Magazine menu Close Magazine menu

research

Latest stories

interconnected technologies ai, occupation, professionals, people wearing helmets, industrial

The next big business challenge: How organizations are preparing to secure AI

  • min read
    • Of all investments today, artificial intelligence (AI) is transforming enterprises, enabling them to provide improved services, automate processes and make better decisions. Business leaders must invest in the right tech at the right time, and have the people and systems in place that can guarantee success. AI will change most industries but also brings new risks and challenges in securing enterprises and safeguarding customers. Kaspersky's new research aims to help businesses stay ahead of the changes AI brings, published in this 2024 report, Connecting the future of business: How leaders should prepare for using and securing AI and interconnected technologies. About the interconnected tech research Kaspersky surveyed 560 IT security leaders in six regions – North America (US,) Latin America (LATAM: Brazil, Chile, Columbia and Mexico,) Europe (Austria, France, Germany and Switzerland,) Middle East and Africa (META: Saudi Arabia, South Africa, Turkey and United Arab Emirates,) Russia and Asia-Pacific (APAC: China, India and Indonesia.) Respondents were either aware of or involved in cybersecurity decisions about interconnected tech such as AI, web 3.0, data spaces, digital twins, augmented reality (AR,) virtual reality (VR,) 6G and internet of things (IoT.) They worked in organizations with at least 1,000 employees across many sectors. Kaspersky asked how they're introducing and securing AI and other interconnected technologies. Here's what the research revealed. AI is organizations' significant focus for the next two years AI is becoming a cornerstone for organizations striving to stay ahead thanks to its ability to foster innovation. In cybersecurity, AI offers predictive analytics and greater adaptability. Goldman Sachs says global investment in AI will reach 200 billion US dollars by 2025. AI is more than a technology. It's a strategy that lets organizations navigate today's complex business environment. AI adoption Nearly all organizations surveyed have already adopted (54 percent) or plan to adopt AI within two years (33 percent.) Respondents see Generative AI (GenAI) as valuable for improving security technologies' performance. Goldman Sachs economists Joseph Briggs and Devesh Kodnani say GenAI could boost global labor productivity by more than one percentage point yearly once its use becomes widespread. IT companies worldwide are upskilling their workforce and undertaking GenAI pilots to avoid falling behind. IT giants Accenture pledged three billion US dollars to data and AI investment, while French tech firm Capgemini is putting two billion Euros towards GenAI over the next three years. Securing AI 49 percent of organizations said they were extremely well, or well prepared, to secure AI. Almost 50 percent think AI is slightly or not at all hard to secure. Compared with securing other interconnected technologies, most organizations felt more prepared to secure AI. In responding to Kaspersky's survey, the head of cybersecurity at a Brazilian bank said, "I mostly don't find security problems with GenAI. We already understand how to run and train it." While many organizations feel confident in their ability to secure AI, a little over half felt less than well-prepared to secure AI. These businesses need to do more to prepare for the inevitable scale-up of AI-based technologies. AI makes digital trust and data compliance indispensable AI introduces new challenges and complexities in protecting sensitive data and maintaining digital trust. Digital trust is an aspect of customer trust. In Kaspersky podcast Insight Story, emerging tech security expert Malek Ben Salem described digital trust as, "Our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with." Tech researchers McKinsey's 2022 Digital Trust report said 70 percent of people trust companies to protect their privacy, but most companies aren't meeting their expectations. Data breaches, unauthorized access and privacy violations can erode digital trust and lead to reputation damage, lost business and regulatory consequences. Building digital trust takes time but is essential to users' confidence in AI. How AI impacts digital trust AI lets organizations collect and store more data about customers, operations and interactions. This wealth of data helps gain insight but also means more risk of breaches. AI facilitates sharing data between devices, networks and organizations. Data sharing aids collaboration, efficiency and innovation but also means more opportunities for unauthorized access. As it is relatively new, organizations may struggle to be clear about their practices and security around AI. Without clear communication, trust may break down. Top ways organizations are improving digital trust and compliance Adopting zero-trust frameworks is organizations' top response to the need to improve digital trust, with 81 percent already using or planning to adopt zero-trust within two years. Other actions include pursuing data privacy and cyber resilience regulations (74 percent) and digital sovereignty initiatives (73 percent.) Kaspersky's research found companies introducing zero-trust frameworks are better prepared to secure AI and other interconnected technologies: 51 percent of zero-trust framework early adopters said they were extremely well-prepared or well-prepared to secure these technologies, compared with just 27 percent of the rest. The zero-trust canvas: Painting the future of cybersecurity The rise of AI is opening the door for organizations to break with all traditions that don't work for today's tech realities. Traditional cybersecurity is vulnerable to insider attack because it relies on trusting those within a network's perimeter while viewing outsiders as suspicious. Enter: Zero-trust frameworks. The head of IT at cloud provider Searce said, "The zero-trust security model is the only framework that works. The traditional security model can't do the job, especially for interconnected technologies." Under zero-trust frameworks, every user and device must undergo continuous multi-factor authentication (MFA) and authorization, regardless of their trust level. Users and devices get the minimum access needed for their tasks, with constant monitoring of user activity, device behavior and network traffic. Regulation and compliance With each territory having different data protection and privacy legislation, global organizations find it hard to achieve consistent standards around AI. 62 percent of leaders find compliance certification hard. They want to see standardized compliance processes across regulations and say online tools and platforms, with clear guidelines, would further simplify certification. Handling growing challenges and preparing to secure AI With the scale of change AI will likely bring, organizations must have a strategy to prepare themselves to adopt and secure it. Kaspersky research uncovered four effective strategies to ensure readiness to secure AI and other interconnected technologies: Adopting security by design principles, training and upskilling your workforce, upgrading your cybersecurity solutions and meeting regulation and standards. The full report, Connecting the future of business, details each strategy. Interconnected technologies like AI bring huge business opportunities but also a new era of vulnerability to serious cyberthreats. With more data collected and transmitted, cybersecurity measures must get stronger. Organizations can use effective strategies to safeguard critical assets and fortify customer trust amid a growing interconnected landscape. Leaders must also resource cybersecurity well enough to enable access to improved cybersecurity solutions that can meet oncoming challenges.
interconnected technologies 4 strategies, Young, Woman, Touching, Sensitive, Screen, While, Selecting, Surface, Female

Four ways to prepare your business to secure AI and interconnected technologies

  • min read
    • Of all business investments today, interconnected technologies – the growing network of devices, systems and applications connected to the internet and to each other – are the most vital and challenging. From artificial intelligence (AI) to data spaces to internet of things (IoT,) interconnected tech is letting enterprises gather more data, automate processes and make better decisions. While this 'Fourth Industrial Revolution' is propelling change in every industry, it also brings new risks and challenges in securing enterprises and safeguarding customers. Kaspersky's new research aims to help businesses stay ahead of the changes interconnected technologies bring, published in this 2024 report, Connecting the future of business: How leaders should prepare for using and securing AI and interconnected technologies. About our interconnected tech research Kaspersky surveyed 560 IT security leaders in six regions – North America (US,) Latin America (LATAM: Brazil, Chile, Columbia and Mexico,) Europe (Austria, France, Germany and Switzerland,) Middle East and Africa (META: Saudi Arabia, South Africa, Turkey and United Arab Emirates,) Russia and Asia-Pacific (APAC: China, India and Indonesia.) Respondents were either aware of or involved in cybersecurity decisions about interconnected technologies. They worked in organizations with at least 1,000 employees across many sectors. We asked how they're introducing and securing AI, web 3.0, data spaces, digital twins, augmented reality (AR,) virtual reality (VR,) 6G and internet of things (IoT.) Four interconnected tech preparation strategies With the scale of change these new technologies will likely bring, organizations must have strategies to prepare to adopt and secure interconnected tech. We found organizations that felt ready to secure interconnected tech tended to adopt four strategies: Embracing security by design principles, training and upskilling their workforce, upgrading their cybersecurity solutions and striving to meet regulation and standards. Here's a little more on each strategy. 1.    Adopting security by design principles Integrating cybersecurity into each stage of the software development lifecycle makes secure-by-design software and hardware more resilient to cyberattacks. Our research found leaders focused on integrating cybersecurity into development processes – dubbed Security by Design Promoters – were also better prepared to secure interconnected technologies. 50 percent of Security by Design Promoters felt prepared to secure interconnected tech, compared with 26 percent of the rest. Leadership teams can start promoting security by design by asking where in their design processes cybersecurity expertise is usually first involved. They may also play a role in ensuring budget for security testing during design. 2.   Training and upskilling your workforce With the right cybersecurity education, staff can be a formidable line of defense against cyberattacks. Building a cyberaware culture requires a strategy that empowers employees to gain knowledge and put it into practice. Our research found Training and Upskilling Promoters – organizations prioritizing training and upskilling their people – were better prepared to secure interconnected tech. 55 percent of Training and Upskilling Promoters felt prepared to secure interconnected tech, compared with 25 percent of the rest. Leaders we surveyed shared cybersecurity education approaches that worked well. They favored regular programs covering topics like cybersecurity policies and common cyberthreats, phishing simulations to identify further training needs and awareness campaigns sharing best practice and real-world cyber incident examples. Leaders also emphasized user-friendly security policies, greater collaboration with the IT and security teams and demonstrating good cybersecurity practice from the top. Leadership teams can support training and upskilling the workforce by asking how often employees receive cybersecurity training and how the organization measures their understanding. 3.   Upgrading cybersecurity solutions More devices connecting to the internet means more ways to attack. As businesses adopt these technologies, they need more advanced cybersecurity solutions, such as those with enhanced access controls, encryption and regulatory compliance. Our research found Advanced Cybersecurity Adopters — organizations focused on upgrading cybersecurity solutions — are better prepared to secure interconnected tech. 55 percent of Advanced Cybersecurity Adopters felt prepared to secure interconnected tech, compared with 22 percent of the rest. Advanced cybersecurity solutions let your business adapt to evolving threats, meet new regulation and protect critical data. The leadership team should ask what the organization knows about threats that suggest upgrading cybersecurity solutions, how to minimize the impact of upgrading solutions on workflows and how to ensure employees can use the upgraded tools effectively. 4.   Meeting regulation and standards To avoid legal problems or reputation damage, your cybersecurity practice must meet changing standards and legal requirements. Our research found organizations prioritizing meeting new regulation and standards — Regulation Promoters — are better prepared to secure interconnected tech. 40 percent of Regulation Promoters felt prepared to secure interconnected tech, compared with 27 percent of the rest. To better meet regulation and standards, leadership teams can ask if the organization already meets all security regulation and standards, and if not, which to prioritize. You might also look at how to use cybersecurity compliance processes to build customer's digital trust. Interconnected technologies bring huge business opportunities but also a new era of vulnerability to serious cyberthreats. With more data collected and transmitted, cybersecurity measures must get stronger. Organizations can use these four strategies to safeguard critical assets and fortify customer trust amid a growing interconnected landscape. Leaders must also resource cybersecurity well enough to enable access to new cybersecurity solutions that can meet interconnected tech's oncoming challenges.
IT economics report

Guess who’s leaking as much data as cybercriminals

  • min read
    • New research by Kaspersky finds employees are causing more data leaks. So much so that employee action and cyberattacks are running neck-and-neck. What's behind this growth in employee-initiated data leaking? And what can business leaders do to turn employees from cyber risk to cyber asset? Why are employees causing more data leaks? More than 3,000 IT security managers in 26 countries contributed views to Kaspersky's 2022 IT Security Economics report. The research found that in 2022, cyberattacks caused 23 percent of data leaks, while employees caused a close 22 percent. This growing proportion of leaks linked to employees may follow work-life changes since the pandemic. The report says, "IT security teams are now battling data leakages caused by employees […] following the introduction of new staff laptops or tablets, and Virtual Private Networks (VPNs) to enable remote working." And it's not all innocent mistakes. Most employee-triggered leaks involved ignoring cybersecurity policy, but security managers also reported more than a third (36 percent) were deliberate acts of sabotage or espionage. How employees cause data leaks Small, almost mundane actions often lead to data leaks. Usually, the employee is tricked by a 'social engineering' tactic or practicing poor cyber 'hygiene.' But what does that mean? Social engineering Cybercriminals use manipulative tricks known as social engineering to fool employees into giving them access to systems or giving out information they otherwise wouldn't. A common approach is 'phishing' – emails or messages containing links that give cybercriminals access to business systems when clicked on. Phishing is getting more sophisticated – mimicking, for example, emails announcing sales or discounts from household brands so well they're hard to tell apart from the real thing. 'Spear phishing' is more targeted and personalized. It might, for example, target those in an organization most likely to take the bait, or mimic a target organization's internal newsletter or email format. Cybercriminals also engage in social engineering one-on-one. For example, they may phone employees saying they're from the IT support desk and try to persuade the employee to share their login and password details. Cyber hygiene Maintaining good cyber hygiene means everyday practices that make it harder for cybercriminals to access systems. The actions that make up cyber hygiene will hopefully be familiar, for example: Having complex passwords, always using a VPN when working remotely and deleting digital information you no longer need. How to stop employee leaks Cybersecurity awareness training aims to teach cyber hygiene alongside the broader education employees need to notice and avoid falling for social engineering tricks. Earlier Kaspersky research in partnership with Longitude, a thought leadership agency within the Financial Times Group, found businesses confident in their cyber skills programs also report better overall cyberattack preparedness. While cybersecurity experts should upskill regularly, the research highlights the importance of training all staff – beyond the IT department – to create a company-wide cybersecurity culture. One-off training is also not enough: staff need to absorb ideas and practice skills to make new habits. Heathrow Airport's innovative employee cyber awareness program aims to change behavior long-term with 'little and often' education targeted at those who need it most. Heathrow uses mock phishing emails to identify employees at risk of falling for cybercriminals' tricks, so they're not wasting time educating employees whose cyber awareness is already strong. Cybersecurity awareness training should also aim to encourage 'cyber pride' – building positive motivation for good cyber behavior rather than stoking fear. What about preventing employee sabotage? Comprehensive cybersecurity education may not be enough to prevent the 36 percent of employee-generated data leaks done by disgruntled employees. Examples of how employees have deliberately leaked data abound – from sharing customer data online to handing access keys to cybercriminals. Regular user access reviews – checking who has access to what and keeping all system access to a minimum – are important, but nothing surpasses the value of maintaining a positive workplace culture. Leaders need ways to 'temperature check' their organization beyond relying on the Personnel department or peers in senior leadership to thoroughly report concerns. Affected departments have a 'dog in the fight,' so to speak, and may not share everything they should. Ways to temperature-check include 360-degree feedback mechanisms – where all staff give anonymous feedback about their manager. Writing in Forbes, founder of Rungway workplace advice platform, Julie Chakraverty, says, "To… uncover hidden attitudes and views, you need to ask your employees how they feel. Lead by example by being fully open and transparent… [and] empower your employees to share their opinions and give honest feedback." The change in how data leaks happen, with more employees triggering them, should give every business pause for thought. Bringing leadership focus back to workplace culture and employee wellbeing has always paid dividends across the business, but we now understand its crucial importance in keeping data safe. Regular, targeted cybersecurity education, strong cyber hygiene and understanding how everyone in your organization is feeling should be central to your data protection strategy.
financial times report cybersecurity skills

Why successful companies invest in cybersecurity skills

  • min read
    • Arming your cybersecurity team with the right skills and experience is a crucial first step in facing down threats. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found a small group of companies strongly believe their cybersecurity training programs can keep pace with the ever-changing threat landscape. Dubbed the Skills Leaders, these businesses have better security outcomes. About three-quarters (74 percent) say they're prepared for employees accidentally creating a cybersecurity threat – such as falling for a phishing scheme – compared with only half (49 percent) of the rest. This is good news, because cybersecurity skills are in short supply. In 2021, Microsoft announced the US is facing a cybersecurity skills crisis, citing that more than one in 20 of all open jobs in the country require cybersecurity skills. In the same year, research by Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG) found 95 percent of cybersecurity employees globally believe the skills gap has not improved in recent years. Our research found one-third (34 percent) believe this shortage will get worse in the next two years. But the Skills Leaders are a small group — just eight percent of the research sample. How can more organizations follow their lead? Three ways to upskill your workforce in cybersecurity 1. Train everyone, not just IT It's not just the cybersecurity team that should be on constant alert for threats. Employee-wide updates and reminders help make security part of company culture. "People need to keep their software up to date, understand how to encrypt their internet traffic and not use public Wi-Fi," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "These are general cyber hygiene practices, and they're critical. Reducing human error is crucial. Technology researchers Gartner predicts that by the end of 2025, more than 99 percent of cloud breaches will arise from preventable user misconfigurations or mistakes. One way to reduce these errors is to introduce cybersecurity 'tests' to see how employees respond to threats and increase training for those who fail them. This is what Ricardo Lafosse, Chief Information Security Officer (CISO) at Kraft Heinz, does. "It's probably one of our best ways to see whether a malicious actor could mislead our employees and get into our organization using phishing techniques," he says. 2. Update your coaching techniques Training must also move with the times to keep up with the evolving threat landscape. The Skills Leaders identified in the research seem to understand this. They're more likely to be forward-thinking with their training. About two-thirds (67 percent) say it will be very important to carry out immersive cybersecurity training (gamification and simulations to recreate real attacks) in the next two years, compared with less than half (49 percent) of the rest. "Cybersecurity training is often perceived as a formality, but one-off training is not enough," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. "Behavioral change won't appear with the wave of a magic wand. It takes commitment and practice for acquired skills to become habit. Continuous learning is especially important for enterprises to prepare teams for the evolving threat landscape." Staying up to date also means being able to change strategy fast. To combat new threats as effectively as possible, Kraft Heinz's Lafosse prioritizes agility and flexibility in his cybersecurity team. 3. Put cybersecurity at the heart of recruitment Upskilling in cybersecurity will inevitably involve addressing the skills gap. And that could force companies to take an innovative approach to recruitment, like hiring candidates with non-IT backgrounds. The research found the Skills Leaders are more likely to embed cybersecurity awareness in their recruitment and onboarding processes, stressing the need for high cybersecurity standards from the start. Enterprises with a multinational presence must ensure they approach cybersecurity consistently across their global operations. It only takes one cyber threat in one region to potentially wreak havoc across the whole organization. The skills gap is a big challenge for enterprise cybersecurity teams. To be protected against the full range of evolving threats, enterprises must do all they can to fill it. That means expanding recruitment, preparing their existing workforces by keeping them abreast of changes and training them right from the start. This content was paid for by Kaspersky and produced in partnership with the Financial Times Commercial department.
digital health report

How has COVID-19 changed medicine’s view of digital health?

  • min read
    • It's often said that necessity is the mother of invention. The last few years in digital health also show necessity is also the mother of adoption and acceleration. In a recent Deloitte survey, physician leaders reported increases in virtual appointments for nearly all types of care. For chronic condition management, appointments increased ninefold. In the same survey, more than half said their organization's virtual health strategy changed significantly in response to the pandemic. Telehealth is being adopted worldwide, from the UK's Babylon Health, to Doctolib in France, to China's Ping An Good Doctor. And it's been necessity – like quarantine regulations, contamination risks and growing consultation requests – driving the acceleration. The COVID effect Although the healthcare industry has historically been slow to adopt digital tech, the 'COVID effect' put telemedicine front and center for patients and providers. Kaspersky's 2021 report, Telehealth take-up: The risks and opportunities, confirms healthcare is ready to embrace digital. More than 90 percent of providers use some form of telehealth, such as video consultation, mobile app or remote patient monitoring. Interestingly, only half of providers used telehealth before COVID-19. The same report finds more than one in three, or 37 percent, in the medical community think tech could replace doctors by 2042. Is this fear of AI replacing humans or optimism about how fast digital technologies are advancing? At the same time, projected digital health adoption varies across regions. When will we see AI doctors and psychologists? Asia-Pacific, the Middle East, Africa and Russia are most optimistic about digital doctors. Around half of healthcare professionals in the Asia-Pacific and Middle East regions think digital technologies could replace doctors in the next 20 years, but only around one in three in North America and Europe. These differences may arise from varying public perceptions of digital health. In China in 2019, publicized events in which digital technologies assisted in animal operations, minimally invasive heart surgery and remote brain surgery may have helped public and medical trust in digital health. In medical communities across regions, 40 percent predict there'll soon be digital replacements for psychologists. This may be because of the relative maturity of related technologies like text analysis and natural language processing (NLP.) What will most drive value in healthcare? Kaspersky's report found providers in the Middle East, Asia-Pacific and Latin America think AI and big data will be the biggest driver of value for healthcare by 2045. But North America and Russia think it will be telemedicine and mobile apps. Wearables are valued similarly across regions. These differences might be explained by differences in how regions innovate. In the US, it tends to within an industry: Uber and Lyft for ride sharing and AirBnB for travel. In the Middle East and China on the other hand, super-apps integrate services across industries, such as China's Meituan, providing everything from concert tickets to hotel booking to food delivery. Another factor could be government and business emphasis on AI, machine learning and data analytics. In 2019, I spoke at the AI Everything summit in Dubai, positioned as the largest AI conference in the world. The general level of interest in technologies like AI and uptake in other industries may influence how strongly healthcare professionals and patients welcome these. Taking advantage of digital health optimism How can we use the increased confidence in digital health to accelerate development? I suggest four approaches. 1.    Enhance rather than replace experts Digital health best works side-by-side with physicians, nurses and other care providers. For example, image recognition by machine learning can better detect some cancers. This could free up oncologists and radiologists from routine image-reading to focus on treatment. 2.    Carefully manage and govern data Health data is personal and sensitive. We must pay attention to how we collect and use it. In Kaspersky's survey, over half (52 percent) of frontline telemedicine providers said patients had declined video consultations over privacy and other data concerns. But healthcare systems can also use patient data to improve outcomes and reduce costs. We've seen encouraging results from using big data to improve clinical trial design. 3.    Improve data security across all stakeholders In Kaspersky's survey, around a third of healthcare organizations said they'd had cybersecurity issues, and 30 percent had had data breaches from virtual consultations. Causes likely include outdated IT systems, poor security and not following protocols. We must keep improving security technologies and practices across all stakeholders, like government agencies, insurers and nursing homes. 4.    Encourage collaboration To realize the potential of digital health, we need broader collaboration. To facilitate data sharing, we must share investment to build better data infrastructure and fairly distribute value gained from data. These negotiations will be critical to advancing data-related collaboration in healthcare. The healthcare sector showed its agility and solidarity throughout the COVID-19 pandemic. The ramp-up of telehealth increased provider and patient optimism around digital health. Let's retain the momentum and build healthcare's capability to use technology securely and creatively to improve knowledge, efficiency and patient care.
iot report 2020

Neat yet slippery: Getting a more secure grip on your Internet of Things

  • min read
    • Now and again, a tool comes along that can be used in so many different ways, to meet so many different goals, that it changes everything. Like the Internet of Things (IoT). Whatever business outcome is challenging you most – health and safety, reducing waste or simply, being more efficient – IoT can help. All sectors are adopting these devices and systems at top speed, for an almost limitless range of reasons. And in this fast-expanding market, research suggests business security practices around IoT have some catching up to do. It's a neat yet slippery name, 'the Internet of Things.' The term defines any device that can connect to the internet, but think less smartphone or laptop, and more the raft of new devices that send or receive data through networks for more precise reasons. While consumers eye fridges that connect to the internet with wry suspicion, they nonetheless sell well. From wearable exercise monitors to virtual assistants, to smart lightbulbs, there's been strong uptake. But in business, IoT has been a bombshell. Using IoT for business is now more common than not. Kaspersky's 2020 report, With superpower comes super responsibility: Benefits and challenges of IoT in business found nearly two-thirds of companies worldwide use IoT. Analyst firms Gartner says there'll be 25 billion global IoT connections by 2025, and IDC (International Data Corporation) and GSMA forecast business spending on IoT will reach $1.1 trillion in the same year, up over 500 percent on 2016. Why has the world gone mad for IoT? IoT can save money, create new revenue streams and optimize processes, to name but a few advantages. Kaspersky's research showed the most common applications in business were things like metering, transportation and heating, venting and air conditioning (HVAC), but their application is almost without limit. Take Singapore. To reduce pollution and congestion, and improve residents' experience of getting around the city, they've recently implemented the IoT-based Green Link Determining (GLIDE) system. It links adjacent traffic signals to allow journeys with minimal stops, detecting vehicles and pedestrians and adjusting traffic signals for them. Or Barcelona, where they're using IoT for smart street lighting, and air quality and noise sensors to make their urban systems data-driven. Meanwhile, in manufacturing, IoT is making it possible to automate more, spot problems before they happen and better maintain equipment. Netherlands' Tata Steel uses IoT sensors across its plant. Analyzing the data has helped the business optimize raw material use, increase yields and reduce waste. IoT has even let loose a whole new industry – 'equipment as a service' – where customers pay by how much they use something, rather than leasing it for a period of time. A whole new world of potential! What's the catch? As with any new technology that expands fast, we see many cases where the gate needs closing after the horse has bolted. The same reasons IoT is changing the business world are why attacks on it are such a risk. The data these devices collect is often personal, commercially sensitive, or both. And as IoT devices are increasingly used for critical systems like traffic, electricity and transport, attacks that aim to stop services working risk public safety. Overcoming the IoT security challenge This high rate of compromise must not go on. What's going wrong, and how can you make sure you get it right when implementing IoT? Minimize the IoT cybersecurity risk by following good processes and asking good questions. Kaspersky's report recommends six areas of action. 1.   Look at security during selection Assess the device and system security before you decide to use it. Give preference to devices with cybersecurity certificates and from makers who are upfront about information security. Look for industry- or use-specific frameworks your business can use to research the device security, such as Industrial Internet Consortium's IoT security maturity model. 2.   Lock the gate Gateways described as 'secure' or 'trusted' sometimes protect only connected devices and not the gateway itself. If the gateway is compromised, cybercriminals can deactivate security, affecting all IoT devices on the network. Use an IoT Secure Gateway solution. 3.   Audit regularly Schedule regular cybersecurity audits and risk assessments on IoT systems. Make sure the team responsible for protecting IoT systems has up-to-date, high-quality threat intelligence. 4.   Update regularly Have a process for getting information on software and application vulnerabilities and making timely updates. 5.   Analyze network traffic Smart devices sometimes use a corporate network to communicate with the data center. Use a cybersecurity solution that analyzes network traffic, and detects and prevents network attacks on IoT. Integrate the analysis into the business's network security system. 6.   Stay in control of your partner and supplier relationships Have an up-to-date list of your partners and suppliers, and the data they can access. Give all partners requirements to follow, including compliance and security practices. Ensure those you no longer work with can't access your data and assets. We all stand to benefit from the efficiency, health and safety, and environmental improvements IoT is already making. If businesses can implement IoT securely, it needn't pose a greater risk of compromise than other technologies. In the coming years, I believe we'll see more and more impressive IoT applications that make a difference not only to the business bottom line but to our daily lives.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries