CSLATEST
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Computing<br />
Security<br />
Secure systems, secure data, secure people, secure business<br />
KEEPING IT REAL-TIME<br />
New digital landscape demands ever<br />
faster response to risk<br />
NEWS<br />
OPINION<br />
INDUSTRY<br />
COMMENT<br />
CASE STUDIES<br />
PRODUCT REVIEWS<br />
SAFE PAIR OF HANDS?<br />
The goalposts are shifting in<br />
pursuit of achieving<br />
a Zero Trust outcome<br />
LIGHTING THE WAY<br />
New rays of hope may be<br />
on the horizon as a fresh<br />
approach to cybersecurity<br />
starts to filter through<br />
SHARK-INFESTED WATERS<br />
Surge in ransomware attacks puts<br />
the bite on more potential victims<br />
Computing Security Sept/Oct 2024
DON’T<br />
SaaSSS<br />
GET YOUR<br />
KICKED! !<br />
TAKE CONTROL NOW AND<br />
PROTECT YOUR SaaS DATA<br />
Global SaaS vendors like Microsoft, Google and Salesforce<br />
don’t assume any responsibility for your data hosted<br />
in their applications. So, it’s up to you to take control<br />
and fully protect your SaaS data from cyber threats or<br />
accidental loss. Arcserve SaaS Backup offers complete<br />
protection for your SaaS data, eliminating business<br />
interruptions due to unrecoverable data loss.<br />
Arcserve SaaS Backup<br />
Complete protection for all your SaaS data.<br />
arcserve.com<br />
The unified data resilience platform
comment<br />
QUANTUM RESEARCH HUBS: THE GOOD AND THE DISTURBING<br />
EDITOR: Brian Wall<br />
(brian.wall@btc.co.uk)<br />
LAYOUT/DESIGN: Ian Collis<br />
(ian.collis@btc.co.uk)<br />
SALES:<br />
Edward O’Connor<br />
(edward.oconnor@btc.co.uk)<br />
+ 44 (0)1689 616 000<br />
David Bonner<br />
(dave.bonner@btc.co.uk)<br />
+ 44 (0)1689 616 000<br />
Stuart Leigh<br />
(stuart.leigh@btc.co.uk)<br />
+ 44 (0)1689 616 000<br />
PUBLISHER: John Jageurs<br />
(john.jageurs@btc.co.uk)<br />
Five new quantum research hubs have been backed by more than £100 million of<br />
government funding in the hope that they will deliver breakthroughs in healthcare,<br />
cybersecurity and transport.<br />
Announced by the Science Secretary Peter Kyle, the hubs will bring researchers and businesses<br />
together to use their scientific expertise and talent alongside the commercial know-how and<br />
resources to develop "groundbreaking quantum technologies that will directly impact people's<br />
lives in areas like healthcare, security, and clean energy", states the government.<br />
It's the sort of positive initiative that has been badly lacking of late in this area. However, Tim<br />
Callan, chief experience officer at Sectigo, has some concerns: "It is impressive to witness the UK's<br />
commitment to maintaining its position as a leader in the field of quantum technology. However,<br />
we must not forget the security challenges associated with this advanced technology.<br />
"In the event that a country does develop a quantum computer capable of breaking current<br />
encryption methods, it is likely that they would keep it a closely guarded state secret, as the UK<br />
did when it broke the Enigma code during World War II. For this reason, it is imperative that<br />
businesses take their own proactive measures to prepare for this eventuality by transitioning to<br />
quantum-safe algorithms before it is too late."<br />
It's a warning that should be borne in mind and acted upon. Better to anticipate the possible<br />
consequences now then try to react after the wheels have come off.<br />
Brian Wall<br />
Editor<br />
Computing Security<br />
brian.wall@btc.co.uk<br />
Published by Barrow & Thompkins<br />
Connexions Ltd (BTC)<br />
35 Station Square,<br />
Petts Wood, Kent, BR5 1LZ<br />
Tel: +44 (0)1689 616 000<br />
Fax: +44 (0)1689 82 66 22<br />
SUBSCRIPTIONS:<br />
UK: £35/year, £60/two years,<br />
£80/three years;<br />
Europe: £48/year, £85/two years,<br />
£127/three years<br />
R.O.W:£62/year, £115/two years,<br />
£168/three years<br />
Single copies can be bought for<br />
£8.50 (includes postage & packaging).<br />
Published 6 times a year.<br />
© 2024 Barrow & Thompkins<br />
Connexions Ltd. All rights reserved.<br />
No part of the magazine may be<br />
reproduced without prior consent,<br />
in writing, from the publisher.<br />
www.computingsecurity.co.uk Sept/Oct 2024 computing security<br />
@CSMagAndAwards<br />
3
Secure systems, secure data, secure people, secure business<br />
Computing Security Sept/Oct 2024<br />
inside this issue<br />
CONTENTS<br />
Computing<br />
Security<br />
NEWS<br />
OPINION<br />
INDUSTRY<br />
COMMENT<br />
CASE STUDIES<br />
PRODUCT REVIEWS<br />
KEEPING IT REAL-TIME<br />
SAFE PAIR OF HANDS?<br />
The goalposts are shifting in<br />
New digital landscape demands ever<br />
pursuit of achieving<br />
faster response to risk<br />
a Zero Trust outcome<br />
LIGHTING THE WAY<br />
New rays of hope may be<br />
on the horizon as a fresh<br />
approach to cybersecurity<br />
starts to filter through<br />
SHARK-INFESTED WATERS<br />
COMMENT 3<br />
Inside quantum research hubs:<br />
from the good to the disturbing<br />
Surge in ransomware attacks puts<br />
the bite on more potential victims<br />
NEWS 6<br />
AI is scammers' best buddy<br />
Total Backup solution totally enhanced<br />
Late disclosure earns rap on knuckles<br />
Onslaught of new fraud campaigns<br />
Critical VMware flaw detected<br />
ICO steps up its wider powers<br />
ARTICLES<br />
KEEPING IT REAL-TIME 18<br />
Managing security threats often hinges on<br />
identifying and responding to risks in real<br />
time. But how does 'real time' work and is<br />
it an end game that’s always achievable?<br />
AI HIGHJACKED 14<br />
NEW ERA OF HOPE 24<br />
With the helter-skelter rise of Artificial<br />
Might the ushering in of a new government<br />
Intelligence revolutionising how we do<br />
signal a fresh approach to cybersecurity?<br />
business and conduct our everyday lives,<br />
fears are raidly growing that cybercriminals<br />
A SUSTAINABILITY MANIFESTO 27<br />
are likely to weaponise the technology to<br />
Steve Mellings of ADISA makes the case<br />
commit bigger, more sophisticated and ever<br />
for why the default position should be to<br />
more dangerous crimes.<br />
promote re-use of redundant equipment<br />
EASING THE MALWARE ANGST 28<br />
Modern-day threats mean the old ways of<br />
protecting against attacks are no longer<br />
SHIFTING THE GOALPOSTS 20<br />
enough. Change must come… and now<br />
Implementing Zero Trust in a complex<br />
RANSOMWARE RAMPAGE 32<br />
infrastructure that includes a mix of legacy<br />
When trying to prevent ransomware<br />
systems, on-premises servers and cloud<br />
strikes, keeping pace with the ingenuity of<br />
services can be a huge challenge. Ensuring<br />
those carrying them out is the challenge<br />
seamless integration and consistent security<br />
policies across all these components requires<br />
PRODUCT REVIEW<br />
constant effort and deep expertise.<br />
BACKBOX NETWORK<br />
AUTOMATION PLATFORM 23<br />
CRIME GANGS AIM TO WIN WITH AI 30<br />
In today's dynamic technological landscape,<br />
BOOK REVIEW<br />
the emergence of Generative Artificial<br />
Intelligence (Generative AI) and its blend<br />
AN HONOURABLE QUEST 26<br />
with deepfake technology has affected<br />
Cybersecurity needs an overarching code<br />
voice, image and video. This amalgamation<br />
of ethics and conduct, argue authors Paul<br />
has opened up a whole new landscape of<br />
J. Maurer and Ed Skoudis<br />
opportunities and risks.<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk<br />
4<br />
BACKLASH ON COMPLIANCE FAILURES 10<br />
Failure to adhere fully to the General Data<br />
Protection Regulation could result in heavy<br />
penalties. A new guide provides a detailed<br />
commentary on the GDPR, explaining the<br />
many changes that you need to make<br />
to your data protection and information<br />
security regimes, in order to comply.
Building cyber security<br />
awareness together.<br />
Leading the way in personalised<br />
cyber security awareness.<br />
Keep your staff engaged, cyber-secure, and compliant with our award-winning,<br />
personalised cyber security training.<br />
Designed with real people and teams in mind, our expertly crafted content transforms<br />
cyber security into an informative and captivating experience. By making learning<br />
fun and impactful, we maximise engagement and enhance staff security behaviour,<br />
ensuring constant vigilance against cyber threats.<br />
Our staff fully engaged with our<br />
security awareness program, with<br />
completion rates over 85%<br />
Best cyber security awareness<br />
platform available
news<br />
TOTAL BACKUP SOLUTION TOTALLY ENHANCED<br />
Hornetsecurity has released an<br />
enhanced version of its 365 Total<br />
Backup solution for Microsoft 365, now<br />
including comprehensive backup and<br />
recovery support for Microsoft Planner.<br />
This upgrade extends Hornetsecurity's<br />
data protection suite, ensuring critical<br />
business data is securely backed up and<br />
recoverable, it states.<br />
The enhancement follows the roll-out of Microsoft's Planner function to manage tasks<br />
and projects. The free update from Hornetsecurity is available for customers on both its<br />
365 Total Backup products and 365 Total Protection (Plans 3 and 4).<br />
The broader scope of protection supports GDPR compliance and adds to the existing<br />
backup and recovery functionality across essential M365 applications, including Mailbox,<br />
OneDrive, SharePoint and Teams.<br />
AI IS SCAMMERS' BEST BUDDY<br />
Anew report from VIPRE highlights the<br />
ingenuity of cyber-criminals in using<br />
AI to evade detection and maliciously<br />
scam individuals and enterprises. The<br />
company processed 1.8 billion emails<br />
globally, detecting 226.45 million spam<br />
emails and 16.91 million malicious URLs<br />
to identify the email threat trends that<br />
impact enterprises the most.<br />
The Q2 2024 Email Threat Trends Report<br />
identifies Business Email Compromise<br />
(BEC) as a major scourge. Nearly half<br />
(49%) of all detected spam emails were<br />
attributed to BEC scams, with the CEO,<br />
followed by HR and IT, being the most<br />
common targets identified.<br />
It takes on a more sinister complexion<br />
when a full 40% of the BEC emails<br />
uncovered were shown to be AIgenerated.<br />
TARDY BREACH DISCLOSURE EARNS RAP ON KNUCKLES<br />
The ICO has reprimanded the Electoral Commission for the<br />
data breach it suffered in 2021, identified in 2022 and<br />
disclosed in 2023. In response, Dominic Trott, director of<br />
strategy and alliances, Orange Cyberdefense, Europe, argues<br />
that, in future, swift public disclosure is crucial to maintaining<br />
trust and allowing individuals to protect themselves.<br />
"It is comforting that the Electoral Commission has<br />
strengthened its security posture since the attack, including<br />
implementing a plan to modernise their infrastructure, as well<br />
as password policy controls and multi-factor authentication<br />
for all users," says Trott. "We can therefore hope that, if it is<br />
targeted again in future, the attack will come to light and be<br />
Dominic Trott<br />
communicated quicker than in this instance."<br />
ONSLAUGHT OF NEW FRAUD CAMPAIGNS<br />
Anew report, the result of continuous investigation by a team<br />
of fraud analysts in the Transmit Security Research Lab, has<br />
revealed how dark web marketplaces and fraud tools have<br />
changed since the release of ChatGPT. Key findings highlight<br />
the powerful capabilities of blackhat generative AI (GenAI)<br />
platforms that fraudsters are said to be using to create new<br />
fraud campaigns at unprecedented levels of sophistication,<br />
speed and scale. "It's easy to find malicious GenAI tools like<br />
FraudGPT and WormGPT, and it's just as easy to use them - to<br />
probe for vulnerabilities, write malicious code, harvest data and<br />
create highly deceptive fraud," says Ido Rozen, security researcher<br />
team lead at Transmit Security. "These tools have no security<br />
Ido Rozen<br />
guardrails and require little to no skills. GenAI has dramatically<br />
lowered the bar for novice fraudsters to churn out more advanced attacks on a global scale."<br />
6<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
news<br />
Sarah Pearce.<br />
ICO STEPS UP ITS WIDER POWERS<br />
Sarah Pearce, partner at Hunton Andrews<br />
Kurth, has proffered her legal firm<br />
expertise regarding the ICO's reprimand of<br />
the Electoral Commission after a cyberattack<br />
compromised its servers (see 'Tardy breach<br />
disclosure earns rap on knuckles', page 6).<br />
"The use of reprimands by the ICO has, in<br />
the past, been controversial, with some<br />
questioning whether in fact the ICO had<br />
properly exercised the use of its powers in<br />
certain instances. One point to note, Recital<br />
148 UK GDPR clearly anticipates the use<br />
of reprimands for "minor infringements,"<br />
says Pearce.<br />
"However, the infringements identified in<br />
the reprimand issued to the Electoral<br />
Commission would appear to be serious -<br />
and with serious impact," she adds.<br />
"The use of reprimands in this context, in<br />
respect of a government agency such as<br />
the Electoral Commission, is in line with<br />
the ICO's revised approach to public sector<br />
enforcement and ICO25, in which the UK<br />
Commissioner John Edwards outlined his<br />
plan to reduce impact of fines on the public<br />
sector and to increase use of the ICO's wider<br />
powers, including reprimands, with fines<br />
being reserved for only the 'most serious<br />
cases'.", she concludes.<br />
DDOS ACTORS 'CAN WREAK HAVOC'<br />
Donny Chong.<br />
The recent Microsoft outage, caused by a DDoS attack<br />
affecting 365 products and Azure, demonstrates the ease<br />
at which DDoS actors can wreak havoc against critical business<br />
services, warns Nexusguard director Donny Chong. "Anyone<br />
can carry out an attack of this magnitude from their own<br />
bedroom, if they have the right equipment," he coments.<br />
"While no company can guarantee the always-on availability<br />
of its cloud services, customers of these services have high<br />
expectations today and that's exactly what attackers are<br />
counting on." The tech community would benefit from<br />
more transparency on how many DDoS attacks companies<br />
thwart and how they mitigate them, adds Chong. "Our data<br />
suggests that attack sizes increased by an average of 183%<br />
last year and 81% of attacks are now shorter than 90 minutes. This shows both the scale of<br />
the task at hand for stretched cybersecurity teams and that attacks are now more efficient<br />
than ever when inflicting disruption on businesses."<br />
CRITICAL VMWARE FLAW DETECTED<br />
Microsoft researchers have found a critical vulnerability in<br />
VMware's ESXi hypervisors. Ransomware operators are<br />
using this to attack systems worldwide. "While the security<br />
advisory for CVE-2024-37085 provided a moderate severity<br />
rating, a CVSSv3 score of 6.8 and Tenable Vulnerability<br />
Prioritization Rating of medium, successful exploitation can be<br />
catastrophic for impacted organisations," says Scott Caveza,<br />
staff research engineer at NASDAQ-listed Tenable. "Microsoft's<br />
analysis of compromised hosts provided valuable insights into<br />
the variety of methods that can be deployed to compromise<br />
ESXi hosts." All new and existing attack methods appear<br />
relatively simple and straightforward to exploit where conditions<br />
exist that allow for exploitation in the first place, he warns.<br />
Scott Caveza.<br />
ONLINE FRAUD IS BATTERING BUSINESSES<br />
Failing to tackle online fraud is increasingly damaging the<br />
brand reputation and the bottom line for thousands of<br />
businesses around the globe, new research reveals. Almost twothirds<br />
of all ecommerce brands (61%) have found themselves at<br />
the centre of highly damaging public media storms when fraud<br />
hits, according to Ravelin's Global Fraud Trends 2024 Survey.<br />
Of those polled, 40% (and 41% in the UK) say their brand image<br />
has been affected by fraudulent activities. This varies by sector -<br />
40% of retailers, 36% of those in travel, 45% in digital goods<br />
and 38% in marketplaces.<br />
"In a highly connected world where reputations can be globally<br />
trashed with just a few keystrokes, brands must do more to<br />
Martin Sweeney.<br />
mitigate against fraud," states Ravelin CEO Martin Sweeney.<br />
8<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
Want to<br />
understand<br />
how to sanitise<br />
media?<br />
Learn more about the NEW international<br />
media sanitisation standard IEEE 2883 from<br />
one of the authors - Jonmichael Hands<br />
conference<br />
conference<br />
2024<br />
2024<br />
17TH OCTOBER 2024 , LONDON<br />
USE PROMO<br />
CODE:<br />
CSMAG FOR<br />
50% OFF!<br />
WWW.ADISA.GLOBAL/ADISACONFERENCE2024/
legal focus<br />
CLAMPDOWN ON COMPLIANCE FAILURES<br />
FAILURE TO COMPLY WITH THE GENERAL DATA PROTECTION REGULATION COULD RESULT IN FINES OF<br />
UP TO €20 MILLION OR 4% OF ANNUAL GLOBAL TURNOVER - AND THE SCREWS ARE BEING TIGHTENED<br />
As most organisations will now be<br />
aware, the GDPR - General Data<br />
Protection Regulation - gives individuals<br />
significant rights over how their personal<br />
information is collected and processed, and<br />
places a range of obligations on organisations<br />
to be more accountable for data protection.<br />
The Regulation applies to all data controllers<br />
and processors that handle EU residents'<br />
personal information. It supersedes the 1995<br />
EU Data Protection Directive and all EU<br />
member states' national laws that are based<br />
on it - including the UK's DPA (Data Protection<br />
Act) 1998.<br />
Failure to comply with the Regulation could<br />
result in fines of up to 20 million euros or<br />
4% of annual global turnover - whichever is<br />
greater. So, this timely guide is a perfect<br />
companion for anyone managing a GDPR<br />
compliance project. It provides a detailed<br />
commentary on the Regulation, explains<br />
the changes you need to make to your data<br />
protection and information security regimes,<br />
and tells you exactly what you need to do to<br />
avoid severe financial penalties.<br />
So, looking at the last completed calendar<br />
year (2023), who was hit with the biggest<br />
fines? In first place, by some measure, was<br />
Facebook owner Meta, with Ireland's Data<br />
Protection Commission imposing a record<br />
$1.2 billion fine in May. "The mammoth<br />
penalty related to the transfer of European<br />
Facebook user data to the United States<br />
without sufficient protection from<br />
Washington's intelligence agencies," says<br />
EQS, cloud provider in corporate compliance,<br />
investor relations and ESG (Environmental,<br />
Social and Governance). Meta was also<br />
ordered to suspend the transfer of user d<br />
ata between the EU and the US within six<br />
months.<br />
As Andrea Jelinek, chair of the European<br />
Data Protection Board, commented at the<br />
time: "The EDPB found that Meta IE's infringement<br />
is very serious, since it concerns transfers<br />
that are systematic, repetitive and continuous.<br />
Facebook has millions of users in Europe, so<br />
the volume of personal data transferred is<br />
massive. The unprecedented fine is a strong<br />
signal to organisations that serious infringements<br />
have far-reaching consequences."<br />
HEAVY HITTING<br />
The Irish Data Protection Commission also<br />
slapped Meta with the second-highest penalty<br />
of 2023 when two fines were imposed on the<br />
company, adding up to a total 390 emillion<br />
euros. And the Irish regulator did not stop<br />
there. It also fined TikTok 345 million euros<br />
after an investigation found that the platform<br />
improperly processed children's data.<br />
TikTok was in the frame again in the UK,<br />
with the Information Commissioner's Office<br />
fining the company 14.5 million euros for<br />
failing to comply with data protection<br />
principles under the GDPR, after it was found<br />
children under the age of 13 were allowed to<br />
create accounts on the platform.<br />
All in all, those who fail to comply with the<br />
Regulation can expect to be held to account<br />
and fined, although not everything in the<br />
GDPR garden is held to be rosy. "In the past<br />
few years, GDPR has also been criticised for<br />
hindering innovation and technology," points<br />
out Legit, a fast-growing EU-based regtech<br />
company and one of the pioneers in the<br />
newly-emerged privacy and personal data<br />
protection area. "For data-driven innovation,<br />
GDPR's restrictions can be particularly<br />
challenging. Companies must be careful<br />
about collecting and using personal data,<br />
which can limit the amount of data<br />
10<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
legal focus<br />
available for research and development,<br />
especially in fields like AI and machine<br />
learning."<br />
Obtaining explicit consent from users is<br />
another hurdle that can complicate or delay<br />
new technological developments. "Startups<br />
and smaller businesses often feel the impact<br />
more acutely, because they have fewer<br />
resources to handle these compliance<br />
requirements. This can create a competitive<br />
disadvantage and act as a barrier to entry<br />
for new players in the market," adds Legit.<br />
On a global scale, GDPR can also<br />
complicate data flows across borders,<br />
hindering international business operations.<br />
Companies outside the EU must also comply<br />
with GDPR, if they deal with EU citizens,<br />
adding another layer of complexity. "Despite<br />
these challenges, GDPR also encourages the<br />
development of privacy-friendly technologies<br />
and the implementation of cybersecurity<br />
measures, and fosters consumer trust,"<br />
says Legit. "The key is balancing protecting<br />
privacy and fostering an environment that<br />
supports technological innovation and<br />
protects individual's rights."<br />
BUSINESSES STRUGGLING<br />
UK businesses are clearly struggling to deal<br />
with mounting data protection regulation<br />
and many are being fined sizable amounts<br />
for compliance violations, according to<br />
Frank Catucci, CTO and head of Security<br />
Research, Invicti. "In fact, the most recent<br />
ISMS report - 'The State of Information<br />
Security Report 2024' - shows that 70% of<br />
those fines were over £100,000. To be fair,<br />
trying to keep an organisation completely<br />
safe and compliant is like trying to hold back<br />
the tide. The unfortunate reality of modern<br />
cybersecurity is that vulnerabilities and bugs<br />
lie deep within the various software components<br />
that businesses rely on. Many of the<br />
challenges that the majority of businesses<br />
face around regulatory and security considerations<br />
are rooted in their software supply<br />
chains," he comments.<br />
Catucci singles out an increasing point of<br />
concern for regulators everywhere. "UK GDPR<br />
makes a point of saying that compliant<br />
organisations must take account of the risks<br />
within their software supply chain. The EU's<br />
NIS2 will come into enforcement in a few<br />
months and makes it clear that organisations<br />
must take into account the security of suppliers<br />
and service providers. Furthermore, the<br />
incoming EU AI act will cement this deeper,<br />
holding every party in the AI supply chain<br />
accountable for failures.<br />
"The UK government is now proposing the<br />
Cyber Security and Resilience Bill, which will<br />
grant new powers to regulators and expand<br />
the scope of existing regulation to, as the<br />
King's Speech announced, 'protect more<br />
digital services and supply chains'. That same<br />
speech cited a June cyberattack on the UK's<br />
NHS, in which ransomware was spread<br />
through a private software provider.<br />
Regulations like these aim to underline the<br />
fact that cybersecurity is an issue of public<br />
safety, as well as private security."<br />
Supply chain security has to be thought<br />
about deeply, if organisations want to<br />
remain compliant, he suggests. "That will<br />
likely start with the thorough scanning and<br />
penetration testing of internal software<br />
systems, and the adoption of Zero Trust<br />
practices when it comes to suppliers and<br />
vendors. Regulators are increasingly focusing<br />
on software supply chains and, if businesses<br />
don't take this seriously, then regulatory<br />
penalties will make them do so."<br />
COMPLIANCE DEFIANCE<br />
Over the past year, more than 99% of UK<br />
businesses have received fines for data<br />
breaches or violation of data protection<br />
rules, according to research into the 'State<br />
of Information Security', by ISMS.online,<br />
the auditor-approved compliance platform.<br />
The findings, if correct, highlight the complexity<br />
of mounting legislation and equally the<br />
challenges that arise from seeking to meet<br />
multiple compliance requirements.<br />
"This year has seen an influx in large scale<br />
breaches and the UnitedHealth Group ransom<br />
attack in April this year is one example of the<br />
huge financial impact these breaches can<br />
have," states ISMS.online. "This attack alone<br />
resulted in the ChangeHealthcare platform<br />
being suspended, with the BlackCat/ALPHV<br />
group claiming it stole 6 TB of data and<br />
resulted in a massive $872 million loss.<br />
"As data breaches continue to surge,<br />
government entities and trade bodies are, in<br />
turn, trying to meet these challenges with<br />
updates and implementation of regulations<br />
and compliance mandates. Equally, businesses<br />
are prioritising cybersecurity. According to the<br />
UK Cybersecurity Breaches survey 2024, threequarters<br />
of businesses (75%) reported that<br />
cybersecurity is a high priority for their senior<br />
management and many organisations have<br />
continued to invest either the same amount<br />
or more in cybersecurity over the last 12<br />
months. This is in part a response to the<br />
perceived increase in the number of cyberattacks<br />
and their sophistication."<br />
Despite continued investment, ISMS.online's<br />
survey of 502 information security professionals<br />
in the UK found that businesses are still<br />
falling foul to data breaches. The average UK<br />
fine for data breaches and violation of data<br />
protection rules now amounts to £257,982.<br />
"That said, only 19% of businesses cite that<br />
their main motivation for compliance and<br />
robust information security is to avoid fines<br />
and penalties. Increased customer demand<br />
(34%), protecting business information (33%)<br />
and remaining competitive (30%) rank as the<br />
top three motivations."<br />
REPUTATION THE BEST ROI<br />
Luke Dash, CEO of ISMS.online, comments:<br />
"Businesses are failing to recognise that<br />
compliance and security come hand in hand<br />
and, if they want to protect their information<br />
and maintain their custom, meeting regulatory<br />
requirements will put them in a good<br />
position to do so. It will also demonstrate<br />
their willingness to put their customers and<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
11
legal focus<br />
Frank Catucci, Invicti: 70% of those fines<br />
imposed for compliance violations were<br />
over £100,000.<br />
Lorraine Mouat, Thistle Initiatives: with such<br />
increased scrutiny, it's crucial that firms are<br />
fully compliant.<br />
their data first. Should a breach occur, this<br />
should ease any financial repercussions, but<br />
will certainly bode well for loyalty and reputation<br />
to enable businesses to remain competitive,<br />
despite any incident and setbacks that<br />
may ensue."<br />
This is supported by the findings, he says,<br />
given that a mere 22% of respondents believe<br />
that complying to avoid fines and penalties<br />
has provided a decent return on their investment<br />
in information security compliance<br />
programmes. The majority cite enhancing<br />
their business reputation as a secure reliable<br />
entity was the best ROI.<br />
"The landscape is certainly changing when it<br />
comes to compliance and fines," adds Dash.<br />
"It is staggering to see that over 99% of<br />
businesses have received fines over the past<br />
12 months, yet it seems that these penalties<br />
are now seen as a small part of the compliance<br />
story. Businesses previously saw<br />
compliance as a way to sidestep hefty fines<br />
and negative publicity; however, as our<br />
research shows, competitive advantage,<br />
reputation and protecting information are<br />
now seen as the main benefits of<br />
compliance."<br />
On a positive note, he says businesses do<br />
seem to be recognising that building effective<br />
information security foundations is essential<br />
for compliance "and it is encouraging to see<br />
that 45% of the ISMS.online survey respondents<br />
noted that their businesses plan to<br />
increase their information security budget by<br />
up to 25% in the coming year to do so. This<br />
provides critical assurances to customers,<br />
shareholders and regulators".<br />
The research also found that current<br />
compliance processes can be demanding<br />
and time-consuming, with over 65% citing<br />
that it took between 6-18 months to meet<br />
compliance with GDPR alone. Similarly, 60%<br />
took the same length of time to comply with<br />
NIST and ISO27701, and 57% struggled to<br />
meet ISO270001 and The Privacy Act,<br />
needing as much as 18 months to do so.<br />
"This is just a snapshot of the legislation<br />
businesses are facing and these rising<br />
regulatory fines, as highlighted by the<br />
ISMS.online research, prove there's still some<br />
way to go. But compliance doesn't need to<br />
be as onerous. As auditors, it's our job to<br />
identify conformity with standards and,<br />
therefore, aid businesses in meeting the<br />
mounting requirements within these to help<br />
them reduce the risk of a breach."<br />
Adds Warwick Tams, head of sales, Alcumus<br />
ISOQAR: "There are solutions now that can<br />
streamline and automate these conformity<br />
audits, reducing manual tasks and enabling<br />
successful audit engagements. Being able to<br />
eliminate the frustration of sorting through<br />
diverse and complex systems and making<br />
audits more straightforward could be the<br />
difference between saving thousands or<br />
losing hundreds of thousands and your<br />
reputation to boot."<br />
MULTIPLE LINES OF FAILURE<br />
Meanwhile, the Financial Conduct Authority<br />
has been exerting increased scrutiny over<br />
financial firms' regulatory compliance, in light<br />
of firms such as AstroPay recently having<br />
restrictions imposed, while operations are<br />
improved.<br />
"These types of restrictions are typically<br />
imposed by the FCA for reasons such as noncompliance<br />
with regulatory requirements,<br />
including operational and governance<br />
weaknesses, financial stability concerns,<br />
consumer protection failures or previous<br />
regulatory breaches," says Lorraine Mouat,<br />
head of payment services at Thistle Initiatives,<br />
the compliance consultancy for financial<br />
service businesses. "It's worth noting that the<br />
FCA has significantly raised the bar since the<br />
requirement for payments firms to be<br />
authorised first came into effect in 2018. As<br />
a result of the supervision work the FCA has<br />
been conducting, we're going to see more<br />
intervention where firms are failing to meet<br />
12<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
legal focus<br />
these now enhanced standards. With such<br />
increased scrutiny, it's crucial that firms are<br />
fully compliant, if they are to avoid constraints<br />
on operations like the ones imposed on<br />
AstroPay."<br />
There are several ways firms can stay on top<br />
of compliance standards, advises Mouat. "For<br />
instance, by actively engaging with regulators<br />
and participating in industry forums, firms can<br />
ensure they stay informed about regulatory<br />
changes and expectations. Internally, it's<br />
important to invest in a strong compliance<br />
infrastructure - hiring experienced compliance<br />
professionals and adopting advanced compliance<br />
technologies. Conducting regular training<br />
for staff on compliance requirements, risk<br />
management and best practices in the<br />
industry is also invaluable."<br />
Additionally, partnering with a compliance<br />
consultancy means firms can benefit from<br />
tailored guidance and support aligned with<br />
their specific business models, as well as<br />
practical solutions that reflect their real needs.<br />
"Partnerships like this are key to ensuring firms<br />
are always moving forward with the everchanging<br />
regulatory environment."<br />
BIG CHALLENGES<br />
All too clearly, data protection regulations<br />
like the GDPR pose significant challenges for<br />
businesses. "Despite Brexit, the UK adheres to<br />
GDPR principles through its version, the UK<br />
GDPR," says Gareth Owen, director, Redkey<br />
USB. "Reports reveal over 99% of UK businesses<br />
faced fines for data breaches or<br />
violations of data protection rules last year,<br />
highlighting the urgent need for robust data<br />
protection measures. While this figure seems<br />
exceptionally high and warrants scrutiny, it<br />
underscores the critical importance of<br />
compliance."<br />
One effective way to ensure compliance is<br />
by securely erasing data from storage devices<br />
before they are sold or recycled. "Simply<br />
deleting files or using free software is<br />
insufficient for GDPR standards, as these<br />
methods leave sensitive information<br />
vulnerable to unauthorised access. Certified<br />
secure data-wiping solutions are essential,<br />
adhering to international standards and<br />
providing a reliable method for completely<br />
removing all data from a device. These<br />
tools securely overwrite the data and verify<br />
the erasure, ensuring no trace of the<br />
original data remains."<br />
For businesses with IT personnel, Owen<br />
adds, it is crucial to avoid inadequate datawiping<br />
methods. "Free software may seem<br />
convenient, but lacks the necessary security<br />
measures and certifications required for<br />
regulatory compliance. Certified datawiping<br />
solutions offer detailed erasure<br />
reports, serving as vital evidence of compliance<br />
for audits and regulatory reviews.<br />
However, not all companies have dedicated<br />
IT personnel. Small businesses often rely on<br />
individuals with basic computer knowledge,<br />
but without formal IT security qualifications.<br />
There's a common misconception<br />
that simply resetting the device or using<br />
a restore function is sufficient for data<br />
protection, but these methods do not<br />
provide the thorough data erasure needed<br />
to ensure regulatory compliance, leaving<br />
sensitive information at risk of recovery."<br />
Whether data erasure is performed inhouse<br />
or outsourced, the key is to use<br />
certified secure data wiping tools, he<br />
argues. "When outsourcing, ensure the<br />
third-party service uses certified tools and<br />
processes. Implementing a secure data<br />
disposal policy is not just about avoiding<br />
fines; it's about protecting the integrity and<br />
trust of the business. Customers and clients<br />
need to be confident their data is handled<br />
with the utmost care, even at the end of its<br />
lifecycle.<br />
"By using certified secure data-wiping<br />
solutions, businesses can uphold their<br />
commitment to data privacy and security,<br />
maintaining their reputation in an<br />
increasingly security-conscious market."<br />
Gareth Owen, Redkey: certified datawiping<br />
solutions offer detailed erasure<br />
reports, serving as vital evidence of<br />
compliance.<br />
Luke Dash, ISMS.online: most respondents<br />
said enhancing their business reputation as<br />
a secure reliable entity was the best ROI.<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
13
AI cybercrime<br />
AI HIGHJACKED<br />
UNEASE IS SPREADING THAT CYBERCRIMINALS WILL COMMANDEER AI TO<br />
COMMIT BIGGER, MORE SOPHISTICATED AND MORE DANGEROUS CRIMES<br />
With the rise of Artificial Intelligence<br />
revolutionising how we do business<br />
and conduct our everyday lives,<br />
fears are growing that cybercriminals are<br />
likely to weaponise the technology to commit<br />
bigger, more sophisticated and more<br />
dangerous crimes.<br />
In new research, 78% of the chief internal<br />
auditors who were questioned believe AI<br />
will negatively impact cybersecurity and data<br />
security, while 58% say it will exacerbate<br />
fraud, underscoring the growing concern<br />
amongst business leaders about the risks<br />
associated with AI.<br />
Organisations are being advised that, in<br />
preventing AI-powered attacks, they will<br />
increasingly need to deploy the same AI<br />
tools as part of their cyber defences, with<br />
the best defence against AI-powered<br />
cybercrime often being AI-powered<br />
cybersecurity solutions themselves. For<br />
example, some AI cybersecurity tools<br />
can detect ransomware in seconds.<br />
Internal audit, it is argued, can play a key<br />
role in supporting boards and senior<br />
management to raise the AI cybersecurity<br />
bar across the organisation by making<br />
recommendations and advising on improving<br />
cyber controls and defences. Anne Kiem,<br />
chief executive of the Chartered Institute of<br />
Internal Auditors, notes how AI, as with all<br />
new technologies. can be used for positive<br />
and negative reasons. "Our research has<br />
shown that chief internal auditors are alert<br />
to the threats and this should bring some<br />
comfort to those organisations that have<br />
a strong focus on risk control, risk mitigation<br />
and having a well-resourced internal audit<br />
function. Internal auditors remain a force<br />
for good."<br />
How much does this anxiety about the<br />
weaponising of AI coalesce with the views<br />
of those across the security industry?<br />
Substantially, as far as Carlos Arnal, product<br />
marketing manager at WatchGuard<br />
Technologies, is concerned. "Despite efforts<br />
by commercial generative AI tools like<br />
ChatGPT to implement safeguards against<br />
malicious use, hackers have found ways<br />
to exploit these technologies," he confirms.<br />
"Emerging alternatives, such as WormGPT, are<br />
also being weaponised by malicious actors."<br />
THREAT TECHNIQUES<br />
The most common AI-supported threat<br />
techniques he identifies include:<br />
AI-generated phishing campaigns:<br />
Generative AI has transformed phishing<br />
campaigns, enabling hackers to create<br />
more convincing texts that are harder<br />
to detect, thus making these campaigns<br />
more effective and time-efficient<br />
AI-assisted target research: machine<br />
learning algorithms analyse social media<br />
and other online data to gather valuable<br />
information about targets, such as their<br />
interests, habits and vulnerabilities<br />
Intelligent vulnerability detection:<br />
AI-enabled reconnaissance tools can<br />
automatically scan corporate networks<br />
for vulnerabilities and select the most<br />
effective exploits<br />
Intelligent data filtering: during an attack,<br />
AI selectively extracts only the most<br />
valuable information, making it harder<br />
to detect the breach<br />
AI-powered social engineering: AI can<br />
generate deepfake audios or videos that<br />
mimic trusted individuals in vishing<br />
attacks, increasing the credibility of the<br />
attack and persuading employees to<br />
disclose sensitive information.<br />
"The complexity of AI-driven cyberattacks<br />
necessitates robust defence mechanisms,"<br />
advises Arnal. "Advanced endpoint security<br />
is crucial in this defence and organisations<br />
should implement solutions that incorporate<br />
AI capabilities to prevent, detect and respond<br />
to these threats." An advanced endpoint<br />
security solution with AI technology can:<br />
Detect emerging threats: utilise<br />
behavioural analysis and machine learning<br />
to identify and block new and evolving<br />
malware. These solutions can also assist<br />
with patching to eliminate potential<br />
vulnerabilities within a network<br />
Minimise the risk of data breaches:<br />
prevent sensitive data leaks from<br />
14<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
AI cybercrime<br />
successful phishing campaigns or malware<br />
attacks, thereby avoiding financial loss,<br />
erosion of customer confidence and<br />
reputational damage<br />
Contribute to regulatory compliance:<br />
many industries are legally required to use<br />
advanced protection against malware.<br />
Non-compliance can result in fines and<br />
other legal repercussions.<br />
While businesses thrive in the digital age,<br />
with more organisations adopting hybrid<br />
work environments to enhance employee<br />
well-being and productivity, "cybersecurity<br />
teams face significant challenges, including<br />
heavy workloads and the risk of burnout,"<br />
warns Stephen Amstutz, director of<br />
innovation at Xalient. "The use of digital<br />
transformation and cloud-based technologies<br />
has made organisations more complex and<br />
heavily reliant on their networks. Thus,<br />
security breaches can dramatically impact<br />
operations and productivity. The increase in<br />
attack surfaces, along with a rise in AI related<br />
cyberattacks, is putting immense pressure on<br />
cybersecurity professionals. A recent report by<br />
Hack the Box highlights the toll on mental<br />
health and its cost to UK companies - $130<br />
million in lost productivity, due to sick days<br />
from work-related stress."<br />
AI offers a promising solution for these<br />
challenges, he states. "AI-powered software<br />
that monitors networks using artificial<br />
intelligence and analytics can detect issues<br />
and potential threats before they become<br />
apparent to employees and automatically<br />
rectify low-level issues. This technology not<br />
only frees up cybersecurity professionals to<br />
tackle high-level threats and projects, but also<br />
acts as a reliable team member that ensures<br />
operational efficiency and higher productivity.<br />
This supports existing teams in their workflow<br />
and contributes positively to employee<br />
experience."<br />
As we continue to see advancement on<br />
improving employee experiences, it's crucial<br />
for companies to regard their cybersecurity<br />
teams as valuable assets worth investing in.<br />
"AI software emerges as a key player in this<br />
context," adds Amstutz, "serving as both a<br />
protective measure against cybersecurity<br />
threats and a supportive colleague, with the<br />
added benefit of enhanced cybersecurity and<br />
supported career progression."<br />
AI WINS WIDE ENDORSEMENT<br />
Rather than being distracted by negative<br />
headlines, a new survey conducted by Jitterbit<br />
found that office workers see beyond the AI<br />
hype. "Employees across the US and UK see<br />
AI as a strategic tool that can be used for:<br />
learning new skills, automating processes and<br />
outsourcing routine tasks to focus on more<br />
strategic efforts," says Bill Conner, the<br />
company's CEO. "AI is changing the world.<br />
However, its implementation remains an<br />
evolution, not a revolution - with business<br />
introductions needed to occur gradually, in<br />
order to foster the best outcomes."<br />
Many office workers are embracing the<br />
potential for job augmentation and<br />
optimisation - seeing AI as an enabler of<br />
professional growth, he adds. "We are now<br />
witnessing the majority of workers view AI<br />
as a way to enhance their professional skills,<br />
reflecting broad acceptance and excitement<br />
about the technology. This sentiment is<br />
particularly strong among younger workers,<br />
who view AI as a valuable educational<br />
resource, with top skills they want to learn<br />
through AI including analytical and statistical<br />
skills, financial management skills, and coding<br />
and development."<br />
However, it's notable that a significant<br />
number of office workers are not concerned<br />
about AI replacing human jobs, despite the<br />
fears often aired. "This indicates a growing<br />
understanding of AI as a tool that complements<br />
human efforts, rather than competing<br />
with them," comments Conner.<br />
The top anticipated benefits of AI include<br />
reducing time spent gathering information<br />
from work systems and applications,<br />
increasing time for thoughtful work and<br />
providing more time for larger projects.<br />
"While office workers seem often to get<br />
caught up in the pursuit of AI, seeing it as a<br />
'silver bullet' that promises maximum gains in<br />
time, money and productivity, instead the<br />
technology needs to be implemented within<br />
their jobs strategically where it adds the most<br />
value, in order to garner the biggest returns.<br />
This approach mitigates risks and ensures a<br />
smoother transition to a more efficient work<br />
environment."<br />
Overall, office workers are not only ready<br />
to embrace AI, but also eager to harness<br />
its potential for professional growth and<br />
efficiency, he adds. "This pragmatic approach<br />
to AI adoption ensures that it becomes a<br />
valuable tool for job augmentation and<br />
optimisation, paving the way for a future<br />
where human ingenuity and AI capabilities<br />
work hand in hand."<br />
DEEP FAKES, DEEP CONCERN<br />
Basil Philipsz, CEO, Distributed Management<br />
Systems, believes the advancement of deep<br />
fakes makes biometric authentication weaker,<br />
due to the ability of sophisticated AIgenerated<br />
media to convincingly replicate<br />
physical traits, such as facial features, voices<br />
and even behavioural patterns. "Deep fakes<br />
can create realistic images and videos of<br />
individuals, potentially allowing attackers<br />
to spoof biometric systems that rely on facial<br />
recognition, voice recognition or other<br />
biometric data. This undermines the reliability<br />
of biometric authentication, as the systems<br />
may be tricked into granting access based<br />
on these forged credentials."<br />
Industry leaders and cybersecurity experts<br />
have highlighted these concerns, he adds.<br />
"Gaelan Woolham from Capco points out<br />
that deepfake technology can mimic voices<br />
and faces with high fidelity, making it<br />
challenging for existing biometric systems to<br />
distinguish between real and fake identities.<br />
This technology can bypass voice biometric<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
15
AI cybercrime<br />
Anne Kiem, Chartered Institute of<br />
Internal Auditors: internal audit can play<br />
a key role in supporting boards and<br />
senior management to raise the AI<br />
cybersecurity bar.<br />
Stephen Amstutz, Xalient: an increase in<br />
attack surfaces, along with a rise in AI<br />
related cyberattacks, is putting immense<br />
pressure on cybersecurity professionals.<br />
systems used by financial institutions, as<br />
demonstrated by a University of Waterloo<br />
study, which showed that deepfakes could<br />
fool such systems in a few attempts." He also<br />
references security company Sensity, which<br />
tested facial recognition systems and<br />
demonstrated that deepfake technology<br />
could easily bypass liveness detection-a<br />
critical component of facial recognition<br />
security. "Liveness detection typically relies on<br />
recognising natural human behaviours, like<br />
blinking and subtle facial movements, but<br />
deepfakes can replicate these actions<br />
convincingly," says Philipsz.<br />
The recent significant development is the<br />
easy deployment by non-experts; making it<br />
easier for individuals to create realistic fake<br />
videos and images, including those used<br />
for biometric cloning. "The availability of<br />
sophisticated yet user-friendly applications,<br />
such as FakeApp, ReFace and DeepFaceLab,<br />
has democratised access to deepfake creation<br />
tools, allowing even non-experts to produce<br />
convincing fakes."<br />
Deepfakes can pose serious threats to<br />
biometric authentication systems, especially<br />
those that rely on facial recognition. "These<br />
attacks can be categorised into presentation<br />
attacks, where fake images or videos are<br />
presented to a camera or sensor, and<br />
injection attacks, where data streams or<br />
communication channels are manipulated."<br />
Examples of deepfake attacks include face<br />
swapping, lip-syncing and gesture or expression<br />
transfer, all of which can deceive<br />
biometric systems.<br />
ROBUST API SECURITY<br />
APIs are the backbone of AI systems,<br />
facilitating data ingestion, interoperability<br />
and service delivery, says Jamie Beckland,<br />
chief product officer at APIContext. "They<br />
enable seamless integration with various data<br />
sources, allowing AI models to access and<br />
process large volumes of data in real time."<br />
APIs also ensure AI systems can interact with<br />
other services, databases and applications<br />
effectively. This interoperability is crucial for<br />
the scalability and flexibility of AI systems.<br />
However, APIs also represent potential points<br />
of vulnerability where cybercriminals can<br />
launch attacks, making robust API security<br />
indispensable. "Since APIs are so critical to AI<br />
operations, they create choke points that<br />
cybercriminals can exploit. The risk is<br />
compounded by the fact cybercriminals are<br />
now building and using their own AI tools to<br />
automate and enhance attacks. These tools<br />
can identify and exploit API vulnerabilities,<br />
such as weak authentication, inadequate<br />
encryption and insufficient input validation."<br />
To mitigate these risks, application owners<br />
must implement protective measures," states<br />
Beckland. "Ensuring strong authentication<br />
and authorisation, such as multi-factor<br />
authentication [MFA] and OAuth standards,<br />
is crucial to allow only authorised access.<br />
Data encryption, both in transit and at rest,<br />
protects sensitive information during API<br />
communication. Implementing rate limiting<br />
and throttling helps prevent abuse and<br />
mitigates the impact of automated AI-driven<br />
attacks. Comprehensive input validation and<br />
sanitisation prevent injection attacks and<br />
malicious data manipulation.<br />
"Also, we recommend that teams use an<br />
automated tool to ensure API conformance<br />
to design specifications, as around 80% of<br />
API attacks stem from misconfigurations."<br />
AI tools are particularly vulnerable to Broken<br />
Object Level Authorization (BOLA) attacks, he<br />
adds. "In these attacks, cybercriminals exploit<br />
insufficient authorisation mechanisms to<br />
access or manipulate data that should be<br />
restricted. Since so much personalised data<br />
is available through AI tools, the risks of<br />
unauthorised access is higher than with<br />
other, more static, systems.<br />
As cyber attackers increasingly leverage AI<br />
to enhance attacks, securing APIs becomes<br />
even more critical. "APIs can hold the<br />
defensive line against malicious AI systems."<br />
16<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
eal-time threats<br />
KEEPING IT REAL-TIME<br />
IN TODAY'S DIGITAL LANDSCAPE, MANAGING SECURITY THREATS OFTEN HINGES ON<br />
HOW WELL ORGANISATIONS CAN IDENTIFY AND RESPOND TO RISKS IN REAL TIME<br />
Identifying and responding to security<br />
threats in real time is crucial. Organisations<br />
often struggle with managing<br />
these threats, due to the inevitability of<br />
human errors. If unnoticed, these can lead<br />
to substantial and punitive security incidents.<br />
But how exactly does 'real time' work and is<br />
it always achievable? And is real time as<br />
'real' as some might argue when it comes<br />
to achieving its lofty aspirations?<br />
In today's digital landscape, managing<br />
security threats often hinges on how well<br />
organisations can identify and respond<br />
to risks in real time. "While human errors<br />
are bound to happen, with the right<br />
technologies and processes, they don't<br />
always have to pose a significant risk,"<br />
says John Scott, lead security researcher at<br />
CultureAI. "Unfortunately, when people make<br />
mistakes, they often go unnoticed until they<br />
result in an incident. This is where nudges<br />
can help, filling a crucial gap by intervening<br />
in risky behaviours<br />
automatically and efficiently. A well-executed<br />
security nudge can reduce Security Operation<br />
Centre (SOC) interventions and remediation<br />
times, while reinforcing security policies,<br />
security culture and best practices."<br />
What exactly is a nudge? "Nudge Theory,<br />
popularised by Richard Thaler and Cass<br />
Sunstein in 2008, gained prominence as<br />
a cheap and effective method to influence<br />
behaviour change," he continues. "The<br />
premise of this concept is that shaping the<br />
environment, known as choice architecture,<br />
influences individuals' decision-making, and<br />
allows them to maintain freedom of choice<br />
and feel in control of their decisions, whilst<br />
being guided towards the 'best' solution."<br />
The term 'nudge' has become a buzzword<br />
in cyber security over recent years, often<br />
mistakenly equated with 'notifications'.<br />
"While nudges can be used in different ways,<br />
overreliance can lead to 'nudge fatigue',<br />
overwhelming employees with dismissible<br />
reminders and notifications to<br />
complete training. To<br />
make best use<br />
of them,<br />
nudges should aim to shift behaviours rather<br />
than simply notifying an employee of their<br />
actions."<br />
Why do we need nudges in cyber security?<br />
"When people are busy, they tend to be<br />
reactive and reliant on system-one thinking,<br />
which is automatic and intuitive, but more<br />
prone to errors," says Scott. "By sending<br />
a security nudge to employees at the point<br />
of risk, they are alerted in real time and<br />
prompted to shift to more logical, lower-risk,<br />
system-two thinking. Incorporating nudges<br />
as part of a human risk management (HRM)<br />
strategy is an effective way to mitigate<br />
risks in real time, empowering employees<br />
precisely when it matters most. Nudges<br />
encourage employees to pause and think<br />
before making potentially risky security<br />
decisions, making them aware of the threat<br />
and empowering them to choose wisely."<br />
However, nudging employees does come<br />
at something of a cost. "Interrupting their<br />
workflow can hamper productivity, so a<br />
nudge must have a strong rationale. If you<br />
interrupt, there should be a specific, actionable<br />
step the employee can take to mitigate<br />
the identified risk. If the security team can fix<br />
the risk without interruption, they should.<br />
Repetitive or intrusive nudges will lead to<br />
nudge fatigue, causing employees to ignore<br />
them," he advises.<br />
To ensure a nudge isn't ignored,<br />
Scott recommends delivering it<br />
within the applications that<br />
employees are already<br />
using, such as Slack,<br />
Teams or their browser.<br />
"Over time, nudges<br />
simplify decision-making<br />
for employees, requiring<br />
18<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
eal-time threats<br />
minimal cognitive effort to execute decisions<br />
without overthinking."<br />
Also, rather than just leaving employees<br />
to navigate the safe use of SaaS and GenAI<br />
apps on their own, nudges can help<br />
establish guardrails and provide guidance in<br />
real time. "For example, if the organisation<br />
has an approved GenAI solution, a good<br />
nudge can not only dissuade employees<br />
from using non-authorised sources, but it<br />
can also guide them towards a preferred<br />
solution," Scott adds. "Nudges can help<br />
create a cultural shift towards proactive<br />
and engaged participation in cyber security<br />
practices. This approach not only streamlines<br />
security operations, but also creates an<br />
environment where employees are<br />
empowered to make their own security<br />
decisions."<br />
POSITIVES AND NEGATIVES<br />
Kennet Harpsoe, lead security researcher,<br />
Logpoint, flags up how "real-time protection<br />
sees the constant surveillance of systems and<br />
networks to detect anomalies and suspicious<br />
activities; automated detection, using AI and<br />
machine learning (ML) to identify potential<br />
threats based on patterns and behaviours;<br />
and rapid response to contain and neutralise<br />
threats. It can, for example, quickly detect<br />
the active encryption of a machine by ransomware<br />
or abnormal outbound traffic patterns,<br />
indicating potential data exfiltration, and<br />
trigger immediate response actions to stop<br />
the data breach".<br />
Human errors, such as misconfigurations,<br />
oversight and delayed responses, can all<br />
create vulnerabilities. "It can be complex to<br />
manage across large disparate networks and<br />
scalability issues often arise, complicating the<br />
deployment of consistent security measures,"<br />
he cautions. "Automated systems can also<br />
generate false positives [benign activities<br />
flagged as threats] and false negatives<br />
[actual threats going undetected], which<br />
can undermine trust in the system. While<br />
advances in technology have made real-time<br />
more feasible, it is not always achievable.<br />
Latencies in detection and response,<br />
integration issues and the sophistication<br />
of modern threats can impede true realtime<br />
protection. These systems also require<br />
significant investment and resources, skilled<br />
personnel and maintenance."<br />
To achieve real-time protection, says<br />
Harpsoe, a robust monitoring infrastructure<br />
is needed, comprising advanced monitoring<br />
tools capable of real-time data analysis and<br />
threat detection over all network segments.<br />
"Automated and adaptive systems are a<br />
must, but consider also the human element<br />
by training IT staff to recognise and respond<br />
to threats. Keep security systems updated<br />
with the latest threat intelligence. And<br />
streamline incident response by developing<br />
and updating IR plans, and conducting drills<br />
and simulations to ensure readiness."<br />
Where real-time can go wrong, he points<br />
out, is through inadequate preparation,<br />
an overreliance on technology and by<br />
ignoring emerging threats. "Lack of thorough<br />
preparation and planning can lead to gaps<br />
in real-time protection and, while technology<br />
is essential, so, too, is human oversight to<br />
manage and mitigate unforeseen issues.<br />
Failing to keep up with an evolving threat<br />
landscape can also render real-time systems<br />
ineffective. Many current real-time protection<br />
systems rely upon simple Indicators of<br />
Compromise [IoC], with all of their inherent<br />
problems, which sees their usefulness decay<br />
as rapidly as the IoC."<br />
While achieving true real-time protection<br />
is challenging, it's a worthwhile goal, he<br />
insists, as implementing robust monitoring,<br />
leveraging automation and maintaining<br />
constant vigilance can greatly enhance an<br />
organisation's security posture. "However,<br />
it is crucial to recognise the limitations and<br />
continuously improve processes to adapt<br />
to the ever-changing threat landscape.<br />
Real-time protection will probably never<br />
be completely autonomous."<br />
John Scott, CultureAI: nudges can help<br />
create a cultural shift towards proactive<br />
and engaged participation in cyber<br />
security practices.<br />
Kennet Harpsoe, Logpoint: real-time can go<br />
wrong through inadequate preparation, an<br />
overreliance on technology and by ignoring<br />
emerging threats.<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
19
zero trust<br />
SHIFTING THE GOALPOSTS<br />
SHIFTING FROM A LOCATION-CENTRIC MODEL TO A MORE DATA-CENTRIC APPROACH, IN PURSUIT OF<br />
A ZERO TRUST SOLUTION, IS A COMPLEX UNDERTAKING, DEMANDING SIGNIFICANT EFFORT AND EXPERTISE<br />
Digital environments are more complex<br />
than ever and threats are becoming<br />
increasingly sophisticated by the day,<br />
warns Andy Syrewicze, security evangelist,<br />
Hornetsecurity. "One framework to address<br />
this is Zero Trust - an approach that follows<br />
the mantra of 'never trust, always verify'.<br />
However, it requires total buy-in from<br />
everyone in an organisation and represents<br />
a significant investment in cybersecurity<br />
technology and training."<br />
How does Zero Trust help bolster defences?<br />
"It assumes that threats exist inside and<br />
outside an organisation's network. Every<br />
access request must be authenticated,<br />
authorised and encrypted, regardless of<br />
source. This ensures internal systems<br />
remain protected, even if a network is<br />
compromised."<br />
The current threat landscape is volatile and<br />
evolving, highlighting the importance of Zero<br />
Trust, he says. "High-profile incidents, such as<br />
the recent attack on Ticketmaster, illustrate<br />
how even large, financially robust, companies<br />
can be vulnerable. Advancements in technologies,<br />
like generative AI, have also<br />
expanded the pool of potential attackers,<br />
making it increasingly difficult to stay ahead<br />
of threats. Zero Trust limits the potential<br />
damage from AI-enabled threats - as well as<br />
ransomware and other traditional attacks -<br />
by continuously verifying the legitimacy of<br />
requests."<br />
How can firms apply a Zero Trust approach?<br />
"Organisations should start by verifying<br />
everything, ensuring every authentication<br />
request and connection is checked," advises<br />
Syrewicze. "Implementing 'least privilege<br />
access' means that, once a user is connected<br />
to a service or data, they only have the access<br />
they need. This involves mapping out all<br />
sensitive information and deciding who<br />
requires access. Multi-factor authentication<br />
[MFA] can also be used to ensure only verified<br />
users gain access, with regular audits, reviews<br />
and updates to maintain this level of security."<br />
Another key component he singles out is<br />
micro-segmentation, which divides a network<br />
into smaller, isolated segments. "This prevents<br />
attackers from moving within a company's<br />
network, containing potential breaches.<br />
Advanced monitoring tools should be<br />
implemented to track activity and identify<br />
anomalies, with automated responses in<br />
place to rapidly address issues."<br />
Syrewicze stresses how organisations should<br />
always be prepared for a breach and have<br />
strong security tools in place to catch<br />
intruders before they penetrate too far<br />
into the network. "Employees are pivotal<br />
in defending against cyber threats, and<br />
comprehensive cyber-awareness training<br />
solutions, such as Hornetsecurity's Security<br />
Awareness Service, [which provides<br />
automated ongoing training and phishing<br />
simulations], are essential. Our recent<br />
research revealed 25.7% of organisations<br />
do not provide IT security awareness training<br />
to end users."<br />
Educating employees on recognising and<br />
responding to phishing attempts and other<br />
social engineering tactics is vital, he adds, and<br />
education should be ongoing to keep pace<br />
with evolving threats. "Training on recovery<br />
processes is also crucial. Employees, IT staff<br />
20<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
zero trust<br />
and key stakeholders need to know how to<br />
restore data efficiently from backups during<br />
a cyber incident and bring critical business<br />
processes back online."<br />
EFFORT AND EXPERTISE<br />
All too clearly, implementing Zero Trust in<br />
a complex infrastructure that includes a mix<br />
of legacy systems, on-premises servers and<br />
cloud services can be extremely challenging.<br />
Ensuring seamless integration and consistent<br />
security policies across all these components<br />
requires significant effort and expertise.<br />
"Moving from a traditional security mindset<br />
to a Zero Trust approach is often met with<br />
resistance within an organisation," says<br />
macmon secure. "Employees and stakeholders<br />
may be accustomed to more lenient<br />
access controls and may find the rigorous<br />
verification processes of Zero Trust<br />
cumbersome.<br />
"The initial stages of implementing Zero<br />
Trust can put a strain on an organisation's<br />
resources. This includes the financial cost<br />
of new technologies, the time required for<br />
planning and deployment, and the need for<br />
skilled personnel to manage the transition.<br />
Achieving the level of visibility required<br />
for effective Zero Trust can be difficult.<br />
Organisations need to continuously monitor<br />
and analyse data flows to ensure that access<br />
controls are being enforced correctly and<br />
to detect anomalies that could indicate a<br />
security threat. Constantly verifying users and<br />
devices can potentially slow down network<br />
performance. This is particularly challenging<br />
in environments where high-speed access to<br />
data and applications is critical."<br />
Adopting a Zero Trust posture requires<br />
a fundamental change in the way an<br />
organisation views cybersecurity. It means<br />
moving away from the assumption that<br />
internal networks are inherently secure and<br />
instead treating every access request with<br />
suspicion, the network security software<br />
company advises. This shift requires:<br />
Ongoing education and training: ensuring<br />
that all employees understand the<br />
importance of Zero Trust and are trained<br />
in best practices<br />
Executive buy-in: gaining the support of<br />
senior management to drive the cultural<br />
change required for successful<br />
implementation<br />
Ongoing adaptation: continually evolving<br />
security policies and practices to address<br />
new threats and vulnerabilities as they<br />
emerge.<br />
Says Heiko Fleschen, head of marketing,<br />
macmon secure: "We have adopted a Zero<br />
Trust Network Access approach to help<br />
organisations achieve a robust Zero Trust<br />
posture. Our strategy focuses on ensuring<br />
that only authenticated and authorised users<br />
and devices can access network resources,<br />
thereby minimising the risk of unauthorised<br />
access and potential breaches."<br />
STRATEGY RETHINK<br />
The shift towards Zero Trust architecture<br />
represents one of the most significant<br />
changes in recent years, confirms Denny<br />
LeCompte, CEO of Portnox. "The US Cyber<br />
Defense Agency's emphasis on a data-centric,<br />
rather than a location-centric, approach<br />
underscores the necessity of rethinking our<br />
security strategies in a world where traditional<br />
network perimeters no longer exist.<br />
Zero Trust is fundamentally about enforcing<br />
accurate, least privilege per-request access<br />
decisions in information systems and services,<br />
treating the network as if it is already<br />
compromised. This paradigm shift requires<br />
a comprehensive understanding of every user,<br />
system, data point and asset within an<br />
organisation."<br />
To transition to a Zero Trust model, he<br />
states, an organisation must first achieve<br />
comprehensive visibility into its network. This<br />
involves deploying advanced monitoring tools<br />
that can continuously assess the behaviour of<br />
users and devices and identify anomalies that<br />
could indicate potential threats. "However,<br />
the transition to Zero Trust is not merely<br />
a technological upgrade; it demands a<br />
fundamental change in an organisation's<br />
philosophy and culture around cybersecurity.<br />
Implementing Zero Trust also requires<br />
collaboration across various departments.<br />
IT, security and business units must work<br />
together to identify critical assets, understand<br />
their value and determine the appropriate<br />
level of access needed for different users."<br />
The journey to a Zero Trust posture involves<br />
several key steps, saysLeCompte. "First, assessment<br />
and planning are crucial, requiring<br />
a thorough evaluation of the current security<br />
posture to identify gaps and areas for<br />
improvement. Implementing robust identity<br />
verification processes, such as passwordless<br />
certificate-based authentication, ensures that<br />
only authorised users can access sensitive<br />
information.<br />
"Network segmentation is another vital<br />
step, which involves dividing the network<br />
into smaller segments to limit the lateral<br />
movement of attackers, with each segment<br />
having its own security controls and policies.<br />
Continuous monitoring through tools like<br />
Network Access Control (NAC) and application<br />
conditional access is essential for realtime<br />
visibility into resource access, device<br />
posture and potential risk, and enables<br />
prompt threat detection and response."<br />
Developing and enforcing granular security<br />
policies, based on the principle of least<br />
privilege, ensures that users have only the<br />
access they need to perform their tasks and<br />
adapts to the changing environment.<br />
FUNDAMENTAL SHIFT<br />
Rich Hall, AVP technical sales, DigiCert,<br />
says Zero Trust requires a comprehensive<br />
understanding of the organisation's assets<br />
and how they interact. "This visibility is crucial<br />
for developing, implementing, enforcing and<br />
evolving security policies. However, achieving<br />
Zero Trust goes beyond technical changes -<br />
it requires a cultural and philosophical<br />
transformation within the organisation."<br />
From DigiCert's perspective of 'Digital trust<br />
for the real world', this cultural shift is<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
21
zero trust<br />
Rich Hall, DigiCert: Zero Trust requires<br />
a comprehensive understanding of the<br />
organisation's assets and how they<br />
interact.<br />
Heiko Fleschen, macmon secure: the<br />
objective is to help organisations achieve<br />
a robust Zero Trust posture.<br />
essential, he adds. "Digital trust extends<br />
beyond merely securing transactions and<br />
communications; it involves creating an<br />
environment where security is integral to<br />
every operation and interaction within<br />
the organisation. To foster this environment,<br />
organisations must commit to<br />
transparency, continuous monitoring<br />
and dynamic response strategies.<br />
"The transition to Zero Trust begins<br />
with educating all stakeholders about<br />
the importance and implications of this<br />
model. Employees, partners and customers<br />
must understand that security<br />
is not just an IT concern, but a shared<br />
responsibility. Training programmes and<br />
awareness campaigns can help cultivate<br />
a security-first mindset across the<br />
organisation."<br />
Next, organisations need to re-evaluate<br />
their existing security policies and access<br />
controls to ensure the principle of least<br />
privilege, in order to minimise the risk<br />
of insider threats and lateral movement<br />
by attackers within the network. "Implementing<br />
Zero Trust also involves deploying<br />
advanced technologies, such as multifactor<br />
authentication [MFA], identity<br />
and access management [IAM], and<br />
continuous monitoring tools," Hall states.<br />
"These technologies provide the granular<br />
control and visibility needed to enforce<br />
Zero Trust principles effectively. Also,<br />
organisations should leverage artificial<br />
intelligence and machine learning to<br />
detect anomalies and respond to threats<br />
in real time."<br />
However, technology alone is insufficient.<br />
"A successful Zero Trust strategy requires<br />
ongoing collaboration between IT, security<br />
teams and other business units. Regular<br />
audits, policy reviews and simulations of<br />
potential attack scenarios can help ensure<br />
that the Zero Trust framework remains<br />
robust and adaptive to new threats."<br />
SOLID FOUNDATION<br />
Cybercriminals are not new and often neither<br />
are their tactics, comments David Morimanno,<br />
thought leader at Xalient. "Despite this, phishing<br />
attacks continue to be highly successful.<br />
New technologies, such as GenAI, are further<br />
improving these tactics and companies must<br />
implement a strategic approach that’s built<br />
on a solid foundation of identity security to<br />
minimise risks. For this process, organisations<br />
should first recognise pre-existing<br />
vulnerabilities."<br />
Human error represents the most significant<br />
vulnerability within an organisation's cybersecurity<br />
framework. "An employee's online<br />
presence can provide adversaries with<br />
sufficient data for sophisticated social<br />
engineering attacks. These can manipulate<br />
employees into divulging confidential<br />
information or inadvertently granting access<br />
to secure systems. Employees frequently<br />
exhibit poor cybersecurity practices, such<br />
as employing weak passwords, reusing<br />
credentials across multiple platforms and<br />
neglecting regular software updates."<br />
"Although organisations implement robust<br />
security measures, including multi-factor<br />
authentication and regular mandatory password<br />
changes, users often perceive these as<br />
burdensome. Consequently, employees may<br />
seek shortcuts, such as storing passwords<br />
insecurely or using easily guessable credentials,<br />
undermining the security controls in<br />
place," he adds.<br />
Zero Trust can be a compelling strategy to<br />
address the multifaceted challenges of<br />
cybersecurity, says Morimanno. "This approach<br />
operates on the principle that every connection,<br />
user and even device may pose a potential<br />
threat, thereby eliminating the default<br />
trust traditionally placed in employees and<br />
machines. It requires rigorous verification of<br />
identities and granting trust levels based on<br />
thorough security assessments, Zero Trust<br />
helps ensure that workflows remain<br />
uninterrupted."<br />
22<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
product review<br />
BACKBOX NETWORK AUTOMATION PLATFORM<br />
As enterprise networks grow in<br />
complexity, businesses can no<br />
longer afford to rely on inefficient<br />
and error-prone manual processes<br />
to manage and maintain critical<br />
infrastructure devices. Network<br />
automation is now an essential tool<br />
for support departments and change<br />
management teams, as it brings<br />
operational efficiencies, not least in terms<br />
of significantly reduced security risks.<br />
This can be challenging in geographically<br />
distributed, multi-vendor environments,<br />
but BackBox's Network Automation<br />
Platform (NAP) has you covered, as it<br />
supports over 180 technology vendors.<br />
It provides an impressive suite of tools<br />
that include network vulnerability and<br />
change management, automated device<br />
configuration backup with five-step<br />
verification, device updates, configuration<br />
comparisons, a smart one-click restore<br />
service and much more.<br />
A key feature is the BackBox automation<br />
library, which offers over 3,000 preconfigured<br />
tasks for common use cases, such as<br />
firmware and OS updates, vulnerability<br />
management, compliance audits and<br />
device backups. The beauty of this nocode<br />
automation approach is that support<br />
staff don't need to be versed in complex<br />
scripting languages, as they can create<br />
custom automation tasks using only API<br />
commands or the CLI.<br />
Installation is a breeze and the NAP<br />
CentOS ISO or OVA/VHDX file can be<br />
deployed on physical, cloud or virtual<br />
servers. We loaded it on a Hyper-V host,<br />
followed the quick start wizard and<br />
had NAP all ready for action in only<br />
twenty minutes.<br />
The web console is easy to navigate and<br />
you start by running an SNMP discovery<br />
job on selected networks. An instant time<br />
saver is the ability to assign a backup<br />
task to these jobs, so, as your devices are<br />
being discovered, they will also be backed<br />
up for the first time.<br />
Regardless of the type of device, all<br />
configuration backups can be stored<br />
in the same repository for consistency.<br />
Alternatively, you can send them to<br />
different local, remote or cloud locations<br />
and ransomware protection comes into<br />
play, as BackBox supports immutable<br />
cloud storage.<br />
For backup integrity and assured<br />
recovery, BackBox applies five checks<br />
on every backup, which include end of<br />
file, file size, checksum matches and file<br />
size comparisons with previous backups.<br />
Configuration recovery is a swift process,<br />
as you choose a device, view its log<br />
history, pick a backup job and select the<br />
restore option.<br />
Remote sites are integrated into BackBox<br />
by deploying agents, which take their<br />
instructions from the central console.<br />
These run distributed parallel executions<br />
and perform backups locally, so there<br />
are no overheads on the main server.<br />
Furthermore, businesses can keep backups<br />
at remote locations, if they need to<br />
demonstrate regional compliance.<br />
The Network Vulnerability Manager<br />
component inventories network devices,<br />
reports back on discovered vulnerabilities,<br />
prioritises them and delivers full remediation<br />
services. It follows all industry<br />
standard benchmarks and provides<br />
technical surveys during backups.<br />
It works hand in glove with Intelli-Check<br />
tasks, which monitor health and compliance<br />
of all devices by regularly running tests<br />
on them and optionally remediating out<br />
of compliance devices. Using threat<br />
intelligence from NIST and other bodies,<br />
such as CISA, Backbox manages the entire<br />
lifecycle of vulnerabilities by matching<br />
inventory against all CVEs and using<br />
configuration information to determine risk.<br />
You can run tasks to find all vulnerable<br />
devices on the network, see which CVEs<br />
apply to specific devices and find out what<br />
their risk level is. BackBox runs scheduled<br />
remediation jobs and accelerates<br />
remediation by performing multi-step<br />
updates and applying them to high<br />
availability pairs with one task.<br />
BackBox's Network Automation Platform<br />
takes the pain out of configuration<br />
management, network security and<br />
compliance. Easy to deploy, it can<br />
streamline all essential backup and<br />
update operations across multi-vendor<br />
environments, and its smart zero-code<br />
automations will appeal to busy support<br />
departments.<br />
Product: Network Automation Platform<br />
Supplier: BackBox Software<br />
Web site: www.backbox.com<br />
Sales: info@backbox.com<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
23
SURGE IN EXTORTION ATTACKS<br />
Orange Cyberdefense, the specialist arm of<br />
Orange Group dedicated to cybersecurity,<br />
has released its latest cyber extortion report,<br />
Cy-Xplorer 2024. Examining data from a total<br />
of 11,244 confirmed business victims, the<br />
findings show a steep increase (77% YOY) in<br />
the number of observable cyber extortion<br />
(Cy-X) victims over the past 12 months, with<br />
analysis suggesting the actual number to be<br />
50-60% higher than what it has directly<br />
observed, due to the dynamic and everhacker<br />
attacks<br />
NEW ERA OF HOPE?<br />
HERE, WE BRING READERS ANOTHER ROUND-UP OF SOME OF THE<br />
LATEST ATTACKS THAT HAVE BEEN WAGED AGAINST ORGANISATIONS<br />
Significant change can bring hopes of a<br />
significant new approach - and Spencer<br />
Starkey, VP EMEA at SonicWall, points<br />
to how the ushering in of the new Labour<br />
Government has raised expectations for a<br />
fresh approach to cybersecurity, especially<br />
after a series of high-profile cyberattacks on<br />
the UK's healthcare system, government and<br />
schools.<br />
However, he has some concerns. "Despite<br />
the urgency, the absence of a comprehensive<br />
cybersecurity strategy in the election manifestos<br />
was alarming for experts who are<br />
calling for detailed, actionable plans to tackle<br />
the complex challenges of our digital age.<br />
The new Labour government faces the<br />
challenge of not only addressing these<br />
immediate threats, but also setting a<br />
benchmark for the private sector. Inadequate<br />
regulations could leave both public and<br />
private sectors vulnerable. Labour's commitment<br />
to national security, as highlighted<br />
in their manifesto, includes a focus on<br />
economic stability, border integrity and<br />
national security."<br />
Starkey sees the announcement of a new<br />
Cybersecurity Bill in the King's Speech<br />
as a promising development, but effective<br />
implementation will require strong<br />
collaboration between government bodies<br />
and industry experts, he states. "This<br />
partnership is crucial to ensure that the<br />
right practices are established to safeguard<br />
against evolving threats. To navigate these<br />
complexities, Labour must prioritise the<br />
development of a comprehensive, futureoriented<br />
cyber strategy that addresses the<br />
risks posed by AI, enhances the security of<br />
critical national infrastructure, and educates<br />
citizens on cybersecurity risks and best<br />
practices. Furthermore, international<br />
cooperation will be essential to combat<br />
global cyber threats.<br />
"The effectiveness of the government's<br />
cybersecurity strategy will definitely hinge<br />
on its ability to balance immediate responses<br />
with long-term planning, ensuring the UK<br />
is well protected against the challenges of<br />
the digital age."<br />
WORRYING MOVE<br />
Progress Software recently patched a high<br />
severity authentication bypass in the<br />
MOVEit managed file transfer (MFT) solution,<br />
a matter of some concern, as MOVEit has<br />
been a popular target for ransomware<br />
gangs and other threat actors.<br />
"CVE-2024-5806, the authentication bypass<br />
vulnerability recently disclosed by Progress<br />
Software, affects their MOVEit managed file<br />
transfer (MFT) solution," points out Scott<br />
Caveza, staff research engineer at Tenable.<br />
"MOVEit was at the heart of a massive<br />
ransomware campaign in May 2023 when<br />
the ransomware gang known as CLOP began<br />
mass exploiting a zero-day SQL Injection<br />
vulnerability (CVE-2023-34362) affecting<br />
MOVEit Transfer."<br />
That attack had a major impact at hundreds<br />
of organisations worldwide and, with a new<br />
vulnerability affecting the product, it raises a<br />
lot of questions and concerns for users of the<br />
software," Caveza states. "CVE-2024-5806 is<br />
a severe vulnerability. However, based on the<br />
detailed analysis and exploit code from<br />
researchers at watchTowr, it does appear that<br />
this vulnerability is not easily weaponisable<br />
and still requires an attacker to take<br />
additional steps, in order to exploit a<br />
potential target."<br />
Although details on how this exploitation<br />
works are publicly available, watchTowr<br />
confirmed that Progress contacted affected<br />
customers prior to publicly disclosing their<br />
security advisory. "While this is not the first<br />
time we've seen a vendor take measures to<br />
protectively warn and secure customers prior<br />
to public acknowledgment of a vulnerability,<br />
it could have been a risky move. An unknown<br />
individual tipped watchTowr off to the vulnerability<br />
well before it was public knowledge. If<br />
this individual had malicious intentions, this<br />
information could have easily been given to<br />
threat actor groups to develop an exploit and<br />
abuse the flaw."<br />
24<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
hacker attacks<br />
changing nature of the cyber extortion<br />
ecosystem.<br />
Despite the takedown and disruption of<br />
prominent cyber extortion groups such as<br />
RagnarLocker, ALPHV/BlackCat, and LockBit<br />
by law enforcement, there has been no<br />
noticeable decrease in victim count. The<br />
research highlights the general volatility of the<br />
Cy-X actor ecosystem, indicating that one-third<br />
of all actors tracked will 'disappear' each year,<br />
while an equivalent number of new actors are<br />
identified annually. It also suggests half of all<br />
identified threat actors will disband or rebrand<br />
in less than six months.<br />
Comments Hugues Foulon, CEO at Orange<br />
Cyberdefense: "We are seeing a measured<br />
rise in the pace at which law enforcement is<br />
responding to meet the Cy-X threat; but, as<br />
victim numbers surge at an alarming rate,<br />
with new tactics being deployed and moral<br />
restraints dwindling, it's an ongoing battle<br />
that's further complicated by the decentralised<br />
and fragmented ecosystem. Small businesses<br />
are increasingly falling victim to the crime and<br />
we see a real need for all organisations to join<br />
forces and play their part by working together<br />
and taking actions that will increase the cost<br />
for attackers."<br />
DDOS ATTACKS SPIKE<br />
Imperva, a Thales company, has released its<br />
2024 DDoS Threat Landscape Report, revealing<br />
a dramatic increase in Distributed Denial<br />
of Service (DDoS) attacks during the first half<br />
of the year. The report highlights key trends<br />
and provides critical insights into the evolving<br />
threat landscape, including:<br />
Surge in DDoS attacks: Imperva mitigated<br />
111% more DDoS attacks in H1 2024,<br />
compared to the same period in 2023,<br />
underscoring the escalating threat<br />
Industry targets: the financial services sector<br />
remains the top target, experiencing some<br />
of the most forceful attacks. The telecommunications<br />
and ISP sectors saw a staggering<br />
548% rise in the volume of attacks overall<br />
DNS attacks: DNS DDoS attacks surged by<br />
215%, with amplification attacks increasing<br />
in size by 483%<br />
New attack vectors, such as HTTP/2 Rapid<br />
Reset and HTTP/2 Continuation Frame<br />
Attacks, have emerged, highlighting the<br />
evolving threat landscape<br />
Hacktivism: hacktivist groups, such as<br />
NoName57(16), frequently employ DDoS<br />
attacks to disrupt critical infrastructure,<br />
especially during major events and<br />
geopolitical tensions.<br />
BREACHES AND DEVICE LOSSES<br />
Apricorn has released further findings from<br />
its annual Freedom of Information (FoI)<br />
responses into data breaches and device<br />
loss amongst 27 local councils. The results<br />
highlight the significant number of breaches<br />
occurring within just 17 of the councils<br />
questioned and the threat to customer data,<br />
with over 5,000 breaches recorded in 2023.<br />
Worryingly, Kent County Council declared<br />
734 breaches alone between Jan 2023<br />
and Dec 2023, with Surrey County Council<br />
amassing 665 and Norfolk Council not far<br />
behind with 605. Other big losses included<br />
Warwickshire County Council (495) and East<br />
Sussex (490).<br />
"We're familiar with the fact organisations<br />
suffer data breaches, particularly those housing<br />
valuable customer data," points out Jon<br />
Fielding, managing director, EMEA Apricorn.<br />
"That said, the excessive number of breaches<br />
being declared is concerning. These government<br />
organisations should be setting a<br />
precedent, in terms of data protection. Whilst<br />
we know there is no silver bullet for preventing<br />
a breach, multiple steps and processes can<br />
be put in place to limit the risks of a breach.<br />
The councils should invest in comprehensive<br />
training programmes to educate employees<br />
about the importance of safeguarding data<br />
and the proper protocols to follow, in case of<br />
device loss or theft."<br />
Scott Caveza, Tenable: although CVE-2024-<br />
5806 is a severe vulnerability, it is not easily<br />
weaponisable.<br />
Hugues Foulon, Orange Cyberdefense:<br />
a measured rise in the pace at which law<br />
enforcement is responding to meet the<br />
Cy-X threat, but there are still concerns.<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
25
ook review<br />
AN HONOURABLE QUEST<br />
CYBERSECURITY HAS NEVER HAD AN OVERARCHING CODE OF ETHICS AND CONDUCT.<br />
PAUL J. MAURER AND ED SKOUDIS WANT TO SEE THAT FAILURE FULLY ADDRESSED<br />
Whilst other professions - such<br />
as medicine, law, and indeed<br />
engineering - have long<br />
required their practitioners to embrace<br />
and abide by an overarching code of<br />
ethics and conduct, cybersecurity has<br />
never had such a code. This absence<br />
of an ethical standard is regarded as<br />
a serious threat to the safety of consumers<br />
and businesses around the world.<br />
In 'The Code of Honor', authors Paul J.<br />
Maurer and Ed Skoudis are focused on<br />
delivering a comprehensive discussion<br />
of the ethical challenges facing<br />
contemporary workers, managers and<br />
executives - both in the tech world and<br />
in those companies which serve the<br />
public. They explain and establish ethical<br />
best practices and take a deep dive<br />
into many of the high-stakes situations<br />
commonly encountered. A series of case<br />
studies-called 'Critical Applications' in<br />
the book-included at the end of each<br />
chapter demonstrate how to use the<br />
hands-on skills being explored within.<br />
'The Code of Honor' is the result of<br />
a journey the authors began several<br />
years ago "to address an expanding<br />
ethical vacuum in our industry, where<br />
critical decisions are often made without<br />
regard to their ethical implications. At<br />
the same time, the weight and financial<br />
impact of our decision-making is rapidly<br />
increasing", they state.<br />
"As you will learn in the coming pages,<br />
the crossroads of cybersecurity and<br />
ethics aren't some philosophical 'pie in<br />
the sky' discussion. Cybersecurity<br />
professionals hold a great deal of power<br />
and enormous levels of responsibility<br />
in the workplace and the broader<br />
economy. It is a high-pressure, fastpaced,<br />
and exciting field where<br />
ethical decision-making can make the<br />
difference between success and abject<br />
disaster, not only for your career but for<br />
your organization, customers, or constituents,<br />
and perhaps far beyond. The<br />
topics we explore in this book are<br />
integral to the daily operations of nearly<br />
every industry and are essential to the<br />
very stability of our modern world."<br />
With the cybersecurity industry now<br />
changing at light speed, we must truly<br />
respond to the emergent ethical<br />
challenges with a level of "hair on fire"<br />
determination and precision, insist<br />
Maurer and Skoudis. "Our offering in<br />
'The Code of Honor' is a systematic and<br />
thoughtfully constructed program for<br />
building best practices regarding ethics<br />
in decision-making in the tech industry,<br />
with a specific focus on cybersecurity.<br />
This book presents a concise, carefully<br />
designed and timeless set of ethics that<br />
will engage everyone from C-suite<br />
leaders who work on the periphery of<br />
the cyber world to the most seasoned<br />
cybersecurity professionals and everyone<br />
in between," they state.<br />
MORE INFO<br />
The Code of Honor: Embracing Ethics<br />
in Cybersecurity<br />
Authors: Paul J. Maurer and Ed<br />
Skoudis (ISBN: 9781394275861)<br />
Published June 2024 by Wiley<br />
Hardcover and ebook, priced £30.99<br />
26<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
the re-use route<br />
DON'T LET FEAR HINDER YOUR SUSTAINABILITY MANIFESTO<br />
STEVE MELLINGS OF ADISA MAKES THE CASE WHY THE DEFAULT POSITION<br />
SHOULD ALWAYS BE TO PROMOTE RE-USE OF REDUNDANT EQUIPMENT<br />
As individuals and businesses, we're<br />
all examining our impact on the<br />
environment with one area where<br />
'wins' can be achieved being the management<br />
of product lifecycles, states Steve<br />
Mellings, CEO, ADISA. "At the end of life,<br />
viable technology should be made available<br />
for reuse by reselling or donating it. This<br />
aligns with financial and environmental,<br />
social, and governance [ESG] considerations,<br />
but many organisations fear data breaches,<br />
so adopt a 'destroy' mentality. But why<br />
destroy when we can re-use?"<br />
One explanation, he points out, lies in<br />
the evolving nature of technology, which<br />
makes logical sanitisation more difficult.<br />
"Networking equipment, for instance,<br />
holds data, and factory resets don't always<br />
guarantee complete erasure. Our research<br />
centre recently spent eight months testing<br />
smartwatch sanitisation, uncovering a range<br />
of challenges with this technology. Why is<br />
this important? Smartwatches have nonvolatile<br />
flash storage that retains copies of<br />
texts and photos, and other locally stored<br />
data saved when it was paired with a host<br />
phone. A solution provider needed verification<br />
of their product, which was used<br />
to sanitise each device and create an audit<br />
trail when it had done so. Following testing,<br />
the solution can now allow the re-use of<br />
android and apple watches to be done<br />
with confidence," he adds.<br />
For some technologies, says Mellings,<br />
storage is shifting from being a separate<br />
component within a device to being<br />
embedded. "This blurs the traditional<br />
host-component relationship and poses<br />
challenges for sanitisation-especially in<br />
the case of Apple MacBooks. Our research<br />
centre has developed proprietary techniques<br />
that took over six months to achieve<br />
to verify successful sanitisation, with the<br />
first products approved just last month."<br />
So, amidst these technical challenges,<br />
a critical then question arises: how do we<br />
sanitise storage? "In the UK, many organisations<br />
use Information Assurance 5 (IS5)<br />
or Commercial Product Assurance (CPA)<br />
schemes, both administered by the National<br />
Cyber Security Centre (NCSC). Currently,<br />
there are no approved products for data<br />
sanitisation under the CPA scheme, leaving<br />
IS5, and CAS-S, as only available<br />
destruction."<br />
So, where exactly should organisations<br />
turn when creating a reuse sanitisation<br />
specification? Mellings points to a new<br />
standard called IEEE 2883, which was<br />
released in November 2022, as providing<br />
the best logical sanitisation specification<br />
and serves as an excellent starting point<br />
for all organisations to use. "The perceived<br />
[or real!)] fear of GDPR-related actions has<br />
often justified destruct-ion over re-use.<br />
"To extend product lifecycles, the use of<br />
third parties to perform data sanitisation<br />
and remarketing becomes crucial. Unfortunately,<br />
where the wrong type of vendor is<br />
selected, we still observe significant noncompliance<br />
with GDPR, leaving their<br />
customers exposed."<br />
But fear not! He continues: "If GDPR<br />
concerns are primary for you, you should<br />
use a company certified under the ICOapproved<br />
UK GDPR Certification Scheme-<br />
ICT Asset Recovery Standard 8. This<br />
certification verifies compliance with GDPR,<br />
as determined by the regulatory bodies<br />
themselves. In addition, it incorporates<br />
adapted versions of IEEE 2883 and NIST<br />
800-88 as its primary specifications,<br />
enabling vulnerabilities to be resolved and<br />
build greater assurance. With technical<br />
audits in place, compliance is more than<br />
a tick-box exercise and provides assurance<br />
that data is gone for good."<br />
While it may not be the highest profile<br />
process, he concedes, asset retirement<br />
enables organisations to see redundant<br />
equipment as a strategic resource.<br />
"By not allowing fear to take over, organisations<br />
can promote re-use and allow<br />
other organisations and those users less<br />
fortunate to benefit from technologies<br />
which they very much need."<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
27
malware<br />
EASING THE MALWARE ANGST<br />
THE EVOLUTION OF MODERN-DAY THREATS MEANS THE OLD METHODOLOGIES FOR PROTECTING<br />
AGAINST ATTACKS ARE NO LONGER ENOUGH. CHANGE HAS TO BE INTRODUCED… AND NOW<br />
Palo Alto Networks Unit 42 research<br />
team has been sharing some of the<br />
current trends in malware and the<br />
evolving threat landscape - and the picture<br />
the company presents is a worrying one.<br />
This includes an analysis of the most<br />
common types of malware and their<br />
distribution methods.<br />
"With the growing volume and<br />
sophistication of today's threats, it's critical for<br />
network security professionals to understand<br />
the landscape and how to defend against it<br />
properly," advises Palo Alto Networks. Here<br />
are some highlights from past findings:<br />
A boom in traditional malware techniques,<br />
taking advantage of interest<br />
in AI/ChatGPT<br />
The ratio of malware explicitly targeting<br />
the operational technology (OT) industry<br />
has increased by 27.5%<br />
Exploitation of vulnerabilities increased<br />
by 55% over one 12-month period<br />
PDFs are rated the most popular file<br />
type for delivering malware as email<br />
attachments (66.6% of the total at<br />
a recent count)<br />
48.94% of network communication<br />
generated during sandbox analysis<br />
(including both malicious and benign<br />
files) used encrypted SSL for its traffic;<br />
12.91% of what is caused by malware<br />
is SSL traffic.<br />
Cryptominer traffic was found to<br />
have doubled in 2022 alone.<br />
NEW DEFENCE APPROACHES<br />
We exist in a cyber security world<br />
where anti-malware, firewalls and<br />
IDS [intrusion detection systems]<br />
are no longer enough to<br />
defend against the latest<br />
threats, comments Steven<br />
Usher, security services<br />
manager/senior analyst, Brookcourt Solutions,<br />
a portfolio group company of Shearwater<br />
Group. "Modern-day threats have evolved<br />
far beyond the old norms. APT groups<br />
create customised malicious code and even<br />
infrastructure to support that code, simply to<br />
attack a single organisation, making the old<br />
methods of utilising known IOCs [Indicators<br />
of Compromise] less than effective in this<br />
evolved modern era. Threat groups are using<br />
services specifically designed to ensure code<br />
is not detected by commercial anti-malware<br />
and constantly run code through those<br />
services to ensure victims are targeted with<br />
bespoke malicious code."<br />
Usher offers some insights into the insider<br />
threat category of dangers, from phishing<br />
to rogue USB devices. "Continuing to ensure<br />
that protecting a network is no longer simply<br />
depending on detections; a change of<br />
approach is needed - not to replace, but to<br />
augment<br />
the<br />
security capabilities of an organisation. First,<br />
let's consider AI, the current buzzword; this<br />
does add something to the security program<br />
of any company, whether augmenting the<br />
anti-malware solutions they are using or<br />
adding to the efficacy of the SOC team by<br />
working through the most obvious alerts they<br />
are receiving and providing a more curated<br />
list of alerts that require a human touch. AI<br />
could potentially greatly augment the entire<br />
security program of a company. However, as<br />
this technology is still being developed and<br />
perfected, it should be used carefully in a very<br />
considered manner."<br />
Aside from AI, he identifies numerous other<br />
things that can be done, ranging from minor<br />
changes through to comprehensive<br />
strategies. "Zero trust concepts are essential<br />
for securing large environments in today's<br />
'modern world'. Nevertheless, implementing<br />
Zero trust strategies can be complex and time<br />
consuming; their implementation usually<br />
requires significant effort and considerable<br />
ongoing maintenance to them, to a stage<br />
where they provide adequate protection for<br />
your environment. Micro segmentation is<br />
another power tool for combating security<br />
threats on networks. However, like zero trust,<br />
implementation of this strategy also demands<br />
substantial work both to deploy and to<br />
maintain effectively."<br />
There are various concepts and<br />
changes that can be made to protect<br />
against threats. "One of the most<br />
fundamental steps is to maintain<br />
a comprehensive inventory of all<br />
hardware, software and users on<br />
the network," he says. "Coupled<br />
with a robust Configuration<br />
Management Database<br />
(CMDB), this provides the<br />
28<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
malware<br />
most solid foundation possible to help<br />
address any network threat. In addition,<br />
implementing concepts such as defence-indepth<br />
strategy further strengthens security<br />
by layering multiple measures for protection,<br />
a concept that would make any attack<br />
considerably more difficult for adversaries<br />
carrying it out."<br />
Finally, Usher points to what he sees as the<br />
greatest weakness in any security landscape:<br />
the workforce. "There are the obvious tools,<br />
security awareness training and password<br />
training; separated, as security awareness is<br />
a huge topic, and often not really provided<br />
in a useful manner [there is no consensus on<br />
how to do this effectively]. Passwords are<br />
a very specific topic and utilised across a vast<br />
array of services and devices. It is considerably<br />
more important to educate staff on password<br />
security, then general security awareness<br />
training."<br />
"Sophisticated ransomware attacks pose<br />
a pressing and immediate concern," warns<br />
Aron Brand, CTO, CTERA. "With cybercriminals<br />
not only encrypting critical data,<br />
but also exfiltrating it, the pressure is on for<br />
organisations to find the best, most up-todate<br />
and most comprehensive solutions<br />
available to beat these bad actors at their<br />
own game - and frankly, not even give them<br />
the chance to play."<br />
TROUBLE IN STORE<br />
According to Gartner, cyberstorage, by<br />
definition, is about making data protection<br />
an inherent part of how storage is designed<br />
and delivered, focusing on active defence<br />
beyond recovery, states Brand.<br />
"Amid the proliferation of cyberthreats<br />
targeting storage systems, cyberstorage<br />
emerges as a promis-ing direction, especially<br />
when providers leverage artificial intelligence<br />
to detect anomalous and malicious behaviour<br />
patterns at the storage level. AI-driven<br />
cyberstorage solutions continuously analyse<br />
data for unusual activities, providing real-time<br />
monitoring that acts as a 24/7 sentinel,<br />
always on the lookout for threats and armed<br />
to take them down."<br />
He also points to the manifold benefits of<br />
AI-powered cyberstorage. "AI enables more<br />
accurate and swift identification of potential<br />
threats, continuously learning from new data<br />
to improve detection algorithms over time,<br />
much like an immune system that adapts<br />
to recognise and combat new pathogens.<br />
Continuous surveillance allows for the<br />
detection of unusual activities as they occur,<br />
enabling organisations to intervene promptly<br />
and mitigate the impact of ransomware<br />
attacks. In the event of a detected threat,<br />
AI-powered solutions can respond rapidly,<br />
isolating affected systems, alerting IT teams<br />
Aron Brand, CTERA: sophisticated<br />
ransomware attacks pose a pressing<br />
and immediate concern.<br />
and initiating protocols to minimise damage,<br />
acting as digital antibodies that swiftly<br />
neutralise invaders.<br />
"As we advance more rapidly in our technological<br />
evolution, you can bet that bad actors<br />
are doing the same," Brand states, adding:<br />
"There's never been a more pivotal time to use<br />
AI and other human innovations to block<br />
malicious threats."<br />
BITDEFENDER PARTNERSHIP GOES UP A GEAR<br />
Bitdefender has expanded its collaboration with Arrow Electronics to deliver a broader range of threat<br />
prevention, detection and response solutions to managed service providers (MSPs) and their customers.<br />
Through the extended cooperation, Arrow will shift to a subscription-based model, offering Bitdefender's<br />
full MSP product portfolio on a pay-as-you-go basis to customers in the UK, France, Germany, Luxembourg,<br />
Belgium and the Netherlands.<br />
"Businesses must leverage every possible advantage to keep pace with the latest malware and techniques<br />
cybercriminals use to exploit systems and breach environments," says Richard Tallman, senior director,<br />
worldwide MSP and cloud at Bitdefender Business Solutions Group. "<br />
Richard Tallman, Bitdefender.<br />
Arrow has incorporated Bitdefender GravityZone Cloud MSP Security Solutions, designed for MSPs, into<br />
ArrowSphere Cloud, the company's cloud delivery and management platform, which provides a range of<br />
on-demand security solutions.<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
29
deep fakes<br />
CRIME GANGS CAN TRIUMPH WITH AI<br />
GENERATIVE ARTIFICIAL INTELLIGENCE AND ITS BLEND WITH DEEPFAKE TECHNOLOGY<br />
HAS AFFECTED VOICE, IMAGE AND VIDEO. WHAT PROTECTIONS CAN BE PUT IN PLACE?<br />
In the past few years, artificial<br />
intelligence technology has crossed<br />
a threshold with the capability to make<br />
people look and sound like other people.<br />
A 'deepfake' is fabricated hyper-realistic<br />
digital media, including video, image<br />
and audio content. Not only has this<br />
technology created confusion, scepticism<br />
and the spread of misinformation,<br />
deepfakes also pose a threat to privacy<br />
and security.<br />
"With the ability to convincingly<br />
impersonate anyone, cybercriminals can<br />
orchestrate phishing scams or identity<br />
theft operations with alarming precision,"<br />
says Stanford University IT. "In a recent<br />
incident, cybercriminals posed as a<br />
company's chief financial officer and<br />
other colleagues in a Zoom meeting.<br />
The elaborate scam led to the loss of<br />
$25 million."<br />
In today's dynamic technological<br />
landscape, the<br />
emergence of<br />
Generative<br />
Artificial Intelligence (Generative AI) and<br />
its blend with deepfake technology has<br />
affected voice, image and video. This<br />
amalgamation has opened a landscape of<br />
opportunities and risks.<br />
"The recent spate of deepfake videos<br />
targeting women celebrities results in<br />
reputational and emotional damage and<br />
privacy invasion," says Deloitte. "These<br />
videos can also lead to trauma. Consumers<br />
rely on digital multimedia content; there is<br />
a significant increase in risks associated<br />
with these new technologies. For example,<br />
people working remotely and relying solely<br />
on video/audio calls for their daily tasks,<br />
are more vulnerable to attacks, such as<br />
deepfake and phishing.<br />
"To address these challenges, a proactive<br />
approach towards safeguarding against<br />
deepfakes is imperative. This point of view<br />
aims to discuss the convergence of<br />
Generative AI and deepfake technology,<br />
illuminating the potential weaknesses and<br />
risks they introduce to biometric authentication<br />
systems [voice and video-based<br />
authentication systems]. Once seen as<br />
a robust security<br />
measure, biometric<br />
authentication faces<br />
extraordinary<br />
challenges, due to<br />
the malicious use<br />
of Generative AI, which can create<br />
deceptively realistic voices/videos. As the<br />
digital landscape continues to evolve,<br />
understanding and addressing these<br />
vulnerabilities is crucial to fortify the<br />
foundations of digital security in an age<br />
defined by Generative AI and deepfake<br />
innovation," cautions Deloitte.<br />
UNDERMINING THE DEFENCES<br />
The advancement of deep fakes makes<br />
biometric authentication weaker, due to<br />
the ability of sophisticated AI-generated<br />
media to convincingly replicate physical<br />
traits such as facial features, voices and<br />
even behavioural patterns.<br />
That is the worrying verdict delivered<br />
by Basil Philipsz, CEO of Distributed<br />
Management Systems. "Deep fakes can<br />
create realistic images and videos of<br />
individuals, potentially allowing attackers<br />
to spoof biometric systems that rely on<br />
facial recognition, voice recognition or<br />
other biometric data," he states. "This<br />
undermines the reliability of biometric<br />
authentication, as the systems may be<br />
tricked into granting access based on<br />
these forged credentials."<br />
Industry leaders and cybersecurity experts<br />
have highlighted these concerns, he points<br />
out. "Gaelan Woolham from Capco points<br />
out that deepfake technology can mimic<br />
voices and faces with high fidelity, making<br />
it challenging for existing biometric<br />
systems to distinguish between real and<br />
fake identities. This technology can<br />
bypass voice biometric systems used<br />
by financial institutions, as demonstrated<br />
by a University of Waterloo<br />
study, which showed that deepfakes<br />
could fool such systems in a few<br />
30<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
deep fakes<br />
attempts. Moreover, Sensity, a security<br />
company, tested facial recognition systems<br />
and demonstrated that deepfake<br />
technology could easily bypass liveness<br />
detection-a critical component of facial<br />
recognition security.<br />
"Liveness detection typically relies on<br />
recognising natural human behaviours<br />
like blinking and subtle facial movements<br />
is the easy deployment by non-experts:<br />
making it simpler for individuals to create<br />
realistic fake videos and images, including<br />
those used for biometric cloning. The<br />
availability of sophisticated, yet userfriendly,<br />
applications, such as FakeApp,<br />
ReFace and DeepFaceLab, has democratised<br />
access to deepfake creation tools,<br />
allowing even non-experts to produce<br />
convincing fakes," adds Philipsz.<br />
SERIOUS THREAT<br />
Deepfakes can pose serious threats to<br />
biometric authentication systems,<br />
especially those that rely on facial<br />
recognition, he continues. "These attacks<br />
can be categorised into present-ation<br />
attacks, where fake images or videos<br />
are presented to a camera or sensor, and<br />
injection attacks, where data streams or<br />
communication channels are manipulated.<br />
Examples of deepfake attacks include face<br />
swapping, lip-syncing, and gesture or<br />
expression transfer, all of which can<br />
deceive biometric systems.<br />
"The ease with which deepfakes can be<br />
created and the increasing sophistication<br />
of these technologies highlights significant<br />
vulnerabilities in biometric authentication.<br />
"As deepfakes become more realistic,<br />
the challenge of detecting and preventing<br />
such attacks grows, making traditional<br />
biometric systems potentially less reliable<br />
without additional security measures,<br />
like liveness detection and multi-factor<br />
authentication." These biometric<br />
vulnerabilities have a direct impact on<br />
other forms of Multi-factor Authentication<br />
(MFA) like Authentication mobile Apps or<br />
'Password-less' methods, he says. "The<br />
often ignored, but most important, main<br />
facilitator in this threat is that most MFA<br />
installations are accomplished by selfprovisioning:<br />
for example, by receiving an<br />
email link to download the app that helps<br />
installs the process."<br />
PROFILE PROMOTING<br />
Most CEOs have been encouraged to<br />
extend their public social profile by giving<br />
presentations or announcements in posts<br />
on public platforms. "Eleven Labs can make<br />
a passable cloned voice with 60 seconds of<br />
any training audio, can refine pitch, rate<br />
and add custom phonemes, and have text<br />
input generate the appropriate audio.<br />
"Consider a call from the attacker's text to<br />
the generated cloned CEO voice made to<br />
the help desk assistant requesting set-up<br />
of new phone or wanting an email link to<br />
re-establish their MFA. CIOs are mandated<br />
to use MFA methods for privileged access,<br />
but selecting what MFA methods are<br />
appropriate and how best to deploy them<br />
are crucial decisions and need considered<br />
evaluation."<br />
PULLING UP THE ANCHOR<br />
Tim Callan, chief experience officer at<br />
Sectigo, says it is alarming to see the<br />
rise of deepfake technology now being<br />
used to mimic news anchors to spread<br />
misinformation. "People don't realise how<br />
far AI-deep fake technology has come<br />
and how democratised the technology<br />
is. Unfortunately, anything about your<br />
physical appearance can be replicated -<br />
ie, eyes, face, voice.<br />
"This is no longer something that only<br />
exists in films, as more people are now<br />
capable of creating convincing deepfakes.<br />
As the landscape has dramatically changed,<br />
people's mindset when consuming media<br />
must shift with it. They must now exercise<br />
Basil Philipsz: systems may be tricked into<br />
granting access, based on forged<br />
credentials.<br />
more caution than ever in what they watch<br />
and reconsider the validity of the source<br />
and its trustworthiness." With the acceleration<br />
of deep fake technology, people will<br />
no longer be able to trust the authenticity<br />
of a digital record, whether that be a photo,<br />
video or voice recording.<br />
"Given our current reliance on digital records<br />
within our legal, security and digital systems,<br />
without a solution people will no longer be<br />
able to trust what they are seeing. This is<br />
why, by 2100 [at a conservative estimate], all<br />
forms of recording devices will have a built-in<br />
encrypted timestamp, acting as a watermark<br />
at the time of capture.<br />
"These encrypted watermarks will separate<br />
out authentic images from deepfakes to reestablish<br />
digital trust in images, videos and<br />
recordings." Already we are seeing high-tech<br />
cameras having to include this in their tech,<br />
with digitally signed photos, Callan<br />
concludes. "Soon, all smartphones and<br />
devices will follow suit, defending against<br />
the deepfake surge."<br />
www.computingsecurity.co.uk @CSMagAndAwards Sept/Oct 2024 computing security<br />
31
ansomware<br />
THE SHARKS STEP UP THEIR ATTACKS<br />
WHEN TRYING TO PREVENT RANSOMWARE STRIKES, KEEPING PACE WITH THE INGENUITY<br />
OF THOSE CARRYING THEM OUT IS THE CHALLENGE. HOW REALISTIC IS THAT TO ACHIEVE?<br />
Ransomware attacks are increasing at<br />
an alarming rate. The US government<br />
estimates that companies are subject to<br />
more than 4,000 attacks each day, resulting<br />
in $1 billion in ransom paid each year.<br />
"While ransomware attacks come in many<br />
variants - Cryptowall, Locky Cryptolocker are<br />
among the most common - they each follow<br />
a similar pattern," says Mimecast. "A user<br />
receives an email with an attachment that<br />
looks like a Word document, an invoice, a<br />
package notice or a fax report, along with<br />
a message that convinces the user the<br />
attachment is real. When the attachment is<br />
opened, the ransomware virus runs a file<br />
that encrypts files and documents on the<br />
user's computer. The user receives a message<br />
stating that they can get the encryption key<br />
and regain access to their files only by paying<br />
a ransom."<br />
Mobile ransomware infects cell phones<br />
through drive-by downloads or fake apps,<br />
adds Mimecast. "Cyber attackers who gain<br />
access to a user's contact list could have<br />
access to names, addresses, phone numbers<br />
and other protected information. Once<br />
attackers gain access to your contacts list,<br />
they can then use your contacts and<br />
credentials to send text messages with<br />
malicious links to malware to other users<br />
and devices."<br />
In June 2024, ransomware gangs listed 450<br />
victims on their extortion sites, up from 328<br />
in April, nearing the record of 484 attacks in<br />
July 2023, according to The Record, which<br />
tracks such events. LockBit was said to be<br />
responsible for over a third of these attacks,<br />
although that has been disputed. By the end<br />
of March this year, there had been 54 publicly<br />
reported ransomware attacks on state and<br />
local governments, with incidents accelerating<br />
early in the year. February and March saw<br />
the highest number of recorded attacks,<br />
with more than 20 seperate groups targeting<br />
local governments.<br />
DIGITAL TRANFORMATION<br />
Jeff Gray, who is Americas Operations VP -<br />
Xalient, has been focusing on the risks that<br />
ransomware poses to digital transformation.<br />
"Digital transformation is a hot topic in the<br />
modern world: organisations in a diverse<br />
range of sectors, such as finance, healthcare,<br />
retail and manufacturing, are searching for<br />
ways to drive innovation, increase connectivity<br />
and gain a competitive advantage. With<br />
technological advancements facilitating<br />
global networks and increasing capacity<br />
to collect and share an influx of fresh data,<br />
organisations can enjoy faster connectivity,<br />
agility and responsiveness," he says.<br />
However, he points out that no growth<br />
comes without risk. "As an organisation<br />
becomes more connected, its network<br />
becomes more complex, posing significant<br />
challenges to identity and cybersecurity<br />
measures. Adopting new technologies, such<br />
as APIs, LLMs and the Cloud, increases an<br />
organisation's attack surface. Across a vast<br />
network, their individual machine identities<br />
can be a challenge to monitor for anomalies."<br />
When considering threats, Gray advises<br />
organisations also to take stock of the risk of<br />
human error. "In modern work, employees<br />
operate in a blended environment, moving<br />
seamlessly between work applications and<br />
personal apps. This can result in a lot of freely<br />
available open-source data, or OSINT, which<br />
cybercriminals use for social engineering<br />
purposes to customise phishing attacks.<br />
All it takes is for one employee to click a link<br />
in a phishing email, or one machine identity<br />
to be exploited, and a bad actor can potentially<br />
have access to an organisation's entire<br />
database.<br />
"The results from a ransomware attack,<br />
as seen with the Ascension Healthcare<br />
Incident and most recently CDK Global,<br />
can have a devastating effect on business,<br />
daily operations and consumer trust - not to<br />
mention the costs incurred from downtime,<br />
disruption and potentially paying the ransom."<br />
If the risk in digital transformation is deemed<br />
32<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
Layers aren’t just for cakes; they’re<br />
essential in cybersecurity’s secret<br />
recipe for protection!<br />
Bake it happen with VIPRE Security Group. Secure your<br />
bytes before you take a bite with Email Security, Endpoint<br />
Security and User Protection<br />
www.vipre.com
ansomware<br />
Simon Hodgkinson, Semperis: criminal<br />
gangs are leveraging many organisations'<br />
vulnerabilities to detonate two, three or<br />
four malicious attacks.<br />
Jeff Gray, Xalient: adopting technologies,<br />
such as APIs, LLMs and the cloud, increases<br />
an organisation's attack surface.<br />
too high to invest in, organisations can<br />
potentially become outdated, which not<br />
only poses cybersecurity risks, but can also<br />
lead to them stagnating and falling behind<br />
their competition. "As such, organisations<br />
should strike a balance between digital<br />
transformation and improving their<br />
cybersecurity posture, without measures<br />
that restrict and slow their workflow," states<br />
Gray. "To stay ahead, organisations should<br />
implement Zero-Trust strategies to support<br />
growth, workflow and keep important data<br />
safe and secure."<br />
NEVER-ENDING<br />
A global study recently released shows that<br />
most organisations are facing a never-ending<br />
series of breaches - a serious epidemic that<br />
leaves them continuously in the crosshairs<br />
of ransomware gangs. In fact, 85% of UK<br />
companies said they were targeted. In 14%<br />
of attacks, companies paid a ransom, because<br />
they faced a life-or-death situation.<br />
"Considering that there is a 24/7 threat<br />
arrayed against today's organisations, you can<br />
never say 'I am safe' or take a moment off. The<br />
best you can do is to make your environment<br />
defensible and then defend it," comments<br />
Chris Inglis, strategic advisor and first US<br />
national cybersecurity director at Semperis,<br />
the company that published the ransomware<br />
research.<br />
The report, titled '2024 Ransomware Risk<br />
Report: Essential Guidance for Building<br />
Operational Resilience Against Cyberattacks',<br />
found that 39% of attacked companies in the<br />
UK, US, France and Germany paid a ransom<br />
four times or more in the past 12 months.<br />
Also, more than 80% of ransomware attacks<br />
eventually compromise an organisation's<br />
identity system, such as Microsoft Active<br />
Directory (AD) or Entra ID, yet over one fifth<br />
(22%) of UK companies don't have dedicated<br />
AD or Entra ID recovery plan in place.<br />
The findings indicate that ransomware<br />
attacks are frequent, with one fifth of UK<br />
respondents facing either simultaneous (20%)<br />
or multiple (28%) attacks on the same day.<br />
And 42% were attacked multiple times in the<br />
same week. Globally, the healthcare sector is<br />
most likely to be the victim of a simultaneous<br />
ransomware attack (35%), whereas the<br />
financial sector is more likely to be attacked<br />
multiple times in the same week (40%).<br />
"When multiple attacks happen, they<br />
tend to happen in quick succession,"<br />
adds Simon Hodgkinson, strategic advisor,<br />
Semperis and former CISO at BP. "Data<br />
points from the study suggest that multiple<br />
criminal gangs are leveraging organisations'<br />
vulnerabilities to detonate two, three or four<br />
malicious attacks - frighteningly, some are<br />
simultaneous."<br />
WAR DECLARED ON RANSOMWARE<br />
European Commission president Ursula von der Leyen (left) has<br />
pledged to set out a plan to tackle ransomware attacks against<br />
healthcare providers - "increasingly the target of cyber and<br />
ransomware attacks" - within the first 100 days of her second<br />
term in office. Her guidelines state: "To improve threat detection,<br />
preparedness and crisis response, I will propose a European<br />
action plan on the cybersecurity of hospitals and healthcare<br />
providers in the first 100 days of the mandate."<br />
Recent months have seen multiple hospitals and the healthcare<br />
system across the European Union impacted by cyberattacks,<br />
including in the UK, Romania, France, Belgium and Spain.<br />
34<br />
computing security Sept/Oct 2024 @CSMagAndAwards www.computingsecurity.co.uk
Computing<br />
Security<br />
Secure systems, secure data, secure people, secure business<br />
e-newsletter<br />
Are you receiving the Computing Security<br />
monthly e-newsletter?<br />
Computing Security always aims to help its readers as much as possible to do<br />
their increasingly demanding jobs. With this in mind, we've now launched a<br />
Computing Security e-newsletter which is produced every month and is available<br />
free of charge. This will enable us to provide you with more content, more<br />
frequently than ever before.<br />
If you are not already receiving this please send your request to<br />
christina.willis@btc.co.uk and advise her of the best email address for the<br />
newsletter to be sent to.
ACCORDING TO JAMF 2024:<br />
Security<br />
Trends Report<br />
39 % of<br />
organisations<br />
had at least one device<br />
with known vulnerabilities<br />
40 % of<br />
mobile users<br />
were running a device<br />
with known vulnerabilities<br />
9 % of<br />
users fell for<br />
a phishing attack<br />
Manage and Secure<br />
Apple at work<br />
With Jamf Trusted Access, you ensure<br />
that only authorised users, on enrolled<br />
devices that are secure and compliant,<br />
can access sensitive data.<br />
REQUEST<br />
Y O U R<br />
F R E E<br />
T R I A L<br />
TODAY<br />
www.jamf.com