Menu

governance

cybersecurity and the metaverse

Cybersecurity and the Metaverse: Risks, Threats, Challenges, and Opportunities

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

The metaverse, a boundless realm where the lines between the real and the virtual blur into a kaleidoscope of possibilities. The metaverse is a term that describes a 3D virtual world that integrates physical and digital realities as well as enables immersive and interactive experiences for users. Imagine being able to visit any place, meet any person, or do any activity in a realistic and engaging way, without leaving your home.

In this digital utopia, businesses and organizations across various sectors (including retail, finance, education, healthcare, and defence) are embarking on an extraordinary journey. That is the vision of the metaverse, which is expected to experience exponential growth following the ongoing huge improvements and strides in Generative Artificial Intelligence (AI). According to the Wall Street Journal (WSJ), metaverse spending is projected to reach US$5 trillion by 2030 i.e., within the next 7 years.

However, as we delve deeper into the wonders of the metaverse, we must tread with caution and embrace cybersecurity to safeguard this new frontier. In a couple of previous posts, we discussed Artificial Intelligence (AI) in healthcare services. In this article, we’ll discuss some of the main cybersecurity challenges and risks that the metaverse poses to organizations and how they can be effectively addressed. We’ll also discuss some of the opportunities that the metaverse offers to organizations and how they can leverage them to gain a competitive edge.

Understanding the Metaverse: Unravelling the Infinite

The metaverse, a concept once confined to science fiction, is now a reality, rapidly evolving through the convergence of virtual reality, augmented reality, blockchain, the Internet of Things (IoT), and the power of Generative AI. These technologies enable the creation of realistic and dynamic virtual environments that can be accessed by millions of users simultaneously.

This immersive domain transcends the limits of screens and keyboards, presenting an entirely new interface between humans and information. In the retail sector, fashion retailers allow customers to try on virtual outfits, providing a personalized shopping experience like never before. Financial institutions are exploring virtual banks, offering seamless transactions through virtual reality interfaces. Even healthcare is leveraging the metaverse to simulate complex surgeries and explore innovative medical treatments.

However, as with any new technology, the metaverse also brings new challenges, risks, and threats that need to be addressed by cybersecurity professionals and business leaders. The metaverse is a complex environment that’s highly interconnected, which creates new kinds of cybercrime and attack surfaces. Cybersecurity in the metaverse involves the security of the hosting platform, the property, and the users of the property.

Cybersecurity Challenges and Risks in the Metaverse

The metaverse is not immune to cyberattacks. In fact, it may be more vulnerable than the traditional web due to its novelty, complexity, and diversity. Some of the cybersecurity challenges and risks that organizations may face in the metaverse include:

  1. Lack of regulations: The metaverse is still an emerging phenomenon that has not been fully regulated by governments or industry standards. This creates uncertainty and ambiguity for both platform owners and property owners regarding their rights and responsibilities. For example, who owns the data generated by users in the metaverse? Who is liable for any damages caused by cyberattacks or malicious actors? How can intellectual property rights be enforced in the metaverse? What are the obligatory AI ethics for the metaverse? These are some of the questions that need to be clarified and addressed by legal frameworks and policies.

  2. Identity theft: The metaverse allows users to create and customize their respective avatars and personas that represent them in the virtual world. However, this also creates opportunities for identity theft and impersonation by cybercriminals who can use AI-generated deepfakes to create realistic and convincing fake images or videos of individuals or organizations. Deepfakes can be used for various malicious purposes, such as fraud, extortion, blackmail, defamation, or propaganda.

  3. Data breaches: The metaverse generates massive amounts of data from user interactions, transactions, preferences, behaviours, emotions, biometrics, and more. This data is valuable for both legitimate and illegitimate purposes. For example, data can be used to improve user experience, personalize content, offer recommendations, or provide insights. However, data can also be used to target users with phishing attacks, spam messages, malware infections, or ransomware demands. Data breaches can expose sensitive information that can compromise user privacy or security.

    The recent compromise of the MOVEit Transfer file management software; a computer program used by over 600 organizations worldwide including UK Ofcom, US Department of Energy, Deutsche Bank, PwC, and EY; is reported to have affected nearly 40 million people. The hydra-headed data breach incident of such magnitude perhaps underscores the possible damages that could be caused if something similar were to happen in the metaverse.

  4. Malware infections: The metaverse relies on various devices and platforms to deliver its services and experiences. These devices and platforms may have vulnerabilities that can be exploited by hackers to inject malware into the system. Malware infections can disrupt or damage the functionality or performance of the devices or platforms or steal or encrypt data from them. Malware infections can also spread from one device or platform to another through network connections or user interactions.

  5. Cyberattacks on critical infrastructure: The metaverse depends on critical infrastructure such as power grids, telecommunications networks, cloud servers, or IoT devices to operate smoothly and reliably. However, these infrastructure components may also be targeted by cyberattacks that aim to cause physical or digital harm or disruption.

    For example, cyberattacks on power grids could cause blackouts or brownouts that affect millions of users in the metaverse. Cyberattacks on telecommunications networks could cause latency or connectivity issues that degrade user experience or prevent access to the metaverse. Cyberattacks on cloud servers could compromise data integrity or availability or cause service outages. Cyberattacks on IoT devices could hijack or manipulate their functions or data.

Cybersecurity Solutions for the Metaverse: Thriving amidst Adversity

The metaverse poses significant cybersecurity challenges and risks that require proactive and comprehensive solutions from organizations. Some of the cybersecurity solutions that organizations can implement to protect themselves and their users in the metaverse include:

  1. Establishing cybersecurity governance: Your organization should develop and enforce a proactive cybersecurity governance model that includes clear and consistent policies and standards. These policies and standards should cover aspects such as privacy-by-design principles, privacy-by-default tenets, data ownership, data protection, data sharing, user consent, user verification, user behaviour, user feedback, user rights, user responsibilities, system status, dispute resolution, incident response, and compliance.

  2. Ensuring regulatory compliance: To ensure and promote a more compliant predisposition amidst a shifting metaverse landscape and ever-changing regulations, your organization should adopt a proactive approach involving regular audits and swift adaptation.

  3. Educating and empowering users: Your organization should educate and empower its users in the metaverse. You should inform users about the potential cybersecurity risks and threats that they may encounter in the metaverse and how to avoid or mitigate them. You should also provide users with the necessary tools and resources to protect themselves and their data in the metaverse, including privacy settings, security settings, reporting mechanisms, feedback mechanisms, or security awareness training.

Cybersecurity Opportunities in the Metaverse

The metaverse is not only a source of cybersecurity challenges and risks but also a source of cybersecurity opportunities for organizations. Some of the cybersecurity opportunities that organizations can leverage in the metaverse include:

  1. Enhancing user experience: Organizations can use cybersecurity as a competitive advantage to enhance user experience in the metaverse. They can offer their users a secure, reliable, and trustworthy environment that fosters confidence, loyalty, satisfaction, and engagement. They can also use cybersecurity as a differentiator to attract new users or retain existing users who value security as a key factor in their decision-making.

  2. Expanding business opportunities: Organizations can use cybersecurity as a catalyst to expand their business opportunities in the metaverse. They can explore new markets or segments that are emerging or growing in the metaverse. They can also create new products or services that address the specific needs or demands of users in the metaverse.

  3. Innovating business models: Organizations can use cybersecurity as an enabler to innovate their business models in the metaverse. They can adopt new ways of delivering value to their customers or stakeholders in the metaverse. They can also leverage new sources of revenue or cost savings that are enabled by cybersecurity technologies or practices in the metaverse.

What isn’t hard to imagine for us in cybersecurity is that the metaverse is going to greatly expand the threat landscape. So, the metaverse is more than an imaginative exercise for us; it’s the future – a future we should ideally start planning for now.

— Jonathan Singer, Senior Product Marketing Manager, Checkmarx

Final thoughts

The metaverse is a promising phenomenon that offers unprecedented opportunities for organizations to create immersive and engaging experiences for their users.

However, the metaverse and Generative AI will become more pervasive, diverse, and complex, requiring more advanced and adaptive cybersecurity solutions, posing significant challenges and risks for organizations to secure their platforms, properties, and users from cyberattacks or malicious actors.

Therefore, businesses and organizations need to adopt proactive and comprehensive cybersecurity solutions that can protect themselves and their users in the metaverse while leveraging its potential benefits. They should adopt best practices and recommendations to enhance their cybersecurity posture and resilience in the metaverse, such as adopting a cyber resilience strategy, implementing a zero-trust model, using blockchain technology, leveraging artificial intelligence tools, establishing clear policies, standards, guidelines, roles, responsibilities for cybersecurity management, and collaborating with other stakeholders in the metaverse ecosystem.

If you need help developing and implementing effective cyber resilience strategies within your organization, or you’re simply interested in learning more about effective cybersecurity and risk management best practices, then please feel free to contact me today.

また会うまで – take care, until we meet again.

supply chain and cybersecurity part 2

Safeguarding the Digital Fortress: Navigating Cybersecurity and Supply Chain Challenges – Part 2

, , , , , , , , , , , , , , , , , , , , , , , ,

This is the second part of a 2-part series wherein we explore cybersecurity and supply chain challenges. In the first post, we explored the challenges, risks, and threats that cybersecurity and the supply chain pose to organizations and how these could be effectively mitigated against. We also looked at how cybersecurity supply chain risks touch nearly all facets of business operations including sourcing, vendor management, supply chain continuity and quality, transportation security and many other functions across the enterprise.

The digital landscape is fraught with diverse cybersecurity threats, ranging from malware and phishing attacks to the ever-looming threat of ransomware. Such threats not only compromise data integrity but also disrupt operations and tarnish the reputation of businesses. In this second and final part of the series, we’ll delve even further into a few other factors that play into the complex yet critical fabric of the global interconnectedness of businesses and organizations. Let’s get started, shall we?

A holistic approach to C-SCRM

Cybersecurity and the supply chain are interdependent and mutually influential. C-SCRM is a vital process that helps organizations to ensure the security and integrity of their products and services and to mitigate the risks and threats that may affect their supply chain.

To be effective, C-SCRM must be seen and conducted as an enterprise-wide activity that involves all tiers of your organization i.e., people, business processes, and technology. C-SCRM requires a holistic and proactive approach that involves collaboration among all parties in the supply chain and incorporates other aspects of cybersecurity such as generative AI, data protection, leadership, cyber resilience, privacy, third-party risks, and cybersecurity governance.

Generative AI for C-SCRM

The emergence of Generative AI, a subset of Artificial Intelligence (AI), has brought new possibilities for enhancing cybersecurity. Generative AI can be a powerful tool for C-SCRM in several ways, such as:

  1. Enhancing the security and quality of products and services by using generative AI to test, verify, or validate their functionality, performance, or compliance.

  2. Improving the efficiency and agility of supply chain processes by using generative AI to automate, optimize, or streamline tasks such as design, development, distribution, deployment, maintenance, etc.

  3. Increasing the innovation and differentiation of products and services by using generative AI to generate new features, functionalities, or designs that meet customer needs or expectations.

  4. Enabling the personalization and customization of products and services by using generative AI to tailor them to specific preferences, contexts, or scenarios of customers or users.

However, there are some challenges and risks of integrating Generative AI into C-SCRM, such as:

  1. Introducing new vulnerabilities or threats to products and services by using generative AI to create malicious or harmful content or data that can compromise their security or integrity.

  2. Reducing the transparency or accountability of products and services by using generative AI to generate content or data that is difficult to explain, verify, or trace.

  3. Increasing the complexity or uncertainty of products and services by using generative AI to generate content or data that is dynamic, unpredictable, or probabilistic.

  4. Affecting the ethics or legality of products and services by using generative AI to generate content or data that is inappropriate, offensive, deceptive, or infringing.

Therefore, it is important to use generative AI responsibly and ethically for C-SCRM and ensure that it complies with the relevant standards, regulations, and best practices.

A reinforced and sturdy C-SCRM

C-SCRM is not a standalone activity but rather an integral part of the overall cybersecurity strategy and culture of an organization. Therefore, it’s essential to incorporate other key aspects of cybersecurity such as data protection, leadership, cyber resilience, privacy, third-party risks, and cybersecurity governance into C-SCRM. Some of the ways to do this include:

  1. Data protection: Ensure that the data that is collected, processed, stored, transmitted, or shared in the supply chain is protected from unauthorized access, use, disclosure, modification, or destruction. Implement data protection measures such as encryption, authentication, authorization, backup, recovery, etc. Comply with data protection laws and regulations such as GDPR, CCPA, etc.

  2. Leadership: Establish a clear vision and direction for C-SCRM that is communicated and supported by the top management and stakeholders. Empower and enable the C-SCRM team with the necessary resources, authority, and accountability. Foster a culture of trust, collaboration, and continuous improvement among all parties in the supply chain.

  3. Cyber resilience: Build the ability to anticipate, prepare for, respond to, and recover from cyberattacks in the supply chain. Develop a cyber resilience strategy that covers prevention, detection, response, recovery, and learning. Implement cyber resilience measures such as redundancy, diversity, modularity, adaptability, etc.

  4. Privacy: Privacy is a complex and evolving domain that requires balance and trade-offs. It’s subject to various interests and values that may conflict or compete with each other. Respect the rights and preferences of customers and users regarding their personal information in the supply chain. Implement privacy measures such as consent, notice, choice, access, rectification, erasure, etc. Comply with privacy laws and regulations such as GDPR, CCPA, etc.

    Your organization can implement privacy standards and frameworks (e.g., ISO/IEC 29100, NIST SP 800-53A, or CIS Privacy Controls) that provide guidance on how to embed privacy principles and practices into its data processing activities.

  5. Third-party risks: Third-party risk management is subject to various sources and types of risks that may change or evolve over time. Some examples of such sources and types of risks include performance risks, financial risks, operational risks, strategic risks, compliance risks, or reputational risks. Assess and manage the risks associated with the external parties that provide products or services in the supply chain. Implement third-party risk management measures such as due diligence, risk assessment, contract management, monitoring, auditing, etc.

    Your organization can comply with third-party risk management standards and frameworks such as ISO 27036 (parts 1 through 4), NIST SP 800-161, etc.

  6. Cybersecurity governance: Cybersecurity governance is a challenging and demanding domain that requires leadership, culture, and competence. Cybersecurity governance is subject to various stakeholders and expectations that may vary by sector, industry, or region. Some examples of such stakeholders and viewpoints include board members, senior managers, employees, customers, suppliers, regulators, and auditors. Establish and maintain the policies, processes, structures, roles, and responsibilities for C-SCRM. Implement cybersecurity governance measures such as planning, organizing, directing, controlling, reporting, etc.

    Your organization can implement cybersecurity governance standards and frameworks such as ISO 27001, ISO 38500, NIST SP 800-37, NIST CSF, COBIT, etc. Your organization can also invest in cybersecurity governance tools to help enhance its cybersecurity governance capabilities and performance. Such tools and training include cybersecurity governance dashboard, cybersecurity governance scorecard, cybersecurity governance maturity model, cybersecurity governance workshop, etc.

NIST has outlined some key practices for effective C-SCRM alignment including:

  1. Integrate C-SCRM across the organization.

  2. Establish a formal C-SCRM program.

  3. Know and manage critical suppliers.

  4. Understand the organization’s supply chain.

  5. Closely collaborate with key suppliers.

  6. Include key suppliers in resilience and improvement activities.

  7. Assess and monitor throughout the supplier relationship.

  8. Plan for the full lifecycle.

Experts on cybersecurity and supply chain management like to draw attention to the fact that operating systems are only as strong as their “weakest link“. The “weakest link” argument is evoked with good reason when discussing risk management.

— Xeneta

Conclusion

Okay, we’ve discussed the challenges and opportunities of cybersecurity and supply chain management. We’ve also discussed how Generative AI can be used to create and protect data in various domains. Finally, I’ve provided some best practices and recommendations for improving cybersecurity and supply chain management, drawing on relevant guidance and regulations such as the NCSC Supply Chain Security Guidance, the NIST CSCRM, and the EU Supply Chain Due Diligence Directive.

If you are interested in learning more about C-SCRM or need help with implementing it in your organization, please contact me today. I can help you to design, develop, and deploy a C-SCRM strategy that suits your business objectives, risk appetite, regulatory obligations, and cybersecurity posture. I can also help you to leverage generative AI for C-SCRM responsibly and ethically.

Hasta que nos encontremos de nuevo; take care, see you around soon.

Why Cyber Kill Chain not Sufficient to Protect Your Organization

Why The Cyber Kill Chain Is Not Sufficient to Effectively Protect Your Organization

, , , , , , , , , , , , , , , ,

An epochal shift during the 21st century has led us to enter a new era of technological advancements, where cyber security has become vital in keeping an organization and business secure.

The rise of computers, telecommunications and the internet had opened the doors for cyberterrorism. Cyberattacks had become so rampant that they started to become a threat to the economy. Cybercriminals and hackers have also evolved their digital skills in stealing and destroying other businesses by breaching information security.

Having an effective security system to protect your organization is your best defense against cybersecurity threats. It does not only protect your business but your consumers and employees as well.

Investing in an efficient cybersecurity plan promotes risk management for monetary and reputational damage and ensures data integrity and confidentiality within your organization.

Ignoring cybersecurity is a grieve and an expensive mistake to make. Though it may not eliminate the risk of cyberattacks, a layered security approach can withstand cyber intrusion and assaults.

Lockheed Martin Cyber Kill Chain Framework

The Cyber Kill Chain is a stage-based framework (or methodology, if you like) originally developed by Lockheed Martin which traces the stages of cyberattacks. An adaptation of an established military defense operation, it is a part of their Intelligence Driven Defense Model that identifies vulnerabilities and prevent cyber intrusion activities.

This framework is named “Kill Chain” as it was adapted from a military term related to an attack’s structure. By stopping the attacker at any stage during the assault can break the chain of attack! The adversary must completely advance through all the stages to succeed. Each stage of intrusion will give us the chance to know more about the attacker and use their tenacity as our leverage.

The Kill Chain Framework works in 7 stages:

  1. Reconnaissance – The step where the targets are identified. Adversaries plans and research their target organizations. These intruders will use automated scanners to find weak points in the system. They could scan firewalls to create a point of entry in the system. Detecting the intruders during reconnaissance could be challenging, but it could help reveal the attackers’ criminal intents.

  2. Weaponization – The adversaries start staging their operation. After finding security vulnerabilities in the system, these attackers will develop malware. If their target is document-based, they produce a “decoy” file to present to the victim. They weaponize malware based on the attack’s intention. This is also the stage where adversaries could find ways to reduce their chances of being detected. The defender will not detect weaponization as it happens, but they can figure out the intent by investigating malware artifacts.

  3. Delivery – The adversaries start to launch their operations. The attackers will start sending the malware to the defenders. They will deliver the weapon through email phishing or a removable/portable device. This is a vital stage for the defenders. Blocking the operation should be prioritized at this point. This can be done if the delivery medium is analyzed or targeted servers are detected.

  4. Exploitation – Advancing to this stage is when the attackers start to gain access to their victims. The malicious malware was delivered and breached the secured parameter. Opening a phishing email attachment or clicking on a malicious link has triggered the “zero-day”, a phrase that refers to the exploit code. At this rate, custom capabilities are crucial to stop zero-day exploits. But traditional hardening measures could also help in adding resiliency to the security.

  5. Installation – The hacker, had already established a beachhead at the victim. The malware has installed a backdoor that will serve as a point of entry for the intruder. Some adversaries would ensure that the malware looks like a regular part of the installed operating system. In this stage, it is important to stop the attack by using systems such as the Host-Based Intrusion Prevention System (HIPS). It can alert or block common installation paths.

  6. Command and Control (C2) – The adversaries gain control of the system’s network. The malware has opened a channel of command to remotely manipulate the victim. They can gain access to secure and confidential accounts and could attempt damaging attacks. This stage is the defender’s last chance to block the attack. And this can be done by blocking the C2 channel. This will stop the adversaries from issuing a command to prevent further damage.

  7. Action on Objectives – The adversaries have reached their goals-the stage where the hackers have successfully extracted their needed data from the system. They gained the power to damage further, such as collecting user credentials, destroying the system, or overwriting and corrupting the data. The longer the hacker has access to CKC7, the greater the impact of the damage. This stage could be detected as soon as possible using forensic evidence and network packet capture.

cyber kill chain model

Key Elements of the Cyber Kill Chain:

The Cyber Kills chain was designed to assist companies in developing in-depth strategies for defense. By mapping out the steps that the hackers take to complete a cyberattack, organizations would be able to combat persistent cyber threats.

Since the Cyber Kill was derived from a military model, the main elements of this framework are established to identify adversaries, prepare for an attack, engage, and destroy a target. It can quickly identify and recognize social engineering, insider threats and innovative attacks.

Drawbacks of Kill Chain Framework

The Cyber kill chain is modelled to respond to pre-determined attack sequences. It has been universally adopted for cybersecurity. But like any other model, it is not perfect and has its fundamental flaws.

  1. The model assumes a perimeter focus defense where the main resistance is a firewall. It fails to cover other internal attacks and cyberattack vector paths.

  2. Cyber Kill Chain framework’s phase sequence cannot precisely block all attacks. Most of its phases can be easily bypassed.

  3. The framework only focuses on blocking an attack but fails to define what to do after the adversaries successfully breaches the system.

  4. Once the adversary was able to penetrate the victim’s system, the framework’s timing of the attack in every phase was inconsistent. Adversaries could easily stay dormant for a longer period while they wait for the opportunity to launch their final phase of attack without being detected.

Teams that say their cybersecurity is really good are the ones to worry about. After our breach, the most difficult issue was deciding when it was safe enough to come back online. I learned that really smart engineers can talk English, under extreme pressure.

— Dame Dido Harding, former CEO of TalkTalk

Other Frameworks with Similar Objectives Compared to the Cyber Kill Chain

MITRE ATT&CK vs Cyber Kill Chain

ATT&CK is an acronym that stands for Tactics, Techniques, and Common Knowledge.

The MITRE ATT&CK framework was designed based on observations in the real world. It reflects the different phases of an intruder’s attack lifecycle and the target platforms.

One could argue that there are Cyber Kill Chain and MITRE ATT&CK both share common views and understanding of cyberattacks i.e., most cyberattacks involve adversaries breaking into networks, avoiding getting detected, stealing as much data as they possibly can, interrupting as much network operations as they possibly can, getting out as quietly and stealthily as they got in, making hidden backdoor access available if they ever need to return, etc.

However, compared to Cyber Kill Chain, the Mitre ATT&CK framework maintains a matrix model that has more in-depth details on how the adversary will attack in each stage. Also, Cyber Kill Chain fail to factor in the different techniques and tactics of a cloud-native attack.

The Cyber Kill assumes that the attackers will deliver malware to a target environment but ATT&CK assumes that the adversaries may very well change their goals/objectives mid-way through an attack especially when the success of the attack appears either easier or more difficult than they had initially planned.

Yes, one could argue that the MITRE ATT&CK framework uses Situational Crime Prevention (SCP) techniques, a set of techniques which assumes that the goals/objectives of most adversaries are not linear but influenced/informed by opportunities, constraints, limitations, resistance, and situations presented to them by their targets during the execution of attacks.

Google BeyondCorp vs Cyber Kill Chain

BeyondCorp is an implementation of a zero-trust security concept that creates a zero-trust network. Designed to provide end-to-end real-time protection and platform security. It has embedded data built into the Chrome browser to prevent malware infection from networks and provide phishing-resistant authentication.

Unlike the Cyber Kill Chain framework, Google BeyondCorp “shifts access control from the traditional network perimeter to individual devices”. Its zero-trust access approach users to securely work with untrusted networks even if they are not using a client-side VPN.

NIST Cyber Security Framework (NIST CSF)

The National Institute for Standards & Technology (NIST) Cyber Security Framework (CSF) provides a set of structured standards and measurements for cybersecurity. The framework sets out “standards, guidelines, and best practices to manage cybersecurity-related risks.”

But the downside of the framework is that its 5 categories/elements i.e., Protect, Identify, Detect, Respond and Recover; fail to directly outline how it can dissect a cyberattack incident. It also fails to supply analytic markers to test the detection.

Nevertheless, the descriptive (and not prescriptive) nature of the NIST CSF has made it seem “business-friendly” and therefore, made it possible for the framework to be adopted by businesses and organizations of all sizes and across several industries, particularly organizations in industries that are guided by regulary controls and compliance requirements where industry-uniqueness and specificities are considered important.

data breach

In conclusion, there is no one defense framework or set of techniques that could be considered all-in-one sufficient for all cybersecurity defense requirements.

In a previous article, I had looked at how the proposed Digital Operational Resilience Act (DORA) could impact businesses and organizations once ratified and signed into law.

Given the significant penalties that would be imposed for non-compliance with DORA directives, it is perhaps reasonable to envisage that DORA could eventually have similar, if not greater, impacts in both the UK and the EU region as did GDPR, albeit with very different objectives.

Whilst some of these defense techniques may excel in certain aspects of information security, many of them are complimentary to each other and bring different or much enriched strengths to the conversation.

 

gdpr data regulations in the uk post brexit

GDPR Post-Brexit – The Data Regulation Frontier in the United Kingdom After Brexit

, , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Yes, Brexit is happening! The United Kingdom is scheduled to exit the European Union by the end of this month i.e. on 31 January 2020. And there are already loud callouts on social media for hundreds of thousands of people to gather in Westminster at 23:00 on 31/Jan/2020 to celebrate Brexit and usher in perhaps what you could call the “new and rediscovered” United Kingdom.

The General Data Protection Regulation (GDPR) came into force in May 2018 across all the European Union (EU) member states and the European Economic Area (EEA). The regulation requires businesses and organisations to protect the personal data and privacy of EU citizens. The regulation aims to give individuals greater control over their privacy, how their personal data is collected, stored, shared, and generally used.

Whenever there are data breaches or information breaches, the regulation requires that “culprit” businesses and organisations must report the events to authorities and inform individuals affected or impacted by such breaches, all within the stipulated time frame; usually within 72 hours of them finding out about the breach. The regulation imposes hefty penalties on non-compliance.

Perhaps it’s fitting to emphasise that the word “organisations” is used here loosely to include for-profit organisations, not-for-profit organisations, and government institutions and offices. Literally speaking, every type of organisation that handles or comes into contact with personal information of people in the EU is factored into the word.

GDPR Basics: Make sure you know what information you hold, where you hold it, why you hold it, and how people consented to give it to you.

— Zoë Findon

The Information Commissioner’s Office (ICO) is the independent data protection and information rights watchdog in the UK. The GDPR regulation was adopted into UK law through the Data Protection Act 2018 (DPA 2018).

According to stats and reports published by the European Commission on the occasion of the first-year anniversary of the GDPR regulation, over two-thirds (67%) of Europeans have heard about GDPR and nearly 90,000 Personal Data Breach (PDB) reports were received across Europe within the first year of GDPR.

In October 2019, Österreichische Post AG (ÖPAG); the national postal service providers in Austria; was fined €18 million (approximately US$20 million) for illegally selling personal data of approximately 3 million Austrians to various third parties.

In January 2019, Google was fined €50 million (approximately US$56 million) by CNIL; the data protection and information rights watchdog in France; for breaching GDPR requirements for transparency and specific, unambiguous consent.

The online advertising industry is behind comprehensive illegal collection and indiscriminate use of personal data

In the UK, more specifically, similar stats and reports from the ICO show that PDB reports went up by over 324% to 14,000 by May 2019 from the previous reporting year when the reports were put together under the previous DPA 1998 legislation.

Some high-profile data breach and non-compliance cases reported in the UK include the maximum fine of £500,000 (approximately US$660,000) issued to Facebook for data breaches that allegedly occurred in 2017. The ICO later admitted that the fine could have been a lot higher under the GDPR legislation.

Under the GDPR regulation, a business or organisation that is found to have infringed on the provisions of the GDPR regulation, could be fined up €20 million (approximately US$22 million), or in some situations, up to 4% of its total worldwide annual turnover in the preceding financial year, whichever is higher.

Just thinking of the huge figure, you can understand the thoughts of the ICO re Facebook, and you might just say that Facebook was lucky, eh?

In July 2019, the ICO issued a notice of its intention to fine Marriott International £99 million (approximately US$131 million) for GDPR breaches relating cyber incidents suffered by the hoteliers which compromised the personal data of approximately 339 million guests globally.

In April 2019, a local government council in the Greater London area was fined £145,000 (approximately US$191,400) for unlawfully disclosing the personal information of more than 200 people.

In November 2018, Uber was fined £385,000 (approximately US$508,200) because the company failed to protect customers’ personal data during a cyberattack.

In May 2018, the UK Crown Prosecution Service (CPS); i.e. the UK equivalent to the U.S. Attorney’s Office (USAO); was fined £325,000 (approximately US$429,000) for the loss of several encrypted DVD discs containing records of police interviews.

A recent information breach (and a major security concern) occurred in the UK when the UK government inadvertently publicly published the full home and work addresses of over 1,000 New Year (2020) Honour recipients on the internet. As we understand it, the ICO is yet to rule on this matter or yet to publicly announced its ruling.

But, perhaps the biggest GDPR fine in the UK so far; in July 2019, the ICO issued a notice of its intention to fine the British Airways £183.39 million (approximately US$242 million) for GDPR breaches relating to cyberattacks suffered by the airline which compromised the personal data of approximately 500,000 customers.

general data protection regulation gdpr

You’d recall that in my article at the start of the year, I reviewed some major breaches that were reported in 2019

I’ve always posited that cybersecurity risks, threats, and attacks pose a significantly high risk to businesses and organisations. This is simply because breaches of information or data could potentially result in financial damages, operational damages, reputational damages, diminished investors’ confidence and exposure to potential regulatory, statutory, and other compliance issues, plus penalties.

The GDPR regulation permits free data flow between EU member states and EEA. But it places stringent rules, safeguards, and controls on the transfer of data from the EU to recipients in a third country, a territory, or an international organisation.

Implicitly, therefore, after 31/Jan/2020, the UK will be considered a “third country” by the EU, and all relevant rules applicable to third countries and international organisations under the GDPR will become applicable to the UK. Conversely of course, after the Brexit date, the EU GDPR will no longer apply to the UK.

So, it’s quite understandable that one of many questions which has repeatedly popped up in conversations with businesses and organisations up and down the country is; what does a post-Brexit UK mean to businesses and organisations in terms of GDPR requirements?

My reassuring response is always; there is no immediate or critical need to fret or be excessively be worried.

According to the ICO, “the UK government intends to write the GDPR into UK law, with the necessary changes to tailor its provisions for the UK (the ‘UK GDPR’).”

This implies that the UK government will immediately incorporate the EU GDPR into UK law with only necessary UK-specific changes to bring about the UK GDPR.

If you are a UK business or organisation that receives personal data from contacts in the EEA, you need to take extra steps to ensure that the data can continue to flow after Brexit.

If you are a UK business or organisation with an office, branch or other established presence in the EEA, or if you have customers in the EEA, you will need to comply with both UK and EU data protection regulations after Brexit. You may need to designate a representative in the EEA.

Yes, there would be some changes but these would be absolutely necessary changes, and both sets of regulations are expected to be substantially very similar.

My understanding, therefore, is that any immediate changes that’s required to be made to the UK GDPR will not require complete rework of your existing internal controls, processes, frameworks, policies, procedures, and reporting in your management information systems.

For UK-based SME businesses and organisations that want to keep data flowing between the UK and the EU, the ICO has released an interactive tool that could help you determine whether Standard Contractual Clauses (SCCs) could help you maintain the flow of data, in the event of a no-deal Brexit.

Remember, whatever effective controls and processes you currently have in place to address the EU GDPR regulation, these may require a few changes to ensure they remain relevant to the UK GDPR. But, rest assured, they would still be reasonably effective and applicable post-Brexit. And I expect the ICO would give businesses and organisations some reasonable time to implement whatever necessary changes emerge.

I envisage that the probabilities of cybersecurity risks, threats, and attacks will probably most likely increase/heighten in the few weeks, months, and possibly couple of years right after Brexit. My informed understanding, however, is that whatever effective controls, monitoring, and response strategies & policies you already have in place would suffice, for now. Of course, the key operative word here is “effective“!

top 10 cybersecurity risks trends for 2020

Top Cyber Security Risk Trends & Predictions for 2020

, , , , , , , , , , , , , , , , , , , , , , , , , , , , ,

Many security experts would probably agree that 2019 was a very interesting and challenging year. According to a Forbes report, 2019 saw more than 3,800 publicly disclosed data security breaches in the United States within the first 6 months.

The year 2019 witnessed some very large, disturbing, and public-profile information security breaches.

According to the Ninth Annual Cost of Cybercrime Study Report published by Accenture in 2019, the average number of security breaches grew by 11 percent since 2018.

Some of the security breaches recorded in 2019 include (presented in descending breach reported date order):

Gekko Group, a subsidiary of Accor Hotels, in November 2019 with over 660,000 customer records exposed

Quest Diagnostics in June 2019 with about 11.9 million patient records affected

First American Financial Corporation in May 2019 with about 885 million records of mortgage transactions affected

Facebook in April 2019, via third-party hosted servers with over 540 million records exposed

Capital One in March 2019 with over 106 million breached customer information

Fornite, owned by Epic Games, in January 2019 with about 200 million users affected worldwide

We are now only the third day into the new decade and already a retail foreign-exchange specialist company; Travelex; was reportedly forced to shut down its online services following a virus attack on its systems.

Cybersecurity and cyberattack issues are becoming ever-increasing struggles for businesses and organisations. And these can so easily affect all organisations, regardless of size.

With new risks & threats emerging every other day, the risks of compromising customer or employee data are becoming ever increasingly challenging to organisations as more severe consequences are being put in place and followed through by regulatory agencies.

Reputational damages caused by security incidents and data breaches could be incalculable.

data breach

So, with 83% of enterprise workload expected to move to the cloud by the end of this year, here are some security risks and threats that I expect (predict) to cause major headlines this year:

Ransomware

It is reported that a business will fall victim to a ransomware attack every 14 seconds in 2019 and every 11 seconds by 2021. This suggests that a similar prediction for 2020 will put the figure less than every 11 seconds. That is appears to be a worrying prediction.

Ransomware attacks were very prevalent in 2019. With the increase in sophistication and complexities; particularly enterprise ransomware; I envisage this trend will continue in 2020, particularly against healthcare organisations, small businesses, schools, and local government institutions.

Phishing & Social Engineering

According to the 2019 Data Breach Investigation Report published by Verizon, 32% of data breaches involve phishing.

And according to the 2019 Internet Security Threat Report (ISTR) published by Symantec, phishing security incidents have declined year on year for the last four years; I expect this trend to continue.

Formjacking

The report by Symantec reveals that formjacking remains the greatest threat to online retailers and other organisations within goods supply chain. I expect to see this trend continue to rise.

internet of things iot

Internet of Things (IoT)

Gartner projects that there will be around 20.4 billion IoT devices by the end of this year (i.e. 2020).

Symantec reports that, in 2018, network routers accounted for 75% of infected devices, and connected digital cameras accounted for 15% of infected devices. Understandably, routers were the most targeted devices simply because they are gateways (i.e. entry/exit points) from internal networks to the internet.

China, North America, and Europe collectively represent two-third of installed and in-use IoT devices, with consumer items (smart televisions, virtual assistant smart speakers, smart refrigerators, digital set-up boxes, etc.) representing more than 60% of IoT connected devices.

Adoption of 5G technologies, infrastructure, and systems is expected to have a global reach in 2020, and this should give rise to a plethora of new IoT devices.

I envisage that there would be an increase in the number of devices at risk as more consumers and businesses introduce more IoT connected devices to more everyday activities.

Malware

According to a study by Accenture, the average cost of a malware attack on a company is $2.6 million.

Another similar study by IBM, indicates that the average cost of a data breach is $3.9 million.

Given the magnitude of potential damages this could cause to organisations, this appears to be one area of risks and attacks that shows no sign of letting off in 2020.

Mobile Devices

Mobile devices used within corporate environments remain high risk concerns to businesses.

Symantec reports states that, in 2018, 1 in 36 mobile devices had high risk apps installed, and infections on mobile devices were up by a third when compared to 2017.

Mobile devices will become prime phishing attack vectors as attackers continue to employ machine learning and artificial intelligence in attacks.

I envisage that this upward trend is expected to continue in 2020, especially with the anticipated advent of 5G networks and even more mobile devices.

Internal Actors

Insider attacks are forecast to rise in 2020. This is a high impact, high severity, and high probability risk because of the potential for disgruntled or careless employees to inflict great harm on any organisation.

One-third of data breaches involved internal actors.

The human factor remains the weakest link in cybersecurity implementation. Blackmails, hefty bribes, threat to life & family members remain enough duress to make hereto loyal employees to reluctantly reconsider their decisions and choices.

It’s important to emphasise that, as far as regulatory laws and legislation are concerned, the final responsibility and accountability for protecting data in the cloud lies with the organisations that choose to use cloud services, and not the cloud service providers.

This, therefore, mandates that businesses & organisations must ensure that the appropriate and fitting risk mitigating plans, incident response plans, monitoring, controls, and reporting are put in place.

The report by Verizon indicated that 56% of breaches took months to discover. I envisage that effective cyber and information security strategies and implementations could help organisations promptly identify risks, respond and manage security incidents & events.

risks controls availability planning security incidents

Security Risk Mitigation and Controls – Going Above and Beyond Availability Plans

, , , , , , , , , , , , , 0

According to Werner Vogels, CTO at Amazon.com, “Everything FAILS all the time.” This popular quote lends itself to logical grounds for robust availability plans.

Availability planning aims to put in place plans, processes, and actions that ensure the ability of a system or service to withstand or recover from exceptional events like an infrastructure or component failure.

When you are operating and supporting large, critical, and/or complex business functions, failure must not be treated as an exceptional event. Rather it must to be treated as an operational event; something you expect and anticipate to happen without causing major or severe disruptions to services and support available to business.

And here’s the rub that quite a few senior executives and management teams are rather somewhat oblivious of; risks of disruptions to services are not limited to infrastructure and/or application failures, they also include data security risks, information security risks, and cyber-security risks, e.t.c.

A comprehensive security architecture strategy proactively covers operational failure, disruptions, abuse, damage, threats, attacks, and denials; it goes (and should go) above and beyond a good availability plan.

Security Incident Response Policies and Security Incident Response Plan; both which must be consistent with applicable laws in relevant jurisdictions; must form integral part of your proactive comprehensive architecture, governance, and strategy.

Back To Top
Management Wire

ManagementWire © 2015-2025. All rights reserved.

Terms of Use

Privacy Policy

Cookie Policy

Contact