Magazine menu Close Magazine menu

Trends

Latest stories

paper dead shredder

Is paper dead?

  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
cybersecurity predictions

What a year of changing cyberthreats can tell business

  • min read
    • For business leaders, knowing what's changing in cybersecurity helps you recruit the right people with the right skills today for what you'll soon need. Kaspersky's 2022 Security Bulletin (free download) analyzes which attacks their global cloud service Kaspersky Security Network (KSN) has detected, blocked and disabled over the past year. There are some numbers your business will want to know about. 15 percent of users had a malware attack Kaspersky Security Network blocked malware-class attacks on some 15 percent of users in 2022, or around 1 in 7. This shows just how common malware is. The malware class of attacks covers familiar cybercrime tools like viruses, trojans and ransomware. The countries where Kaspersky's software blocked the most malware attacks in 2022 were Tunisia, Taiwan and Algeria. 506 million web-based attacks Web-based attacks result from users downloading files that then trigger a cyberattack. These might come from websites made by cybercriminals, infected online resources within user-created content (like online forums) or legitimate resources that cybercriminals have hacked. Cybersecurity education can be a powerful tool in preventing web-based attacks. Heathrow Airport has a novel staff cybersecurity education that carefully targets those needing it most with 10-minute online learning modules. 1.4 million cryptocurrency mining attempts Cryptocurrency mining is very much on the rise. Kaspersky Security Network detected around 1.4 million attempts to install mining software in the past year. Mining means digitally solving complex mathematical problems that verify cryptocurrency transactions, which also earns cryptocurrency. It slows devices and uses much electricity. In November 2022, Kaspersky announced they'd seen a 230 percent growth in cryptocurrency mining in the third quarter of 2022 compared with the same period in the year before. 102 million attempts to visit malicious URLs Malicious URLs are a common tool in 'phishing' attacks – when cybercriminals send emails inducing recipients to click on links, downloading malware. Endpoint security is vital in protecting against phishing, as is employee cyber-awareness. 377,000 attempts to steal money These attacks were often in the form of 'banking Trojans'. In early 2022 a particularly sophisticated money-stealing Trojan popped up that masquerades as a banking app and imitates phone conversations with bank employees. The app fooled many, highlighting the need to teach employees 'cyber hygiene' – like remembering to pause and think before downloading anything. Those who provide legitimate apps or financial services might also reflect on how they can show customers their products are trustworthy. These big numbers in cybersecurity over the past year show how threats to business are growing and changing. Cybercriminals always find new ways to get through consumers' and employees' defenses. By combining hiring the right people with robust cybersecurity education and strong security solutions, your business will greatly reduce its chances of a serious attack succeeding. Then, you can spend your time on what you do best.
QR codes

COVID-19 made QR codes huge, but what’s their future?

  • min read
    • If you've visited a restaurant or store recently, chances are you've seen and used the ubiquitous small squares that make up a QR code. Our exposure to these codes has never been higher than since the COVID-19 pandemic, nor their value clearer. But how did we get here? Why are QR codes today's technology of choice for navigating our lives? Let's step back to Japan, 1994. Where QR codes began Automotive components manufacturer Denso Wave had a frustrating problem on their supply line. They were using bar codes on their components that workers had to scan for information they needed. But bar codes became limiting for the company because of the small amount of information each could hold. The company gave one of their young engineers, Hara Masahiro, the task of developing a solution. Bar codes are one-dimensional (read along one axis,) but Masahiro's creation was two-dimensional: Read horizontally and vertically. It increased the information held from just 20 characters to 7,000. The speed these new codes introduced to manufacturing created its own problem. Technologist Simon Raik-Allen explained it to me like this: "Imagine a conveyor belt with all the products going past. You want a camera to see which products are where. If they go too fast, the camera won't read it." Since then, eagerness to adopt QR codes in business and personal lives has varied. Asia has been the keenest adopter, with QR codes playing a central role in digital payments. In China, consumers use WeChat or Alipay apps to make some 90 percent of mobile payments, and both use QR codes to facilitate the transaction. In Africa, M-Pesa has started to incorporate QR codes into its text message banking service. In Europe and North America, uptake had been less enthusiastic – until now. A 2015 TechCrunch article called QR codes "frustrating" and a "laughing stock." Brands eager to plaster QR codes wherever they could and the likes of QR code tattoos led to perception the codes were a gimmick. The user needing to download a QR code scanning app may have contributed to this sense of needless novelty. In 2017 things changed. Phone manufacturers began incorporating QR code scanners into camera apps so users didn't need to download an app. Improvements in mobile technology letting scanned links open more quickly also played a part, according to Joe Waters, author of QR Codes for Dummies. These improvements planted the seed that allowed the technology's quick adoption in the pandemic when the need became clear. Waters says, "People now want as little contact as possible with everyday objects that may spread germs." This poses a novel question: Will our newfound familiarity with QR codes lead to new uses in the coming months and years? How should business and tech leaders be thinking about QR codes? The Future of QR codes Large retailers like Amazon have started experimenting with QR codes to track and for payment in their physical stores. But opportunities are opening for retailers of all sizes, especially around demonstrating sustainability and environmental credentials. Fashion label Another Tomorrow uses QR codes on labels to give consumers more information on the clothing item's sustainability. Provenance uses blockchain to make supply chains transparent, with QR codes for consumers to see evidence of what the brand claims. The 2021 'right to repair' EU law means consumer electronics manufacturers must add a QR code for more information on the product, like how loud it is. Securing QR code-reading for business Data security is a pressing concern with widespread adoption of QR codes. Consumers and businesses may not have known the security risks as they rapidly adopted the technology in the past 12 months. David Emm, Principal Security Researcher at Kaspersky, says "A tainted QR code might ask a user to download a malicious app containing malware. The malware could then steal personal information." Businesses can reduce their risk by using a reputable, up-to-date QR code scanner. It also pays to raise awareness among staff and customers of malicious QR codes, for example, advising they consider whether a code looks tampered with before scanning it. The battle for a new technology's acceptance is won when the audience understands what it does that no other technology can do. The pandemic gave the QR code a chance to show it was no gimmick. Business should expect to see QR codes used more widely and creatively, and consider how those game-changing 7,000 characters could help them do business better.
ATTACHMENT Dglobal cybersecurity priorities

COVID-19 has changed global cybersecurity. What must nations do now?

  • min read
    • During the pandemic, lockdowns and 'shelter in place' orders around the world have done much good. They've not only saved lives, they've shown us our cities without pollution and let businesses realize employees working from home can be more business benefit than business challenge. I spoke about the growing cyberthreat landscape and what we must do about it as part of a high-level leaders discussion on international cybersecurity during the United Nations Internet Governance Forum (IGF) 2020. During the pandemic, cybercriminals used new-found time to hone their skills and test out new methods. We saw a sharp rise in cybercrime of all kinds, from malware to advanced persistent threats (APT.) New hacking groups came on the scene, and with them, new kinds of attacks. New attacks and actors unmasked Here's just a sample of the expansion of cybercrime our researchers detected since the coronavirus pandemic came into our lives. This year we've seen unique malicious file detection rise 20 to 25 percent a day. Most threats, like malware, are relatively easy to deal with. But when what we're seeing is a rise in more professional cybercrime gangs, that's a different story. Kaspersky researchers are now monitoring more than 200 cybercrime gangs who've been launching hyper-targeted attacks against targets such as banks and governments. We've also seen more 'juniors' entering cybercrime. While they're easy to stop now, many will graduate from hacker kindergarten and join the pros. With the increasing use of the internet of things, the number of points where cybercriminals can attack has grown exponentially. We know they're willing and able. Take, for example, one of the most successful global attacks, the 2016 Mirai malware attack on domain name system provider Dyn. It took down hundreds of news websites around the world. How should nations respond to the new threat landscape? The cybersecurity impact of the pandemic has two parts. First, people are at greater risk of cyber-intrusion thanks to working from home and spending more time online. Second, there are more cybercriminals, and they've become better at what they do. Meanwhile, the digital economy has been growing fast. Many businesses decided to use the breathing space and necessity of the pandemic to digitalize new parts of their business. So we're at a place and time when organizations and their customers need to feel confident in these new ways of buying and delivering services. Building that confidence will help economies thrive. So how do we get there? I've got three priorities. Leaders discuss international cybersecurity in the United Nations Internet Governance Forum (IGF) 2020 1. Secure technology by design We can make technologies much more difficult and expensive to compromise, but they must be designed that way from the start. We have operating systems in devices already on the market that are so secure we had to devise a new way of talking about them – so we call this cyber-immunity. The chances of an attack on these systems succeeding means the cost to the criminal of a successful cyberattack is higher than the damage caused. To make critical infrastructure safer, we could deploy cyber-immune technologies across the network. The time to do it is now. 2. Enforcing cybersecurity law on an international level International cooperation is crucial for hunting down cybercriminals, but it looks as though the world isn't going in a 'cooperation' direction – it's becoming more fragmented. We need a space in cybersecurity where nations can cooperate safely, without geopolitical fractures getting in the way. 3. High-level cooperation requires high-level cybersecurity education As well as needing to overcome our differences, international cooperation against cybercrime will require 'cyber diplomats' to stay continually informed about the changing threat landscape. Good news for those imagining a boring slide talk in a dark basement – cybersecurity education keeps pace with innovation and developments in learning science. For example, learning through immersive gamified simulations like Kaspersky Interactive Protection Simulation (KIPS) is popular and effective. While the world recovers from the shocks of the COVID-19 pandemic, we must recognize much has changed, not least in cyberthreats. We need a new era of international cooperation to hunt cybercriminals. We need to make sure 'cyber diplomats' (those who develop and enforce national and international policy against cybercrime) fully understand the threats. As professional cybercrime gangs hone their skills, I predict we'll see cyberattacks grow at every level, harming business and governments. Thankfully, technology keeps evolving, and no one is powerless. Adopting cyber-immune systems will help nations keep the lights, water and internet running at times of crisis and beyond.
enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
5 trends shaping cybersecurity

What’s about to change cybersecurity forever? Five factors to watch.

  • min read
    • In business, you've got to be able to predict the future. But rather than juggling a crystal ball, deduct from what you already know. Leaders should scan the horizon for innovation and think through the consequences for their customers' expectations and lives. And with technological change always comes information security challenges. I've been keeping my eye on a number of developments I believe will change IT security as we know it, in the year ahead. Look into these five innovations and their implications for your business. 1. New data sources will raise new privacy concerns Tech giants just keep seeking more of customers' personal data. At the end of 2019, Google announced plans to acquire health tracking company Fitbit, and a partnership with Ascension, a healthcare records system used in 21 US states. Apple and Amazon have made similar moves toward customer's health data. Other companies of all sizes will take a similar path to track customers' habits and preferences. The sources of customer data will keep getting more diverse. One autonomous car could generate 40 terabytes of data for every eight hours of driving. What does this mean for business? Headline-grabbing examples like these mean activists and broader society will pay ever-closer attention to how data is handled. Expect increasingly stricter government regulation on data use. 2. Cybersecurity will move to a service model Many companies who've handled some cybersecurity in house are now looking to outsource, because it's faster and cheaper, and they get a better overall service. The market for managed services might almost double by 2023. It's a competitive landscape. Service providers will need to distinguish themselves by providing more specific cybersecurity services, where expertise is crucial. According to a recent Kaspersky survey, 74 percent of managed service providers named cybersecurity expertise as a key client need. And for business? Information security vendors must adapt their intelligence and expertise to a service model. Simplify delivery as services rather than products, through managed service providers. 3. Industrial cyberattacks will change cybersecurity expertise Industrial cybersecurity is now moving fast. It's all about letting organizations protect industrial endpoints as they would corporate ones. In 2019, four in five industrial organizations said they were prioritizing managing operational technology (OT) and Industrial Control System (ICS) network cyber risks in the year ahead. This emphasis will help build industrial protection expertise. We need more people who understand vulnerabilities in equipment and the Internet of Things (IoT). More industry and manufacturers will use smart components and entire IoT platforms  to improve efficiency, such as smart meters, predictive maintenance and digital twins. What should business do? The focus should be on identifying vulnerabilities in industrial equipment, and patching them fast. If you're responsible for systems critical to your industry, consider advanced threat detection and response systems, and look for industrial threats expertise. Identify what smart components you're using and make sure they're protected. 4. Machine Learning will need its own cyberattack protection Businesses are using machine learning and artificial intelligence systems more, because they can expand product and service use, from finance and banking, to manufacture and biometric authentication. Their security will be strategically important. They're also popular targets for compromise attempts, including using adversarial techniques meant to spoil machine learning algorithms. For example, bombarding an algorithm with data that may appear clean, but includes deviations too small to detect a bad sample, gradually erasing a once-clear line between clean and harmful files, triggering false positives. What should you do? Protect machine learning-driven systems from compromise with dedicated experts who understand machine learning and adversarial techniques, and can build cyber protection for each case. The same applies to cybersecurity systems that use machine learning for attack detection and response. Review these systems for vulnerability. 5. Businesses will need new ways to innovate Many tech companies innovate by acquiring start-ups. Cloud infrastructure developer VMware acquires start-ups and integrates their technology with existing products. They have a team that looks for innovations that could be useful. This approach demands resources and expertise, and it's only relevant when a company constantly seeks fresh blood. On the other hand, companies that sometimes need highly specialized innovations, but don't have internal resources to search for or nurture start-ups, will look to outsource the search and selection process to a third party with the right expertise. Third parties build a shortlist. You get to choose the best-fit start-up and how you'll interact. What should your business do? Those companies that adopt new technologies first can better attract customers and oust the competition by providing convenient, tailored services and products. But to get the most out of new projects, make sure there are no hidden risks. These five factors should give you a starting place to look in your industry for what could be about to re-shape the cybersecurity you know. There may be further niche trends that matter in your unique field. A business that's always thinking ahead is one that can use that the inevitability of change to its advantage.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries