Magazine menu Close Magazine menu

education

Latest stories

ransomware brazil, computer screen with code

The day ransomware nearly stole thousands of young people’s data in São Paulo

  • min read
    • There's an awesome purpose behind São Paulo, Brazil's 121 youth justice centers, Fundação CASA: Every day, they work with teenagers who have committed offenses and been given a court-ordered chance to learn to change their ways. But with 5,000 teenagers accessing a network of some 10,000 devices, Fundação CASA's information security and cybernetics team must manage a tinderbox of cybersecurity risk daily. 24 hours to escape a ransomware attack is the latest film in Tomorrow Unlocked's hacker:HUNTER Behind the Screens series. Fundação CASA's cybercrime fighters tell how they foiled a ransomware attack in a day, successfully safeguarding their young clients' personal data. There's much any organization or business can learn from their winning formula. Young people sentenced to learning When young people commit a criminal offense in São Paulo, the courts may sentence them to rehabilitation through learning how to escape criminal behavior patterns. That's where Fundação CASA comes in: They deliver that education on behalf of the Department of Justice and Citizenship. Meanwhile, the private data of the 5,000 teens who attend one of Fundação CASA's 121 centers must be kept secure. Julio Signorini has worked for Fundação CASA for over 20 years. He says, "As they're taught by the state, the teens' data comes under the Child and Adolescent Statute (ECA.) There's always a risk their data may be leaked." What is ransomware? There are many ways the young people's data could be leaked, including deliberate cyberattacks. Julio says, "A constant threat for us is ransomware: Malicious software that encrypts your data and demands you pay to recover it." To spread ransomware, attackers use social engineering to find users' vulnerabilities. Then the malware can spread across the network, eventually encrypting files and demanding a ransom. Ransomware is a growing threat. Kaspersky software detected over 21,000 ransomware strains and saw attacks rise 63 percent between 2021 and 2022 as a proportion of total attacks. Rapid response foils attack Julio explains how Fundação CASA's most recent ransomware incident began. "A young person brought in a compromised USB flash drive from home." Alex Christy Rogatti, Fundação CASA's Head of Security, remembers the day well. "It was a tense time because it was our first experience with ransomware, but we addressed it in one day." Julio says their fast response started with their young client's good decision to report something unusual. "The young person noticed his device behaving strangely and contacted our service desk, who quickly escalated the case to our information security and cybernetics team." Alex explains what happened next: "We isolated the infected device and recovered encrypted data on that device and our network. We isolated the malware so it couldn't spread further." Should you pay the ransom? Not every organization responds so fast and effectively as Fundação CASA. Proving there's no low cybercriminals won't sink to, 2023 saw some particularly vicious ransomware attacks, like a ransomware gang breaching Lehigh Valley Health Network in Pennsylvania, US, then leaking stolen photos and personal details of breast cancer patients. It's the severity of cases like these that tempts some victims of ransomware to pay their captors. Fundação CASA's Chief Information Security Officer (CISO) Odenilson Dos Santos Bonfim says, "Paying the ransom should be the last option. First, there's no guarantee they'll let you unencrypt your data when you pay. Second, paying the ransom encourages more ransomware. Third, you'd share financial information they may use in a scam or financial crime in future." To help ransomware victims and deter these kinds of attacks, Kaspersky is a found partner of the No More Ransom initiative. It offers free ransomware decryption tools and advice on how to prevent and deal with ransomware attacks. Reducing business vulnerability to ransomware Odenilson thinks there's much business can do to prevent more cyberattacks of all kinds. "We maintain an always up-to-date environment, with effective solutions for monitoring data and preventing any type of attack." That a user first raised the alarm about this attack shows the importance of a cyber-aware organizational culture. Odenilson says, "It's fundamental to encourage awareness, good market practices and publicize information security and cybersecurity information to your whole team and organization." How the ransomware attack on Fundação CASA was stopped echoes the importance of their work showing young people alternatives to a life of crime. By doing the right thing thanks to knowing what to do, one young person kickstarted the process that safeguarded their peers' precious personal data. The quick thinking and coordinated action of the service desk and information security and cybernetics teams shows how strong relationships make strong cybersecurity.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
women who shaped computing, careers, education, history Woman uses laptop on desk alongside model space rocket. Portraits of notable women hang on her wall.

We should all know about these women who shaped cybersecurity

  • min read
    • According to Cybercrime Magazine research, women held 25 percent of cybersecurity jobs globally in 2022. Surely cyber and computing careers are for everyone. So why are many women tuning out? Today's working wisdom is that diversity benefits teams, but there's slow progress in getting more women to join technology-led careers and keeping them on board. Human computers: The first data scientists The word 'computer,' coined in 1613, was first used for humans who performed computation. Many of the best were women: Nicole-Reine Etable de la Brière Lepaute helped predict Halley's Comet's return in 1758. A century later, Maria Mitchell plotted the planet Venus's motion, earning an astronomy professorship. When the US Civil War ended in 1865, war widows needed to support themselves. Women were hired as human computers. Agnes Meyer Driscoll, known as 'Madame X,' led the decoding of Japanese ciphers and manuals for the US during both world wars. Women solved the ultimate Enigma Britain's Alan Turing is famed for cracking the Nazi's 'Enigma' code during World War II, but it wasn't the work of a lone genius. Of Bletchley Park's codebreaking team, 75 percent were women. Turing's colleague Joan Clarke worked out how to speed up decoding double-encrypted messages, but unlike many of her male colleagues, her technique wasn't named after her. Clarke's job title didn't match her expertise – there was no 'senior female cryptanalyst' role, so she was given the job title 'linguist.' Painstaking calculation devalued as 'kilo-girls' The dominance of women as human computers cloaked an inconvenient truth. Their work was on average better, and they were cheaper than male counterparts. The Harvard Computers, mockingly called "Pickering's harem," supported Edward Pickering at Harvard Observatory in the 1880s, doing work men and scholars found tedious, unpaid or at a fraction of what men earned. The term 'kilo-girl' came about in the 1940s to describe complex calculations seen as 'women's work.' We measure computing power in gigabytes or terabytes, but they measured kilo-girl hours – one kilo-girl was a thousand hours of painstaking calculations. The kilo-girls work was far from trivial: In the 1950s, Gladys West's calculations for the US Naval Weapons Laboratory led to GPS's development. Computing becomes a man's world By the 1960s, human computing had given way to machines. In the 1940s programmers were mostly women, but by the end of the 1960s women made up 30 to 50 percent. Women were still paid less and few were promoted to leadership. The perception computing is for men and boys started at home. A 1984 report showed 1 in 5 girls used a computer at home, compared with 1 in 2 boys. Female computer science graduates peaked in 1984 at 37 percent, before steadily declining. Academic Wendy Hall says by the 1990s, men led professional computing and computers "were sold as toys for boys." Ten women from computer history to know Ada Lovelace invents the first algorithm Publishing the first algorithm in 1843, Ada Lovelace is said to be the world's first computer programmer. She realized Charles Babbage's Analytical Engine could do more than calculation: Combining mathematics and analysis. Ada Lovelace Day celebrates women's achievements in science, technology, engineering and maths (STEM) and encourages young women to follow her path. Hedy Lamarr averts the Cuban Missile Crisis 1940s Hollywood actress Hedy Lamarr co-invented a frequency-hopping method to control torpedoes remotely without the risk of signal tracking or jamming. Naval ships were using the technology by the 1962 Cuban Missile Crisis. It later became part of Bluetooth and Wi-Fi. Grace Hopper invents new ways to code Grace Hopper created the first compiler for a programming language. She programmed and wrote a comprehensive manual for an electro-mechanical computer based on Babbage and Lovelace's Analytical Engine, Harvard Mark I. She wasn't credited for this but is widely miscredited for coining the term 'bug' when a moth caused her computer to malfunction. She later developed computer programming language COBOL (common business-oriented language) and invented new symbolic ways to write code. Margaret Hamilton took us to the moon The 1969 moon landing wouldn't have happened without Margaret Hamilton, who programmed Apollo's flight software.It needed more 'human computing:' After Hamilton's programming, seamstresses hardwired the code by threading copper wire through magnetic rings. Elizabeth "Jake" Feinler organized the internet At Stanford University in 1969, Elizabeth "Jake" Feinler created the first internet directory, ARPANET, alongside mostly female staff. By the early 1970s, they'd put together the first WHOIS directory of web domain ownership. Feinler suggested categorizing domains by where the computer was, like .edu domains for educational institutions. Women who built new audiences for technology Organizing, building relationships and human factors – often thought of as female traits – are critical in computing projects' success and creating demand for new services. Joan Ball set up the first computer-aided dating service in 1964. In 1988, Stacy Horn started a community in New York, the East Coast Hang Out (ECHO,) where users could chat online. Game designer Brenda Laurel's research showed girls wanted to play more interactive character computer games. In the 1990s, her company Purple Moon developed a best-selling game series inspired by that research. In the 1970s, Joan Margaret Winters researched how software should consider human factors for IBM's SHARE project. When you see the iconic trash symbol on your Apple Mac, thank Susan Kare. She worked with Steve Jobs to design its original icons. Today's influencers for women in cybersecurity When young people see people who look like them succeed in a career, they're more likely to choose it. For women considering going into cybersecurity, there's no shortage of inspiration. Parisa Tabriz, the self-styled "Security Princess" (official title: Director of Engineering,) runs Google's security testing labs. Eva Galperin, Director of Cybersecurity at Electronic Freedom Foundation (EFF,) fights for digital privacy, security and civil liberties. Eva Galperin helps women secure their devices against stalkers and spying ex-partners. Rebecca Bace's threat intrusion detection work at the US National Security Agency contributed to famous hacker Kevin Mitnick's arrest. The cybersecurity community nicknamed her 'Den Mother' for her vital mentorship and advice and posthumously inducted her into the 2019 Cyber Security Hall of Fame. Dr. Anne-Marie Imafidon MBE creates skills training and certification to encourage young women to pursue cyber careers through her company Stemettes. Jane Frankland, security entrepreneur and author of InSecurity: Why a failure to attract and retain women in cybersecurity is making us all less safe, helps the C-Suite (senior management) attract and retain women in cybersecurity. Attracting and retaining more women in IT careers In the UK in 2022, just 19 percent of IT professionals were women. But in many countries, such as those in Central Asia, women make up nearly half of the IT workforce. It's the gender-equality paradox: In countries with less gender equality, educated women seek careers with more income security, while in countries with better gender equality, women avoid careers said to discriminate against women. There are green shoots of progress. Kaspersky's Women in tech report surveyed women in four global regions. Encouragingly, 57 percent say gender equality is improving in their organization. Despite this, 44 percent think male colleagues progress faster. In the report, Dr. Ronda Zelezny-Green, Co-Founder and Director of Panoply Digital, says change is slow because "too much activity around gender equality in IT focuses on one-off gimmicks and band-aid solutions that can be spotlighted in the press, instead of focusing on female employees and actions that will make a sustained difference in their professional lives." Dr. Zelezny-Green thinks we should entice more women into the industry by creating new products and services for women. Widely-reported diversity problems with Artificial intelligence (AI) could be seen as an opportunity: "There's huge potential in telling the stories of Timnit Gebreu and Joy Buolamwini, black women leading the charge for more ethical and inclusive AI design. These stories make inroads in IT and tech roles where women are currently underrepresented." In a prosperous future, we won't need to ask "Where are the women in cyber?" They're not hiding under the desk. They're making change, but in another industry. We're on the right path, but it's a long journey ahead. With more women, we can better create products that represent users and benefit from a gender-equal computing industry.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
virtual reality VR education

Learning in 3D: How virtual reality is changing higher education

  • min read
    • In 1989 film Back to the Future II, set in an imagined California of 2015, virtual reality (VR) headsets are as common as our smartphones. Protagonist Marty McFly, seen in the first Back to the Future traveling to the 1950s and nearly erasing his existence, in the future finds his teenage offspring glued to their VR headsets. Beyond the real year 2015, VR is yet to become a fixture in our lives. But it's fast-growing – a study by Artillery Intelligence predicted VR will reach 25 percent of US internet users by 2023. Global shipments of VR and augmented reality (AR) headsets are set to reach 43.5 million by 2025 – a 690 percent growth on 2020 numbers. Part of this growth may be in VR's potential to change how future generations study, with immersive experiences giving learners a deeper understanding of their topic. "The limits are near endless. History teachers take students to the battleground and recreate battles. Instructors give virtual tours of museums, and students create 3D models of bridges and buildings, then stress-test them with weather effects," says Jonathan Kinsey, Senior Instructional Designer at Collegis Education, a higher education technology services provider. "It's an excellent tool for applying knowledge," he adds. Gur Windmiller, Astronomy instructor at the San Diego University, says, "I think VR can be used wherever content lends itself to the combination of immersion, interactivity and 3D spatial geometry. With enough funding, I can see many subjects benefitting from VR." Steven King, professor at University of North Carolina's Hussman School of Journalism and Media, built a 3D virtual version of his classroom, letting students walk about, talk to each other and form groups. "I feel like I'm engaging in class — a community aspect I would not have gotten from Zoom," said one of King's students in university news, The Daily Tar Heel. 3D visualizing in medical sciences Teaching anatomy and neurology involves translating a mass of complex, three-dimensional data into two-dimensional images for learning. Tod Clapp, Assistant Professor in the Department of Biomedical Sciences at Colorado State University, says, "We got into VR because we wanted to find something that could solve the problem of students trying to translate two-dimensional images into three dimensions." Colorado State University built the world's first large-scale VR lab – 2,500 square feet equipped with 100 computers and VR headsets. Anatomy students can work in 'pods' of four, interacting with each other in the VR environment. "Students reported the course to be as engaging, or more engaging, than a face-to-face course," continues Clapp. Since Colorado State University was pioneering the use of VR on this scale in education, most course content had to be developed in-house – a huge undertaking, but one Clapp considers worth the effort. "In materials science data, we've had some collaborators looking at the way atoms align in metals. That's been exciting because when I look at it in three dimensions and collaborate with colleagues in three dimensions, it's intuitive." Traveling back in time with VR History buffs may have wondered what it was like to be a gladiator in Rome's Colosseum in 80 AD. Or to have roamed Pompeii's streets in 79 AD, seeing monuments, frescoes and public baths. Or when the Great Pyramid at Giza was built during the reign of Pharaoh Khufu in 2500 BC. With VR, history students can explore ancient civilizations almost as if they were there. In 2018, for the first time, anthropology students from Harvard University in the US and Zhejiang University, China "traveled" to the Giza Plateau and studied the tombs and Sphinx from their respective VR-equipped classrooms. About 7,000 miles away from each other, the two student groups worked together as avatars examining tombs and studying Egyptian hieroglyphs. More recently, apps like KingTut VR, Timelooper, and Trench Experience VR let students visit King Tutankhamun's tomb, experience World War II and virtually time travel around the world, all from a VR headset. Meanwhile, portals like ClassVR bring VR history curriculums to the classroom, letting students visit Stonehenge, the tomb of Ramesses VI or the Acropolis of Athens. News publishers like The New York Times and BBC have also released impressive VR learning experiences. Medical emergency practice without risk Nurses need to make fast decisions about patient care in high-stakes, stressful situations. Trainers have previously relied on 'manikins' – life-sized models – to demonstrate and let students practice. There's no scope for controlled crisis scenarios where student nurses can practice thinking on their feet. VR can bridge this gap. In 2019, West Carolina University's School of Nursing conducted a trial VR simulation. Participants were introduced to a virtual environment where a patient had experienced a severe allergic reaction. The virtual patient, whom a cat had bitten, was given an antibiotic which led to the patient going into anaphylactic shock. The participants had to deal with the emergency while the patient's condition worsened rapidly. Patricia Rade, a senior nursing major, told the university news, "It felt like I was at the scene and dealing with an actual emergency. It was a great experience. I had to use my knowledge and critical thinking skills to prioritize the best action." As well as simulating scenarios that would be hard to replicate, VR can reduce training costs that in some countries fall on students. Jonathan Kinsey of Collegis Education says, "Nurses probably need more tools than anyone – tools that need to be bought every time. VR gives us the chance to say, "Wait, let's replace this recurring expense with an up-front cost and never worry about it again."" More engaging, hands-on learning Students must often grapple with a flat and uninspired form of learning with online learning: Staring at a screen. But virtual classrooms can be more engaging, allowing better retention than even face-to-face classrooms. Students can interact with each other using avatars, look closer at what they're learning about and be physically involved in the subject. Windmiller says, "There is no question in my mind that VR is extremely engaging, especially being novel and different from anything else the students are doing." Clapp agrees, saying, "We see each other's avatars, and you reflexively turn to that person when you're talking to them. So, for us, VR has proven valuable for working and looking at three-dimensional data, and it's also highly engaging." A 2020 study showed how efficient VR learning can be, with a 75 percent retention rate over 5 and 10 percent respectively for lectures and reading. The only form of learning that beat VR was teaching others, with a retention rate of 90 percent. Another study in a Beijing classroom compared VR with traditional methods and reported students taught using VR scored 27 to 32 percent higher in tests. As with any connected technology, VR has its share of privacy and cybersecurity concerns. It may store sensitive personal data and is vulnerable to data breach and 'deep fakes – artificial video footage that closely mimics how a real person acts and sounds. Anyone investing in VR should learn about reducing cybersecurity and privacy risk and follow security steps like encrypting sensitive data and keeping firmware up to date. VR has much to offer in education, improving engagement, information retention and facilitating hard-to-replicate experiences, from high-pressure situations they'd face on a job or traveling back in time to see historical events play out. Although its adoption is far from widespread, headsets are selling fast, and big players are entering the market for developing VR learning experiences. With privacy and security at the forefront of our minds, VR could open new levels of skill, competence and opportunity for the next generation.
cybersecurity predictions 2021

What does 2021 have in store for cybersecurity?

  • min read
    • Predicting the future is notoriously precarious. Who would have foreseen a year like 2020? Kaspersky's Global Research and Analysis Team reflect on this year in cybercrime and deduce what we should expect in 2021. Leaked patient records and COVID pressures in healthcare 2020 was the year everyone had a vested interest in new medical technologies' success. Cybercriminals attacked medical devices, hospitals and research institutions, intent on stealing COVID-19 vaccine insights. We also saw the first known directly fatal cyberattack: A patient died because ransomware infection of medical equipment caused care delays. Other cybercrime groups surprised us by ruling out attacking medical institutions. The cybersecurity community set up CTI League: Experts helping medical organizations respond to cyberthreats. Kaspersky gave healthcare organizations free access to tailored cybersecurity. In 2021, expect more attacks on COVID-19 vaccine developers attempting to steal critical data that could help other nations get ahead. Private healthcare organizations will further come under attack, as many don't have the resources to protect valuable patient data. With the transition to cloud computing, we may see patient data leaks from cloud services. Criminals can use personal data in hacked medical records to dupe people into revealing more. More healthcare industry cybersecurity predictions for 2021 Cybercriminals have learned about industrial networks Attacks on industrial networks will become more targeted. By watching randomly infected machines, cybercrime groups have learned organizations' IT setup and know how to exploit it. They can then on-sell network access to more sophisticated cybercrime groups who will take control of finance systems to steal cash. As many industrial control systems (ICS) use old operating systems, the end of support for systems like Windows 7 creates an exploitable loophole. We could see another significant, multi-industry crime campaign like WannaCry. As utilities and government services go through digital transformation they're more vulnerable to attack. Cybercriminals can use a government service as an entry point into industrial systems to disrupt services like public transport. In 2020, COVID-19 restrictions on working on-site delayed IT-system upgrades. During an attack, it may be harder for IT admins to regain system control quickly. Basic malware could spread and become more serious. Upgrading endpoint security and training workers are vital. More industrial cybersecurity predictions for 2021 Online education revolution brought new threats Education changed abruptly in 2020. 1.5 billion students took classes from home. Educators had to learn new skills, like running a class on Zoom or using TikTok lessons. For those who can access the technology, these new services enhance education. But they come with new threats. Learning management systems (LMS) like Google Classroom are exploding. And with growth comes cybercrime. We saw a staggering 20,000 percent growth in threats to online learning platforms between 2019 and 2020. Privacy usually involves getting the user's consent, but a child can't easily manage their privacy settings. Video will keep growing as a learning tool. About 60 percent of teachers use YouTube in the classroom. There's increased risk of exposure to age-inappropriate content, and new threats like Zoombombing could expose learners to harmful content. Games like Minecraft are a great way to make learning more interactive but exposes students to risks like cyberbullying, trolls and malicious files. Teachers must moderate content in their learning management systems, but with the popularity of social platforms and games for pupil engagement, the challenge has leveled-up. More education cybersecurity predictions for 2021 Poverty driving more financial cybercrime in 2021 In 2021, financial companies became less secure thanks to due hastily deployed remote working solutions. Some bought retail laptops that didn't match the security standards of the organization. Limited employee training, default configurations and remote access all contributed to increased attacks. There's rising extortion using distributed denial of service (DDoS) and ransomware. Targeted ransomware is the new normal for financial organizations. Criminals increased ransoms, emboldened by successful attacks and media coverage. To cover their tracks, they'll now expect you to pay in cryptocurrencies. People are often the weakest link, like in the failed attempt to infiltrate Tesla. Stay at home orders didn't affect cybercriminals: Brazilian cybercrime groups went global in 2020, expanding to Europe and beyond, including attempts to hack ATMs. Bigger crime groups are evolving their business models to boost profits by hiring more people within their virtual walls rather than outsourcing. To crack down on cybercrime, the US Department of the Treasury's Office of Foreign Assets Control warned of sanctions for organizations facilitating ransom payment. Next, we predict sanctions against institutions and nations that don't combat cybercrime coming from their territory. More financial cybersecurity predictions for 2021 Crime gangs collaborating on advanced threats Advanced persistent threats (APTs) are the most dangerous kind of attacks, often seen in geopolitical clashes, intent on harming national interests. With the trend towards improved organization security and more people working from home, crime groups will exploit network technologies such as virtual private networks (VPNs,) using social engineering to get access. 5G is big news, with bogus stories of health risks and some nations limiting or banning Huawei products in their 5G infrastructure. Security researchers are examining Huawei and other 5G providers for implementation flaws. If found, they'll make the front pages. As more devices depend on 5G for connectivity, attackers will have more incentive to seek vulnerabilities to exploit. As ransomware becomes the weapon of choice for many criminals, we may see ransomware players' concentrate. In 2020 the Maze and Sodinokibi gangs pioneered an affiliate collaboration model. These bigger groups may combine to deliver APT-style attacks that overwhelm a target organization's system, to access specific data. We'll likely see attacks like these disrupt everyday lives. It could be an intentional attack on critical infrastructure like utilities or collateral damage from ransomware targeting big organizations we all rely on, like supermarkets, mail or public transport. More advanced threat predictions for 2021 Threats may be increasing, but fortunately, there's better education, technology and intelligence available today to help your organization stay secure and face the future.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries