Magazine menu Close Magazine menu

People investment sees off cyberthreats

New research by Kaspersky in partnership with the commercial department of the Financial Times finds enterprises that invest in cyber-skills have better security outcomes. Find out how to strengthen security by putting cyber-learning at the heart of your strategy.

Selected articles

industrial cybersecurity training

Industrial cyberattacks are on the rise. Technology and your people can stop them.

  • Digital transformation
  • min read
    • The industrial sector didn't have much cause for cybersecurity before. In the 20th century, there were few computers and little use of the internet in the manufacturing process. The internet of things (IoT) and the rise of operational technologies (OTs) – automated systems responsible for operating machinery safely – has changed all that. With fatal cyberattacks on the rise, it's time to take your cybersecurity seriously and work with your people to help minimize the risks. Digital transformation is transforming cyber-threats As manufacturing plants and sites are becoming more digital, cyber-threats are growing. There's a significant rise in devastating cyberattacks, for example, ransomware like LockerGoga crippling industrial organizations, either by shutting down operations or demanding costly ransoms. The good news? There are simple steps to take, which can limit the chances of it happening to you. Corporate revenge? Hackers for hire? Cyberwarfare? Collateral damage of malware? Motivations and reasons behind industrial cyberattacks vary, but the stakes are sky-high for plants and businesses. If industrial OT systems are hacked and large machinery is compromised, there could be fatalities. Triton: Why industrial cyberattacks could cost lives Let's explore a previous industrial cyberattack. Triton is malicious software (malware) used to target Triconex, a Safety Instrumented System (SIS) – sensors and software to reduce safety risks in industrial settings – used in power stations and petrochemical plants. In 2017, hackers attacked a Saudi Arabian petrochemical plant with Triton. But, luckily (and somewhat ironically), a bug in the malware halted the attack in its tracks. The hackers' intentions were unknown, but the infiltration of the system could have put the plant and its workers in jeopardy. Could it have been stopped otherwise? Yes, but only with the right cybersecurity measures. There's a significant challenge here: IT security is new to industrial workplaces, and it's only been a requirement in the last decade; in some cases, it's non-existent. Plus, many IT teams and engineering squads don't have the training to work effectively together to spot a threat that's unfolding in real-time. OT engineers may be unaware of how to detect the signs of an attack and look for other faults like machinery, human error or asset misconfiguration. Want to protect your business? Update your security systems and start training your workforce. How to minimize the chances of a cyberattack Let's explore how to defend operational technologies (OT) that operate machines and make them easier to manage and monitor plant safety, among other things. To start, you need an industrial endpoint security product – software that can help you protect all your devices and network from hackers. This is crucial. Once you have this, you need to use all the endpoint features effectively (this is called system hardening) to make it harder for hackers to get into your network. Also, use an OT network security monitoring solution (this is usually hardware) to detect the signs of attack on controllers and other equipment. Why training employees to be cyber-aware is crucial for defending your business Kaspersky reported 52 percent of enterprise breaches happen after employees' inappropriate IT use. With lives at stake, when it comes to cybersecurity, your employees need to know not just what to stay away from but how to keep secure. Here's how. Train everyone in cybersecurity It's not just IT teams that need cybersecurity training; everyone from engineers to finance managers need it. But, that said, your primary focus should be with your IT and IT security teams. OTs are typically not in their remit. They need time to learn how to secure them and work alongside operational engineers. Everyone is responsible for preventing an attack. Book in time to train everyone. Differentiate the training for IT, engineers and operations. Engineer, operations and other groups need theoretical teaching and practical exercises but pitched to their level of expertise. For IT security teams, exercises should include red and blue teaming. Red teams try to attack your organization while the blue teams defend it. This is an attack simulation using real-world cyberattack scenarios and case studies, like the 2015 attack on a Ukrainian power grid. Here, hackers orchestrated a spear-phishing attack to gain access to the operating system, then disabled power across the affected regions for between one and six hours. It's a practical way to assess the capabilities of your cybersecurity team. Lockdown activities on corporate devices Engineers or other personnel may use work devices outside the plant, like when traveling to meetings or other sites. They will most likely use corporate devices for personal use. By browsing social media on a work laptop, employees are exposed to different materials that could be malicious. Using USB sticks from outside your organization can carry a significant risk of bringing malware into your network. Explain the importance of using work devices only for work and not personal use. Retrain and refresh Retraining is critical, especially as your organization continues its digital transformation. People forget things, especially if it's not a day-to-day task. To keep protected, your education efforts must be consistent, not just one-off. The future of industrial cybersecurity As the industrial sector evolves, technology like the internet of things (IoT) will become more critical to the success of the industry. Industrial IOT and smart sensors could enable anything from control systems automation to predictive maintenance. As the industrial sector becomes more connected, it will benefit society and improve business productivity. But, like any technological shift, cyber-threats will evolve with it. By taking measures to secure your technologies and educate your employees, you minimize the chances of falling foul of a cyberattack, saving money and lives.
Security Awareness

How to build a better cyber-aware culture at work

  • Small business
  • min read
    • Your employees are one of the biggest risk factors when it comes to your business and cybersecurity. You can lecture them, make them take online tests, even install software on their machines, but one rogue click on a phishing email could cost your business dearly. The answer: build a robust cybersecurity awareness culture to keep your business safe. When was the last time you inspired your employees about cybersecurity? You might've given a presentation, or delivered a series of online tests for people who, most probably, didn't pay it their full attention. Ask yourself, if you said "cybersecurity awareness session," would employees A: be excited and engaged, B: see it as a chance to switch off, or C: be more worried about pressing deadlines to pay full attention? If you answered A, well done – you're already building a cyber-aware organization. If you answered B or C, you need to change the dynamic from one-off training to a more embedded cultural of cyber-awareness. Culture, not lectures I worked at a firm years ago, one of their biggest rules: the phone never rings a fourth time. So for every member of staff, as soon as we stepped into that office, we knew the drill. And nobody had to teach new members of staff to do it – they could see for themselves what was expected of them. We just did it instinctively. It was part of our culture which became a habit. Think of cybersecurity best practice like clearing out your cupboards – you do it once, but inevitably you'll need to repeat it on a regular basis. Or to get more specific, it's like putting anti-virus software on a computer and never updating it. Strong cybersecurity cultures aren't built on one-off lectures about how dangerous the cyber-world is, they're built on engagement and habit. How to engage your employees and protect your business Firstly, if you have the funds, invest in IT talent. By appointing someone who's in charge of protecting your business, monitoring threats and educating your staff, your business will be better equipped to deal with cyberattacks. And make sure your IT teams have the training in threat intelligence and the right technologies in hand to spot and act on threats. But what if you're a small medium-sized businesses (SMB) with limited resources, and perhaps none or few dedicated IT specialists? Think bite-sized: small, but frequent. As you build momentum in the office, people will become more aware of what you're trying to do. For example, a poster with five ways to stay cyber-safe will catch people's eyes if you put it somewhere public, like the kitchen sink – next to your other safety at work signs. Or think about your procedures. As spear phishing emails – in which hackers assume the identity of a member of your staff – become more prevalent in targeted attacks. Giving multiple people the responsibility to sign off financial transactions, could stop identity thieves in their tracks. Rewarding colleagues and employees can go a long way too. Who has reported the most phishing emails, for example? A gift voucher prize should keep everyone keen to report them. And while you're at it, encourage other more security awareness practises in the workplace, like questioning when unknown people are in the building, and avoiding digital clutter like confidential information on the printer or unsecured data sticks. Ultimately, the most effective way to build a better cybersecurity culture is regularity. My top tip: run short activities often – lessons, tests, simulations, even treasure hunts or a meeting room transformed into a 'cyber-escape room' for the day. Frequently give employees a digestible amount of information. They'll get small enough bites of information to integrate into their daily work while building a foundation for a strong cybersecurity culture. The result? Stronger protection for your business. For more tips on security awareness and workplace cybersecurity best practise, read an interview with Barton Jokinen, Kaspersky's Head of Information Security and Compliance for the Americas.

Report: Three steps to superior cybersecurity

  • Enterprise cybersecurity
  • min read
    • The threat of cybersecurity weighs heavily on enterprises now more than ever. Technology researchers Gartner say new ransomware models alone are the biggest emerging risk organizations face today — bigger than the pandemic and supply chain disruption. But new research from Kaspersky in association with Longitude, a Financial Times company, shows enterprises are not prepared. Less than one in 10 are very well prepared to deal with cyberattacks by professional cybercriminals (9  percent,) lone hackers (7 percent) and nation states (6 percent.) The research surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. Respondents, representing companies from many regions and industries of at least 1,000 employees, were those who knew their organization's cybersecurity strategy. Enterprises unprepared for cyberattacks "Most people are completely unprepared," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "Every day, something changes: There's a newer, better virus, a new technique, a new modus operandi. It's impossible to keep up with everything, and that's frightening for everyone." Delaney is more prepared than most, with her company's security credentials and her background at the Defense Intelligence Agency conducting clandestine intelligence operations around the world. According to Kaspersky's research, the main reason companies are not prepared is reliance on legacy technology vulnerable to today's threats. They also lack financial resources to recruit or consult skilled security professionals. The risk is real, and companies are not prepared. What can they do? Kaspersky's research shows three things they can change for better security outcomes. Step 1: Make cybersecurity teams more diverse Diversity and inclusion is high on the business agenda, thanks partly to movements like #MeToo and Black Lives Matter. There's also a strong business case for it. Research by management consultancy McKinsey & Company shows companies in the top quartile for gender diversity on executive teams were 25 percent more likely to have above-average profitability than those in the bottom quartile. Businesses expect cybersecurity to benefit from diversity too. In Kaspersky's research, most enterprises (62 percent) believe creating a more diverse and inclusive cybersecurity team will be important in the next two years. They're right to focus on this because there's a long way to go. Figures from the UK National Cyber Security Centre show 85 percent of professionals working in cybersecurity are white and 66 percent are male. Kaspersky's research finds cybersecurity teams benefit from being more diverse and inclusive. A fifth (20 percent) of respondents strongly believe they're actively improving diversity and inclusion in their cybersecurity teams. The data shows this small group, which Kaspersky calls the Diversity Leaders, is much better prepared to deal with a range of cybersecurity attacks. Kaspersky's Diversity Leaders have also been quicker to learn from the pandemic. They are more likely than others to be planning for a major crisis through real-world cyberincident training (68 percent of Diversity Leaders versus 54 percent of the rest.) There are more than three million unfilled positions in cybersecurity globally, according to cybersecurity professional organization (ISC)². Darren Argyle, group chief information security risk officer at international bank Standard Chartered, believes improving diversity on teams can help fill vacant spots. In 2021 Standard Chartered launched its Cyber Acceleration Programme (CAP.) About 50 women have participated so far. A 'skill-up and scale-up' program, CAP provides junior and mid-level women with self-paced modules on cybersecurity and leadership. On top of the learning modules, groups of up to ten women are assigned to senior cybersecurity leaders and undergo a 12-week mentoring program. "We're creating a leadership framework that women can engage with," says Argyle. "They work with role models in the bank, who are predominantly women, on areas they might want to develop." Step 2: Closely integrate the C-suite with cybersecurity teams C-suite (senior management) leaders have broad and high-level remits, while cybersecurity professionals focus on the details of cyberthreats. They are not obvious partners. But Kaspersky's research shows that when enterprises build strong links between the two, they experience better security outcomes. A quarter (26 percent) of respondents believe strong integration between the C-suite and cybersecurity teams will be very important in the next two years. The data shows this small group, which Kaspersky calls the Integration Leaders, is better prepared to deal with cyberattacks. UK IT giant Softcat closely aligns its C-suite and cybersecurity teams. Responsibility for risk — including cybersecurity — ultimately rests with its CEO, Graeme Watt. "I am the key stakeholder for security within the board. I have a Chief Information Officer (CIO) who reports directly to me, and the information security team sits under them," he says. "I am the person the board looks to on cyber risks, but I don't do all the reporting myself. I bring the CIO into the board meeting when we're talking about cybersecurity risk." The company faces scrutiny of its cyber risk status from many sources. As a public company, it is subject to external audit. It has its own internal audits. As an IT company that offers security products and services, its reputation among customers depends on its own security standards. Watt works closely with its cybersecurity team to ensure standards are met, but elsewhere in the Softcat C-suite other leaders also have responsibility for cybersecurity. Indian manufacturer Shriram Pistons and Rings takes a similar approach and keeps its security expertise close to the C-suite. 'Shop floor' digitization is a priority for the company, and it plans to use the internet of things (IoT) extensively across its facilities. Its chief digital officer Prashant Khairnar, hired to drive digitization from 'shop floor to top floor,' explains that the leadership team takes security seriously. "When we do risk assessments, cybersecurity is always the top concern," he says. "Of course, I am not a cybersecurity expert, but the person who handles this area is, and he reports directly to me. I take a more strategic view, and he focuses on day-to-day security and the technical issues." Cybercrime is increasing rapidly. Data from technology market analysts Canalys shows 30 billion data records were stolen globally in 2020 – more than the previous 15 years combined. Evgeniya Naumova, executive vice president of corporate business at Kaspersky, says the rise in cybercrime has made the C-suite wake up to the threat. "I think the importance of information security was highlighted to the C-suite and top management during the Covid-19 pandemic," she says, suggesting the increased security risks of remote working captured leaders' attention. "There was a switch — a really obvious switch — in their minds. They understood that it's not just something to observe from afar — it needs to be top of their minds." Step 3: Invest in high-quality cybersecurity training It's no secret that a skilled cybersecurity team is essential to fighting cybercrime. But with four million unfilled vacancies in cybersecurity globally, there is a major skills shortage. A third (34 percent) of companies in Kaspersky's research believe the shortage will get worse in the next two years. Skills and training programs help fill this gap. But to stay relevant, these schemes must be kept up to date. The Kaspersky research identifies a very small group of companies, eight percent, that strongly believe their cybersecurity training programs can keep pace with the evolving threat landscape. The data shows this group, which Kaspersky calls the Skills Leaders, has better security outcomes. Continuously updating skills and training programs eventually helps to make security part of the company's culture. This is essential, according to Vaillance's Delaney. And she thinks continuous training on basic cybersecurity principles is a good place to start. She continues, "Employees need to keep their software up to date, understand what the VPN is and how to use it and not use public Wi-Fi, for example. These are general cyber hygiene best practices critical to maintaining security." Kaspersky's Skills Leaders are more likely to innovate around their training. Two-thirds of Skills Leaders (67 percent) believe it will be very important to carry out immersive cybersecurity training in the next two years, compared with just 49 percent of the rest. The Skills Leaders are also more likely to embed cybersecurity awareness into their recruitment and onboarding process. Another innovative way to fill the skills gap in cybersecurity teams is to recruit from competitors, according to Standard Chartered's Argyle. But to do this, companies must adapt how they work. "If you look at the skills we want to try to attract into organizations around cybersecurity and technology, a lot of those skills don't necessarily sit in another bank," he says. "They sit in fintechs, technology organizations and cloud companies. So we need to be able to offer the same working environment as a large technology company like Google, Amazon or a fintech. And that's a very different way of working." Kaspersky's Naumova says security is every employee's responsibility. "We offer educational courses on how to change the behavior of everyone in the company," she says. "It's not just something the information security team should care about. It's the responsibility of everyone." She adds that companies must take a top-to-bottom approach to security, so everyone learns. "Some companies have an information security director or similar on their board," she says. "They promote them there because they understand they can lose business in a single day if security isn't done properly." The three steps create a virtuous cybersecurity circle Kaspersky's research shows enterprises are better prepared against cyberattacks if they increase diversity in cybersecurity teams, improve collaboration between the C-suite and cybersecurity teams, and invest in quality skills programs. But developing these in isolation is not the answer. The research shows each factor complements one another. For example, Kaspersky's Skills Leaders are more likely to create diverse and inclusive cybersecurity teams and integrate their C-suites and cybersecurity teams more closely. It's a virtuous circle that increases cybersecurity preparedness. The threat landscape is evolving quickly, and cybercriminals are becoming increasingly sophisticated. Businesses have no choice but to match sophistication with extreme preparedness.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • Data and privacy
  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
financial times report cybersecurity skills

Why successful companies invest in cybersecurity skills

  • Leadership
  • min read
    • Arming your cybersecurity team with the right skills and experience is a crucial first step in facing down threats. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found a small group of companies strongly believe their cybersecurity training programs can keep pace with the ever-changing threat landscape. Dubbed the Skills Leaders, these businesses have better security outcomes. About three-quarters (74 percent) say they're prepared for employees accidentally creating a cybersecurity threat – such as falling for a phishing scheme – compared with only half (49 percent) of the rest. This is good news, because cybersecurity skills are in short supply. In 2021, Microsoft announced the US is facing a cybersecurity skills crisis, citing that more than one in 20 of all open jobs in the country require cybersecurity skills. In the same year, research by Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG) found 95 percent of cybersecurity employees globally believe the skills gap has not improved in recent years. Our research found one-third (34 percent) believe this shortage will get worse in the next two years. But the Skills Leaders are a small group — just eight percent of the research sample. How can more organizations follow their lead? Three ways to upskill your workforce in cybersecurity 1. Train everyone, not just IT It's not just the cybersecurity team that should be on constant alert for threats. Employee-wide updates and reminders help make security part of company culture. "People need to keep their software up to date, understand how to encrypt their internet traffic and not use public Wi-Fi," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "These are general cyber hygiene practices, and they're critical. Reducing human error is crucial. Technology researchers Gartner predicts that by the end of 2025, more than 99 percent of cloud breaches will arise from preventable user misconfigurations or mistakes. One way to reduce these errors is to introduce cybersecurity 'tests' to see how employees respond to threats and increase training for those who fail them. This is what Ricardo Lafosse, Chief Information Security Officer (CISO) at Kraft Heinz, does. "It's probably one of our best ways to see whether a malicious actor could mislead our employees and get into our organization using phishing techniques," he says. 2. Update your coaching techniques Training must also move with the times to keep up with the evolving threat landscape. The Skills Leaders identified in the research seem to understand this. They're more likely to be forward-thinking with their training. About two-thirds (67 percent) say it will be very important to carry out immersive cybersecurity training (gamification and simulations to recreate real attacks) in the next two years, compared with less than half (49 percent) of the rest. "Cybersecurity training is often perceived as a formality, but one-off training is not enough," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. "Behavioral change won't appear with the wave of a magic wand. It takes commitment and practice for acquired skills to become habit. Continuous learning is especially important for enterprises to prepare teams for the evolving threat landscape." Staying up to date also means being able to change strategy fast. To combat new threats as effectively as possible, Kraft Heinz's Lafosse prioritizes agility and flexibility in his cybersecurity team. 3. Put cybersecurity at the heart of recruitment Upskilling in cybersecurity will inevitably involve addressing the skills gap. And that could force companies to take an innovative approach to recruitment, like hiring candidates with non-IT backgrounds. The research found the Skills Leaders are more likely to embed cybersecurity awareness in their recruitment and onboarding processes, stressing the need for high cybersecurity standards from the start. Enterprises with a multinational presence must ensure they approach cybersecurity consistently across their global operations. It only takes one cyber threat in one region to potentially wreak havoc across the whole organization. The skills gap is a big challenge for enterprise cybersecurity teams. To be protected against the full range of evolving threats, enterprises must do all they can to fill it. That means expanding recruitment, preparing their existing workforces by keeping them abreast of changes and training them right from the start.
disinformation technology

Can AI help mend trust in business damaged by trolling and fakes?

  • Artificial intelligence
  • min read
    • In 2021, artificial intelligence (AI) might have finally become better than humans at being human. A study found people trust AI-made fake faces more than real people's faces. The researchers warn their findings show widespread use of AI poses a threat to the public. They recommend stronger safeguards restricting code to those with good reason to use it. As deepfakes and manipulated imagery increase, we've seen a counter-balance in businesses wanting to communicate with customers in a more authentic voice. This also means rooting out manipulated sentiment and trolling, so we see governments and brands contracting tech firms to reveal those spreading disinformation on social media. Could we get better at spotting fakes? In a world where four in ten teens can't tell the difference between fake and real news, rebuilding trust must be a business priority. But how AI technology has advanced makes it complex. It's now easy to create many synthetic images and videos using AI systems that analyze thousands of real images to learn how to make fakes. In the past, that workload would've needed many trained people. The FBI recently alerted that HR managers have spotted people using deepfakes to apply for remote jobs. But why? "Fake employment applicants may be hoping to access and hack the hiring company's IT systems," says Kaspersky senior data scientist Dmitry Anikin. "It's happening, but today, it's hard to do well. Making a high-quality deepfake needs much data and computing power, especially for online meetings. We should prepare for the threat to grow, because technology doesn't stand still." Fighting to maintain online credibility All business relies on trust. So how can business operate with the albatross of fakery hovering above? Luckily, companies like Truepic offer solutions. Truepic's software development kit (SDK) integrates with apps that rely on images, verifying media in real time. It checks image metadata – like when, where and on which device it was created – then cryptographically signs it, embedding validation in the file. This lets businesses on the back end know if content is real or synthetic. Truepic's clients include credit reporting company Equifax and car manufacturer Ford. When Ford pays out on a warranty claim, they need to know if car parts or damage photographs are legitimate or have been manipulated or pulled from the web. Brown says tagging tools like Truepic come at a time of brand and consumer frustration with social media companies doing little to stem disinformation. "We're in that sea change now. A consumer push for authenticity is starting to pressure social media platforms to take notice." But firms like Truepic aren't sitting on their hands waiting for Facebook, Twitter and TikTok to act differently. Truepic belongs to Adobe's Content Authenticity Initiative (CAI), a community of tech companies, media, non-government organizations (NGOs) and others promoting an open industry standard for proving content authenticity. This year, Adobe released a three-part open-source toolkit to help get trust-building technology into developers' hands faster. Rooting out social media trolls ZeroFox, Astroscreen and Cyabra use AI to identify disinformation disseminators and 'sock puppets' – fake profiles creating an illusion of wider support for (or opposition to) an idea or company. Cyabra calls itself a "social media search engine designed to track and measure the impact of fake accounts." Companies like Cyabra recognize social media platforms aren't doing this enough. Rafi Mendelsohn, vice president of marketing at Cyabra, says, "We look at the 'breadcrumbs' to find out if an account is real or not." Breadcrumbs might be, for example, a user posting 23 hours a day or multiple users Tweeting the same text. Brands using Cyabra include Warner Media, which faced a deluge of Twitter trolling when they announced the first female-led superhero film, Wonder Woman, in 2017. "We helped Warner recognize authentic enthusiasm for the film and what was false," says Mendelsohn. Cyabra works with Brazilian, Colombian and US state governments to track fake narratives leading up to major elections. Mendelsohn notes, "Human analysts have done this work for years, but we can do it at scale with AI." In the highly publicized battle between Elon Musk and Twitter, Musk contracted Cyabra to find out how many Twitter users were fake before confirming purchase – their analysis found about 11 percent. Towards a more authentic internet Those studying distrust online have found language is important in identifying disinformation. Victoria Rubin, associate professor of information and media studies at University of Western Ontario, has tracked disinformation spreaders for several years and noticed some hallmarks. "Those who lie don't often reference themselves in posts and prefer to use 'they' in language." She says fake news and election lies spread fast when people don't look critically at what they see. It's common – haven't we all reacted to a news item after just reading the headline? Disinformation isn't going anywhere soon, so to attack it requires greater vigilance. Those I interviewed said education and company responsibility must be part of confronting it. They agree we must teach people how bad actors use new technologies to fool us something's real when it's not. Platforms like Twitter and Facebook must also do as much as possible to rebuild trust, says Truepic's Brown. "Our big-picture goal is an internet with built-in authenticity infrastructure, so everyone has the right data to make decisions that affect their lives."

Explore Kaspersky Enterprise cybersecurity solutions

No matter your structure or level of cybersecurity expertise, our stage-by-stage enterprise solutions will keep your business and workforce protected.

Explore now
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries