Magazine menu Close Magazine menu

data security

Latest stories

cybersecurity new team sport

Why cybersecurity is the new team sport

  • min read
    • The pace of technological change is accelerating, and we readily adopt its many advantages. But despite this massive technological change, approaches to the threats it brings have changed little. The result is, we're losing the battle against constant attacks and breaches. For CEOs and Chief Information Security Officers (CISOs,) history may supply an answer – not in the form of technological genius, but in the form of humanity. Our recent history and deepest past show why cybersecurity must become the new team sport. The futuristic wild west of IT When I started working with computers in the early 1980s, they were controlled by men with beards in woolen tank tops. They ruled from a refrigerated IT throne – refrigerated because the IT team would often share the room with servers that need to be kept cool – knowing everything that went on in their realm. If something happened that was not allowed, it was fixed and hidden from the outside world with a combination of embarrassment and corporate secrecy. Today, we're in more of a futuristic wild west. The business perimeter contains many more applications, devices and entry points. Specialist 'gun slingers' – in the form of CISOs – have the IT administrator's security responsibilities. Each tries their best to cope with the onslaught of potential threats – anything from a nation-state attack to an employee accidentally sending data somewhere they shouldn't. Start-up mentality not all it's cracked up to be "Fail fast" and "move fast and break things" are often hailed as mantras of tech start-up success. But history also shows bad people have these same mentalities. They don't worry about due diligence or putting new ideas and technologies through rigorous testing. They try anything they think will work without considering if it will breach compliance. Meanwhile, budget, resources and red tape often tie CISO hands. They can feel held hostage by a board that doesn't understand the need for rapid reaction to combat the latest advance in 'dark tech.' We've seen this challenge before Up to now, I've described a futile, dystopian, 'Mad Max' world. But I think the battles CISOs fight today are our history, not of our future. Companies, and those in cybersecurity, often call their critical data and intellectual property the 'crown jewels,' referencing the ceremonial treasures acquired by English kings and queens. Those crown jewels are protected by thick walls, with guards and few entry points – like how IT administrators guarded our data back in the 80s. CISOs are inevitably 'outgunned,' under-resourced and underfunded in a battle against an agile and risk-indifferent enemy. So how do we 'fight the good fight' and win? Again, history has answers. Early 1900s business theorist Harrington Emerson is sometimes paraphrased, "Methods are many, principles are few. Methods may change, but principles never do." So let's go back to first principles. We're stronger together Humans first formed settlements as they started farming some 14,000 years ago. Having individuals in these settlements with different skillsets and abilities facilitated their growth. Some of us have an aptitude for the cerebral, like designing and inventing. Others are more physical, excelling in building and protecting. Settlements developed when we used complementary skills to advance a common goal, like making a safer, more prosperous place to live. Settlements collaborated – sometimes merging, sometimes building coalitions. And in times of crisis, while a few favored 'everyone for themselves,' most joined together for the greater good. Charles Darwin said, "It is the long history of humankind (and animal kind, too) that those who learned to collaborate and improvise most effectively prevailed." History has countless examples of international teamwork, from expeditions into unchartered territory to the allied nations of World War II, and more recent history. COVID-19: Each taking on a little During the recent COVID-19 pandemic, as individuals, we took precautions to keep ourselves and our families safe. But our actions of self-isolation, social distancing and complying with lockdowns knowingly served to protect society. Some countries legally enforced these measures. In others, it was a request. Regardless, most adhered, each playing their part by taking on a little of the responsibility to keep everyone safe. Eventually, the infection rate dropped and with much help from modern medical science, the world could open up. During the pandemic, countries teamed up, sharing information about infections – different strains, different consequences and symptoms. The data grew as individuals and teams combined findings, leading to the creation of vaccines to reduce the impact of the virus. It didn't stop there – sharing goes on, so vaccines can be tweaked to ensure continued efficacy. Extrapolating from this, the roadmap for cybersecurity should see the CISO as part of a team – not just within one organization, but within a global network, openly sharing intelligence and insight. On the other side of the planet, a CISO who has seen similar adds more context. As the chain passes from CISO to CISO, value increases. Quantity and depth of data grow, like crowdsourced security. This level of open collaboration may sound far-fetched, but intelligence agencies worldwide have shared information on threats similarly since September 11, 2001. This operating model may be closer than we think. CISOs already attend lunches or drinks where they swap 'war stories' under the Chatham House rule: You may use the information, but you may not disclose its source. Cybersecurity researchers in different companies and institutions worldwide combine their findings, writing shared reports. We already collaborate this way, instinctively reaching out for help, as we did in the days of early human settlements, but mostly we do it individually. Corporate legalities and organizational culture tend to restrict rather than encourage inter-company information exchange – it doesn't have to be that way. History shows collaboration naturally happens between groups with a common cause, and today is no different. By encouraging CISOs, staff and researchers to exchange knowledge and skills through a system for sharing threat information, we can nurture the communication of cooperation. We are better together, and together we can play the new team sport of cybersecurity.
motorsports business

Win at business leadership with wisdom from motorsport racing

  • min read
    • The more I speak with business leaders in technology, the more common ground I find with my work, as a racing driver for AF Corse (the Ferrari privateer team), specializing in endurance races of up to 24 hours. I'd like to tell you about the preparation, technology and mindset I use to win races. I hope you'll find it useful in your work too. How to win depends on the kind of race you're in Before I started endurance racing, I first raced in sprint. With sprint racing, you must give 100 percent all the time. In endurance, with just one mistake, your plan is gone. For the first part, you have to stick to the race strategy agreed with your crew. Then once you're through the night – the most challenging time – and if your team decides it's right, you attack at 100 percent. Prepare for success I'm an Italian from Rome, and I'm superstitious. When I put on my racing shoes, it's always the left then the right. Thirty minutes before the race, I meditate. I listen to music that means something to me; classic tunes like The Final Countdown get me in the zone! I use disco for adrenaline, letting my heart rate move up with the beats, then channeling my breath to reduce my heartbeat. I also use visualization. I imagine I'm in the car and plan what I'll do. I'll envision finishing the perfect race. To think of my success as the success of the team gives me strength. Teamwork wins the race We learn to speak the same language. Once I'm in the car, my team makes me stronger, safer and more focused because we must all perform at our peak. In an endurance race, once you're in the car, you know you're doing your best, but you may not be the fastest. The drivers ahead may be on new tires. Getting information from the crew tells you how you're performing. Share, share and share with your team My team and I share our hopes and fears. All the time, we're sharing ideas about how to make the next race better. We don't just win races because of superb performance. Analyzing details matters. Not noticing a small problem can cause you to lose. Everyone can play a part, even the cook in the kitchen may notice if someone's sick. It's happened – a food allergy turns into a crisis during the race. Don't just use technology, use technology well It's a marriage: the technology and the team need to work together. The technology helps balance performance and risk. If you're too slow, it's safe, but you won't win. Too fast, you may crash. If something changes, you need to manage and adapt to succeed. You can work with the engineer to improve the technology step by step, but it's got to be used in the right way. We raise our game by managing these steps. Treat your data like a diamond In our industry, competition is fierce. To win, you have to try new technologies that could make you faster and safer. The car's data is a diamond, so data theft is always a risk. If someone hacks our data records or email conversations, they could use that information for advantage. Even the simulator drivers use at home holds essential data about how we're preparing. It's a relief to know Kaspersky is always protecting Ferrari's data. Trust your team members to do their job My crew is like my second family. We're real friends. We share our hopes and fears. Working closely together, we share pressure but also our achievements. We understand each other. Together, we achieve more. Everyone in the team is super professional and highly skilled. You need to understand the potential of each person and trust their expertise. I never say to anyone, "do this" or "do that." I explain what I want to achieve and let them find the best way. They know how to do their job. If they're involved, they'll give more. To reduce risk, ask questions, follow the plan and adapt For me, there's only one risk – ruining the race. I can't think about crashing or ending up in a hospital. If I start to feel fear, I ask my crew for the information I need that will give me confidence. Then I think about our plan and our goals. Focusing on these reduces pressure. There's been significant safety progress in motorsports. If one thing goes wrong, you'll probably be OK. But if two things fail, you could be in trouble. When you crash, or there's a fire, you need to stay calm and follow the drill. We train on how to respond to problems, but not everything can be simulated. Two years ago, the engine ignited when I stopped in the grass. I tried to get out, but the plastic to open the door was on fire, so I had to get out through the other side and kick. You have to adapt. Data analysis shows the way forward We use data to raise our game. We use it to develop our plan. There's also real-time data on my car's dashboard. It allows me to make quick decisions when I need to. My dashboard is vital when radio communication fails. It's enough information that I can keep going. The engineer can see what's happening, but they may need you to check in the car and from your gut feeling. We're in constant contact. If something doesn't work, they tell you how to check it on your dashboard, like the temperature of your exhaust. You have to multitask while you're racing! After each race, we have a technical meeting. We analyze the race performance and decide what to do differently, for example, upgrading software. If the race hasn't gone our way, the mood may be tense and silent. But when we know the solution, the mood improves. It gives us hope we will make the next race safer and better.
choosing testing solutions

Four types of security testing and when to use them

  • min read
    • When it's time to 'security test' your infrastructure, what should you do? Security testing can mean all kinds of things, and it's not always obvious what's the right choice, and when. Here I'll summarize what I think are the four main types of security testing, when to use each and pitfalls to watch. 1.  Vulnerability scanning What is vulnerability scanning? Vulnerability scanning means running automated software that looks for common vulnerabilities in your systems, like a web server that hasn't been patched or misconfigured cloud storage, exposing customer data. Ideally, you give the software a list of targets, set it in motion and wait to get a report listing vulnerabilities and remediation advice. It's not vulnerability scanning that improves your security, but acting on the results. Depending on the scanning software, it may just check your software against lists of known issues, or do something more complex, like a brute force attack: Guessing user credentials and passwords to see if they're secure. When should you use it? Use vulnerability scanning on everything you have that faces the internet (endpoints), like corporate web servers, virtual private network (VPN) endpoints and office internet connections. You can also run vulnerability scans sporadically or scheduled on internal network systems, or as part of your software development lifecycle. When shouldn't you use it? Vulnerability scanning isn't helpful when you want to know how a human attacker would see your infrastructure. What are the advantages and disadvantages? You can run vulnerability scanning yourself, which puts you in control. Or you can have a third party run it for you. While vulnerability scanning is often seen as the "poor cousin" of security testing, I don't agree. It quickly highlights problems you might have missed, like a temporary internet-facing website the development team forgot to take down or the internal user account with an easy password. It helps you tidy up low-level issues at little cost. 2.  Penetration testing What is penetration testing? Penetration testing, or pen testing, can mean different things to different people. I define it as combining automated and manual techniques to look for weaknesses in the target's security posture. A penetration testing team emulates the methods of genuine attackers. How close it is to a real attack depends on the team. They may use the kinds of tools attackers use, or just their techniques, like trying SQL injection on a web interface, when another method might work better. With help from the system administrators, developers and project team, a penetration testing team can do a more cost-effective and useful audit. They shouldn't be wasting time evading intrusion detection systems or trying not to get noticed by your Security Operations Center. If that's the kind of security test you want, see the section below on red team exercises. When should you use it? A pen test should have a tight scope around a new installation, project or area of concern. It must concentrate on the most likely source of security issues for your organization. When shouldn't you use it? Don't use a penetration test to see how your security teams and Security Operations Center would react to a real cyberattack. A penetration test is overt: The system administrators should know it's happening. See it as an "aggressive technical audit" rather than emulating how attackers think and work. What are the advantages and disadvantages? You'll get an attacker's mindset to look at your project, program or installation. It's useful to have someone on your side who sees what you've built as a set of weaknesses and targets. And it's easy to schedule and assign budget for, compared with red team exercises. Results may not be consistent between one pen test and the next. This isn't necessarily a bad thing. If you repeat it or have several pen testers, you may find more issues. Pen testing is poorly defined. There will be penetration testers reading this who define the term differently to me. Do some work before you pen test to make sure there's a shared understanding. 3.  Red team testing What is red team testing? Red teaming, also sometimes called ethical hacking, is a simulation to test how well your people and technology would respond to an adversary's attack. It's hard to find the line between penetration testing and red teaming. I define a red team exercise as an engagement with much wider scope than a penetration test. The scope of a red team exercise could be your whole organization. It's up to the red team how they attack. Agree strict rules of engagement in advance. Red teamers will stay within the law, but you should also address ethics, staff relations and cultural norms before you start. When should you use it? Use a red team exercise when you want to see, as closely as possible, how real attackers would act against you. It's more of an adversarial simulation than pen testing. A penetration tester finds as many weaknesses as possible in the time available to help defenders see issues. A red teamer will only find and exploit any vulnerability they need to, to achieve a goal. If they can get into your internal network through a poorly configured VPN but could've achieved the same through poor wireless security at your remote offices, you may not discover both issues. "Purple teaming" can make a red team exercise more useful. It's when you have an attacking red team and a defending "blue" team. When shouldn't you use it? Only hold a red team exercise when you've done vulnerability scans and penetration tests, and fixed problems found. Otherwise, the attackers' level of expertise will probably overwhelm the organization's defenses, giving no useful insight. What are the advantages and disadvantages? A significant part of a red team exercise is testing defenders' detection abilities. Attackers must be covert, careful and evasive, like a genuine attacker. There must also be clear paths for contact and escalation. You don't want the Security Operations Center concentrating on the red teamers, but missing a genuine compromise. If you need to show stakeholders the breadth of issues to get resources to fix them, a red team exercise tells a compelling story. It will build a picture of how real attackers could work their way through your infrastructure. A red team exercise is not the same as adversarial analysis: Examining a company's way of working or project plan for issues without attack. For a deeper look at adversarial analysis, see the work of Mark Mateski of Red team journal or Bryce Hoffman of Red team thinking. A downside of a red team exercise is cost. The people involved are specialists with skills and tools that need constant maintenance. They use methodology that encourages slow, careful work. All this affects the day rate. 4.  Bug bounty programs What are bug bounty programs? Bug bounty programs see companies offering a reward to those who report specific vulnerabilities in parts of its infrastructure within a given scope. The programs may be by invitation only or open to anyone. When should you use it? I would only run a bug bounty program after running and responding to the results of at least two types of tests already mentioned. Get an expert to determine the scope and rewards, and how to run it. When shouldn't you use it? A bug bounty program might distract staff and give you more reports than you can use if your organization is still working out how to deal with penetration tests and red team exercises. What are the advantages and disadvantages? All other testing methods are paid on effort rather than results. Your organization may be mature enough that other options aren't what you need. Bug hunters follow some of the same steps as an attacker, so their judgment on what's worth attacking and how may be close to a real attack. Running a bug bounty program makes it clear to anyone who discovers a security issue with your organization that you're approachable on security issues. As bug bounty hunters rarely share details of successful attacks until they've got their bounty, your company must do the work of filtering out duplicate or irrelevant reports. Now when you're asked about security testing and what your organization should be doing, you can start the conversation informed. Stay aware of the flexible and overlapping definitions out there – always ask what someone means by a term they're using before you devote budget or schedule testing.
fog computing

Industrial data security is finding its way in the fog

  • min read
    • The cloud is a smart way to store data and use virtual services. But some businesses, especially in industrial manufacturing, find it doesn't meet their needs. And that's where 'fog computing' has come to the fore. What is fog computing? In 2011, IT networking hardware company Cisco's vice president coined 'fog computing' to describe a system of devices that process information before sending it to the cloud. According to the Journal of System Architecture, fog computing means computation, decision making and data management happen on the path between internet of things (IoT) devices and the cloud. It links to edge computing, where data is processed close to its source to avoid processing in the cloud. Fog computing defines how edge computing works, and facilitates services between end devices and cloud data centers. Cisco defines the difference: edge is the concept; fog is the standard that delivers scalable performance. With fog, security must be provided at the edge or in dedicated fog nodes, as opposed to central security mechanisms for cloud data centers. Industry needs to beat the cloud lag Why is fog a step up from using cloud alone? Well, cloud is great if you don't need to send data to and from the data center instantly. These legacy systems prioritize safety but weren't all designed to connect to the internet. Today, even firm believers in the air gap approach (when to avoid cybersecurity risks, you prevent a computer storing valuable information or controlling a critical process ever connecting to the internet) are tempted to use machine-learning algorithms. Meanwhile, most also know the benefits of using data to optimize industrial processes. Data collection can be a jumbo problem Engineering company Rolls-Royce reaps the benefits of machine learning on sensor data collected in the cloud. Not from their legendary cars, but their aircraft engines. 4,500 turbines continuously send real-time data about consumption, pressure and temperature to Rolls-Royce's data centers. Machine learning predicts and plans maintenance routines, sending parts and personnel to a specific airport before the plane lands. It optimizes logistics, reducing delays and overheads. But these benefits come at a price: One Boeing 787 flight with two Rolls-Royce engines generates 500 GB of data. For long-distance, it may be terabytes. How could you streamline this? You could collect only some of the sensor data. But how do you decide what to drop, so you don't lose something essential for safe operations? Fog computing may be the answer. In 2016 Cisco and machine tool builders Yamazaki Mazak began a pilot to demonstrate the benefits of fog computing for industrial automation. (Yamazaki Mazak sponsors the McLaren team in Formula 1 racing, rivals of my favorite Scuderia Ferrari.) The pilot processes industrial internet of things (IIoT) data from sensors in machinery, detecting sudden temperature spikes, changes in pressure and coolant liquid levels. Like Rolls-Royce, they want to improve safety and predict maintenance cycles. The benefit is broadly the same, but with less data sent to the cloud. A bright future in the fog Fog computing hasn't had the same recognition as the cloud, but I think that will change. We've seen exponential growth in sales and the computing power of IoT and IIoT devices. The importance of this data to business will keep growing. My colleagues at Kaspersky will stay busy enhancing our cloud security solutions, as seen with our hybrid cloud team adding protection against supply chain attacks. Whether you're flying high in the cloud or keeping data close to its source with fog computing, protecting your industrial technology with up-to-date and effective enterprise-grade cybersecurity will be critical to surviving and flourishing in the future.
data security supply chain

Where you should tighten the privacy links in your data supply chain

  • min read
    • A chain is only as strong as its weakest link. Your business is responsible not just for upholding your customers' data privacy inside your organization. Everyone who uses the data on your behalf must be as privacy-conscious as you. Those data-handling partners may include accountancy, telecommunications and cloud storage, even office security and maintenance contractors. Personal data regulation takes privacy very seriously There's a legal reason strong privacy links in your supply chain matter, as well as a moral one. Privacy is at the core of the European Union's stringent General Data Protection Regulation (GDPR.) It applies to personal data processed by organizations in the European Economic Area (EEA) and those outside that offer goods or services to those within. GDPR is the gold standard for data protection. Many other legislative frameworks have used it as a model, like California Consumer Privacy Act (CCPA,) Brazil's Lei Geral de Proteção de Dados (LGPD) and the proposed strengthening of Australia's Privacy Act 1988. Complying with GDPR won't always mean you're complying with other jurisdictions' regulations, so if you're sending personal data across borders, get local advice. GDPR is built around defining what it means to be a data controller or data processor, and what each must do. A controller decides what personal data to collect, gathers it and decides how to use it. A processor receives personal data from another party and processes it as directed, but doesn't decide how it's used. The law says controllers must use only processors with technical and organizational structures that ensure data privacy. Data breaches mean business disruption and reputational damage. Then there's the money. Under GDPR, controller and processor may face huge fines: 20 million euro or up to four percent of the previous year's turnover – whichever is greater. In 2019, British Airways faced a record-breaking 183 million British pounds for a breach. Privacy holes affect businesses of all sizes Although GDPR came into force in 2018, many companies still aren't paying attention, says Jamel Ahmed of UK data privacy consultants Kazient Privacy Experts. "It's true for large enterprises to small- to medium-sized businesses. I often find bigger companies have excellent internal data security processes. The compliance people will ask the right questions and demand evidence. But along the supply chain, there's a massive gap relating to personal data. It's to do with a lack of understanding, and limited awareness and expertise." Peter Wright agrees. He's Managing Director of UK's Digital Law, specializing in online, data and cyber issues. "It's been overlooked in the past. And while there's more awareness now, that doesn't mean it's enough." How to tighten the links 1.    Ask data-processing suppliers the right questions Do your due diligence when you start a relationship with a supplier that involves passing data. Ahmed says, "As a minimum, check new suppliers are registered with UK's Information Commissioner's Office (ICO,) or your country's equivalent. Check they have good policy and practice. Check they understand their data privacy obligations and responsibilities. "Do they have a dedicated data protection officer (DPO,) and what are their qualifications and experience? I'd also want to see evidence they've spent time developing good practices rather than just complying with a checklist they've downloaded from somewhere." 2.    Have a contract that goes above and beyond The GDPR says there must be a written contract between data controller and processor, and what the contract terms must be, including type of data, how long it may be kept for and the nature and purpose of data processing. Data privacy experts think agreements between controller and processor should go further, drilling down to detail, showing the controller is giving enough oversight. 3.    Have a plan in place for what the controller does when there's a breach Under GDPR, all businesses handling data must keep a breach log, recording details of security incidents. Controllers should expect to be able to see anything in the processor's log that relates to its data. Ahmed thinks businesses should go further again, having a detailed plan for what the processor must do if a data breach happens. Ahmed goes on to say, "The GDPR obliges the processor to tell the data controller as soon as they become aware of a breach. But the contract needs to explain what constitutes a breach and what "as soon as you become aware" means." 4.    Bake risk management into your operations Having a watertight supplier contract is just the first step. Wright and Ahmed stress data controllers should manage risk along the supply chain in a proactive and ongoing way. That means regular risk audits and going back to check data policies with clients and suppliers when circumstances change. Wright advises, "Regulators look at how businesses show compliance. They don't want you to hold up a contract audit that says, "Oh yes, we looked at this two years ago and it was fine." They want to see continuous updates. If the worst happens and there is a breach of personal data, they want to see evidence the business did all it could to comply with legislation. "You need to show you've looked regularly at your risk register and updated it after meetings. If a supplier changes its terms, show you investigated, asked questions and reviewed their answers. Regulators want to see the regular auditing, questioning and managing of risk baked into your operations." 5.    Be wary of how behavior changes may impact privacy Our changing ways of life and work mean we need to be vigilant about what's happening with our data. Wright says, "Homeworking has been adopted in ways never envisaged when IT systems were set up. You may have signed up to terms in 2017 and reviewed them during your 2018 GDPR due diligence, but the supplier may have since changed systems. "Say your teleconferencing provider, because of increased demand, says, "We're revising our terms because our servers are no longer in the EU. We have a new web services provider, but we can't confirm where your data is processed. Hope that's OK."" Businesses should insist on full disclosure of what's changed and whether there are knock-on effects on privacy. "Big questions need answering," says Wright. "Where's your data going? Is it following GDPR? Are they transferring business call recordings to servers outside the EEA? What security is in place? Is the data encrypted end to end?" 6.    Consider everyone in your supply chain One of the greatest pitfalls is not realizing your data is passed along the supply chain at all. The golden rule is to assume every business you work with is a data processor. Otherwise, lapses can happen, even with the most sensitive personal information – material classified as "special-category data" under the GDPR. That's anything that could be used for unlawful discrimination such as ethnic origin, sexual orientation, health records or biometric data. Ahmed has a cautionary tale. "One of my clients looked for third-party software to do psychometric testing for graduate recruitment. Throughout the procurement, they didn't realize this involved special-category data under GDPR. There was potential for serious repercussions in failing to assess the data protection impact." In the age of big data, ignorance is never a defense. If personal data is in your possession, you must stay up-to-date with legislation, but also ethics and best practice. Raise awareness of risks and responsibilities, inside and outside your organization. Doing so will reduce the chance of a data breach and ensure your customers know you're looking after their interests.
cyber fraud prevention

What’s changing in cyberfraud and how to keep your business safe

  • min read
    • Today, ecommerce is a basic need. Customers expect speed and convenience, and the 2020 coronavirus lockdowns have only accelerated that demand. Swimming in that tide that raises all boats, Kaspersky's fraud prevention: 2019 report notes a growing number of sharks. One in 50 online financial and ecommerce sessions worldwide are conducted by cybercriminals. As fast as online service technology evolves, fraudsters find loopholes. We're at a crucial point of change in combatting new hacking tools and fraud schemes. So what's changed, and what's changing? Bots fake loyalty Ecommerce customers often receive bonuses as part of loyalty programs, such as for registering, giving reviews and referring friends. With bots, fraudsters create numerous fake accounts and receive bonuses just as real users do. The fraudster then uses the bonuses to buy goods at a big discount for resale. Bots are taking the best seats Research by Distil Networks estimates some 40 percent of traffic to ticket sales sites comes from bots. Fraudsters buy gig, show and sports event tickets with bots, reselling on social media, peer-to-peer sites or ticket resale sites when the event is sold out. This means fans are finding it harder to get tickets and end up paying more. Crawlers are copying prices and photos Cyberfraudsters also use web crawler bots (used legitimately by search engines to give accurate results to search queries) to "crawl" ecommerce competitor websites, recording pricing and making theirs more competitive. They may also steal unique content like images and product descriptions to use on their website, damaging the search rankings of the original website because search engines penalize sites with duplicate content. Bots are getting more like us In 2019 a new generation of "human bots" emerged, designed to mimic human behavior impeccably. Previously, bots moved around web pages in repetitive and simple navigation patterns. The new-generation "human bots" do things humans do, like shake the mouse and make rapid movements. This new human-like behavior is a problem for anti-fraud systems. So far, many have relied on these human foibles to tell bot from human. How fraudsters manipulate The easiest way for fraudsters to attack online businesses is through customers. They use manipulative strategies known as social engineering. They either scare people or earn their trust to get credentials like logins and passwords, and other personal information. Imagine you get a call from someone saying they're with the security department of an ecommerce site you visit. They say someone has tried to buy a high-value item with your credit card and that to stop the transaction, you must download an authentication app. It's a fraudster, of course. The app grants remote access, mirroring the screen of your device and letting the fraudster steal personal information like your full name, address or social security number. They then sell your personal information on the dark web, opening doors to all kinds of fraud, like using your name and bank account to apply for loans. Remote access tools (RATs,) used legitimately by IT support teams in many organizations to access your computer screen to resolve issues, are a powerful tool for fraud in the wrong hands. Fraudsters often target accountants because they work with payment orders. The fraudster accesses the victim's screen without their knowing and substitutes bank details for their own. You may recognize the methods employed in these growing attacks. Some are not new. Here are three emerging cyberfraud trends. Trend 1: Fraud as a service Cybercrime is an easy way to make money without leaving home. This has led to rapid growth in 'fraud as a service (FaaS.)' FaaS makes internet fraud less challenging for newcomers, and so increases the number of people involved. On dark web forums, illegal websites or social media, anyone can buy a set of hacking tools and a leaked customer database, then pay for training on how to make illegal money. Costs range from just 5 US dollars for stolen credit card data, to thousands of dollars for extensive fraud execution courses. The market is booming. Underground digital markets sell bots, digital fingerprints for remotely accessing devices and anonymizer tools that make internet activity untraceable. Trend 2: Resale of bank account access Cybercriminals often target small- to medium-sized businesses (SMBs) in finance who've been acquired by large players, while they adjust their security to meet the buyer's requirements. Kaspersky found, by analyzing dark web forums and chats, criminal groups target these smaller organizations, then resell access to both organizations' internal networks. They predict an increase in this kind of activity, especially in Africa, Asia and Eastern Europe. Trend 3: Data leaks and deepfakes We all love convenient and quick purchases like Amazon's 1-click ordering, despite that these methods usually mean saving and sharing more of our personal information. Yet, a month can't pass without a high-profile data breach from a bank, online store or telecommunications company. Sometimes sensitive personal customer data is exposed, such as biometrics. We're also seeing the rise of impersonation methods where one person's image is replaced with another, using advanced audio, photo and video editing, known as deepfakes. Fraudsters have already used deepfake voice imitation and social engineering to impersonate a CEO successfully. The best ways to protect your business from today's fraudsters These six steps will help your business put in place the strong front against cyberfraud. 1.    Assess risks With growth, or any kind of change in business, comes the possibility of new risks of fraudulent activities. Make sure identifying opportunities for fraud is part of your risk assessment activity. 2.    Review product design Look at the design of your digital services and loyalty program from a fraudster's point of view. Try to find 'loopholes' they could exploit. 3.    Use a fraud detection and prevention system These systems may, for example, analyze online sessions, monitor transactions and analyze payment behavior. They help avoid the financial, reputational and legal consequences of fraud and cut operational costs, such as support team time. 4.    Strengthen your security Put detection and protection measures in place, such as using a web application firewall (WAF) to protect against bots and a solution to protect against Distributed Denial-of-Service (DDoS) attacks. 5.    Strengthen your team Make sure your employees understand how fraud happens and how to combat it by including cyberfraud in your cyberawareness training program. 6.    Record fraud Measure what your business is losing through fraud regularly. Include direct loss, indirect loss and the impact on your brand reputation. If fraud hits your business, hire a fraud expert team to support you through and help you combat future incidents. By taking these steps, you can reduce the risk of cyber fraud affecting your business and make the most of the opportunities the rise of ecommerce brings.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries