PCR Tech and IT retail, distribution and vendor news
Cybersecurity is possibly one of the most constantly changing landscapes in the tech industry. Those who have taken it upon themselves to offer products and services to keep our information and data safe are tasked with the job of not only keeping up with the latest industry trends and consumer and business demands, but ensuring they stay one step ahead of the hackers and cybercriminals looking for a way in to your devices, bank accounts and homes.
As electronic devices continue to sell and more people look towards technology to help them keep their lives – and personal data – in order, the threat of cybercrime shows no sign of slowing down.
Each year the industry and the public hear about new and emerging threats to our cyber security, and 2018 has been no different, with everything from malicious crypto-currency mining to Zero Day malware stealing the security headlines.
One of the biggest issues that tech users face today is that of social engineering, according to David Emm, principal security researcher at Kaspersky Lab UK. “From ransomware and crypto-currency, right through to APT attacks, this remains a consistent tactic for gaining an initial foothold on a victim’s computer.
“This might involve tricking people into clicking on links or clicking on email attachments to run code that will give the attackers access to the victim’s computer and their data. Phishing emails, for example, made to look like they have been sent from official bodies such as governments or banks, remain a successful method.
“This demonstrates that further public awareness is needed of these dangers,” says Emm. “Technology can reduce the risk of attack and help to mitigate the impact of an attack. That’s why it’s vital that we protect the devices we use, apply updates to our operating system and applications as soon as they become available, and backup our data regularly.”
However, Emm notes that there is an element of self-responsibility too. “It’s similar to road safety – we have technologies such as traffic lights and pedestrian crossings to help us navigate the roads safely, but ultimately, we still need to check that roads are clear ourselves before we cross them.
“It is the same concept when it comes to how we use our devices online. There are ways to defend against such social engineering strategies, which are relatively simple. If consumers utilise password managers and don’t click on random links in messages, the success rates of these attacks would be minimised.”
For Emm, the most surprising security news he has come across this year is the massive growth of malicious crypto-currency mining. “This is fuelled by the speculation around crypto-currencies, as people see an opportunity to get rich quick. However, criminals have spotted this opportunity too and are exploiting the mass investment in crypto-currencies for their own gain,” he warns. “There have been cases of hackers taking over people’s devices and stealing the money they have earned through investing in and selling crypto-currencies.”
Jonathan Whitley, Northern Europe area sales director for WatchGuard Technologies, adds Zero Day malware to the list of important security issues we’re facing in 2018. “Zero Day malware continues to be a big headache for end-users while many businesses, especially SMBs still rely on purely signature-based solutions that fail to block most zero-day attacks,” he says.
Looking at the issues IT admins are faced with, Paul Lipman, CEO of BullGuard, believes that it’s not just one thing, but rather a series of security threats. “Becoming the target of a cybercrime syndicate will keep many people awake at night. These days many malicious hacking attacks are the result of organised professionals. Traditional organised crime groups that used to run drugs, gambling and extortion have now developed structured cyber organisations with the sole intention of stealing as much as possible,” says Lipman.
“Another concern is sophisticated malware programs that not only infect the end-user but also break into websites and modify them to help infect more victims. These all-in-one malware programs often come with management consoles so that their owners and creators can keep track of what the botnet is doing, who they are infecting, and which ones are most successful.”
Lipman also cites the theft of intellectual property and corporate espionage as high on the list. “Many times a web server or its application software isn’t hacked; rather it’s a link or online advertisement that a user clicks on enabling attackers to exploit weaknesses in a website that allows them to bypass admin authentication,” he explains. “Common website vulnerabilities such as poor passwords, cross-site scripting vulnerabilities, SQL injection, vulnerable software and insecure permissions have been around a while, yet they are still a problem today.”
Secure selling
There’s no doubt there is a lot for both consumers and businesses to take on board when it comes to protecting their data. But as more people purchase software online, is it becoming harder for retailers to take full advantage of the increase in cybercrime?
“Not for the consumer market,” says BullGuard’s Lipman. “There’s a growing awareness among consumers about the dangers of going online unprotected. The media regularly carries stories about hacks and real-world consequences, such as the impact of hacking on identity theft victims, so the need for online security is constantly being hammered home. That said, there is still an attitude of “it will never happen to me”, when most often, it does.
“From a reseller’s perspective it’s important to keep abreast of the ever changing threat landscape and offer security software that is constantly being enhanced and improved to deal with and get ahead of new and emerging threats.”
Watchguard Technologies’ Whitley adds: “With the increased complexity of malware, it is becoming increasingly daunting for end-user customers to effectively manage and implement the solutions they need. Consequently, end-users are turning to MSSPs to manage their security as an alternative to buying solutions off the shelf. To cater for this, WatchGuard has developed sales programmes and technology that allows MSSP partners to manage and bill their customers flexibly.”
The future of security
Looking ahead, what can we expect to see emerge in the security landscape over the next five years?
Keith Casey, API product solver at Okta, believes API (application programming interfaces) security will be one of the biggest trends in the years ahead.
“API security needs to be an increased focus for both security and engineering teams. Privacy and security issues stemming from API development have continued to rise over the last year, so much so that according to Gartner, by 2022 the largest source of data breaches will arise from this,” says Casey.
“Whether it’s launching a mobile app or working on partner integrations, APIs are the glue that help secure the connections between different applications. However, the growth of APIs needs to be matched with the mindset of securing them.
“Security problems often stem from the fact that software developers don’t always consider the varying levels of access when working with APIs. If you visualise a hotel, you want to make sure only the right people (or in this case, apps) have the correct keys to the correct rooms and nothing more.”
On the consumer side of things, Whitley believes IoT devices will be targeted over the next five years: “The increase in new attack vectors is likely to be significant and the growth of unsecure IoT is going to open new markets and a requirement to secure devices that most people never perceived as being threats. For those offering solutions it will increase the need for products that can be remotely managed with zero touch deployment.”
Lipman agrees, pointing out that with the explosion of IoT devices connecting to the internet, we’re seeing an expansion of attack vectors and an increase in vulnerabilities.
“This will not only increase the risk of attacks, but potentially also the severity of the attacks as they connect to the physical world,” he says. “This risk is compounded by the nature of businesses adopting IoT technology. We will also see a range of new or traditional businesses entering the digital world, some of which might lack the experience, awareness and skills to effectively secure their devices.
“Of course malware will become increasingly sophisticated with some of it driven by artificial intelligence but largely its unsecured IoT devices that will pose the biggest threat in five years and the time leading up to it.”
With smart devices set to continue to have a huge impact on our lives, Emm further agrees that this will be exploited by cyber-criminals in the coming years.
“We are now relying on connectivity even more than we ever have. This now stretches to our homes, as we are digitising machines and devices that have never previously been digitised. This includes everyday items like televisions, baby monitors, toys, entertainment devices, gas and electricity meters; cars and more are also now connected.
“While doing this provides a number of benefits for consumers, it also offers more and more entry points for cybercriminals, as there is now a wider attack surface for them to target,” warns Emm.
“A change we must see in our wider society is greater regulation, to ensure that developers behind digitalising these ‘never-before-digitalised’ products are ensuring they are safe to enter our homes. If we go to a shop and buy curtains, carpets, furniture or children’s toys, we automatically assume, fairly, that they have been subject to quality controls and testing and are safe for us to buy, and the same must happen with smart devices.”
He continues: “They need to come with password-changing obligations and prompts, the ability to apply regular updates to help protect them as best as possible. This may even require the introduction of new legislations at central government level, but it is a change we must see. The more reliant we become on connectivity, the more vulnerable we become in turn.”
PCR’s Sector Spotlight on Security – in association with BullGuard – is running throughout October – click here for more articles.
Like this content? Sign up for the free PCR Daily Digest email service to get the latest tech news straight to your inbox. You can also follow PCR on Twitter and Facebook.
