Security Insights

Quantum computing: a security risk?

Could quantum computing threaten our day to day security, and even the fabric of the internet? Researchers are increasingly concerned about the risks quantum technology poses to encryption.

Organisations need to act now, if they are they are to secure their data and their operations, argue this week's guests.

Ramy Shelbaya is CEO and co-founder of Quantum Dice. That’s a business spun out of Oxford university’s quantum optics lab –  and which is now using quantum mechanics to create a self-certifying quantum random number generator.

And Axel Poschmann is a cybersecurity expert with a background in both the industry and academia. Currently, he works at PQShield, another business with links to Oxford, and which specialises in quantum-resistant cryptography.

We asked them to explain why quantum threatens security, and what CISOs can do about it.

Interviews by Stephen Pritchard

The Cyber Resilience Act: a law with unintended consequences?

The upcoming European Cyber Resilience Act sets out to boost security for anything with “digital elements”.

The Act will apply to hardware and software. The idea is to make it easier to update devices, and to fix any vulnerabilities.

Why, then, has a group of cyber security professionals written an open letter to the European Commission asking them to change a key part of the proposed rules?

Experts are concerned that, by requiring organisations to disclose vulnerabilities within 24 hours, the Act could increase, rather than reduce, risks.

Our guest today is Christine Bejerasco, CISO at WithSecure and one of the signatories of the letter.

We asked her to set out the background to the Act, and why so many security professionals fear it could have unintended consequences.

Interview by Stephen Pritchard

Open source: a security risk?

As many as 96 per cent of vulnerabilities in open source software are because developers use an outdated, or unpatched version of the code.

And this matters, because open source is now the building block of almost all enterprise software, web applications, and even the code that runs consumer technology.

But open source can be secure. It just needs developers, and the organisation they work for, to think about security throughout the software lifecycle.

With guest Brian Fox, CTO and co-founder at Sonatype.

Automation and the cybersecurity skills gap

The cybersecurity industry faces an ongoing -- and some say worsening -- skills gap.

Both the private and public sectors need more skilled security professionals, as more operations go online. And there is only so much the education system, or training within the business, can do to solve the problem.

So do we need to rethink how cybersecurity operates? Perhaps it is time for the industry to undergo its own digital transformation, and look at automation to take the load off human professionals.

Our guest is Marie Wilcox, board director at the Chartered Institute of Information Security and also security evangelist at Panaseer.

Cyber resilience: are we prepared?

Most boards -- and certainly all CISOs -- now understand that it is not if a cyber attack happens, but when.

None the less, organisations are not doing enough to ensure that they can continue to operate during a cyber attack, and recover from it.

And the latest UK Government Cyber Security Breaches survey goes further, suggesting that not only are organisations failing to invest in cyber security, but in some cases, are going backwards. They are paying less attention to the basic "cyber hygiene" measures that can help prevent breaches in the first place.

Our guest this week is Prof. Steven Furnell, professor of cyber security at Nottingham University,a senior member of the IEEE, and one of the researchers for the Cyber Security Breaches survey. 

In this episode he discusses the pressures that could be prompting organisations to cut back on security, comparisons between cyber and "physical" crime, the need for awareness and resilience and what we need to do in a world where cyber attacks are now endemic.

Interview by Stephen Pritchard

Defending healthcare in cyberspace

Healthcare is coming under an increasing volume of cyber attacks, especially since the pandemic.

And attacks are spreading to smaller health care outfits, such as ambulance services, suppliers to the health care system, and the pharmaceutical industry.

Much of this is being driven by ransomware, but we are also seeing more complex attacks.

How can healthcare organisations protect themselves?

Our guest is Trevor Dearing, Director of Critical Infrastructure at Illumio, who reports that a growing percentage of his work now involves the health sector.

 

Cyber war: is it everyone’s business?

Is cyber war a risk that only governments can deal with? Or should enterprises be prepared to mount their own defences?

In this episode we speak to Prof Richard Benham, a UK Government adviser on cyber security, the first professor in cyber security management, Patron of The National Museum of Computing at Bletchley Park, and non-executive director at Emerge Digital.

He believes that, in some ways, a cyber war has already started. He speaks to editor Stephen Pritchard about the reasons why, and sets out what organisations can do to protect their digital assets and infrastructure.

Cloud insecurity: leaving the keys in the door?

The cloud is now a mainstream technology across both the public and private sectors. Its flexibility and scaleability are attractive to organisations of all sizes, and early concerns about security have been addressed.

Or have they?

There is growing evidence that data breaches and attacks, such as ransomware, are exploiting gaps in cloud security.

All too often, this is because security measures have not been deployed, or cloud resources are misconfigured.

And bad actors can exploit those gaps, possibly within just minutes.

Research by vendor Qualys, for their Totalcloud Security Research Insights report, found that in some cases, close to two thirds of cloud instances were misconfigured, and half of internet facing assets were not patched.

In his episode, Paul Baird, Qualys’ EMEA CTSO, discusses the findings – and explores what might be behind them – with editor Stephen Pritchard.

Deep fakes, AI and digital trust

Without trust, we can’t have security. But the growth of the digital economy, and the wider online world, is changing our idea of trust.

A lot of the ways we identified and trusted the people, and organisations in the physical world are not easy to replicate online.

And, as well as removing the human traits that help us to establish trust – from eye contact or a handshake, to a tone of voice – it's becoming harder to identify if another person is who they say they are. In fact, it's now hard to be sure if they are a person at all.

Digital trust is one answer. And our guest this week is an expert in the field. Rolf von Roessing is one of the lead authors of ISACA's digital trust framework. And, as he explains to Stephen Pritchard, understanding digital trust will be ever more important to any organisation that operates in the digital world.

 

 

Biometrics: Eyes in the sky?

Biometric technology promises both security and convenience: there's a reason the leading smartphone makers have adopted face ID, or fingerprint scanners.

But improvements in computing power and AI, as well as more powerful sensors, have opened up entirely new fields, such as remote surveillance.

Are we comfortable with systems that can pick out a face from a crowd?

And how do we feel about artificial intelligence making decisions about those images, such as whether someone’s actions look suspicious?

Our guest is one of the leading experts on these issues. Tony Porter was formerly the UK Surveillance Camera Commissioner, and a former senior police officer. He’s now the chief privacy officer at Corsight – a developer of facial recognition software.

He argues that surveillance, biometrics and even AI will make us more secure – but only if we can secure the technology itself.

Interview by Stephen Pritchard