Club Freelance Neo WP UK

Tag: cyber security

  • Why Enterprise Cybersecurity Should Start at the Boardroom Level

    Why Enterprise Cybersecurity Should Start at the Boardroom Level

    Cybersecurity is becoming increasingly complex, and it is no secret by now that the number of cyber threats companies face on a daily basis has increased dramatically as a result of the pandemic.

    All in all, IT teams and their security experts are pulling extremely long hours to come up with better and more efficient ways of protecting their digital operations and data. As a consequence, that is accelerating digital transformation in the area.

    According to IDG, most CIOs consider cybersecurity a top priority, with 65% of companies planning to increase their security budget this year. This increase in demand involves hiring extra staff to tackle cyber threats – a push that will surely accentuate the already severe drought of cybersecurity talent.   

    But all of this effort
    will not translate into long-lasting changes unless organisations institute a
    security-aware culture and take a more strategic and proactive approach to cyber
    protection. And that must necessarily start from the top.  

    Accountability

    Nobody would be too
    surprised if a CEO was ousted after a major financial fiasco. Why would it be
    any different with cyber incidents?

    A Centrify study from 2019 revealed that almost 40% of UK businesses had dismissed personnel for security-related incidents. You can bet not many of those employees were part of their company’s executive team.

    Traditionally, security
    breaches have been considered a responsibility of technical teams and IT
    leaders, who often end up tracing the incident to a reckless employee who accessed
    sensitive information while sipping on a cup of coffee at a local café. Sure, human
    error and shadow IT are behind most cyber attacks, but, like with all systemic
    problems, a real cultural shift requires everyone’s involvement.

    The truth is that technology is too integral to today’s businesses for companies to afford to have leadership that is not directly or at least ultimately responsible for it. Accountability not only ensures better performance; it drives innovation and promotes continuous improvement.

    When an executive’s reputation and livelihood are at stake, they are more likely to push for deeper, company-wide initiatives to address potential cyber threats. They will, therefore, invest more resources in protection and become cybersecurity ambassadors within the organisation, setting into motion a series of changes spanning areas from HR to external contractors and business partners.         

    But to be accountable,
    business leaders first need to be knowledgeable.

    Executive cybersecurity expertise

    Recommending that executives be security-savvy is not to say that CEOs and other members of the board need to have deep technical knowledge of cybersecurity infrastructure and best practices, but they at least must be able to make informed decisions and factor cybersecurity into every key move they make.

    One way to achieve such
    a boardroom environment is to hire executives with an IT background – a trend
    that is quickly gaining traction among the world’s top companies thanks to the
    inherent benefits that a strong technical foundation brings to business
    processes.

    Another is to involve CIOs in the strategic decision-making process. IT leaders have acquired a bigger role since the start of the pandemic, growing closer to CEOs and becoming even more pivotal to business continuity than they were before. Companies should keep moving in this direction.

    Newer IT-focused executive positions can also be created. Unfortunately, the figure of the Chief Information Security Officer (CISO) remains a rather rare occurrence in the c-suite. Although many companies have dedicated IT leaders in charge of cybersecurity, these are often confined to the IT department and do not get enough executive powers and visibility. Elevating CIOs within the organisation would certainly improve cybersecurity.

    But not all solutions
    involve prioritizing executives with a technical background. Training is always
    an option. CEOs and their peers can learn to assess cyber threats and keep their
    company’s cyber resilience in mind when making business decisions. CIOs and
    their team have a key role to play in this training process, sharing their
    experience and actionable insights while delivering periodic security audits to
    inform the executive board.

    Sign up to mission control center newsletter

  • The State of Cybersecurity in 2020

    The State of Cybersecurity in 2020

    A surprising number of things can happen in a minute, especially when it comes to cyber threats and their consequences. Quick overview. The state of cybersecurity in 2020

    Firstly, every 60 seconds, 375 attacks are unleashed upon the global community, costing the world economy $2.9 million. In other words, every single computer with an internet connection is targeted by malicious agents about 1.5 times per minute. A whooping 16,172 records are compromised.[1] Certainly not a promising picture if you are a business leader or oversee a company’s cybersecurity for a living.

    As we celebrate cybersecurity awareness month to promote greater security and cyber hygiene, we would do well to keep in mind that every day should be cybersecurity awareness month. Therefore, we can all benefit from a deeper understanding of today’s most common threats and what we can do to protect our business systems from them.

    Cybersecurity in 2020: the impact of the pandemic

    The already complex world of enterprise security got further intricate with the advent of COVID-19. Also, the sudden shift to remote work has pushed company networks to the limit, opening a myriad of new potential points of entry for attackers to exploit. Additionally, the ensuing fear and confusion have given more leverage to attackers looking to deceive individual employees as a means to gain company-wide access. As they say: you are as strong as your weakest link. And hackers love that.

    Cybsersecurity in 2020: the impact of the pandemic

    Social engineering, the act of tricking someone by using their natural tendencies and emotional reactions, has acquired a whole new dimension of sophistication and finesse. Phishing emails disguised as governmental safety announcements, fake HR memos encouraging you to get acquainted with the office’s new cafeteria policy. And that is just the start two per cent of all COVID-related websites created in recent months contain malicious code. A seemingly small number until you realise there are billions of COVID-19 pages out there.[2]

    Remote work is here to stay, and so are the advanced techniques that cybercriminals use. In fact, they will only get more refined in the months to come.    

    A growing variety of cyber threats – Cybersecurity in 2020

    In addition to the rising complexity of attacks, the sheer variety of techniques hackers use is a top concern for companies and cybersec professionals who are struggling to catch up with an ever-growing catalogue of threats. New forms of mobile malware alone, for instance, have grown 12% compared to last year. PowerShell-based malware, which leverages the Microsoft task automation and configuration management framework to carry out attacks without leaving any traces, grew by 1,902% over the same time period.[3]  

    Also discover our article & interview: Leadership Failure: The Real Human Element Behind Cyber Attacks

    Targeting the cloud

    Cloud has become the backbone of the modern enterprise, and hackers are targeting it accordingly. The rise in attacks is being particularly felt in those industries which depend the most on the cloud for productivity. For example, threats aimed at the transportation and logistics sector increased by 1,350% in the first quarter of the year. Education experienced a 1,114% rise in attacks, with governmental organisations, manufacturing and financial services following behind.[4]    

    The Top 10 Belgian Cloud Pros to Follow on Twitter

    Most attacks are opportunistic in nature and involve the “spraying” of cloud accounts with stolen access credentials. The majority of access attempts came from either China, Iran or Russia. [5] 

    Ransomware-as-a-service

    While phishing and trojans are still behind most cyber attacks, ransomware continues to surge and is perhaps the most feared malware of them all. Its capacity to cripple an entire company’s operations in a matter of minutes, together with how difficult it can be to prevent these attacks in the first place, surely keeps many security specialists and IT managers awake at night. Also, threat actors are becoming increasingly sophisticated.

    What started as attacks
    by individual hackers or small rogue groups has now evolved into full-fledged
    criminal organisations that operate under a ransomware-as-a-service approach.
    Some even have “customer service” helplines to guide victims through the
    process of paying the ransom.

    These hacker groups have greatly benefited from COVID-19, taking advantage of the increase in cloud usage and telework. Half of the world’s organisations were hit by ransomware last year, with most successful ransomware attacks involving public cloud data. Data was successfully encrypted in 73% of attacks.[6]

    Additionally, attackers
    are finding more and more weaknesses to exploit as remote workers and IT
    engineers increasingly use Remote Desktop Protocol (RDP) to access internal
    resources. The higher use of personal devices has also complicated the problem
    of shadow IT, multiplying the potential points of access and making it more
    challenging for security professionals to safeguard company networks.

    ? Subscribe to our podcast

    Join our community and find your next job or expert in IT

    [1] The 2020 Evil Internet Minute, RiskIQ, Inc. (2020)
    [2] 2020 Threat Report, Webroot (2020)
    [3] The McAfee Labs COVID-19 Threats Report, McAfee (2020)
    [4] McAfee Labs COVID-19 Threats Report, McAfee (2020)
    [5] McAfee Labs COVID-19 Threats Report, McAfee (2020)
    [6] The State of Ransomware 2020, Sophos (2020)
  • Pentester

    Pentester

    The pentester is a role related to the field of cybersecurity security. Its name comes from “penetration test.” The main role of a pentester is to ensure the security of information networks and applications (back end of a site, applications, etc.) and protect systems against cyber attacks.

    What is the role of the Pentester?

    Check website reliability

    As the name suggests, the pentester performs tests with controlled intrusions into the company’s computer systems to find possible vulnerabilities.

    Fix issues

    After the testing stage, the pentester has to find and implement solutions to resolve the flaws identified. They will then have to reinforce and optimize the security of the applications.

    Provide advice and guidance

    The pentester also plays an advisory role. They must anticipate threats, put in place best practices and recommend more effective protection tools.

    Required skills

    Programming mastery

    The pentester should be proficient and familiar with programming and web programming languages, cryptography, coding systems, and network security auditing (Python, C / C ++, Java, PHP, etc.)

    An educational vocation

    The pentester must be able to effectively convey encountered flaws to site and application developers. They must therefore be educators with the ability to communicate well with the developers and technical teams, to know how to clearly communicate problems to help manage them as well and quickly as possible.

    Rapid action

    When an intrusion occurs or a security problem is identified in a computer system, it must be resolved quickly. A poorly protected system can be devastating for the business. The pentester must therefore demonstrate reactivity and proactivity.

    Within the industry

    A pentester can progress to a managerial position or any other senior position in the field of cybersecurity. Their job is critical in an IT world where cyber attacks are growing more and more recurrent.

    Salary

    The average daily rate of a pentester fluctuates between €300 and €600.

    Training

    To be a pentester, you usually need to have an undergraduate or graduate degree in an IT-related discipline and demonstrate at least a base level of cyber security knowledge and experience.

  • Weekly News: Artificial Stupidity and Racial Bias

    Weekly News: Artificial Stupidity and Racial Bias

    Artificial Stupidity and Racial Bias: discover our Weekly News about Tech & IT.

    Artificial Stupidity and Racial Bias

    Microsoft’s AI news editor confuses mixed-race singers

    Last week, The Guardian revealed Microsoft’s
    plans to fire the human editors in charge of its MSN.com news portal. Their
    replacement? A new artificial intelligence software. 

    Unfortunately for the company, the decision
    took less than a week to backfire. Instead of delivering proof of Microsoft’s
    AI prowess, the move served as the perfect example of the dangers of AI’s
    racial bias.

    In the midst of a global call for racial equality, Microsoft’s robot editor sparked public outrage when it illustrated a news story about racism with the picture of the wrong mixed-race member of the band Little Mix.

    Lots to think about here.  

    Oops

    Microsoft’s demise might have provided the
    perfect opportunity for IBM to score major PR points against one of its main
    competitors.

    The company had earlier announced it was halting
    its facial recognition initiatives    ,
    citing concerns around racial profiling and surveillance by law
    enforcement agencies. 

    Unfortunately for IBM, only hours later, its cloud platform suffered a serious global outage, bringing down customer websites and other services. 

    Back to square one.

    Don’t neglect cyber security

    Japanese car maker Honda was hit
    by a cyber attack     that
    impacted worldwide operations. 

    The attack, thought by security experts to
    have been caused by Ekans (or Snake) ransomware, spread quickly throughout the
    company’s network, allegedly affecting production, sales and development. 

    Cyber attacks are on the rise since the start of the pandemic, highlighting the importance of having a proper risk management strategy in place. 

    Worried about cyber security? Take these 10 simple steps to protect your organisation.

    News from the frontlines…

    Technology is playing an important role in
    the fight against the virus.  

    The U.K.’s health secretary, Matt Hancock, praised tech’s COVID-19 response during his talk at CogX, an annual global leadership summit focused on artificial intelligence. Hancock declared tech the backbone of the country’s testing program and discussed its upcoming contact tracing app.     

    A new study commissioned by Kaspersky Labs revealed how technology is helping people overcome loneliness by keeping them connected through the pandemic.

    Join our community and find your next job or expert in IT

  • 10 Essential Steps to Ensure Cybersecurity

    10 Essential Steps to Ensure Cybersecurity

    As businesses around the world begin preparations for the return to the office, a shadow still looms over IT departments: cybersecurity.

    At the beginning and height of the pandemic, the surge in remote work and a new wave of malware attacks put extra strain on network and infrastructure security. Now, with some employees staying at home while others go back on-site, these challenges remain a priority.

    In 2012, the U.K.’s National CyberSecurity Centre (NCSC) debuted a series of cybersecurity guidelines that are now used by most companies in the FTSE350. It is never a bad idea for IT leaders and security experts to consider these 10 proposed steps when assessing their company’s overall security measures.

    Define risk management strategy for cybersecurity

    First things first — Make a full inventory of all business-critical assets and infrastructure. Then, make sure you get the full picture of your strengths and weaknesses. Once that is done, IT and senior management should decide together what level of risk can be assumed and outline a comprehensive security strategy. All concerned stakeholders, from staff to partners and suppliers, must be made then aware of said policy.     

    Secure
    configuration

    Then, no one sets out on a journey without first doing a thorough check-up of the vessel. Make sure all your systems and tools are configured properly and that the latest updates are installed. Disable unnecessary functionalities and fix any issues that might compromise your ecosystem.  

    Network security

    The IT network of
    today’s businesses is vast, intricated and somewhat obscure. It combines
    different physical locations with cloud services and remote workers and
    collaborators. In this context, you must think of any and all vulnerable points
    of entry and put processes like VPNs in place to minimise risks.

    Malware protection

    Also, invest in the malware prevention tools, paying special attention to the functionalities offered in relation to your current and future needs. These tools can come in the form of both software solutions and policies regarding the exchange of information.  

    Defining user
    privileges

    Not all employees and users need access to everything in your network. So, split your users into levels and assign different privileges to each of these groups, limiting access to the most sensitive information to a few users. Moreover, it is a simple step that can save you a lot of trouble if an attack gets through, effectively serving as a firewall around the more critical parts of your network.

    Incident management

    In addition, outline and implement a clear process for identifying and managing incidents whenever they appear. When doing so, keep in mind response time and inter-departmental collaboration to ensure a smooth and efficient response.

    User education and awarenes with cybersecurity

    Then, put in place security awareness programs and carry out training when necessary. Human error is still the first cause behind enterprise data breaches. Therefore, simple-to-avoid malware tactics like phishing can be effectively managed by promoting a security-conscious culture across your stakeholders.

    Home and mobile
    working

    Also, COVID-19 has made it more evident than ever that work extends beyond the office doors. Your employee training and awareness programs should include recommendations on how to work remotely in a safe manner. Make sure you complement this approach with the proper software and network security tools like the aforementioned VPN.

    Removable media
    controls

    This is another area
    in which education and awareness play a big role. Removable devices such as USB
    sticks and hard drives are a great conduit for malware to spread. They also complicate
    the safeguarding of any information that is exported out of the system. Awareness
    initiatives in this area should be accompanied by specific software tools and
    policies, like limiting what information can be exported and by who.

    Monitoring

    Finally, remember to
    stay alert. None of the above steps will suffice unless you establish a
    comprehensive and ongoing surveillance system. Set up all the monitoring
    software that you will need to protect your network and train your IT staff to spot
    any irregularities early on.  

  • Weekly News: We’re Okay with Surveillance Tech Now

    Weekly News: We’re Okay with Surveillance Tech Now

    Just a few months ago, criticism was mounting in the U.K. around
    the facial recognition technology being tested by London’s Metropolitan Police
    to safeguard the city streets.  

    Then came COVID-19 and our focus and
    priorities changed. But as many non-essential stores get ready to re-open in
    mid-June, the general public is again facing the dilemma of adopting monitoring
    tech.  

    Only this time is a more contested dilemma.
     

    A recent Intu survey revealed that 60% of shoppers actively encourage stores to implement surveillance technologies that help make shopping safer. The proposed measures include temperature scans at entry points and CCTV to control crowds.  

    It’s not facial recognition. But we’re getting there. No wonder security experts are concerned that surveillance might be here to stay.

    Switching focus to cyber viruses

    One thing can’t be denied about the global
    response to the pandemic: we weren’t ready for it although we had been told to
    expect it.  

    To help avoid future catastrophic mistakes,
    the World Economic Forum has issued a call to action for
    businesses and institutions to prepare for the cyber pandemic we know will
    come.  

    In today’s interconnected world, a global cyberattack with a behaviour similar to COVID-19 (highly infectious and with high rates of asymptomatic infections) could lead to major cyber outages costing $50 billion per day.  

    WannaCry and other large-scale breaches were the wake-up call, just like SARS and MERS foretold the current crisis. Let’s do something about it this time.

    Building a solid AI foundation

    Many are the companies looking to jump on the
    bandwagon of the AI boom. Sometimes even too quickly.  

    Stephanie Overby at The Enterprisers Project shares some counterintuitive tips on how to implement artificial intelligence into business processes. Building a solid foundation is the crux of proper AI adoption.  

    Key points include taking time to evaluate current needs, as well as investing in talent and skills before tools.

    Discover 5 Online Courses to Get You Up-To-Speed with AI

    News from the frontlines…

    This is what the tech world is doing to help
    fight the pandemic:  

    Biotech entrepreneurs are proposing another
    approach to mass testing: biosensors. Different sensor technologies currently
    under development could be advantageous over existing
    testing methods     like the PCR test, providing faster and more
    accurate results. At a privacy cost, of course.      

    Also, a new wristband helps
    avoid blood clots in patients that remain immobilised for long periods of time
    due to COVID-19.    

    —

    ? ? ?

    Finally, tech has always been about
    connecting people. But how about connecting people and animals? Folks in Palo
    Alto have created a website through which you can feed a flock of happy chickens in
    real time    .  

    And don’t worry –
    it’s animal safe, solar-powered and you can even donate money to a pet rescue
    organisation.