Magazine menu Close Magazine menu

Cybersecurity

Latest stories

interconnected technologies 4 strategies, Young, Woman, Touching, Sensitive, Screen, While, Selecting, Surface, Female

Four ways to prepare your business to secure AI and interconnected technologies

  • min read
    • Of all business investments today, interconnected technologies – the growing network of devices, systems and applications connected to the internet and to each other – are the most vital and challenging. From artificial intelligence (AI) to data spaces to internet of things (IoT,) interconnected tech is letting enterprises gather more data, automate processes and make better decisions. While this 'Fourth Industrial Revolution' is propelling change in every industry, it also brings new risks and challenges in securing enterprises and safeguarding customers. Kaspersky's new research aims to help businesses stay ahead of the changes interconnected technologies bring, published in this 2024 report, Connecting the future of business: How leaders should prepare for using and securing AI and interconnected technologies. About our interconnected tech research Kaspersky surveyed 560 IT security leaders in six regions – North America (US,) Latin America (LATAM: Brazil, Chile, Columbia and Mexico,) Europe (Austria, France, Germany and Switzerland,) Middle East and Africa (META: Saudi Arabia, South Africa, Turkey and United Arab Emirates,) Russia and Asia-Pacific (APAC: China, India and Indonesia.) Respondents were either aware of or involved in cybersecurity decisions about interconnected technologies. They worked in organizations with at least 1,000 employees across many sectors. We asked how they're introducing and securing AI, web 3.0, data spaces, digital twins, augmented reality (AR,) virtual reality (VR,) 6G and internet of things (IoT.) Four interconnected tech preparation strategies With the scale of change these new technologies will likely bring, organizations must have strategies to prepare to adopt and secure interconnected tech. We found organizations that felt ready to secure interconnected tech tended to adopt four strategies: Embracing security by design principles, training and upskilling their workforce, upgrading their cybersecurity solutions and striving to meet regulation and standards. Here's a little more on each strategy. 1.    Adopting security by design principles Integrating cybersecurity into each stage of the software development lifecycle makes secure-by-design software and hardware more resilient to cyberattacks. Our research found leaders focused on integrating cybersecurity into development processes – dubbed Security by Design Promoters – were also better prepared to secure interconnected technologies. 50 percent of Security by Design Promoters felt prepared to secure interconnected tech, compared with 26 percent of the rest. Leadership teams can start promoting security by design by asking where in their design processes cybersecurity expertise is usually first involved. They may also play a role in ensuring budget for security testing during design. 2.   Training and upskilling your workforce With the right cybersecurity education, staff can be a formidable line of defense against cyberattacks. Building a cyberaware culture requires a strategy that empowers employees to gain knowledge and put it into practice. Our research found Training and Upskilling Promoters – organizations prioritizing training and upskilling their people – were better prepared to secure interconnected tech. 55 percent of Training and Upskilling Promoters felt prepared to secure interconnected tech, compared with 25 percent of the rest. Leaders we surveyed shared cybersecurity education approaches that worked well. They favored regular programs covering topics like cybersecurity policies and common cyberthreats, phishing simulations to identify further training needs and awareness campaigns sharing best practice and real-world cyber incident examples. Leaders also emphasized user-friendly security policies, greater collaboration with the IT and security teams and demonstrating good cybersecurity practice from the top. Leadership teams can support training and upskilling the workforce by asking how often employees receive cybersecurity training and how the organization measures their understanding. 3.   Upgrading cybersecurity solutions More devices connecting to the internet means more ways to attack. As businesses adopt these technologies, they need more advanced cybersecurity solutions, such as those with enhanced access controls, encryption and regulatory compliance. Our research found Advanced Cybersecurity Adopters — organizations focused on upgrading cybersecurity solutions — are better prepared to secure interconnected tech. 55 percent of Advanced Cybersecurity Adopters felt prepared to secure interconnected tech, compared with 22 percent of the rest. Advanced cybersecurity solutions let your business adapt to evolving threats, meet new regulation and protect critical data. The leadership team should ask what the organization knows about threats that suggest upgrading cybersecurity solutions, how to minimize the impact of upgrading solutions on workflows and how to ensure employees can use the upgraded tools effectively. 4.   Meeting regulation and standards To avoid legal problems or reputation damage, your cybersecurity practice must meet changing standards and legal requirements. Our research found organizations prioritizing meeting new regulation and standards — Regulation Promoters — are better prepared to secure interconnected tech. 40 percent of Regulation Promoters felt prepared to secure interconnected tech, compared with 27 percent of the rest. To better meet regulation and standards, leadership teams can ask if the organization already meets all security regulation and standards, and if not, which to prioritize. You might also look at how to use cybersecurity compliance processes to build customer's digital trust. Interconnected technologies bring huge business opportunities but also a new era of vulnerability to serious cyberthreats. With more data collected and transmitted, cybersecurity measures must get stronger. Organizations can use these four strategies to safeguard critical assets and fortify customer trust amid a growing interconnected landscape. Leaders must also resource cybersecurity well enough to enable access to new cybersecurity solutions that can meet interconnected tech's oncoming challenges.
ransomware brazil, computer screen with code

The day ransomware nearly stole thousands of young people’s data in São Paulo

  • min read
    • There's an awesome purpose behind São Paulo, Brazil's 121 youth justice centers, Fundação CASA: Every day, they work with teenagers who have committed offenses and been given a court-ordered chance to learn to change their ways. But with 5,000 teenagers accessing a network of some 10,000 devices, Fundação CASA's information security and cybernetics team must manage a tinderbox of cybersecurity risk daily. 24 hours to escape a ransomware attack is the latest film in Tomorrow Unlocked's hacker:HUNTER Behind the Screens series. Fundação CASA's cybercrime fighters tell how they foiled a ransomware attack in a day, successfully safeguarding their young clients' personal data. There's much any organization or business can learn from their winning formula. Young people sentenced to learning When young people commit a criminal offense in São Paulo, the courts may sentence them to rehabilitation through learning how to escape criminal behavior patterns. That's where Fundação CASA comes in: They deliver that education on behalf of the Department of Justice and Citizenship. Meanwhile, the private data of the 5,000 teens who attend one of Fundação CASA's 121 centers must be kept secure. Julio Signorini has worked for Fundação CASA for over 20 years. He says, "As they're taught by the state, the teens' data comes under the Child and Adolescent Statute (ECA.) There's always a risk their data may be leaked." What is ransomware? There are many ways the young people's data could be leaked, including deliberate cyberattacks. Julio says, "A constant threat for us is ransomware: Malicious software that encrypts your data and demands you pay to recover it." To spread ransomware, attackers use social engineering to find users' vulnerabilities. Then the malware can spread across the network, eventually encrypting files and demanding a ransom. Ransomware is a growing threat. Kaspersky software detected over 21,000 ransomware strains and saw attacks rise 63 percent between 2021 and 2022 as a proportion of total attacks. Rapid response foils attack Julio explains how Fundação CASA's most recent ransomware incident began. "A young person brought in a compromised USB flash drive from home." Alex Christy Rogatti, Fundação CASA's Head of Security, remembers the day well. "It was a tense time because it was our first experience with ransomware, but we addressed it in one day." Julio says their fast response started with their young client's good decision to report something unusual. "The young person noticed his device behaving strangely and contacted our service desk, who quickly escalated the case to our information security and cybernetics team." Alex explains what happened next: "We isolated the infected device and recovered encrypted data on that device and our network. We isolated the malware so it couldn't spread further." Should you pay the ransom? Not every organization responds so fast and effectively as Fundação CASA. Proving there's no low cybercriminals won't sink to, 2023 saw some particularly vicious ransomware attacks, like a ransomware gang breaching Lehigh Valley Health Network in Pennsylvania, US, then leaking stolen photos and personal details of breast cancer patients. It's the severity of cases like these that tempts some victims of ransomware to pay their captors. Fundação CASA's Chief Information Security Officer (CISO) Odenilson Dos Santos Bonfim says, "Paying the ransom should be the last option. First, there's no guarantee they'll let you unencrypt your data when you pay. Second, paying the ransom encourages more ransomware. Third, you'd share financial information they may use in a scam or financial crime in future." To help ransomware victims and deter these kinds of attacks, Kaspersky is a found partner of the No More Ransom initiative. It offers free ransomware decryption tools and advice on how to prevent and deal with ransomware attacks. Reducing business vulnerability to ransomware Odenilson thinks there's much business can do to prevent more cyberattacks of all kinds. "We maintain an always up-to-date environment, with effective solutions for monitoring data and preventing any type of attack." That a user first raised the alarm about this attack shows the importance of a cyber-aware organizational culture. Odenilson says, "It's fundamental to encourage awareness, good market practices and publicize information security and cybersecurity information to your whole team and organization." How the ransomware attack on Fundação CASA was stopped echoes the importance of their work showing young people alternatives to a life of crime. By doing the right thing thanks to knowing what to do, one young person kickstarted the process that safeguarded their peers' precious personal data. The quick thinking and coordinated action of the service desk and information security and cybernetics teams shows how strong relationships make strong cybersecurity.
Cybersecurity predictions 2024, a bright bridge leads to the darkness

Growing cyberthreats for business leaders to keep on top of in 2024

  • min read
    • Just as things seemed to be settling down post-pandemic, 2023 turned out to be a year of global political upheaval, conflict and climate catastrophe. Recession impacts and rising prices for business basics like electricity have seen closures rise and start-ups decline. Congratulations are in order if your organization still has its head above water. The last thing any business needs in 2024 is a highly damaging and costly cyberattack or data leak. IBM's 2023 Cost of a Data Breach report found, "The average cost of a data breach reached an all-time high in 2023 of 4.45 million US dollars," having increased over 15 percent in the past three years. Keeping track of how cyberthreats are changing and adjusting your cybersecurity strategy and resourcing accordingly will help businesses avoid the punishing cost of a breach. Here are some of the changing and new threats Kaspersky researchers think you should prepare for in 2024. AI-related threats AI and other interconnected technologies – think augmented reality (AR,) 6G, data spaces and more – made a huge splash for business in 2023, and we'll soon be releasing some exciting new research about the impact of their widespread adoption. On top of that, we think these changes will loom large for AI in 2024: 1.    AI tools will make scams more convincing Scammers use many techniques to get past our defenses. AI tools can now effortlessly create stunning images, even designing whole landing pages. Malicious actors will, of course, use these to craft more convincing materials for fraud, like fake marketing emails and login screens. Expect fraud-related cyberthreats to increase. What to do about it: Improve your employee cybersecurity awareness education to help them become more vigilant to potentially fraudulent content. Use robust antivirus software to block scam emails and warn about suspicious websites. 2.    Concerns about pre-trained AI models will rise As more organizations start using AI chatbots and large language models (LLMs) to help professionals with their work, privacy and security concerns around the data fueling these models will rise, especially in large businesses that deal with a lot of information. And for good reason – training common LLMs often relies on public datasets containing sensitive information, raising uncertainty about whether corporate data fed into these models will stay confidential or be used to train the model further. What to do about it: Businesses must adopt policies limiting how employees can use AI products and educate staff about these policies to reduce the risk of data leaks. They may also adopt Private Large Language Models (PLLMs) – these models are trained only with datasets owned by the organization using them. 3.    AI regulation will ramp up More countries and international organizations will join efforts to regulate AI in the coming year, especially African and Asian nations that are engaged in discussions but haven't yet begun regulating AI domestically. Those already involved will expand regulation, adopting more specific rules, for example, around creating training datasets and using personal data. With their experience developing and using AI, businesses can offer invaluable insight for discussions on AI regulation. Policymakers worldwide are actively seeking input from businesses, academia and the public on shaping AI governance. In 2023, the Bletchley Declaration promoted greater uniformity in AI regulation. But with rising geopolitical tensions, cooperation between countries may reduce, derailing efforts to keep it consistent. What to do about it: Ensure your business is staying ahead of developments in regulation and planning for how it will comply. Take opportunities to get involved in developing AI regulation. More 2024 AI security predictions from Kaspersky researchers Financial services threats 4.    Fraudsters will target direct payment systems Cybercriminals will exploit increasingly popular direct payment systems like Brazil's Pix, the US's FedNow and India's UPI for fraud. We'll also see more clipboard malware – malware that steals data users copy to their clipboard – designed to attack new direct payment systems. Mobile banking trojans will increasingly exploit these systems as a quick and efficient means of cashing out ill-gotten gains. What to do about it: Direct payment systems have enormous benefits for business but must be appropriately secured. Businesses can also educate customers to help reduce their likelihood of accidentally downloading clipboard malware or mobile banking trojans – often disguised as legitimate apps in trusted app stores. 5.    Mobile Automated Transfer Systems (ATS) will spread worldwide Mobile Automated Transfer System (ATS) attacks are fairly new and involve banking malware making fraudulent transactions when the user logs in to their banking app. Mobile ATS has only been seen in Brazilian malware types but could go global in 2024. What to do about it: Those who make banking apps must ensure their security is capable of defending against Mobile ATS. 6.    Brazilian banking trojans will also keep spreading Cybercrime originating from Brazil is well-known to be growing. As many Eastern European cybercriminals have shifted focus to ransomware, Brazilian banking trojans will fill the void left by desktop banking trojans. Trojan Grandoreiro has already targeted more than 900 banks in 40 countries. Grandoreiro attacks start with a malicious link in a phishing email, including fake shared documents, utility bills and tax forms. It then harvests data using keyloggers, screen-grabbers or overlays on online banking login pages. What to do about it: Despite the growing sophistication, cybersecurity awareness education still helps employees and customers avoid falling prey to phishing. Businesses must also make sure users feel comfortable reporting their suspicions. More financial services cybersecurity predictions for 2024 Advanced persistent threats 7.    Creative exploits of wearables and smart devices will grow In 2023, Kaspersky discovered Operation Triangulation – a stealthy new espionage campaign targeting Apple devices. Kaspersky's investigation found five vulnerabilities in Apple's operating systems that affect everything Apple – from smartphones to wearable devices to smart home gadgets like Apple TV and Apple Watch. In 2024, we'll see more advanced attacks on consumer devices and smart home technology, including other operating systems. Devices like smart home cameras and connected car systems are attractive for threat actors because of their surveillance potential and tendency to run on outdated software, which makes them easier to attack. What to do about it: Secure your business Internet of Things (IoT) devices and ensure that if they don't need to connect to the internet, they don't. 8.    Supply chain attacks-as-a-service: Bulk-buying access There is a growing trend of attacking businesses through their suppliers. Small and medium companies that may lack advanced protection become gateways for hackers to access the data and infrastructure of big players. 2022 and 2023 saw breaches through identity management company Okta, which serves over 18,000 customers worldwide. What to do about it: Supply chain attacks expert Eliza-May Austin has great advice on preventing supply chain attacks in this Tomorrow Unlocked video: 9.    More attacks on Managed File Transfer systems Managed File Transfer (MFT) systems that let businesses securely exchange sensitive information with partners have become a cornerstone of organizational efficiency. But housing confidential information like intellectual property, financial records and customer data puts them in the crosshairs of cyber adversaries. MFT systems' intricate architecture and integration into business networks also means potential security weaknesses. In 2023, MFT system incidents involving MOVEit and GoAnywhere confirmed this. What to do about it: Undertake comprehensive reviews of your MFT solutions to identify and reduce security weaknesses. Implement robust Data Loss Prevention (DLP) solutions, encrypt sensitive data and build a cybersecurity awareness culture among employees. More advanced persistent threat predictions for 2024 With attention to where threats will likely grow, the year ahead need not be daunting for business. From getting ahead of AI regulation to improved cybersecurity awareness education, organizations of all sizes can stay secure even as threats grow.
insight story industrial iot a doctor makes an injection to a robot using a wire syringe connected to their smartphone

Industrial ‘Internet of Things:’ Is security too far down the production line?

  • min read
    • Imagine every part of the workplace – from manufacturing equipment to energy grids, healthcare devices to farms – had the connectivity of a smartphone. That's the Industrial Internet of Things (IIoT) – sometimes known as Industry 4.0. It brings a host of efficiencies, like real-time data-analysis and improved predictive maintenance. But with great connectivity comes great responsibility. IIoT can be especially vulnerable to attack. And while it's now widely used, many businesses know their IIoT systems are poorly protected. In the second episode of Insight Story season 2, guests Chris Kubeska, Netherlands-based security researcher, cyber warfare specialist and CEO of HypaSec, and Alison Peace, patient management operations manager for UK and Ireland at Medtronic, illuminate how industry can use and protect game-changing IIoT. Where is IIoT most commonly used? All sectors are using IIoT, but some more than others. Chris says, "The maritime industry uses IIoT a lot. It's also widely used in the space industry, medical devices and critical infrastructure." Medtronic is a global developer and producer of medical devices and therapies like insulin pumps, pacemakers and implantable defibrillators – all increasingly connected. Alison explains the patient benefits: "In the UK, more than 100,000 patients receive an implanted cardiac device each year. They then have constant hospital checks, which places a burden on healthcare services. Remote monitoring for cardiac devices started in basic form almost 20 years ago. Devices can now send wireless alerts if they detect a problem. Data shows patient outcomes are better – they don't go into hospital as much." Cybercriminals have noticed loosely protected IIoT Despite its relative newness, there have been many documented attacks on IIoT. In 2014 an attack on a German steel mill's IIoT systems killed three people and injured many more. The attacker gained access to the mill's office network then compromised its industrial control system. The compromise prevented a blast furnace shutting down, leading to an explosion. Even without a breach, users finding vulnerabilities in everyday tech means reputation-damaging headlines. At-home stationary fitness bike makers Peloton were embarrassed when a security researcher found their gear included an open channel that allowed access to users' private information like weight, gender and date of birth. Similarly, a hacker accessed footage from Verkada internet-connected security cameras. Securing industrial smarts Dr. Amin Hasbini, Head of Research Center Middle East, Turkey and Africa for Kaspersky's Global Research and Analysis Team (GReAT,) is concerned about the gap between businesses who use IIoT and those who fully secure it. "A recent Kaspersky study found over 60 percent of businesses use IoT. But close to half say these systems aren't fully protected. A third of these organizations blame lack of budget, but when it's not resources stopping them, what is it?" Whatever it is, senior leaders in organizations using IIoT must shift the barriers to best-practice security. Amin says, "Some technology vendors race to add features while largely ignoring security." "The challenge starts at the top in each organization. If security becomes a priority, it gets translated into policies, guidelines and methods." Chris advises thinking about how when security may not be front of mind in your organization's tech decision-making. "Your procurement department will be looking for the least expensive deal, but that deal might not include the best security." She continues, "Many IIoT systems come with older operating systems that don't have the security settings you'd want. And then, there may not be a secure way to update the software. These are some of the risks. Know what you're buying so you can plan ahead and mitigate those risks." Alison says medical devices are now made differently to ensure security. "It's important to incorporate an encryption module to make sure others can't read the device's data. Our devices don't connect to the internet, but use a pass-through to a monitor or app. Data is encrypted in the device and sent encrypted." Alison believes the high standards of institutions they work with helps give patients confidence in their devices. "In the UK and Ireland there are strict controls when health systems engage third parties. You must have rules, regulations and systems in place to work with hospitals." Chris also has recommendations for contracts with third parties. "For encryption, your contract should specify meeting the standards of the time. So when you renew, the expectation is to keep to those standards. Have a responsible disclosure policy, and ensure your suppliers have good data security and privacy policies." She says don't be shy to end a technology vendor relationship if security conversations feel awkward. "If you don't feel comfortable speaking about cybersecurity and privacy with your supplier, look for a new one. Look at suppliers who take part in security conferences. If they're actively looking at security, that gives credence." Is regulation keeping up with IIoT? Chris thinks business should expect regulation around IIoT to speed up. "The tech's definitely moving faster than law, but there are some guidelines and frameworks." Alison feels those designing IIoT must allow for changing security requirements – something Medtronic has strived for. "Our global security office is tasked with making sure our devices comply with standards worldwide. National legislation could say, we want the data from your device in this format, and our devices are designed to enable that." Simplifying a tangled net of things Chris thinks IIoT manufacturers could aspire to lead in many ways, but chiefly, making levels of security simple to understand. "Start applying what I call 'easy standards,' like a traffic light system, so consumers and companies can know if something has a minimum level of security – for example, can it be updated? Medical uses would need a higher standard compared with consumer home grade." Alison agrees that clear and standard practice matter. "A third party can easily comply with clearly communicated, standardized security requirements. Open communication and clear criteria are essential." IIoT is already commonplace and will only grow as those organizations yet to adopt see its potential to improve productivity and reduce costs. As technology becomes increasingly connected, securing IIoT is fundamental to the safety of just about everything in our lives. As Chris warns, "I want to retire knowing my own technology won't kill me." Leaders can keep their organization and customers safe by asking the right questions and pursuing IIoT vendors who prioritize security.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
behind the screens

Zero-day: Birth of a new threat

  • min read
    • They're inside your system but no one knows how they got there – or how to stop them. These destructive attacks are called zero-day threats, because your security team will have zero days to prepare. Zero-day attacks involve cybercriminals using vulnerabilities no one knows about. They're hard to detect and can go on for years. Zero-day: Birth of a New Threat is Tomorrow Unlocked's latest film in the hacker:HUNTER Behind the Screens series. Michael Gregg, CEO of Managed Service Provider Catalyst Network Solutions, discusses these attacks and his clever way to trick cybercriminals into giving up their secrets. He also shares ways to spot these sometimes-subtle attacks. Understanding zero-day attacks While you may not have heard of zero-day attacks, some of the most well-known cyberattacks fall into this category, such as WannaCry and BlueKeep. But what does it mean? Software developers are always looking out for vulnerabilities hackers could use to gain access to systems through their software. When you receive software updates, these often include 'patches' for recently discovered security holes. "It's called zero-day because that's exactly how long you've had to prepare for it," says Gregg. Zero-day attacks might include reaching a vulnerable system using phishing – manipulative emails to users aiming to convince them to open a file or visit a malicious site. That action downloads the attacker's malware, which infiltrates user files. It can take time for developers to find the vulnerability that allowed the attack. In recent years, hackers have become faster at exploiting vulnerabilities soon after discovery. Zero-day attacks are especially dangerous because only attackers know about them. Once they have access through a zero-day vulnerability, criminals can attack immediately or wait for the best time. What is a Managed Service Provider (MSP?) Gregg's company, Catalyst Network Solutions, is a Kaspersky partner Managed Service Provider (MSP.) MSPs offer cybersecurity-as-a-service. Rather than or as well as an inhouse cybersecurity team, businesses hire MSPs to take care of their cybersecurity. Using MSPs makes it easier for businesses to have a range of cybersecurity expertise on-hand in a market where hiring cyber experts can be challenging. MSPs typically provide services to multiple companies and organizations, giving them broad-based knowledge of cyberthreats and cyber solutions. With the wide range of business tech that needs securing today – from light switches to security cameras to fridges – the value of wide-ranging experience is rising by the day. Tricking cybercriminals with their own tricks The data tricks cybercriminals into using, and so revealing, their zero-day methods. This has allowed Gregg's team to prevent and stop attacks faster. Preventing zero-day attacks As soon as a zero-day threat is understood, software developers will release updates to patch it, so your business should ensure it always installs updates promptly. If you can't stop a zero-day attack happening, there are ways to ensure it's caught early. Gregg advises "There's never a call that's not worth making," when it comes to cybersecurity. Signs of zero-day attacks can be subtle. "If your mouse is moving in a weird way, you're getting out-of-place keystrokes or your computer's running slowly," let the cyber professionals know – whether you have an internal team or a Managed Service Provider.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries