro's creation was two-dimensional: Read horizontally and vertically. It increased the information held from just 20 characters to 7,000. The speed these new codes introduced to manufacturing created its own problem. Technologist Simon Raik-Allen explained it to me like this: "Imagine a conveyor belt with all the products going past. You want a camera to see which products are where. If they go too fast, the camera won't read it." Since then, eagerness to adopt QR codes in business and personal lives has varied. Asia has been the keenest adopter, with QR codes playing a central role in digital payments. In China, consumers use WeChat or Alipay apps to make some 90 percent of mobile payments, and both use QR codes to facilitate the transaction. In Africa, M-Pesa has started to incorporate QR codes into its text message banking service. In Europe and North America, uptake had been less enthusiastic – until now. A 2015 TechCrunch article called QR codes "frustrating" and a "laughing stock." Brands eager to plaster QR codes wherever they could and the likes of QR code tattoos led to perception the codes were a gimmick. The user needing to download a QR code scanning app may have contributed to this sense of needless novelty. In 2017 things changed. Phone manufacturers began incorporating QR code scanners into camera apps so users didn't need to download an app. Improvements in mobile technology letting scanned links open more quickly also played a part, according to Joe Waters, author of QR Codes for Dummies. These improvements planted the seed that allowed the technology's quick adoption in the pandemic when the need became clear. Waters says, "People now want as little contact as possible with everyday objects that may spread germs." This poses a novel question: Will our newfound familiarity with QR codes lead to new uses in the coming months and years? How should business and tech leaders be thinking about QR codes? The Future of QR codes Large retailers like Amazon have started experimenting with QR codes to track and for payment in their physical stores. But opportunities are opening for retailers of all sizes, especially around demonstrating sustainability and environmental credentials. Fashion label Another Tomorrow uses QR codes on labels to give consumers more information on the clothing item's sustainability. Provenance uses blockchain to make supply chains transparent, with QR codes for consumers to see evidence of what the brand claims. The 2021 'right to repair' EU law means consumer electronics manufacturers must add a QR code for more information on the product, like how loud it is. Securing QR code-reading for business Data security is a pressing concern with widespread adoption of QR codes. Consumers and businesses may not have known the security risks as they rapidly adopted the technology in the past 12 months. David Emm, Principal Security Researcher at Kaspersky, says "A tainted QR code might ask a user to download a malicious app containing malware. The malware could then steal personal information." Businesses can reduce their risk by using a reputable, up-to-date QR code scanner. It also pays to raise awareness among staff and customers of malicious QR codes, for example, advising they consider whether a code looks tampered with before scanning it. The battle for a new technology's acceptance is won when the audience understands what it does that no other technology can do. The pandemic gave the QR code a chance to show it was no gimmick. Business should expect to see QR codes used more widely and creatively, and consider how those game-changing 7,000 characters could help them do business better.
ATTACHMENT Dglobal cybersecurity priorities

COVID-19 has changed global cybersecurity. What must nations do now?

  • min read
    • During the pandemic, lockdowns and 'shelter in place' orders around the world have done much good. They've not only saved lives, they've shown us our cities without pollution and let businesses realize employees working from home can be more business benefit than business challenge. I spoke about the growing cyberthreat landscape and what we must do about it as part of a high-level leaders discussion on international cybersecurity during the United Nations Internet Governance Forum (IGF) 2020. During the pandemic, cybercriminals used new-found time to hone their skills and test out new methods. We saw a sharp rise in cybercrime of all kinds, from malware to advanced persistent threats (APT.) New hacking groups came on the scene, and with them, new kinds of attacks. New attacks and actors unmasked Here's just a sample of the expansion of cybercrime our researchers detected since the coronavirus pandemic came into our lives. This year we've seen unique malicious file detection rise 20 to 25 percent a day. Most threats, like malware, are relatively easy to deal with. But when what we're seeing is a rise in more professional cybercrime gangs, that's a different story. Kaspersky researchers are now monitoring more than 200 cybercrime gangs who've been launching hyper-targeted attacks against targets such as banks and governments. We've also seen more 'juniors' entering cybercrime. While they're easy to stop now, many will graduate from hacker kindergarten and join the pros. With the increasing use of the internet of things, the number of points where cybercriminals can attack has grown exponentially. We know they're willing and able. Take, for example, one of the most successful global attacks, the 2016 Mirai malware attack on domain name system provider Dyn. It took down hundreds of news websites around the world. How should nations respond to the new threat landscape? The cybersecurity impact of the pandemic has two parts. First, people are at greater risk of cyber-intrusion thanks to working from home and spending more time online. Second, there are more cybercriminals, and they've become better at what they do. Meanwhile, the digital economy has been growing fast. Many businesses decided to use the breathing space and necessity of the pandemic to digitalize new parts of their business. So we're at a place and time when organizations and their customers need to feel confident in these new ways of buying and delivering services. Building that confidence will help economies thrive. So how do we get there? I've got three priorities. Leaders discuss international cybersecurity in the United Nations Internet Governance Forum (IGF) 2020 1. Secure technology by design We can make technologies much more difficult and expensive to compromise, but they must be designed that way from the start. We have operating systems in devices already on the market that are so secure we had to devise a new way of talking about them – so we call this cyber-immunity. The chances of an attack on these systems succeeding means the cost to the criminal of a successful cyberattack is higher than the damage caused. To make critical infrastructure safer, we could deploy cyber-immune technologies across the network. The time to do it is now. 2. Enforcing cybersecurity law on an international level International cooperation is crucial for hunting down cybercriminals, but it looks as though the world isn't going in a 'cooperation' direction – it's becoming more fragmented. We need a space in cybersecurity where nations can cooperate safely, without geopolitical fractures getting in the way. 3. High-level cooperation requires high-level cybersecurity education As well as needing to overcome our differences, international cooperation against cybercrime will require 'cyber diplomats' to stay continually informed about the changing threat landscape. Good news for those imagining a boring slide talk in a dark basement – cybersecurity education keeps pace with innovation and developments in learning science. For example, learning through immersive gamified simulations like Kaspersky Interactive Protection Simulation (KIPS) is popular and effective. While the world recovers from the shocks of the COVID-19 pandemic, we must recognize much has changed, not least in cyberthreats. We need a new era of international cooperation to hunt cybercriminals. We need to make sure 'cyber diplomats' (those who develop and enforce national and international policy against cybercrime) fully understand the threats. As professional cybercrime gangs hone their skills, I predict we'll see cyberattacks grow at every level, harming business and governments. Thankfully, technology keeps evolving, and no one is powerless. Adopting cyber-immune systems will help nations keep the lights, water and internet running at times of crisis and beyond.
enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
5 trends shaping cybersecurity

What’s about to change cybersecurity forever? Five factors to watch.

  • min read
    • In business, you've got to be able to predict the future. But rather than juggling a crystal ball, deduct from what you already know. Leaders should scan the horizon for innovation and think through the consequences for their customers' expectations and lives. And with technological change always comes information security challenges. I've been keeping my eye on a number of developments I believe will change IT security as we know it, in the year ahead. Look into these five innovations and their implications for your business. 1. New data sources will raise new privacy concerns Tech giants just keep seeking more of customers' personal data. At the end of 2019, Google announced plans to acquire health tracking company Fitbit, and a partnership with Ascension, a healthcare records system used in 21 US states. Apple and Amazon have made similar moves toward customer's health data. Other companies of all sizes will take a similar path to track customers' habits and preferences. The sources of customer data will keep getting more diverse. One autonomous car could generate 40 terabytes of data for every eight hours of driving. What does this mean for business? Headline-grabbing examples like these mean activists and broader society will pay ever-closer attention to how data is handled. Expect increasingly stricter government regulation on data use. 2. Cybersecurity will move to a service model Many companies who've handled some cybersecurity in house are now looking to outsource, because it's faster and cheaper, and they get a better overall service. The market for managed services might almost double by 2023. It's a competitive landscape. Service providers will need to distinguish themselves by providing more specific cybersecurity services, where expertise is crucial. According to a recent Kaspersky survey, 74 percent of managed service providers named cybersecurity expertise as a key client need. And for business? Information security vendors must adapt their intelligence and expertise to a service model. Simplify delivery as services rather than products, through managed service providers. 3. Industrial cyberattacks will change cybersecurity expertise Industrial cybersecurity is now moving fast. It's all about letting organizations protect industrial endpoints as they would corporate ones. In 2019, four in five industrial organizations said they were prioritizing managing operational technology (OT) and Industrial Control System (ICS) network cyber risks in the year ahead. This emphasis will help build industrial protection expertise. We need more people who understand vulnerabilities in equipment and the Internet of Things (IoT). More industry and manufacturers will use smart components and entire IoT platforms  to improve efficiency, such as smart meters, predictive maintenance and digital twins. What should business do? The focus should be on identifying vulnerabilities in industrial equipment, and patching them fast. If you're responsible for systems critical to your industry, consider advanced threat detection and response systems, and look for industrial threats expertise. Identify what smart components you're using and make sure they're protected. 4. Machine Learning will need its own cyberattack protection Businesses are using machine learning and artificial intelligence systems more, because they can expand product and service use, from finance and banking, to manufacture and biometric authentication. Their security will be strategically important. They're also popular targets for compromise attempts, including using adversarial techniques meant to spoil machine learning algorithms. For example, bombarding an algorithm with data that may appear clean, but includes deviations too small to detect a bad sample, gradually erasing a once-clear line between clean and harmful files, triggering false positives. What should you do? Protect machine learning-driven systems from compromise with dedicated experts who understand machine learning and adversarial techniques, and can build cyber protection for each case. The same applies to cybersecurity systems that use machine learning for attack detection and response. Review these systems for vulnerability. 5. Businesses will need new ways to innovate Many tech companies innovate by acquiring start-ups. Cloud infrastructure developer VMware acquires start-ups and integrates their technology with existing products. They have a team that looks for innovations that could be useful. This approach demands resources and expertise, and it's only relevant when a company constantly seeks fresh blood. On the other hand, companies that sometimes need highly specialized innovations, but don't have internal resources to search for or nurture start-ups, will look to outsource the search and selection process to a third party with the right expertise. Third parties build a shortlist. You get to choose the best-fit start-up and how you'll interact. What should your business do? Those companies that adopt new technologies first can better attract customers and oust the competition by providing convenient, tailored services and products. But to get the most out of new projects, make sure there are no hidden risks. These five factors should give you a starting place to look in your industry for what could be about to re-shape the cybersecurity you know. There may be further niche trends that matter in your unique field. A business that's always thinking ahead is one that can use that the inevitability of change to its advantage.
cyber fraud prevention

What’s changing in cyberfraud and how to keep your business safe

  • min read
    • Today, ecommerce is a basic need. Customers expect speed and convenience, and the 2020 coronavirus lockdowns have only accelerated that demand. Swimming in that tide that raises all boats, Kaspersky's fraud prevention: 2019 report notes a growing number of sharks. One in 50 online financial and ecommerce sessions worldwide are conducted by cybercriminals. As fast as online service technology evolves, fraudsters find loopholes. We're at a crucial point of change in combatting new hacking tools and fraud schemes. So what's changed, and what's changing? Bots fake loyalty Ecommerce customers often receive bonuses as part of loyalty programs, such as for registering, giving reviews and referring friends. With bots, fraudsters create numerous fake accounts and receive bonuses just as real users do. The fraudster then uses the bonuses to buy goods at a big discount for resale. Bots are taking the best seats Research by Distil Networks estimates some 40 percent of traffic to ticket sales sites comes from bots. Fraudsters buy gig, show and sports event tickets with bots, reselling on social media, peer-to-peer sites or ticket resale sites when the event is sold out. This means fans are finding it harder to get tickets and end up paying more. Crawlers are copying prices and photos Cyberfraudsters also use web crawler bots (used legitimately by search engines to give accurate results to search queries) to "crawl" ecommerce competitor websites, recording pricing and making theirs more competitive. They may also steal unique content like images and product descriptions to use on their website, damaging the search rankings of the original website because search engines penalize sites with duplicate content. Bots are getting more like us In 2019 a new generation of "human bots" emerged, designed to mimic human behavior impeccably. Previously, bots moved around web pages in repetitive and simple navigation patterns. The new-generation "human bots" do things humans do, like shake the mouse and make rapid movements. This new human-like behavior is a problem for anti-fraud systems. So far, many have relied on these human foibles to tell bot from human. How fraudsters manipulate The easiest way for fraudsters to attack online businesses is through customers. They use manipulative strategies known as social engineering. They either scare people or earn their trust to get credentials like logins and passwords, and other personal information. Imagine you get a call from someone saying they're with the security department of an ecommerce site you visit. They say someone has tried to buy a high-value item with your credit card and that to stop the transaction, you must download an authentication app. It's a fraudster, of course. The app grants remote access, mirroring the screen of your device and letting the fraudster steal personal information like your full name, address or social security number. They then sell your personal information on the dark web, opening doors to all kinds of fraud, like using your name and bank account to apply for loans. Remote access tools (RATs,) used legitimately by IT support teams in many organizations to access your computer screen to resolve issues, are a powerful tool for fraud in the wrong hands. Fraudsters often target accountants because they work with payment orders. The fraudster accesses the victim's screen without their knowing and substitutes bank details for their own. You may recognize the methods employed in these growing attacks. Some are not new. Here are three emerging cyberfraud trends. Trend 1: Fraud as a service Cybercrime is an easy way to make money without leaving home. This has led to rapid growth in 'fraud as a service (FaaS.)' FaaS makes internet fraud less challenging for newcomers, and so increases the number of people involved. On dark web forums, illegal websites or social media, anyone can buy a set of hacking tools and a leaked customer database, then pay for training on how to make illegal money. Costs range from just 5 US dollars for stolen credit card data, to thousands of dollars for extensive fraud execution courses. The market is booming. Underground digital markets sell bots, digital fingerprints for remotely accessing devices and anonymizer tools that make internet activity untraceable. Trend 2: Resale of bank account access Cybercriminals often target small- to medium-sized businesses (SMBs) in finance who've been acquired by large players, while they adjust their security to meet the buyer's requirements. Kaspersky found, by analyzing dark web forums and chats, criminal groups target these smaller organizations, then resell access to both organizations' internal networks. They predict an increase in this kind of activity, especially in Africa, Asia and Eastern Europe. Trend 3: Data leaks and deepfakes We all love convenient and quick purchases like Amazon's 1-click ordering, despite that these methods usually mean saving and sharing more of our personal information. Yet, a month can't pass without a high-profile data breach from a bank, online store or telecommunications company. Sometimes sensitive personal customer data is exposed, such as biometrics. We're also seeing the rise of impersonation methods where one person's image is replaced with another, using advanced audio, photo and video editing, known as deepfakes. Fraudsters have already used deepfake voice imitation and social engineering to impersonate a CEO successfully. The best ways to protect your business from today's fraudsters These six steps will help your business put in place the strong front against cyberfraud. 1.    Assess risks With growth, or any kind of change in business, comes the possibility of new risks of fraudulent activities. Make sure identifying opportunities for fraud is part of your risk assessment activity. 2.    Review product design Look at the design of your digital services and loyalty program from a fraudster's point of view. Try to find 'loopholes' they could exploit. 3.    Use a fraud detection and prevention system These systems may, for example, analyze online sessions, monitor transactions and analyze payment behavior. They help avoid the financial, reputational and legal consequences of fraud and cut operational costs, such as support team time. 4.    Strengthen your security Put detection and protection measures in place, such as using a web application firewall (WAF) to protect against bots and a solution to protect against Distributed Denial-of-Service (DDoS) attacks. 5.    Strengthen your team Make sure your employees understand how fraud happens and how to combat it by including cyberfraud in your cyberawareness training program. 6.    Record fraud Measure what your business is losing through fraud regularly. Include direct loss, indirect loss and the impact on your brand reputation. If fraud hits your business, hire a fraud expert team to support you through and help you combat future incidents. By taking these steps, you can reduce the risk of cyber fraud affecting your business and make the most of the opportunities the rise of ecommerce brings.
river privacy predictions 2020

Never the same river: Predictions for privacy’s next decade

  • min read
    • Your phone. Your smartwatch. Your smart home. Your data is now everywhere. Collecting personal data makes services better for the user, but over the past decade, multiple cases have demonstrated the risk. In privacy, you never step in the same river twice. Concerns, threats and priorities are always changing. What privacy hazards will we see in the coming decade, and how should your business prepare? 1.  Governments will allow themselves to access more of citizens' data It's already happened, but in the next decade, governments around the world will adopt laws that let them access more of citizens' data. They may cite many reasons, including terrorism, instability and the already widespread use of the same data by business. 2.  The gap between regulation and the real world will only grow While the rationale for it is clear, enhanced access to people's data carries risks, such as unauthorized access and leaking information. It will be a big challenge for regulators to keep adapting regulations at the same speed as new technologies come into play. Companies have been slow to change how they're dealing with user data. The only recent significant change has been asking users to consent to how the company will use their data, now mandatory in many countries. We don't see any strong trend toward adding security to protect sensitive user data. There's already a growing gap between regulation and real-world practice, making regulation seem toothless. 3.  Counter-tools will fuel a privacy cyberbattle The trends I've already mentioned will encourage innovators to develop privacy protection technologies. The tech-savvy will adopt these, and more technologies will arise to circumvent them. It will be a privacy cyberbattle. Meanwhile, users will become more proactive about their privacy. There'll be high demand for password managers, virtual private networks (VPNs) and tokens (automatically generated codes) for two-factor authentication (2FA). However, protection mechanisms like 2FA tokens and password managers are just at the endpoint. Attacks and misuse are often at the backend. These tools protect the local environment, but they don't protect against attacks and abuse of systems such as the cloud. And as cloud-based tools go from being leading-edge to indispensable, all employees will need to understand where the risks are. VPNs protect against some data collection (real IP-addresses, geolocation) but don't protect against users voluntarily sharing data with services like Google and Facebook. 4. We'll keep getting fooled by fun Cybercriminals can use this strategy to attack businesses, targeting employees for personal information, and using it to access business systems and data. 5. We'll see new attacks on democratic process and  protections against disinformation These attacks have been with us for many years, and there's no reason for them to stop. Technology for fake visual and audio IDs already exist, and with the political pendulum of a US presidential election, these will bring undesired attention and abuse from multiple parties. 6. Internet of Things (IoT) vendors will scale up security investment The last few years have been turbulent for the cybersecurity industry. IoT-specific malware, data breaches and disinformation campaigns across the globe have all been challenging. This activity will push vendors to a new level of collaboration for the sake of security. Amazon, Apple, Google and the Zigbee Alliance have announced they're creating a working group to develop and promote a royalty-free connectivity standard. This will increase compatibility among IoT products and embed fundamental security. I hope others will follow their lead. All in all, we're looking at an interesting decade ahead for privacy. The challenges will be significant. Businesses will be a key player in securing the privacy of both their employees' and customers' data. Let's hope solutions from innovators follow fast on the heels of each new threat. In the meantime, by putting in place adequate, regular privacy training and cyberthreat education for all employees, any business can be part of the solution.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries