Magazine menu Close Magazine menu

Search results

Showing 433 results

insight story digital sovereignty

Digital sovereignty and the rise of data spaces: What does it mean for business?

  • Data and privacy
  • min read
    • Data. It seems businesses can't live with it – without big friction – and can't live without it. Cory Doctorow wrote for Secure Futures in 2020 that data – rather than being the 'new oil' – can fast become toxic waste, without due attention to minimization and proper management. Now data fuels almost every business, it's critical leaders understand the next evolution of data regulation – digital sovereignty – and how it applies to their work. It's not just about complying with the law, but an opportunity for competitive advantage with the bonus of enhancing customer trust. In our podcast Insight Story, experts Ben Farrand (UK,) Professor in Law and Emerging Technologies at Newcastle University and Sille Sepp (Finland,) Director of Operations at MyData Global, explore how business can do better in an increasingly interconnected world. Dr. Amin Hasbini of Kaspersky's Global Research and Analysis Team talks about the role of transparency in digital sovereignty, and why sharing intelligence makes good business sense. What is digital sovereignty, and what does it mean for business? Ben says, "Digital sovereignty is about geopolitics. We're seeing increasing tensions between states and concern over the power of big market players like Google, Amazon and Facebook in the US and Chinese companies like Baidu, Alibaba and Tencent. When data moves between countries, there may be detrimental impacts from geopolitics and national regimes, regulations or policies." Against this backdrop, the EU introduced its General Data Protection Regulation (GDPR) in 2016, providing that identifying, personal or sensitive data about EU citizens kept anywhere in the world is governed by EU law. GDPR and digital sovereignty more broadly mean companies must think about the legal implications of their cross-border interactions. Ben recommends firms wanting to trade more internationally have people dedicated to data security and digital sovereignty. "Companies handling EU citizens' personal data need someone aware of how to comply with GDPR's requirements. In the EU and UK, they're often called data protection officers. They must know data security protocols, and how data can and can't be used." Can state concerns and business interests align? Businesses often don't have the same priorities as nations. Is digital sovereignty making it harder to trade internationally? Ben says, "Digital sovereignty covers the whole supply chain from raw materials to cybersecurity services. For example, when supply chains for semiconductors collapsed during the pandemic, shutting some car manufacturers, the EU, China and the US started seeking more control of resources." But he questions the merit of attempts at strategic autonomy in today's world. Getting ahead of compliance with data ethics Digital sovereignty is on the radar for many businesses, but those who go the extra mile to do the right thing, rather than simply comply, may see advantages. Ben says, "We'll see both 'stick' and 'carrot' regulation. There's much legislation about investment, like the US CHIPS and Science Act, around how companies can cooperate and seek funding to diversify supply chains, for improving trade relations with third parties in ways that build resilience." Businesses should also note a growing focus on regulating social media platforms, given its role in communicating with customers. "The EU recently passed the Digital Services Act. It applies to content on social media platforms and search engines that may be illegal in member states, such as hate speech or trade in prohibited goods," says Ben. The legislation isn't concerned with individual instances of illegal content but requires social media platforms and search engines to have transparency, accountability and oversight systems. Ben sees benefits for business. "Companies don't want to be associated with illegal or immoral things. They already manage this by pulling advertising or moving over to other platforms. Digital sovereignty isn't just coming from regulation, but market-based decisions." AI and digital sovereignty The explosion of AI systems has made it even more important that organizations are clear on data ownership. Ben sees regulation in this field coming soon. "The EU is talking about regulating high-risk systems because they believe AI shouldn't be doing some things." And it's not just the EU. "At the AI Safety Summit hosted by UK Prime Minister Rishi Sunak in November 2023, there was an agreement between the EU, US, China and others to take a united approach in managing high-risk systems." Again, there are business opportunities. "New technologies arise from regulation like the 'federated computing' approach, where you train AI on data sets remotely then communicate only the outcomes centrally, minimizing data privacy risks," explains Ben. Making space for data security and data power All businesses want to use their data better for innovation and growth. But it may be challenging to do so securely, fairly and in ways customers trust. Data spaces are one tool for addressing safe and ethical data use while leveraging its power for better business. Sille Sepp is Director of Operations at human-centered data non-profit MyDataGlobal. She explains data spaces: "They're a systemic approach to increasing trust and sovereignty in sharing and using data across organizations and sectors. It's not just technological infrastructure but includes business, legal and operational layers for trustworthy data sharing." Examples include the Smart Connected Supplier Network for manufacturing supply chains and Catena-X for automotive supply chains. MyData is involved in a cross-data space project, Data Spaces Support Center, and preparing for the Data Space for Skills. Businesses can join projects as a data provider, data user or enabling service, or look at creating their own data space with collaborators. Sille recommends how to start: "As a partner in the Data Spaces Support Center, I recommend exploring the website, the repositories of initiatives and the contributing partners. Associations like International Data Spaces, Gaia-X and FIWARE have long mapped data space work." Data spaces go beyond EU-based businesses. "Many initiatives collaborate with international partners and look at business cases that will bring global benefits," says Sille. Sille highlights the need to put customer control of their data at the heart of developing data spaces. "When developing design principles and architecture for data spaces, we must embed human-centric principles. There are ways to empower people through design choices. Businesses can get involved as enabling services – intermediaries that serve the interests of individuals, managing permissions and returning value to them." Transparency's role in digital sovereignty Dr. Amin Hasbini of Kaspersky's Global Research and Analysis Team explains how tech businesses can use transparency centers to uphold different states' digital sovereignty worldwide. "Digital sovereignty means companies, especially multinationals operating in digital, need tools that comply with regulation in countries where they operate. As an example, Kaspersky operates transparency centers in several countries. These let entities check code to ensure it complies with their laws." But he thinks international firms can go further in building regulators' trust. Sharing also benefits the industry as a whole. "We publish many of our threat intelligence findings, which means better threat visibility for everyone. The cybersecurity community can build on our findings," says Amin. Taking the first steps into digital sovereignty Ben advises businesses to consider the basics as they start exploring digital sovereignty. "What data are you collecting and where does it go? Once you know that, you can think through the implications: Security provisions you may need to protect data within your company and outside. Think first about why you need this data, and that will help you define every step of the process." Let's be super clear: Digital sovereignty, like all matters of global trade, is complex. It's not an off-the-shelf charter or compliance checklist. Enterprises should grasp the opportunity now to get involved with data spaces and other cooperation projects to shape the new international standards for data. Digital sovereignty regulation will only grow – particularly around the use of AI. Businesses should think through how they use data and what security should be in place to safeguard it. Digital sovereignty also presents opportunities for better business, such as through data spaces and transparency initiatives.
two professors teach robot to resolve tasks, tech learning

How to get better returns on business tech investments

  • Digital transformation
  • min read
    • In a tech store, it's tempting to convince yourself you need the latest shiny gadget. That device upgrade will radically improve your productivity. You leave with a bag of stylish little boxes and a dented credit card. Enterprise tech decision-makers also struggle with these magpie-like impulses. Recent research found GE, Ford and other major players poured 1.3 trillion US dollars into digital transformation. 70 percent of it – $900 billion – went into failed programs. That's quite some buyer's remorse. Businesses know they need tech for competitive advantage – but which tech? And when they've got it, how do they use it effectively? In our podcast Insight Story, Olivier Blanchard, Research Director for future analysts The Futurum Group, and Arun Narayanan, Chief Digital Officer at renewable energy service providers RES, share how business leaders can ensure best bang for their new tech buck. Every enterprise is different Olivier says there's no one-size-fits-all approach to getting better tech returns. "A major mistake is picking tools because other companies are using them. A solution might be good for your problem but might not suit your company's technical capabilities and cultural processes." Instead, he suggests figuring out what you need the technology to achieve. "Understand your problems and look for the best solution to help them." Arun, who has overseen digital transformation in several big mining and oil and gas companies, echoes Olivier's belief in starting in the right place. "Don't rush around trying to work out what a technology can do for you. Instead, think about how you want to change your business. Do you want to delight customers in new ways? Make employees safer and more productive? Get better returns for investors? Imagine the business processes, then find the technology to make them work." He gives an example from sectors he's worked in – oil and gas, mining and renewable energy. "What they have in common is the work is in remote places. They now have remote operations centers giving information on screen to those who can do the work but can't spend days to weeks away." But the aim isn't to replace those working on-site. "Successful digital transformation will balance what's operationally correct at a site and what a remote center can know and understand. You can't take all control away from operations, nor can those making minute-to-minute decisions on site examine long-term trends and patterns." Evolution or revolution? Olivier thinks senior leadership can contribute to improved returns by appreciating the size of change possible. "If you want to become more competitive within your existing understanding of your company, then it's about finding problem areas to optimize." Arun suggests one place to start. "You're spending a lot of money on this, so find the waste. For example, if you don't know where the oil is and you're drilling in the wrong location. The business question is, how do we drill more in the right place?" The answer isn't always high-tech. "Once you understand the business question, you'll know what technology to find. If software from the 1990s can solve your problem beautifully, use that. Or if you find nothing available, technology like AI might solve it." Getting the people on side Failing to bring your people along on the tech journey can be expensive. Many fear technology will replace them, with Elon Musk saying there'll be no jobs for people in the future. How can leaders ensure people understand tech is there to help, not put them out of work? Arun says, "When calculators came out, they didn't replace accountants – but they let them do a better job, faster. Generative AI solutions like chatbots and document generators are tools – they aim to do the mundane piece fast, then the artistic, skillful and human piece can follow." Arun has had much experience getting people on board with tech integration in industrial settings. "Technology change will create many new jobs. The economic models will change, jobs will be created and lost." "We'll still need project managers, HR and people who can communicate. You don't need to be a technical expert to take part in the transformation." Olivier highlights that cost savings can flow from upskilling employees. "It's easier for someone to learn a new skill than learn everything about a company from scratch. Focusing on employee retention and development rather than letting workers fall by the wayside makes good financial sense." Cybersecurity education's role in new tech adoption Dr. Amin Hasbini, Head of Research Center Middle East, Turkey and Africa for Kaspersky Global Research and Analysis Team (GReAT,) thinks successful tech adoption means getting everyone up to speed on cybersecurity. But many companies aren't yet doing it. Amin says, "A recent Kaspersky and Longitude study found organizations that emphasize cybersecurity training have 25 percent more readiness for dealing with security incidents from employees." The most effective forms of cybersecurity education are generally immersive. Amin says, "Gaming and VR are great for security training because they allow better engagement and learning. Gamification and competition challenges improve managers and director safeguarding decisions." Some approaches are even more immersive. "The most successful involve simulating a real attack on the organization when only a few people in top management know it's a simulation. They test employee capacity and how well teams cooperate to contain and close down an incident." Training must go beyond the IT team. "Security everyone's job, from desk employees in a remote office to top managers. If everyone is aware, it stops incidents getting big." How much risk is right? Arun says businesses must accept that in making room for success, some initiatives will fail. "If you're reimagining with a bold vision, you're guessing about the future. Some guesses will come true – others won't. If your structure has no room for failure, you sell out the opportunity for innovation." He says one way is to make a few calculated smaller bets rather than one big bet. Even if some fail, it's better than not taking those risks. Olivier points to lower-risk ways to trial solutions. "You don't have to buy all your technology anymore. With cloud services and managed services, fantastic industry partners can help you test, implement or scale up new tech. There's a giant menu of opportunities to get expert help." With enterprises finding many tech investments don't pay off, there's much potential for competitive advantage in smarter exploration of new tech options. Business leaders may find more implementations succeed if they start with the right problems and upskill their people as part of the transformation.
a robot-computer with his eyes like projectors, the robot looks like a huge computer with 'on' button and calculations, a scientist stands by the robot

Quantum computing: Is it time for your business to get involved?

  • Tech for business 
  • min read
    • In Douglas Adams' 1979 science fiction comedy novel The Hitchhiker's Guide to the Galaxy, a supercomputer called Deep Thought takes 7.5 million years to answer the question, "What is the meaning of life?" Unlike Adams' monolithic supercomputer, quantum computers will be like today's fiber broadband compared to 1990s dial-up internet. Google's quantum computer can perform a calculation 158 million times faster than classical computers. Quantum computing's sped-up computations could reshape nearly every industry. But it also has strange quirks that make it hard to use in ways that beat classical computer abilities. At least, that's how things are today. Businesses that value innovation are throwing their hat in the quantum ring to ensure they're ready for sweeping change. Should your business get involved – and if so, how? In Insight Story Season 2 Episode 3, I discuss quantum computing's relevance to business with Dr. Oliver Thomson Brown (UK,) Chancellor's Fellow at EPCC (formerly Edinburgh Parallel Computing Centre,) University of Edinburgh and Dr. Henning Soller (Germany,) Partner and Director of Quantum Research, McKinsey & Company. What is quantum computing? Quantum computers are the next step up from the powerful supercomputers that often power AI applications today. They'll be part of our computing future but have a starting role today. Quantum and classical computers are very different beasts – in fact, they can't even communicate with one another. Quantum data is different, too – for example, you can't copy it. Some quantum computers must be kept at very low temperatures in purpose-built fridges. These features may not sound encouraging, but quantum computers have potential to do some things much better and faster. These abilities could be game-changing in many sectors, including finance, chemicals and logistics. How could business use quantum computing? Despite quantum computers currently being about as sophisticated as the classical computers of the mid-20th century, business is interested. Henning advises companies throughout Europe and the Middle East on large-scale IT and data transformations. He's confident quantum's impact will be huge. "We haven't yet proven a case where quantum computers outperform classical computers, but we're certain this technology will be the major disruption for the business in the coming decade. We estimate economic potential of at least several trillion US dollars." Oliver's research focuses on the interaction of quantum and high-performance computing. He says quantum could help with problems where the solution is a sequence of binary numbers. "That might include logistical problems around deciding where things go. For example, how do you fill beds in a hospital ward? Or flow- or network-type problems, like traffic management. Quantum computers may also have advantages when finding the best configuration for a molecule, like in drug discovery." Quantum might also work well for problems that scale poorly on classical computers. "We're looking at problems in aviation and genomics. Genome assembly scales factorially – with a quantum computer, we may be able to reduce that by a lot." Henning adds, "We could use it for experiments that we need humans or animals for today. We could test chemicals much faster and transact money in different but completely secure ways. Some banks are using it for derivative pricing and Monte Carlo simulations." It's something of a hammer looking for a nail, he says. "It's not about having an advantage today, but being able to exploit the advantage tomorrow." Quantum challenges Oliver says, "Adoption will be driven by how easy they are to use." But today, quantum computers aren't easy to use. "You have qubits, and multiple qubits form a register. Then you set up quantum gates in a circuit that apply to that qubit register and transform it – hopefully – into a state representing the solution to your problem." If you didn't understand that, don't worry – classical computers don't get it either. That's one of the biggest challenges that must be overcome for quantum to go mainstream, says Oliver. "You have results stored as quantum information on qubits in your qubit register, but you can't read that out directly into a classical computer. So what do you do with it?" And that's not all. "You can't copy quantum information. That's great for security but terrible for computing," says Oliver. With technology this imperfect – and let's face it, confusing to anyone without a computer science PhD – the business benefits are less obvious. Henning suggests looking at the bigger picture. "There is value in investing in quantum computing already, but not in profit and loss terms." Is quantum a security threat? A 2022 study claimed that it will soon be possible to crack the most established crypto algorithm by combining classical and quantum computing. It comes down to the role giant prime numbers play in encryption. Oliver says, "The first big quantum computing application was for factoring large prime numbers. It has no practical use except that we use large prime numbers for encryption. But security people now know it's not a good base for security, and they're looking at alternatives. It must be something quantum computers are bad at." Dr. Amin Hasbini, Head of Research Centre Middle East, Turkey and Africa for Kaspersky's Global Research and Analysis Team agrees the cybersecurity industry is one step ahead. "Quantum computing will also make encrypted data harder to hack, but hackers will find ways to adapt as they always have." Henning sees the need for improved encryption as a quantum business opportunity. "Quantum cryptography is a whole new industry. It's a major area of active investment." He doesn't see hackers accessing quantum tech just yet. "This is elaborate technology – not something you can steal and easily operate." Oliver thinks one quantum quirk might foil decryption attempts. "The error rate for quantum computers is huge compared to classical computers. You're likely to hit an error with any big circuit. You'd need a very large quantum computer, and we're nowhere near that." What will quantum computing's future look like? What are the next steps to unlocking the potential of quantum computing? Henning says, "The first machines will be hybrid by design because programming them will require a classical computer. Several technologies will need to come together to operate them successfully. They must intelligently break down a problem into what suits each technology and then put the overall result together." He suggests business leaders embrace the future. "This revolution is coming – not tomorrow, but in a foreseeable timeframe. It may make sense to set up a smaller team to scout the technology and identify use cases. Look for opportunities to partner with quantum startups. Your business can bring the knowledge of problems that need solving." Oliver agrees it's not about having all the expertise in-house. "Build partnerships with specialists who understand how to get the most of it." Quantum computers can't do much today, but their potential is undeniable. Businesses exploring this new realm are investing in a reputation for innovation and the possibility of solving today's hard problems. Difficulty accessing and using the technology should keep hackers at bay for now, but cyber researchers are working on new encryption methods that quantum computers can't crack.
insight story industrial iot a doctor makes an injection to a robot using a wire syringe connected to their smartphone

Industrial ‘Internet of Things:’ Is security too far down the production line?

  • Industrial cybersecurity
  • min read
    • Imagine every part of the workplace – from manufacturing equipment to energy grids, healthcare devices to farms – had the connectivity of a smartphone. That's the Industrial Internet of Things (IIoT) – sometimes known as Industry 4.0. It brings a host of efficiencies, like real-time data-analysis and improved predictive maintenance. But with great connectivity comes great responsibility. IIoT can be especially vulnerable to attack. And while it's now widely used, many businesses know their IIoT systems are poorly protected. In the second episode of Insight Story season 2, guests Chris Kubeska, Netherlands-based security researcher, cyber warfare specialist and CEO of HypaSec, and Alison Peace, patient management operations manager for UK and Ireland at Medtronic, illuminate how industry can use and protect game-changing IIoT. Where is IIoT most commonly used? All sectors are using IIoT, but some more than others. Chris says, "The maritime industry uses IIoT a lot. It's also widely used in the space industry, medical devices and critical infrastructure." Medtronic is a global developer and producer of medical devices and therapies like insulin pumps, pacemakers and implantable defibrillators – all increasingly connected. Alison explains the patient benefits: "In the UK, more than 100,000 patients receive an implanted cardiac device each year. They then have constant hospital checks, which places a burden on healthcare services. Remote monitoring for cardiac devices started in basic form almost 20 years ago. Devices can now send wireless alerts if they detect a problem. Data shows patient outcomes are better – they don't go into hospital as much." Cybercriminals have noticed loosely protected IIoT Despite its relative newness, there have been many documented attacks on IIoT. In 2014 an attack on a German steel mill's IIoT systems killed three people and injured many more. The attacker gained access to the mill's office network then compromised its industrial control system. The compromise prevented a blast furnace shutting down, leading to an explosion. Even without a breach, users finding vulnerabilities in everyday tech means reputation-damaging headlines. At-home stationary fitness bike makers Peloton were embarrassed when a security researcher found their gear included an open channel that allowed access to users' private information like weight, gender and date of birth. Similarly, a hacker accessed footage from Verkada internet-connected security cameras. Securing industrial smarts Dr. Amin Hasbini, Head of Research Center Middle East, Turkey and Africa for Kaspersky's Global Research and Analysis Team (GReAT,) is concerned about the gap between businesses who use IIoT and those who fully secure it. "A recent Kaspersky study found over 60 percent of businesses use IoT. But close to half say these systems aren't fully protected. A third of these organizations blame lack of budget, but when it's not resources stopping them, what is it?" Whatever it is, senior leaders in organizations using IIoT must shift the barriers to best-practice security. Amin says, "Some technology vendors race to add features while largely ignoring security." "The challenge starts at the top in each organization. If security becomes a priority, it gets translated into policies, guidelines and methods." Chris advises thinking about how when security may not be front of mind in your organization's tech decision-making. "Your procurement department will be looking for the least expensive deal, but that deal might not include the best security." She continues, "Many IIoT systems come with older operating systems that don't have the security settings you'd want. And then, there may not be a secure way to update the software. These are some of the risks. Know what you're buying so you can plan ahead and mitigate those risks." Alison says medical devices are now made differently to ensure security. "It's important to incorporate an encryption module to make sure others can't read the device's data. Our devices don't connect to the internet, but use a pass-through to a monitor or app. Data is encrypted in the device and sent encrypted." Alison believes the high standards of institutions they work with helps give patients confidence in their devices. "In the UK and Ireland there are strict controls when health systems engage third parties. You must have rules, regulations and systems in place to work with hospitals." Chris also has recommendations for contracts with third parties. "For encryption, your contract should specify meeting the standards of the time. So when you renew, the expectation is to keep to those standards. Have a responsible disclosure policy, and ensure your suppliers have good data security and privacy policies." She says don't be shy to end a technology vendor relationship if security conversations feel awkward. "If you don't feel comfortable speaking about cybersecurity and privacy with your supplier, look for a new one. Look at suppliers who take part in security conferences. If they're actively looking at security, that gives credence." Is regulation keeping up with IIoT? Chris thinks business should expect regulation around IIoT to speed up. "The tech's definitely moving faster than law, but there are some guidelines and frameworks." Alison feels those designing IIoT must allow for changing security requirements – something Medtronic has strived for. "Our global security office is tasked with making sure our devices comply with standards worldwide. National legislation could say, we want the data from your device in this format, and our devices are designed to enable that." Simplifying a tangled net of things Chris thinks IIoT manufacturers could aspire to lead in many ways, but chiefly, making levels of security simple to understand. "Start applying what I call 'easy standards,' like a traffic light system, so consumers and companies can know if something has a minimum level of security – for example, can it be updated? Medical uses would need a higher standard compared with consumer home grade." Alison agrees that clear and standard practice matter. "A third party can easily comply with clearly communicated, standardized security requirements. Open communication and clear criteria are essential." IIoT is already commonplace and will only grow as those organizations yet to adopt see its potential to improve productivity and reduce costs. As technology becomes increasingly connected, securing IIoT is fundamental to the safety of just about everything in our lives. As Chris warns, "I want to retire knowing my own technology won't kill me." Leaders can keep their organization and customers safe by asking the right questions and pursuing IIoT vendors who prioritize security.
insight story, employer uses generative ai

How businesses can use generative AI to empower employees

  • Data and privacy
  • min read
    • Headlines about the power of generative artificial intelligence (gen AI) are everywhere. But business leaders are asking, is it really that game-changing, or just a fad? And if it is a game-changer, how can you make the most of it? In the first episode of our second season of Kaspersky's podcast Insight Story, I speak with experts Shagun Sachdeva (India,) Project Manager for Disruptive Tech at business intelligence service GlobalData Plc and Karen Quinn (UK,) Senior Director, Brand and Corporate Communications at financial software providers, Finastra. What is generative AI? TechTarget defines gen AI as any "artificial intelligence technology that can produce various types of content, including text, imagery, audio and synthetic data." Some applications rely on Natural Language Processing so users can ask for outputs using everyday speech. Well-known examples of gen AI include OpenAI's chatbot ChatGPT and Google Bard, but current and potential business uses are near endless. Shagun thinks many businesses already understand its importance. "A recent GlobalData Plc survey found more than 50 percent of businesses expect gen AI will tangibly disrupt their industry in the next five years. 30 percent are already using gen AI tools." How are businesses using gen AI? "Business leaders are having more sophisticated conversations about how gen AI can go from an experiment to giving strong returns on investment," says Shagun. "Whether it's chatbots engaging with customers, sharing financial tips and customizing financial plans based on individual spending habits. It's also generating loan options based on a user's credit profile." Finastra plans to develop gen AI tools for customers in future, but they've started in-house with GENAI (X,) a gen AI-based system now rolled out to their 8,000 employees. "We use it for things like understanding and reviewing contracts, predicting behaviors and optimizing workflows," says Karen. She believes that although only being used internally so far, their gen AI tools are benefiting customers. "We can only work with the data we have to make financial decisions. Anything that can generate new scenarios, pull in more data sources or enable federated learning can only benefit." Is gen AI a threat to jobs? Shagun acknowledges employees worry AI might replace them. "Some of that anxiety may be justified – a Goldman Sachs report in March 2023 said AI could replace 300 million full-time jobs." But getting to know gen AI better may help overcome that concern. "Lean in to the technology. Education and training is key. Start with courses like prompt engineering." Karen refers to a quote from economist and professor Richard Baldwin, "AI won't take your job. It's somebody using AI that will take your job." In other words, it's not the technology itself that's a threat to jobs but failing to explore it and take full advantage of it. She advises looking at the benefits of gen AI broadly. "This is not an efficiency play. People will become more productive, but hopefully that means work is more rewarding." Getting gen AI right While generative AI offers much possibility, it also raises concerns around ethics, bias and data privacy. It is largely unregulated today and developing AI models can be resource-intensive. Karen highlights Finastra's caution. "We rigorously tested the products, then launched a full-scale training program and disabled other tools. They're still going through testing, like panels to try and break them and make sure no sensitive data gets shared with the wrong audiences." She continues, "In brand and communications, there are copyright issues. If you're using text-to-image prompts, where is it drawing data from? We need to be very careful." Materials used to train AI are often copyrighted, and whether people or businesses can copyright outputs of gen AI is subject to legal challenges in many countries, with some courts – including in the US and Italy – ruling no, at least in the case of visual arts. Balancing gen AI optimism with realism Shagun feels misinformation is the biggest business risk from gen AI. "It can fabricate 'facts' – what Google researchers call hallucinations." She also recommends businesses pay attention to copyright. "Disputes have arisen between artists and AI companies over the value of human creativity." Data privacy and security also rate highly for Shagun. "Large language models are trained on vast swathes of internet data. There's no data protection embedded in these systems by design or default. Training data can fail to include women, older people or marginalized groups – that's an ethical challenge." Security and generative AI Amin Hasbini is Kaspersky's Head of Research Center for its Global Research and Analysis Team (GReAT,) Middle East, Turkey and Africa. He says many employees are already using freely available AI tools, potentially without their employers knowing. "In a 2023 Kaspersky study, we found 57 percent of workers are using generative AI to save time. This raises many security questions. What kind of data are they putting into it? Is it intellectual property, code or documents to summarize? That's a major concern." Cybercriminals are also using generative AI to help them fool people with more realistic fake websites. In 2022, Kaspersky's anti-phishing system blocked more than 500 million attempts to access fraudulent websites – a doubling of attempts in the previous year. It's likely cybercriminals are already using generative AI chatbot ChatGPT's ability to produce convincing texts to create automated spearphishing attacks – phishing targeted at specific people. To protect against generative AI-based threats, Amin advises, "It starts with awareness. Employees need to know their organization's boundaries around putting data into AI websites. Businesses need enterprise cybersecurity solutions that allow monitoring and control of devices, systems and data used within the organization." Leading employee cybersecurity awareness approaches include implementing a cyber champions program or targeted education as used by Heathrow Airport. Gen AI's future potential What kinds of applications for gen AI will we see businesses pursuing in the near future? Shagun believes what businesses do today will decide the future of gen AI. "The world will look completely different by 2030. Global Data Plc estimates the AI market will be worth around 900 billion by 2030. But that doesn't mean carelessly diving in. "Gen AI is no magic bullet. While the enthusiasm around it is justified, prudence is imperative. We need responsible innovation," says Shagun. Karen imagines gen AI helping to make markets fairer. "Gen AI has incredible potential to overcome inefficiencies, like small-to-medium business (SMB) access to trade finance. Gen AI might be able to generate or automate some of the processes for onboarding smaller companies into global trade, opening them up to a wider audience." She also thinks gen AI could help solve some of the problems it's been known to introduce. "It can help identify bias through explainability and ensure we close feedback loops that cause biases. It could also look at efficiencies in supply chains, contracts and communications and marketing. It can take out some of the drudgery and enrich the processes." "We're on the cusp of understanding what gen AI can do," Karen says. "Who knows what the future brings? This could be game-changing in ways we can't even imagine." Like Karen and Shagun, as a creative marketer, I'm drawn between mostly optimism and a little fear about what gen AI will bring. As I wrote following a gen AI talk for marketers where I heard about Karen's exceptional AI program at Finastra, I'm optimistic we can do it right. Having the training, technologies and policies to bring the whole organization on the journey, we can use this tech to free us by shifting mundane tasks down to these somewhat smart bots. But in that shift, we may narrow opportunities – particularly for talent entering our industries – to refine their craft and learn the difference between average and distinctive output. Refined talent that generative AI lacks. For now, anyway.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • Leadership
  • min read
    • Cyber incidents continue to rank as the top risk for Financial Services companies. With 57 percent of banking executives saying their primary cybersecurity concern is phishing attacks targeting employees,  cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. According to Forbes, business-reported cyberattacks keep rising each quarter. Meanwhile, "The cyber skills gap continues to widen, with 3.4 million vacancies for cyber pros globally this year, up from 2.7 million in 2021." Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Forbes reports phishing, malware-spiked emails, social engineering and compromised credentials account for nearly 30 percent of cyberattacks. As all these are linked with lack of employee cyber awareness, everyone getting up-to-speed on today's cyberattacks could prevent many attacks. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up While the C-Suite's involvement is crucial in setting the tone and providing resources, the real strength of a cybersecurity culture is in the entire workforce's commitment and enthusiasm. Robust protection against cyber threats means building a cybersecurity culture from the ground up. Within a good security culture, people engage with cybersecurity, leading to growing awareness which reduces business vulnerability to attack. When staff feel invested in the organization's security, they become its first line of defense. When you foster a sense of joint initiative, employees at all levels help build the culture and security becomes ingrained in their daily practices. UCL Department of Security and Crime Science lecturer, Ingolf Becker, says a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries