Infosec

August 14 2023

Cybersecurity and the Metaverse: Risks, Threats, Challenges, and Opportunities

Raphael Iloh Artificial Intelligence, Business Continuity, Business Strategy, Cyber Security, Cybersecurity Governance, Infosec, Leadership, Metaverse, Risk Assessment, Risk Management, Security Architecture, Security Risks, Security Strategy artificial intelligence, business agility, business continuity, Business Strategy, Competitive Advantage, compliance, Cyber Security, cybersecurity, data protection, governance, infosecurity, innovation, leadership, Metaverse, privacy, risk management, Security Risks, security strategy, third party risk management

The metaverse, a boundless realm where the lines between the real and the virtual blur into a kaleidoscope of possibilities. The metaverse is a term that describes a 3D virtual world that integrates physical and digital realities as well as enables immersive and interactive experiences for users. Imagine being able to visit any place, meet any person, or do any activity in a realistic and engaging way, without leaving your home.

In this digital utopia, businesses and organizations across various sectors (including retail, finance, education, healthcare, and defence) are embarking on an extraordinary journey. That is the vision of the metaverse, which is expected to experience exponential growth following the ongoing huge improvements and strides in Generative Artificial Intelligence (AI). According to the Wall Street Journal (WSJ), metaverse spending is projected to reach US$5 trillion by 2030 i.e., within the next 7 years.

However, as we delve deeper into the wonders of the metaverse, we must tread with caution and embrace cybersecurity to safeguard this new frontier. In a couple of previous posts, we discussed Artificial Intelligence (AI) in healthcare services. In this article, we’ll discuss some of the main cybersecurity challenges and risks that the metaverse poses to organizations and how they can be effectively addressed. We’ll also discuss some of the opportunities that the metaverse offers to organizations and how they can leverage them to gain a competitive edge.

Understanding the Metaverse: Unravelling the Infinite

The metaverse, a concept once confined to science fiction, is now a reality, rapidly evolving through the convergence of virtual reality, augmented reality, blockchain, the Internet of Things (IoT), and the power of Generative AI. These technologies enable the creation of realistic and dynamic virtual environments that can be accessed by millions of users simultaneously.

This immersive domain transcends the limits of screens and keyboards, presenting an entirely new interface between humans and information. In the retail sector, fashion retailers allow customers to try on virtual outfits, providing a personalized shopping experience like never before. Financial institutions are exploring virtual banks, offering seamless transactions through virtual reality interfaces. Even healthcare is leveraging the metaverse to simulate complex surgeries and explore innovative medical treatments.

However, as with any new technology, the metaverse also brings new challenges, risks, and threats that need to be addressed by cybersecurity professionals and business leaders. The metaverse is a complex environment that’s highly interconnected, which creates new kinds of cybercrime and attack surfaces. Cybersecurity in the metaverse involves the security of the hosting platform, the property, and the users of the property.

Cybersecurity Challenges and Risks in the Metaverse

The metaverse is not immune to cyberattacks. In fact, it may be more vulnerable than the traditional web due to its novelty, complexity, and diversity. Some of the cybersecurity challenges and risks that organizations may face in the metaverse include:

Lack of regulations: The metaverse is still an emerging phenomenon that has not been fully regulated by governments or industry standards. This creates uncertainty and ambiguity for both platform owners and property owners regarding their rights and responsibilities. For example, who owns the data generated by users in the metaverse? Who is liable for any damages caused by cyberattacks or malicious actors? How can intellectual property rights be enforced in the metaverse? What are the obligatory AI ethics for the metaverse? These are some of the questions that need to be clarified and addressed by legal frameworks and policies.
Identity theft: The metaverse allows users to create and customize their respective avatars and personas that represent them in the virtual world. However, this also creates opportunities for identity theft and impersonation by cybercriminals who can use AI-generated deepfakes to create realistic and convincing fake images or videos of individuals or organizations. Deepfakes can be used for various malicious purposes, such as fraud, extortion, blackmail, defamation, or propaganda.
Data breaches: The metaverse generates massive amounts of data from user interactions, transactions, preferences, behaviours, emotions, biometrics, and more. This data is valuable for both legitimate and illegitimate purposes. For example, data can be used to improve user experience, personalize content, offer recommendations, or provide insights. However, data can also be used to target users with phishing attacks, spam messages, malware infections, or ransomware demands. Data breaches can expose sensitive information that can compromise user privacy or security.
The recent compromise of the MOVEit Transfer file management software; a computer program used by over 600 organizations worldwide including UK Ofcom, US Department of Energy, Deutsche Bank, PwC, and EY; is reported to have affected nearly 40 million people. The hydra-headed data breach incident of such magnitude perhaps underscores the possible damages that could be caused if something similar were to happen in the metaverse.
Malware infections: The metaverse relies on various devices and platforms to deliver its services and experiences. These devices and platforms may have vulnerabilities that can be exploited by hackers to inject malware into the system. Malware infections can disrupt or damage the functionality or performance of the devices or platforms or steal or encrypt data from them. Malware infections can also spread from one device or platform to another through network connections or user interactions.
Cyberattacks on critical infrastructure: The metaverse depends on critical infrastructure such as power grids, telecommunications networks, cloud servers, or IoT devices to operate smoothly and reliably. However, these infrastructure components may also be targeted by cyberattacks that aim to cause physical or digital harm or disruption.
For example, cyberattacks on power grids could cause blackouts or brownouts that affect millions of users in the metaverse. Cyberattacks on telecommunications networks could cause latency or connectivity issues that degrade user experience or prevent access to the metaverse. Cyberattacks on cloud servers could compromise data integrity or availability or cause service outages. Cyberattacks on IoT devices could hijack or manipulate their functions or data.

Cybersecurity Solutions for the Metaverse: Thriving amidst Adversity

The metaverse poses significant cybersecurity challenges and risks that require proactive and comprehensive solutions from organizations. Some of the cybersecurity solutions that organizations can implement to protect themselves and their users in the metaverse include:

Establishing cybersecurity governance: Your organization should develop and enforce a proactive cybersecurity governance model that includes clear and consistent policies and standards. These policies and standards should cover aspects such as privacy-by-design principles, privacy-by-default tenets, data ownership, data protection, data sharing, user consent, user verification, user behaviour, user feedback, user rights, user responsibilities, system status, dispute resolution, incident response, and compliance.
Ensuring regulatory compliance: To ensure and promote a more compliant predisposition amidst a shifting metaverse landscape and ever-changing regulations, your organization should adopt a proactive approach involving regular audits and swift adaptation.
Educating and empowering users: Your organization should educate and empower its users in the metaverse. You should inform users about the potential cybersecurity risks and threats that they may encounter in the metaverse and how to avoid or mitigate them. You should also provide users with the necessary tools and resources to protect themselves and their data in the metaverse, including privacy settings, security settings, reporting mechanisms, feedback mechanisms, or security awareness training.

Cybersecurity Opportunities in the Metaverse

The metaverse is not only a source of cybersecurity challenges and risks but also a source of cybersecurity opportunities for organizations. Some of the cybersecurity opportunities that organizations can leverage in the metaverse include:

Enhancing user experience: Organizations can use cybersecurity as a competitive advantage to enhance user experience in the metaverse. They can offer their users a secure, reliable, and trustworthy environment that fosters confidence, loyalty, satisfaction, and engagement. They can also use cybersecurity as a differentiator to attract new users or retain existing users who value security as a key factor in their decision-making.
Expanding business opportunities: Organizations can use cybersecurity as a catalyst to expand their business opportunities in the metaverse. They can explore new markets or segments that are emerging or growing in the metaverse. They can also create new products or services that address the specific needs or demands of users in the metaverse.
Innovating business models: Organizations can use cybersecurity as an enabler to innovate their business models in the metaverse. They can adopt new ways of delivering value to their customers or stakeholders in the metaverse. They can also leverage new sources of revenue or cost savings that are enabled by cybersecurity technologies or practices in the metaverse.

What isn’t hard to imagine for us in cybersecurity is that the metaverse is going to greatly expand the threat landscape. So, the metaverse is more than an imaginative exercise for us; it’s the future – a future we should ideally start planning for now.
— Jonathan Singer, Senior Product Marketing Manager, Checkmarx

Final thoughts

The metaverse is a promising phenomenon that offers unprecedented opportunities for organizations to create immersive and engaging experiences for their users.

However, the metaverse and Generative AI will become more pervasive, diverse, and complex, requiring more advanced and adaptive cybersecurity solutions, posing significant challenges and risks for organizations to secure their platforms, properties, and users from cyberattacks or malicious actors.

Therefore, businesses and organizations need to adopt proactive and comprehensive cybersecurity solutions that can protect themselves and their users in the metaverse while leveraging its potential benefits. They should adopt best practices and recommendations to enhance their cybersecurity posture and resilience in the metaverse, such as adopting a cyber resilience strategy, implementing a zero-trust model, using blockchain technology, leveraging artificial intelligence tools, establishing clear policies, standards, guidelines, roles, responsibilities for cybersecurity management, and collaborating with other stakeholders in the metaverse ecosystem.

If you need help developing and implementing effective cyber resilience strategies within your organization, or you’re simply interested in learning more about effective cybersecurity and risk management best practices, then please feel free to contact me today.

また会うまで – take care, until we meet again.

July 25 2023

False Assurance in Risk Management and Cybersecurity: Unmasking the Illusion

Raphael Iloh Business Continuity, Business Strategy, Cyber Security, Cybersecurity Governance, Infosec, Leadership, Risk Assessment, Risk Management, Security Architecture, Security Assurance, Security Risks, Security Strategy, Third-Party Risk Management cyber risks, cyber threats, cyberrisks, cybersecurity, cybersecurity governance, cyberthreats, false assurance, leadership, risk management, security assurance, security audit, third party risk management

In today’s interconnected digital landscape, risk management and cybersecurity are of paramount importance for organizations and individuals alike. With the constant evolution of cyber threats, it is crucial to remain vigilant and proactive in implementing robust security measures.

However, a dangerous phenomenon known as false assurance can undermine even the most well-intentioned efforts. In a previous article, I mentioned the reports of recent unconnected breaches that affected Microsoft Azure and PwC, highlighting the potentially severe impacts that come with third-party security incidents. A more recent report indicates that the number of organizations impacted by the breach incident at Microsoft Azure may have even widened in the last few days.

In this article, we’ll delve into the captivating realm of risk management and cybersecurity, uncovering the deceptive notion of false assurance; exploring its causes, implications, and strategies to mitigate its detrimental effects.

Understanding False Assurance

False assurance in risk management and cybersecurity refers to situations where organizations or individuals mistakenly believe that they are adequately protected against risks and threats, when; in reality; their security measures are ineffective or inadequate.

False assurance occurs when there is a false sense of security, leading to complacency, overconfidence, negligence, and the assumption that all necessary precautions have been taken. It can also stem from a lack of awareness, understanding, or communication of actual risks and vulnerabilities that exist in the operating environment. Unfortunately, this perception gap can expose entities (i.e., organizations and individuals) to severe consequences, including data breaches, financial loss, reputational damage, and regulatory non-compliance.

Causes of False Assurance

False assurance can arise due to several reasons including:

Inadequate risk assessment: Organizations may fail to conduct comprehensive risk assessments, leading to an incomplete understanding of potential vulnerabilities. Overlooking critical risks can create a false sense of security.
Overreliance on technology: While technological solutions play a crucial role in cybersecurity, relying solely on them without considering the human factor or other potential attack vectors can be dangerous. Organizations must adopt a holistic approach to security.
Lack of continuous monitoring: Cyber threats are constantly evolving, necessitating ongoing monitoring and adaptation of security measures. Failure to regularly assess and update security practices can result in false assurance.
Insufficient training and awareness: Human error remains a leading cause of cybersecurity breaches. If employees are not adequately trained on security best practices or are unaware of potential risks, they may engage in risky behaviour, leading to a false sense of security.
Compliance-driven approach: While compliance with regulations and standards is crucial, a compliance-focused mindset can create false assurance. Organizations must recognize that compliance does not automatically ensure security and should go beyond the minimum requirements.
Human factors: People may have cognitive biases, such as confirmation bias, optimism bias, or availability bias, which may influence their perception and judgment of risks. They may also have emotional factors, such as fear, pride, or loyalty, which affect their willingness and ability to report or address risks. Also, they may have behavioural factors, such as inertia, fatigue, or habituation, which may reduce their vigilance and responsiveness to risks.
Organizational factors: Organizations may have cultural factors, such as norms, values, or incentives, that shape their attitude and approach to risk management. They may also have structural factors, such as hierarchy, silos, or bureaucracy, that hinder their coordination and collaboration on risk management. Also, they may have procedural factors, such as policies, standards, or audits, that create a false sense of security or compliance without ensuring actual effectiveness or improvement.
Technical factors: Technologies may have inherent limitations, flaws, or vulnerabilities that expose them to risks. They may also have complex interactions or dependencies that create unforeseen risks. They may also have dynamic changes or updates that introduce new risks or invalidate existing controls.

Implications of False Assurance

The ramifications of false assurance in risk management and cybersecurity can be significant; these may include:

Increased vulnerability: False assurance blinds organizations to potential risks, leaving them exposed to sophisticated cyberattacks that can bypass inadequate security measures. Cyberattacks can cause various damages, such as data theft, encryption, deletion, or manipulation; system infection, corruption, or disruption; or network slowdown, overload, or outage.
Financial losses: Data breaches and security incidents can result in substantial financial losses due to legal liabilities, remediation costs, regulatory fines, and reputational damage.
Damage to reputation: A security breach can erode customer trust and confidence, leading to reputational damage that is difficult to recover from. Customers may choose to take their business elsewhere, impacting an organization’s long-term viability.
Legal and regulatory consequences: Organizations failing to meet their legal and regulatory obligations may face severe penalties, legal action, and loss of business licenses. Compliance failures can result from several factors, such as ignorance, misinterpretation, misalignment, or non-conformance.

These risks and threats can have severe and lasting impacts on the performance, reputation, and sustainability of any organization.

Investors see data breaches as a threat to a company’s material value and feel discouraged in investing in a business that has had its sensitive information compromised.
— Malcolm Marshall, Global Head of Cyber Security, KPMG

Mitigating False Assurance

To mitigate the risks associated with false assurance, organizations must adopt a proactive and comprehensive approach to risk management and cybersecurity. This approach may include the following:

Thorough risk assessment: Conduct comprehensive risk assessments, considering internal and external factors. This step entails identifying potential vulnerabilities, assessing potential impacts, and prioritizing security measures accordingly. Regular reviews and updates are essential to adapt to the ever-changing threat landscape.
Multi-layered security strategy: Recognize that no single solution can provide foolproof protection. Implement a multi-layered security approach that includes a combination of technological solutions, employee training, incident response plans, and regular security audits.
Continuous monitoring and adaptation: Regularly monitor systems and network traffic for suspicious activity. Stay informed about emerging threats and update security measures accordingly.
Embrace Innovation: Stagnation is the enemy of cybersecurity. By embracing innovation, organizations can stay one step ahead of malicious actors. Regularly evaluate emerging technologies, implement robust patch management processes, and foster a culture of continuous learning to promote resilience.
Employee training and awareness: Educate employees about security best practices, potential risks, and their roles and responsibilities in maintaining a secure environment. Foster a culture of cybersecurity awareness.
Independent validation: Seek external validation through independent audits, penetration testing, or cybersecurity assessments to ensure that security measures are effective and up to date.
Cybersecurity governance framework: A framework is a set of standards, guidelines, or best practices that can help organizations design, implement, and manage their respective cybersecurity program. A cybersecurity governance framework can help an organization align its cybersecurity objectives with its business goals, identify and prioritize risks, and measure and improve performance.

Key stakeholders often underestimate how complex and overwhelming it can be to manage all the ancillary people and groups who must play a role in mitigating a major breach incident, including internal and external attorneys, internal and external investigators, law enforcement, regulators, and many others.
— Bryan Sartin, Managing Director, Verizon

Closing thoughts

False assurance is a dangerous and treacherous illusion that can undermine an organization’s risk management and cybersecurity capabilities and resilience, leading to complacency and a failure to adequately protect against evolving cyber threats. It can stem from various human, organizational, or technical factors that create a gap between perception and reality of risks and vulnerabilities.

Organizations must recognize the causes and implications of false assurance and take proactive steps to mitigate its risks. By embracing a comprehensive and dynamic approach to security, organizations can strengthen their defences, protect sensitive information, and preserve their reputation in an increasingly challenging digital landscape.

Remember, true cybersecurity requires constant vigilance and adaptability.

If you need help establishing effective cybersecurity capabilities with your organization, or you’re simply interested in learning more about effective cybersecurity and risk management best practices, then please feel free to contact me today.

Au revoir; take care, until we meet again.

Bridging the Gap: Leadership Strategies for Effective Cybersecurity Governance

Raphael Iloh Business Continuity, Business Strategy, Cyber Security, Infosec, Leadership, Risk Assessment, Risk Management, Security Architecture, Security Risks, Security Strategy best practices, business agility, business continuity, compliance, cyber risks, cyber threats, cyberrisks, cybersecurity governance, cyberthreats, grc, information security, innovation, kpi, leadership, organizational change, organizational culture, policies, risk management, standards, technology

Cybersecurity is no longer a technical issue that can be delegated to IT departments. It is a strategic imperative that affects every aspect of an organization’s operations, performance, reputation, and resilience. In the digital age, cybersecurity threats are constantly evolving and becoming more sophisticated, posing significant challenges and risks to organizations of all sizes and in pretty much all sectors.

As the world around us is evolving and becoming more digital, the collective understanding of what it means to be safe, secure, and resilient is also evolving. According to the Harvard Business Review (HBR), the impact of cybercrime is predicted to reach US$10 trillion this year. In the same report, HBR indicated that human error constitutes the biggest cyber-threat as it accounts for over 80% of cyber-incidents.

How can organizations effectively protect themselves and their stakeholders from cyber-threats, cyber-risks, and cyber-incidents, while also enabling innovation and growth?

I’d argue that, in nearly all cases, the answer most probably lies in effective cybersecurity governance.

In a couple of previous posts; part 1 and part 2 of a series on cybersecurity and the supply chain; I discussed some ways to safeguard the digital fortress including the use of effective cybersecurity governance. Cybersecurity governance is how organizations control and direct their approach to cybersecurity, including defining their risk appetite, building accountability frameworks, and establishing who is responsible for making decisions.

Effective cybersecurity governance will help ensure that cybersecurity activities support the organization’s overarching strategic mission/goals, align with its values, and culture, as well as comply with its legal and regulatory obligations. Effective cybersecurity governance will also enable the organization to respond quickly and effectively to emerging threats and incidents, as well as to communicate clearly and confidently with its stakeholders.

However, achieving effective cybersecurity governance is not easy. It requires strong leadership from the top, as well as collaboration and engagement from all levels of the organization. It also requires a clear vision, a robust strategy, and a flexible framework that can adapt to changing conditions and needs.

In this article, we’ll explore the essential role of leadership in establishing and maintaining effective cybersecurity governance, as well as provide practical insights and strategies for cybersecurity leaders to bridge the gap between security and business objectives.

The Role of Leadership in Cybersecurity Governance

Leadership is the key factor that determines the success or failure of cybersecurity governance. Leadership could be described as the ability of an entity (i.e., an individual, a group, a team, or an organization) to influence or guide other entities to achieve common or shared objectives.

Without any doubt, leadership involves setting direction, communicating vision, motivating action, empowering people, building trust, resolving conflicts, and ensuring accountability. Within any organization, ensuring that policies, standards, principles, and procedures are properly developed and maintained requires a well-defined governance model, such as the one outlined in ISO/IEC 27014-2020.

In the context of cybersecurity governance, leadership plays a vital role in:

Defining the organization’s vision and strategy for cybersecurity
Establishing clear roles and responsibilities for cybersecurity
Informing the organization’s decision concerning investments in cybersecurity.
Allocating adequate resources and budget for cybersecurity
Developing policies and standards for cybersecurity
Implementing controls and measures for cybersecurity
Monitoring performance and compliance for cybersecurity
Reviewing risks and opportunities for cybersecurity
Engaging stakeholders and partners for cybersecurity
Promoting awareness and education for cybersecurity
Driving innovation and improvement for cybersecurity

Cybersecurity leaders are those who have the authority, responsibility, and accountability for overseeing and managing cybersecurity within their organizations. They may have different titles, such as Chief Information Officer (CIO), Chief Technology Officer (CTO), Chief Information Security Officer (CISO), Chief Security Officer (CSO), Principal Cybersecurity Consultant, or team leader but they share a common goal: to ensure that their organizations are secure, resilient, and compliant.

These leaders need to have a range of qualities and skills to fulfil their roles effectively. They need to have a deep understanding of the technical aspects of cybersecurity, as well as the business context and environment in which they operate. Also, they need to have a strategic mindset, as well as an operational focus. Furthermore, they need to have strong communication skills, as well as analytical abilities. They need also to have a collaborative attitude, as well as a decisive approach. They need to have a visionary outlook, as well as a pragmatic perspective.

Until you have experienced something like this, you don’t realise just what can happen, just how serious it can be… I had no intuitive idea on how to move forward.
— Soren Skou, CEO, Maersk

Understanding the Complex Challenges

The ever-changing cybersecurity landscape presents organizations with a myriad of challenges. From sophisticated cyber threats to legal and regulatory compliance, leaders must be well-informed and adaptable. As a cybersecurity leader, you’d expect to face complex challenges, such as:

Align security goals with business objectives: You need to ensure that your security strategy supports your organization’s vision, mission, values, and goals. You need to balance the trade-offs between security and performance, between risk mitigation and innovation, and between compliance and competitiveness. You need to demonstrate the value of security investments and initiatives to senior management and other stakeholders, as well as justify the allocation of resources and priorities.
Manage risks and compliance: You need to identify, assess, prioritise, treat, monitor, and report on the cyber risks that your organization faces. You need to establish a risk appetite framework that defines the level of risk that your organization is willing to accept or tolerate in pursuit of its objectives. You need to implement appropriate controls and measures to reduce or transfer the risks that exceed the risk appetite. Also, you need to ensure that your organization complies with relevant laws, regulations, standards, policies, and best practices.
Respond to emerging threats and incidents: A proactive incident response culture is another hallmark of effective cybersecurity governance. As a cybersecurity leader, you need to be aware of the current threat landscape and the potential impact of cyberattacks on your organization. You need to develop and maintain an incident response plan (or playbook, if you will) that defines roles, responsibilities, processes, procedures, tools, and resources for detecting, containing, analysing, resolving, recovering from, learning from, and communicating about cyber incidents. Also, you need to test and exercise your team’s incident response capabilities regularly.
Foster a culture of security awareness: You need to create a culture where security is everyone’s responsibility within your organization. You need to educate and train staff on security policies, procedures, practices, and behaviours. You need to raise awareness of cyber threats and risks, and how to prevent or report them. You need to reward positive security actions and outcomes, as well as address negative ones. Also, you need to lead by example and demonstrate your commitment to security.
Foster a culture of security innovation: As a cybersecurity leader, you’d champion a culture of innovation within your teams and organization by encouraging curiosity, research, creative thinking, design thinking, risk-taking, and a mindset of learning from mistakes.

As cybersecurity leaders, we have to create our message of influence because security is a culture, and you need the business to take place and be part of that security culture.
— Britney Hommertzheim

Trust in the digital business age is every bit as important as actual service delivery. Few things impact a company’s brand more than a badly handled data breach or prolonged service outage.
— Hugh Callaghan, Executive Director, Cyber Advisory Services, EY

Conclusion

Cybersecurity leadership is essential for effective cybersecurity governance. In this article, we’ve explored the essential role of leadership in establishing and maintaining effective cybersecurity governance within organizations. We’ve examined the qualities and skills required for cybersecurity leaders to navigate complex challenges, foster a culture of security awareness, and drive organizational change for cybersecurity governance.

In the follow-up article, we’ll delve into some practical hands-on insights and strategies for cybersecurity leaders to help them bridge the gap between security and business objectives, as well as create a robust security culture within their respective organizations.

Au revoir; take care, until we meet again.

Why Cyber Kill Chain not Sufficient to Protect Your Organization

July 3 2022

Why The Cyber Kill Chain Is Not Sufficient to Effectively Protect Your Organization

Raphael Iloh Cyber Security, Infosec, Risk Management, Security Architecture, Security Risks, Security Strategy advanced persistent threat, apt, business continuity, cyberattacks, cybersecurity, disaster recovery, framework, governance, infosecurity, leadership, riskmanagement, risks

An epochal shift during the 21st century has led us to enter a new era of technological advancements, where cyber security has become vital in keeping an organization and business secure.

The rise of computers, telecommunications and the internet had opened the doors for cyberterrorism. Cyberattacks had become so rampant that they started to become a threat to the economy. Cybercriminals and hackers have also evolved their digital skills in stealing and destroying other businesses by breaching information security.

Having an effective security system to protect your organization is your best defense against cybersecurity threats. It does not only protect your business but your consumers and employees as well.

Investing in an efficient cybersecurity plan promotes risk management for monetary and reputational damage and ensures data integrity and confidentiality within your organization.

Ignoring cybersecurity is a grieve and an expensive mistake to make. Though it may not eliminate the risk of cyberattacks, a layered security approach can withstand cyber intrusion and assaults.

Lockheed Martin Cyber Kill Chain Framework

The Cyber Kill Chain is a stage-based framework (or methodology, if you like) originally developed by Lockheed Martin which traces the stages of cyberattacks. An adaptation of an established military defense operation, it is a part of their Intelligence Driven Defense Model that identifies vulnerabilities and prevent cyber intrusion activities.

This framework is named “Kill Chain” as it was adapted from a military term related to an attack’s structure. By stopping the attacker at any stage during the assault can break the chain of attack! The adversary must completely advance through all the stages to succeed. Each stage of intrusion will give us the chance to know more about the attacker and use their tenacity as our leverage.

The Kill Chain Framework works in 7 stages:

Reconnaissance – The step where the targets are identified. Adversaries plans and research their target organizations. These intruders will use automated scanners to find weak points in the system. They could scan firewalls to create a point of entry in the system. Detecting the intruders during reconnaissance could be challenging, but it could help reveal the attackers’ criminal intents.
Weaponization – The adversaries start staging their operation. After finding security vulnerabilities in the system, these attackers will develop malware. If their target is document-based, they produce a “decoy” file to present to the victim. They weaponize malware based on the attack’s intention. This is also the stage where adversaries could find ways to reduce their chances of being detected. The defender will not detect weaponization as it happens, but they can figure out the intent by investigating malware artifacts.
Delivery – The adversaries start to launch their operations. The attackers will start sending the malware to the defenders. They will deliver the weapon through email phishing or a removable/portable device. This is a vital stage for the defenders. Blocking the operation should be prioritized at this point. This can be done if the delivery medium is analyzed or targeted servers are detected.
Exploitation – Advancing to this stage is when the attackers start to gain access to their victims. The malicious malware was delivered and breached the secured parameter. Opening a phishing email attachment or clicking on a malicious link has triggered the “zero-day”, a phrase that refers to the exploit code. At this rate, custom capabilities are crucial to stop zero-day exploits. But traditional hardening measures could also help in adding resiliency to the security.
Installation – The hacker, had already established a beachhead at the victim. The malware has installed a backdoor that will serve as a point of entry for the intruder. Some adversaries would ensure that the malware looks like a regular part of the installed operating system. In this stage, it is important to stop the attack by using systems such as the Host-Based Intrusion Prevention System (HIPS). It can alert or block common installation paths.
Command and Control (C2) – The adversaries gain control of the system’s network. The malware has opened a channel of command to remotely manipulate the victim. They can gain access to secure and confidential accounts and could attempt damaging attacks. This stage is the defender’s last chance to block the attack. And this can be done by blocking the C2 channel. This will stop the adversaries from issuing a command to prevent further damage.
Action on Objectives – The adversaries have reached their goals-the stage where the hackers have successfully extracted their needed data from the system. They gained the power to damage further, such as collecting user credentials, destroying the system, or overwriting and corrupting the data. The longer the hacker has access to CKC7, the greater the impact of the damage. This stage could be detected as soon as possible using forensic evidence and network packet capture.

cyber kill chain model

Key Elements of the Cyber Kill Chain:

The Cyber Kills chain was designed to assist companies in developing in-depth strategies for defense. By mapping out the steps that the hackers take to complete a cyberattack, organizations would be able to combat persistent cyber threats.

Since the Cyber Kill was derived from a military model, the main elements of this framework are established to identify adversaries, prepare for an attack, engage, and destroy a target. It can quickly identify and recognize social engineering, insider threats and innovative attacks.

Drawbacks of Kill Chain Framework

The Cyber kill chain is modelled to respond to pre-determined attack sequences. It has been universally adopted for cybersecurity. But like any other model, it is not perfect and has its fundamental flaws.

The model assumes a perimeter focus defense where the main resistance is a firewall. It fails to cover other internal attacks and cyberattack vector paths.
Cyber Kill Chain framework’s phase sequence cannot precisely block all attacks. Most of its phases can be easily bypassed.
The framework only focuses on blocking an attack but fails to define what to do after the adversaries successfully breaches the system.
Once the adversary was able to penetrate the victim’s system, the framework’s timing of the attack in every phase was inconsistent. Adversaries could easily stay dormant for a longer period while they wait for the opportunity to launch their final phase of attack without being detected.

Teams that say their cybersecurity is really good are the ones to worry about. After our breach, the most difficult issue was deciding when it was safe enough to come back online. I learned that really smart engineers can talk English, under extreme pressure.
— Dame Dido Harding, former CEO of TalkTalk

Other Frameworks with Similar Objectives Compared to the Cyber Kill Chain

MITRE ATT&CK vs Cyber Kill Chain

ATT&CK is an acronym that stands for Tactics, Techniques, and Common Knowledge.

The MITRE ATT&CK framework was designed based on observations in the real world. It reflects the different phases of an intruder’s attack lifecycle and the target platforms.

One could argue that there are Cyber Kill Chain and MITRE ATT&CK both share common views and understanding of cyberattacks i.e., most cyberattacks involve adversaries breaking into networks, avoiding getting detected, stealing as much data as they possibly can, interrupting as much network operations as they possibly can, getting out as quietly and stealthily as they got in, making hidden backdoor access available if they ever need to return, etc.

However, compared to Cyber Kill Chain, the Mitre ATT&CK framework maintains a matrix model that has more in-depth details on how the adversary will attack in each stage. Also, Cyber Kill Chain fail to factor in the different techniques and tactics of a cloud-native attack.

The Cyber Kill assumes that the attackers will deliver malware to a target environment but ATT&CK assumes that the adversaries may very well change their goals/objectives mid-way through an attack especially when the success of the attack appears either easier or more difficult than they had initially planned.

Yes, one could argue that the MITRE ATT&CK framework uses Situational Crime Prevention (SCP) techniques, a set of techniques which assumes that the goals/objectives of most adversaries are not linear but influenced/informed by opportunities, constraints, limitations, resistance, and situations presented to them by their targets during the execution of attacks.

Google BeyondCorp vs Cyber Kill Chain

BeyondCorp is an implementation of a zero-trust security concept that creates a zero-trust network. Designed to provide end-to-end real-time protection and platform security. It has embedded data built into the Chrome browser to prevent malware infection from networks and provide phishing-resistant authentication.

Unlike the Cyber Kill Chain framework, Google BeyondCorp “shifts access control from the traditional network perimeter to individual devices”. Its zero-trust access approach users to securely work with untrusted networks even if they are not using a client-side VPN.

NIST Cyber Security Framework (NIST CSF)

The National Institute for Standards & Technology (NIST) Cyber Security Framework (CSF) provides a set of structured standards and measurements for cybersecurity. The framework sets out “standards, guidelines, and best practices to manage cybersecurity-related risks.”

But the downside of the framework is that its 5 categories/elements i.e., Protect, Identify, Detect, Respond and Recover; fail to directly outline how it can dissect a cyberattack incident. It also fails to supply analytic markers to test the detection.

Nevertheless, the descriptive (and not prescriptive) nature of the NIST CSF has made it seem “business-friendly” and therefore, made it possible for the framework to be adopted by businesses and organizations of all sizes and across several industries, particularly organizations in industries that are guided by regulary controls and compliance requirements where industry-uniqueness and specificities are considered important.

data breach

In conclusion, there is no one defense framework or set of techniques that could be considered all-in-one sufficient for all cybersecurity defense requirements.

In a previous article, I had looked at how the proposed Digital Operational Resilience Act (DORA) could impact businesses and organizations once ratified and signed into law.

Given the significant penalties that would be imposed for non-compliance with DORA directives, it is perhaps reasonable to envisage that DORA could eventually have similar, if not greater, impacts in both the UK and the EU region as did GDPR, albeit with very different objectives.

Whilst some of these defense techniques may excel in certain aspects of information security, many of them are complimentary to each other and bring different or much enriched strengths to the conversation.

8 ways to manage business disruptions caused by coronavirus outbreak

March 17 2020

8 Key Ways to Manage Business Disruptions Caused by Coronavirus Outbreak

Raphael Iloh Infosec, Risk Assessment, Risk Management, Security Risks, Security Strategy barclay, business continuity, cdc, china, contingency plan, coronavirus, covid-19, disaster recovery, ebrd, europe, financials, incidence response plan, leadership, natwest, nist, planning, remote working, resilience, resiliency, risk assessment, risk management, security, self isolation, social distancing, telework, who

Coronavirus; also known as COVID-19; reached a critical phase outside China, impacting the worldwide population and economic environment. The virus has spread in several countries and regions of the world, outside China, with devastating effects.

The World Health Organisation (WHO) recently stated that Europe is now the epicentre of the COVID-19 pandemic as very high and increasing numbers of cases of the deadly coronavirus are reported in Italy, Spain, and neighbouring countries.

According to WHO, more than 140 countries, regions, and territories have reported cases of the coronavirus. And whilst the number of reported new cases in China is falling, it is rapidly increasing in Italy, Spain and some other European countries.

As at Monday, March 16 2020; these were the official figures reported in several countries:

In Italy, over 27,000 people tested positive for the coronavirus, with 2,158 deaths
In Spain, over 9,900 people tested positive for the virus, with 342 deaths
Whereas in France, over 6,600 people tested positive for the virus, with 148 deaths
For the USA, over 4,700 people tested positive for the coronavirus, with 86 deaths
And in the UK, over 1,500 people tested positive for the virus, with 55 deaths

Governments of several countries across the world are taking extraordinary measures to combat the pandemic, including shutting down schools, restricting public movement and gathering, postponing sports events, and even imposing border controls in their respective countries.

After the coronavirus, nothing will be as before, we will have to sit down and rewrite the rules of trade and the free market.
— Italy Prime Minister, Giuseppe Conte

COVID-19 has been ruled as a significant impact on businesses from all sectors, and businesses & organisations should understand, learn, and immediately provide appropriate & adequate response, to ensure business continuity. The global financial losses resulting from the impacts of the virus is estimated to be approximately US$2.7 trillion.

Virgin Atlantic recently asked its staff to take eight weeks of unpaid leave over the next three months, to help the airline cope during the coronavirus pandemic. The warning comes after many countries around the world closed borders or placed extensive restriction measures on arrivals.

With the outbreak of COVID-19, the potential of business disruptions is very significant. Businesses and organisations need to ensure that potential and possibly inevitable risks associated with pandemic are well factored into their business continuity and disaster recovery plans, as well as their incident response plan.

The coronavirus pandemic is very most likely already causing disruptions to business operations, and could affect contract performance.

Companies have to think on their feet and have crisis meetings, twice, sometimes three times a week just to try and keep up with the changes in government regulations and what they have to do to try and manage the situation.
— Dr. Adrian Hyzler

In a previous post, I’d written about how much time is generally required to conduct a risk assessment. We’d all agree that, given the current full-blown stage of the coronavirus pandemic, most businesses and organisations would have gone past risk assessment phase, and now in the phase wherein appropriate controls and measures are implemented and followed through.

With such a dynamic situation like COVID-19, it has the potential to be as disruptive, or more, to an organisation’s continuity of operations as a cyber intrusion or natural disaster
— Sandy Shen, Senior Research Director, Gartner

Let’s look at some ways that your business or organisation can manage and limit the impacts of coronavirus pandemic on your business operations and functions:

Communicate frequently with your team
It is imperative in these times to communicate with your staff. They might get concerned about their health and how they will continue to work as the situation worsen.
You have to communicate with your staff informed news about the evolution of COVID-19.You must both formally and informally direct your staff to follow relevant directives and guidance provided by governments and health authorities regarding the matter, including how to improve and maintain good personal hygiene levels.
Business leaders, department heads, and team leads should respond promptly to questions raised by staff and colleagues. You provide direct responses to their questions, escalate the questions to senior staff, or you could simply point them in the direction of more reliable, trustworthy, and accurate sources relating to the questions asked.
Encourage remote working
Several businesses and organisations require their sales team, support team, technical team, and senior executives to travel and visit customers locations across several regions and even countries; these teams are generally the lifeline of these businesses.
On top of that, nearly all businesses and organisations have locations that several staff are required to be physically present at during business hours.
In these times, however, you’d need to ensure that your staff can perform their daily tasks efficiently from remote locations like their respective homes. You may need to invest in internal communication systems or secure corporate Virtual Private Networks (VPN), to allow your staff to do their jobs from these remote locations from home.
Staff members who do not feel well, whose daily tasks do not require physical presence in business locations, or whose commute to work locations exposes them to potentially high-risk areas should be encouraged to work from appropriate remote locations.
The National Institute of Standards and Technology (NIST) has a special publication on telework security that you may find useful on this very matter.
Following these steps would help your business and organisation to avoid a possible epidemy that could affect all your staff and cause severe business disruptions.
Create a disaster recovery policy
A disaster recovery policy will normally help improve the resilience of any business to unforeseen incidents or force majeure, including outbreak of diseases like the coronavirus. You should define your worst-case scenario and prepare adequately for it. You should take into consideration all aspects of your business, and all associated risks and severity of potential impacts on these.
And as usual, your disaster recovery plan, business continuity plan, and incident response plan should all include your communication plan, RACI matrix, and all necessary information how to keep your business going.
Sort out contingency planning
All businesses and organisations; at this moment; would be expected to already have standards, backup plans, policies, and measures in place to address potential risks associated with the coronavirus pandemic.
Such controls and measures are expected to describe the ways your business and organisation will respond in the unlikely event of incidents like the coronavirus pandemic.
You would be expected to have conducted a business impact analysis, which will identify and prioritize the information system and the critical components to support your business operations and functions. The exercise would also help your business and organisation to identify measures that must be taken to reduce the effects of system disruptions and create contingency strategies that will ensure that your business will recover quickly from the incident.
Every senior executive, department head, and team leader should have a clear role assigned, and should know what to do at every stage of the contingency plan. The actions should be specified very clearly and understood very well by your team.
Be prepared to adapt your plan to current situations
The global coronavirus pandemic could be described as uncharted waters for several generations. Consequently, it is almost very difficult to anticipate the course of events that will happen due to coronavirus evolution.
So, you shouldn’t be concerned or afraid to revise or modify plans whenever the prevailing situation takes a different turn (for better or worse), and you’d realised that your plan or any parts thereof is no longer particularly fit for purpose.
Be ready to adapt, improve, and communicate!
This means that you should keep yourself well informed, and be ready to modify your plan as and when events require such modification. History suggests that you could do more wrong if you don’t take necessary actions that demonstrate your ability to improve and improvise if and when necessary. Be ready to revise your plans and communicate with your staff the reasons and grounds for these changes.
Stabilise the supply chain
Several severe disruptions appeared in the supply chains due to shut down of nearly all factories in China. If your business is affected by these disruptions, you may want to research into finding new suppliers from different countries or regions, to help improve the resilience of your supply chain.
Perhaps more importantly, your business or organisation should research into how to effectively manage your supply chain for products that may register very unusually high spikes in demand during crisis times, if your organisation has any vested interest in such products.
Respond to your customers’ new demands
There are good chances that this crisis would will most probably cause a shift in your customers’ behaviour.
The recovery from a coronavirus-triggered recession will usher in a new era in which how we live, do business and invest will fundamentally change.
— Nigel Green, CEO, deVere Group
Researches have shown that businesses and organisations that manage disruptions better generally do very well. The key reason attributed to such good results was the investment, time, and efforts committed by these businesses and organisations to their core customer segments and anticipation of their customers’ behaviours.
To effectively anticipate and address customers’ changing behaviours, businesses and organisations are encouraged to invest in digital online platforms as part of their strategies for multi-channel distribution network.
Make sure that you have sufficient working-capital
For several businesses and organisations, expressing optimism about rebuilding and rapid recovery following critical disruptions and prolonged downturn to business operations and functions may be rather very challenging.
The disruption and shifts will underscore that we live in a time of great capabilities and great promise.
But to build and protect their wealth as the world adapts to a new era, investors should be revising their portfolios to mitigate risk and take advantage of the opportunities.
— Nigel Green, CEO, deVere Group
Knowing where, when, and how to get the right level of badly needed investment into your business or organisation could be the key differentiator in the next cycle of business post-coronavirus.
It’s very heart-warming to know that several financial institutions; like Barclays, NatWest, and the European Bank for Reconstruction and Development (EBRD); have announced emergency financing packages that they have respectively made available to businesses and organisations affected by the coronavirus pandemic.

awesome remote working

In conclusion, the rather disturbing and disruptive global outbreak of the coronavirus could potentially have several unexpected severe consequences and implications on our lives, businesses, and how we get on with everyday tasks and thought process.

But rest assured, some great outcomes from all the mess are yet still very possible.

In order for any business or organisation to hope, anticipate and look forward to great outcomes, therefore, its senior executives, leaders, and key decision makers should not assume the worst outcomes but yet be adequately prepared for the worst nevertheless; by putting in place effective plans, measures, controls, and policies that will help ensure strong business continuity the post-coronavirus pandemic.

gdpr data regulations in the uk post brexit

January 14 2020

GDPR Post-Brexit – The Data Regulation Frontier in the United Kingdom After Brexit

Raphael Iloh Cyber Security, Infosec, Risk Management, Security Risks brexit, business agility, business continuity, cyberattacks, cybersecurity, cyberthreats, data breach, data privacy, data protection, data protection act 2018, data protection officer, data security, dpa 2018, dpo, edpb, enterprise, eu, european data protection board, european union, gdpr, governance, ico, information commissioners office, infosec, post-brexit, regulations, regulatory compliance, risk assurance, risk management, risk mitigation, risks, security, security strategy, siem, strategy, threats, uk, united kingdom, watchdog

Yes, Brexit is happening! The United Kingdom is scheduled to exit the European Union by the end of this month i.e. on 31 January 2020. And there are already loud callouts on social media for hundreds of thousands of people to gather in Westminster at 23:00 on 31/Jan/2020 to celebrate Brexit and usher in perhaps what you could call the “new and rediscovered” United Kingdom.

The General Data Protection Regulation (GDPR) came into force in May 2018 across all the European Union (EU) member states and the European Economic Area (EEA). The regulation requires businesses and organisations to protect the personal data and privacy of EU citizens. The regulation aims to give individuals greater control over their privacy, how their personal data is collected, stored, shared, and generally used.

Whenever there are data breaches or information breaches, the regulation requires that “culprit” businesses and organisations must report the events to authorities and inform individuals affected or impacted by such breaches, all within the stipulated time frame; usually within 72 hours of them finding out about the breach. The regulation imposes hefty penalties on non-compliance.

Perhaps it’s fitting to emphasise that the word “organisations” is used here loosely to include for-profit organisations, not-for-profit organisations, and government institutions and offices. Literally speaking, every type of organisation that handles or comes into contact with personal information of people in the EU is factored into the word.

GDPR Basics: Make sure you know what information you hold, where you hold it, why you hold it, and how people consented to give it to you.
— Zoë Findon

The Information Commissioner’s Office (ICO) is the independent data protection and information rights watchdog in the UK. The GDPR regulation was adopted into UK law through the Data Protection Act 2018 (DPA 2018).

According to stats and reports published by the European Commission on the occasion of the first-year anniversary of the GDPR regulation, over two-thirds (67%) of Europeans have heard about GDPR and nearly 90,000 Personal Data Breach (PDB) reports were received across Europe within the first year of GDPR.

In October 2019, Österreichische Post AG (ÖPAG); the national postal service providers in Austria; was fined €18 million (approximately US$20 million) for illegally selling personal data of approximately 3 million Austrians to various third parties.

In January 2019, Google was fined €50 million (approximately US$56 million) by CNIL; the data protection and information rights watchdog in France; for breaching GDPR requirements for transparency and specific, unambiguous consent.

The online advertising industry is behind comprehensive illegal collection and indiscriminate use of personal data
— The Norwegian Consumer Council

In the UK, more specifically, similar stats and reports from the ICO show that PDB reports went up by over 324% to 14,000 by May 2019 from the previous reporting year when the reports were put together under the previous DPA 1998 legislation.

Some high-profile data breach and non-compliance cases reported in the UK include the maximum fine of £500,000 (approximately US$660,000) issued to Facebook for data breaches that allegedly occurred in 2017. The ICO later admitted that the fine could have been a lot higher under the GDPR legislation.

Under the GDPR regulation, a business or organisation that is found to have infringed on the provisions of the GDPR regulation, could be fined up €20 million (approximately US$22 million), or in some situations, up to 4% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Just thinking of the huge figure, you can understand the thoughts of the ICO re Facebook, and you might just say that Facebook was lucky, eh?

In July 2019, the ICO issued a notice of its intention to fine Marriott International £99 million (approximately US$131 million) for GDPR breaches relating cyber incidents suffered by the hoteliers which compromised the personal data of approximately 339 million guests globally.

In April 2019, a local government council in the Greater London area was fined £145,000 (approximately US$191,400) for unlawfully disclosing the personal information of more than 200 people.

In November 2018, Uber was fined £385,000 (approximately US$508,200) because the company failed to protect customers’ personal data during a cyberattack.

In May 2018, the UK Crown Prosecution Service (CPS); i.e. the UK equivalent to the U.S. Attorney’s Office (USAO); was fined £325,000 (approximately US$429,000) for the loss of several encrypted DVD discs containing records of police interviews.

A recent information breach (and a major security concern) occurred in the UK when the UK government inadvertently publicly published the full home and work addresses of over 1,000 New Year (2020) Honour recipients on the internet. As we understand it, the ICO is yet to rule on this matter or yet to publicly announced its ruling.

But, perhaps the biggest GDPR fine in the UK so far; in July 2019, the ICO issued a notice of its intention to fine the British Airways £183.39 million (approximately US$242 million) for GDPR breaches relating to cyberattacks suffered by the airline which compromised the personal data of approximately 500,000 customers.

general data protection regulation gdpr

You’d recall that in my article at the start of the year, I reviewed some major breaches that were reported in 2019

I’ve always posited that cybersecurity risks, threats, and attacks pose a significantly high risk to businesses and organisations. This is simply because breaches of information or data could potentially result in financial damages, operational damages, reputational damages, diminished investors’ confidence and exposure to potential regulatory, statutory, and other compliance issues, plus penalties.

The GDPR regulation permits free data flow between EU member states and EEA. But it places stringent rules, safeguards, and controls on the transfer of data from the EU to recipients in a third country, a territory, or an international organisation.

Implicitly, therefore, after 31/Jan/2020, the UK will be considered a “third country” by the EU, and all relevant rules applicable to third countries and international organisations under the GDPR will become applicable to the UK. Conversely of course, after the Brexit date, the EU GDPR will no longer apply to the UK.

So, it’s quite understandable that one of many questions which has repeatedly popped up in conversations with businesses and organisations up and down the country is; what does a post-Brexit UK mean to businesses and organisations in terms of GDPR requirements?

My reassuring response is always; there is no immediate or critical need to fret or be excessively be worried.

According to the ICO, “the UK government intends to write the GDPR into UK law, with the necessary changes to tailor its provisions for the UK (the ‘UK GDPR’).”

This implies that the UK government will immediately incorporate the EU GDPR into UK law with only necessary UK-specific changes to bring about the UK GDPR.

If you are a UK business or organisation that receives personal data from contacts in the EEA, you need to take extra steps to ensure that the data can continue to flow after Brexit.
If you are a UK business or organisation with an office, branch or other established presence in the EEA, or if you have customers in the EEA, you will need to comply with both UK and EU data protection regulations after Brexit. You may need to designate a representative in the EEA.
— Information Commissioner’s Office

Yes, there would be some changes but these would be absolutely necessary changes, and both sets of regulations are expected to be substantially very similar.

My understanding, therefore, is that any immediate changes that’s required to be made to the UK GDPR will not require complete rework of your existing internal controls, processes, frameworks, policies, procedures, and reporting in your management information systems.

For UK-based SME businesses and organisations that want to keep data flowing between the UK and the EU, the ICO has released an interactive tool that could help you determine whether Standard Contractual Clauses (SCCs) could help you maintain the flow of data, in the event of a no-deal Brexit.

Remember, whatever effective controls and processes you currently have in place to address the EU GDPR regulation, these may require a few changes to ensure they remain relevant to the UK GDPR. But, rest assured, they would still be reasonably effective and applicable post-Brexit. And I expect the ICO would give businesses and organisations some reasonable time to implement whatever necessary changes emerge.

I envisage that the probabilities of cybersecurity risks, threats, and attacks will probably most likely increase/heighten in the few weeks, months, and possibly couple of years right after Brexit. My informed understanding, however, is that whatever effective controls, monitoring, and response strategies & policies you already have in place would suffice, for now. Of course, the key operative word here is “effective“!