Magazine menu Close Magazine menu

Trends

Latest stories

QR codes, history, predictions

COVID-19 made QR codes huge, but what’s their future?

  • min read
    • If you've visited a restaurant or store recently, chances are you've seen and used the ubiquitous small squares that make up a QR code. Our exposure to these codes has never been higher than since the COVID-19 pandemic, nor their value clearer. But how did we get here? Why are QR codes today's technology of choice for navigating our lives? Let's step back to Japan, 1994. Where QR codes began Automotive components manufacturer Denso Wave had a frustrating problem on their supply line. They were using bar codes on their components that workers had to scan for information they needed. But bar codes became limiting for the company because of the small amount of information each could hold. The company gave one of their young engineers, Hara Masahiro, the task of developing a solution. Bar codes are one-dimensional (read along one axis,) but Masahiro's creation was two-dimensional: Read horizontally and vertically. It increased the information held from just 20 characters to 7,000. The speed these new codes introduced to manufacturing created its own problem. Technologist Simon Raik-Allen explained it to me like this: "Imagine a conveyor belt with all the products going past. You want a camera to see which products are where. If they go too fast, the camera won't read it." Since then, eagerness to adopt QR codes in business and personal lives has varied. Asia has been the keenest adopter, with QR codes playing a central role in digital payments. In China, consumers use WeChat or Alipay apps to make some 90 percent of mobile payments, and both use QR codes to facilitate the transaction. In Africa, M-Pesa has started to incorporate QR codes into its text message banking service. In Europe and North America, uptake had been less enthusiastic – until now. A 2015 TechCrunch article called QR codes "frustrating" and a "laughing stock." Brands eager to plaster QR codes wherever they could and the likes of QR code tattoos led to perception the codes were a gimmick. The user needing to download a QR code scanning app may have contributed to this sense of needless novelty. In 2017 things changed. Phone manufacturers began incorporating QR code scanners into camera apps so users didn't need to download an app. Improvements in mobile technology letting scanned links open more quickly also played a part, according to Joe Waters, author of QR Codes for Dummies. These improvements planted the seed that allowed the technology's quick adoption in the pandemic when the need became clear. Waters says, "People now want as little contact as possible with everyday objects that may spread germs." This poses a novel question: Will our newfound familiarity with QR codes lead to new uses in the coming months and years? How should business and tech leaders be thinking about QR codes? The Future of QR codes Large retailers like Amazon have started experimenting with QR codes to track and for payment in their physical stores. But opportunities are opening for retailers of all sizes, especially around demonstrating sustainability and environmental credentials. Fashion label Another Tomorrow uses QR codes on labels to give consumers more information on the clothing item's sustainability. Provenance uses blockchain to make supply chains transparent, with QR codes for consumers to see evidence of what the brand claims. The 2021 'right to repair' EU law means consumer electronics manufacturers must add a QR code for more information on the product, like how loud it is. Securing QR code-reading for business Data security is a pressing concern with widespread adoption of QR codes. Consumers and businesses may not have known the security risks as they rapidly adopted the technology in the past 12 months. David Emm, Principal Security Researcher at Kaspersky, says "A tainted QR code might ask a user to download a malicious app containing malware. The malware could then steal personal information." Businesses can reduce their risk by using a reputable, up-to-date QR code scanner. It also pays to raise awareness among staff and customers of malicious QR codes, for example, advising they consider whether a code looks tampered with before scanning it. The battle for a new technology's acceptance is won when the audience understands what it does that no other technology can do. The pandemic gave the QR code a chance to show it was no gimmick. Business should expect to see QR codes used more widely and creatively, and consider how those game-changing 7,000 characters could help them do business better.
deep fakes

What does the rise of deepfakes mean for the future of cybersecurity?

  • min read
    • Imagine you're holding a video conference with a colleague or business partner in another city. You're discussing sensitive matters, like the launch of a new product or the latest unpublished financial reports. Everything seems to be going well, and you know who you're talking to. Maybe you've even met them before. Their appearance and voice are as you expected, and they seem to be pretty familiar with their jobs and your business. It might sound like a routine business call, but what if the person you thought you were talking to is actually someone else? They might seem genuine, but behind the familiar imagery and audio is a social engineering scammer fully intent on duping you into surrendering sensitive corporate information. In a nutshell, this is the disturbing world of deepfakes, where artificial intelligence is the new weapon of choice in the scammer's arsenal. What exactly are deepfakes? Among the newest words on the technology block, 'deepfake' is a portmanteau of 'deep learning' and 'fake.' The term has been around for two years, when it first appeared on a Reddit community of the same name. The technology uses artificial intelligence to superimpose and combine both real and AI-generated images, videos and audio to make them look almost indistinguishable from the real thing. The apparent authenticity of the results is rapidly reaching disturbing levels. https://www.youtube.com/watch?v=cQ54GDm1eL0 One of the most famous deepfakes of all was created by actor and comedian Jordan Peele, who made this video of Obama delivering a PSA about fake news. While this one was made for the sake of humor and to raise awareness to this rapidly emerging trend, deepfake technology has, unsurprisingly, been misappropriated since the very beginning. Its implications for credibility and authenticity have placed it squarely in the spotlight. The worrying consequences of deepfakes Wherever there's technology innovation, there's nearly always pornography, so it's little surprise that the first deepfakes to make waves on Reddit were videos which had been manipulated to replace the original actresses' faces with somebody else's – typically a well-known celebrity. Reddit, along with many other networks, has since banned the practice. However, as actress Scarlett Johansson said of deepfake pornography, while celebrities are largely protected by their fame, the trend poses a grave threat to people of lesser prominence. In other words, those who don't take steps to protect their identities could potentially end up facing a reputational meltdown. That brings me to the political consequences of deepfakes. So far, attempts to masquerade as well-known politicians have been carried out largely in the name of research or comedy. But the time is coming when deepfakes could become realistic enough to cause widespread social unrest. No longer will we be able to rely on our eyes and ears for a firsthand account of events. Imagine, for example, seeing a realistic video of a world leader discussing plans to carry out assassinations in rival states. In a world primed for violence, the implications of deepfake technology could have devastating consequences. Purveyors of fake news seeking to make a political impact are just one side of the story. The other is the form of social engineering that business leaders are all too familiar with. As the video conference example illustrates, deepfakes are a new weapon for cybercriminals. And it's not nearly as far away as you may think: the world's first deepfake-based attack against a corporation was reported in August 2019, when a UK energy firm was duped by a person masquerading as the boss of its German parent company. The scammer allegedly used AI to impersonate the accent and voice patterns of the latter's CEO, someone the victim was familiar with, over a phone call. The victim suspected nothing and was duped out of $243,000. These uses of deepfake technology might seem far-fetched, but it's important to remember that social engineering scammers have been impersonating people since long before the rise of digital technologies. Criminals no longer have to go to such lengths as studying targets in great depth and even hiring makeup artists to disguise themselves; they now have emerging technologies on their side, as businesses do for legitimate purposes. Previously, successfully impersonating a VIP was much more difficult. Now, the ability to create deepfake puppets of real people using publicly available photos, video and audio recordings is within everyone's grasp. Can you protect your business from deepfakes? The common misassumption, that synthetic impersonation can never be nearly as convincing as the real thing, is the biggest danger of all. We live in a world where it's getting harder to tell fact from fiction. From the hundreds of millions of fake social media profiles to the worrying spread of fake news and the constant rise of phishing attacks – it's never been more important to think twice about what you see. Perhaps, after all, there is a case for a return of face-to-face meetings behind closed doors when discussing important business matters. Fortunately, there are other ways you can prepare your business for the inevitable rise of deepfakes without placing huge barriers in the way of innovation. To start with, 'seeing is believing' is a concept you'll increasingly want to avoid when it comes to viewing video or listening to audio, including live broadcasts. To untrained eyes, deepfakes are getting harder to tell apart from the real thing, but there are, and likely always will be, some signs due to the fundamental way AI algorithms work. When a deepfake algorithm generates new faces, they are geometrically transformed with rotation, resizing and other distortions. It's a process that inevitably leaves behind some graphical artifacts. While these artifacts will become harder to identify by sight alone, AI itself can also be used as a force for good – it can detect whether a video or stream is authentic or not. The science of defending against deepfakes is a battle of wills: as deepfakes increase in believability, cybersecurity professionals need to invest more in seeking the truth. A team of researchers in China recently published a method for using AI itself to expose deep fakes in real time. Another paper published by the same team figured out a way to proactively protect digital photos and videos from being misappropriated by deepfake algorithms by adding digital noise, invisible to the human eye. As the threat of deepfakes edges ever nearer, we can hopefully expect more countermeasures to follow suit. This article represents the personal opinion of the author.
paper dead shredder

Is paper dead?

  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
cybersecurity predictions

What a year of changing cyberthreats can tell business

  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
ATTACHMENT Dglobal cybersecurity priorities

COVID-19 has changed global cybersecurity. What must nations do now?

  • min read
    • During the pandemic, lockdowns and 'shelter in place' orders around the world have done much good. They've not only saved lives, they've shown us our cities without pollution and let businesses realize employees working from home can be more business benefit than business challenge. I spoke about the growing cyberthreat landscape and what we must do about it as part of a high-level leaders discussion on international cybersecurity during the United Nations Internet Governance Forum (IGF) 2020. During the pandemic, cybercriminals used new-found time to hone their skills and test out new methods. We saw a sharp rise in cybercrime of all kinds, from malware to advanced persistent threats (APT.) New hacking groups came on the scene, and with them, new kinds of attacks. New attacks and actors unmasked Here's just a sample of the expansion of cybercrime our researchers detected since the coronavirus pandemic came into our lives. This year we've seen unique malicious file detection rise 20 to 25 percent a day. Most threats, like malware, are relatively easy to deal with. But when what we're seeing is a rise in more professional cybercrime gangs, that's a different story. Kaspersky researchers are now monitoring more than 200 cybercrime gangs who've been launching hyper-targeted attacks against targets such as banks and governments. We've also seen more 'juniors' entering cybercrime. While they're easy to stop now, many will graduate from hacker kindergarten and join the pros. With the increasing use of the internet of things, the number of points where cybercriminals can attack has grown exponentially. We know they're willing and able. Take, for example, one of the most successful global attacks, the 2016 Mirai malware attack on domain name system provider Dyn. It took down hundreds of news websites around the world. How should nations respond to the new threat landscape? The cybersecurity impact of the pandemic has two parts. First, people are at greater risk of cyber-intrusion thanks to working from home and spending more time online. Second, there are more cybercriminals, and they've become better at what they do. Meanwhile, the digital economy has been growing fast. Many businesses decided to use the breathing space and necessity of the pandemic to digitalize new parts of their business. So we're at a place and time when organizations and their customers need to feel confident in these new ways of buying and delivering services. Building that confidence will help economies thrive. So how do we get there? I've got three priorities. Leaders discuss international cybersecurity in the United Nations Internet Governance Forum (IGF) 2020 1. Secure technology by design We can make technologies much more difficult and expensive to compromise, but they must be designed that way from the start. We have operating systems in devices already on the market that are so secure we had to devise a new way of talking about them – so we call this cyber-immunity. The chances of an attack on these systems succeeding means the cost to the criminal of a successful cyberattack is higher than the damage caused. To make critical infrastructure safer, we could deploy cyber-immune technologies across the network. The time to do it is now. 2. Enforcing cybersecurity law on an international level International cooperation is crucial for hunting down cybercriminals, but it looks as though the world isn't going in a 'cooperation' direction – it's becoming more fragmented. We need a space in cybersecurity where nations can cooperate safely, without geopolitical fractures getting in the way. 3. High-level cooperation requires high-level cybersecurity education As well as needing to overcome our differences, international cooperation against cybercrime will require 'cyber diplomats' to stay continually informed about the changing threat landscape. Good news for those imagining a boring slide talk in a dark basement – cybersecurity education keeps pace with innovation and developments in learning science. For example, learning through immersive gamified simulations like Kaspersky Interactive Protection Simulation (KIPS) is popular and effective. While the world recovers from the shocks of the COVID-19 pandemic, we must recognize much has changed, not least in cyberthreats. We need a new era of international cooperation to hunt cybercriminals. We need to make sure 'cyber diplomats' (those who develop and enforce national and international policy against cybercrime) fully understand the threats. As professional cybercrime gangs hone their skills, I predict we'll see cyberattacks grow at every level, harming business and governments. Thankfully, technology keeps evolving, and no one is powerless. Adopting cyber-immune systems will help nations keep the lights, water and internet running at times of crisis and beyond.
enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries