Security Insights

Cloud insecurity: leaving the keys in the door?

The cloud is now a mainstream technology across both the public and private sectors. Its flexibility and scaleability are attractive to organisations of all sizes, and early concerns about security have been addressed.

Or have they?

There is growing evidence that data breaches and attacks, such as ransomware, are exploiting gaps in cloud security.

All too often, this is because security measures have not been deployed, or cloud resources are misconfigured.

And bad actors can exploit those gaps, possibly within just minutes.

Research by vendor Qualys, for their Totalcloud Security Research Insights report, found that in some cases, close to two thirds of cloud instances were misconfigured, and half of internet facing assets were not patched.

In his episode, Paul Baird, Qualys’ EMEA CTSO, discusses the findings – and explores what might be behind them – with editor Stephen Pritchard.

Deep fakes, AI and digital trust

Without trust, we can’t have security. But the growth of the digital economy, and the wider online world, is changing our idea of trust.

A lot of the ways we identified and trusted the people, and organisations in the physical world are not easy to replicate online.

And, as well as removing the human traits that help us to establish trust – from eye contact or a handshake, to a tone of voice – it's becoming harder to identify if another person is who they say they are. In fact, it's now hard to be sure if they are a person at all.

Digital trust is one answer. And our guest this week is an expert in the field. Rolf von Roessing is one of the lead authors of ISACA's digital trust framework. And, as he explains to Stephen Pritchard, understanding digital trust will be ever more important to any organisation that operates in the digital world.

 

 

Biometrics: Eyes in the sky?

Biometric technology promises both security and convenience: there's a reason the leading smartphone makers have adopted face ID, or fingerprint scanners.

But improvements in computing power and AI, as well as more powerful sensors, have opened up entirely new fields, such as remote surveillance.

Are we comfortable with systems that can pick out a face from a crowd?

And how do we feel about artificial intelligence making decisions about those images, such as whether someone’s actions look suspicious?

Our guest is one of the leading experts on these issues. Tony Porter was formerly the UK Surveillance Camera Commissioner, and a former senior police officer. He’s now the chief privacy officer at Corsight – a developer of facial recognition software.

He argues that surveillance, biometrics and even AI will make us more secure – but only if we can secure the technology itself.

Interview by Stephen Pritchard

 

Building security capability at Thrive Homes

This week's episode is an insider's account of exactly what it takes to review, and build up, an business' cyber defences.

When John Stenton took over as head of IT at housing provider Thrive Homes, he admits technology was a "bit of a mess". And a lot needed to be done, both to review security and to reassure the board.

Thrive Homes is fairly typical of the type of mid-sized organisation that didn't see itself as being in the cyber front line. But, as Stenton explains, any organisation can be a target especially when they are handling seven-figure property transactions.

Here, he talks about his decision to bring in an outside consultancy, the work they did, and the impact this had on Thrive's security capabilities. And we are also joined by Kerry Jones from that partner, DigitalXRAID, where she is head of compliance and information security.

Interview by Stephen Pritchard

 

People and cyber resilience: the human factor

Cybersecurity is about technology, processes and above all, people.

And with CISOs' growing emphasis on resilience in the face of cyber attacks, perhaps it is time to look at the human factors involved in combatting and recovering from an incident.

How can we help our teams make the right decisions, and cope under pressure?

In this episode, we look at an investigation into workforce resilience, carried out by Osterman Research for Immersive Labs. Our guest is Immersive Labs' VP of Cyber, Max Vetter.

CRA and DORA: New laws, new defences?

The next few years will see the European Union introduce new laws governing cybersecurity.

These include the Cyber Resilience Act, and DORA.

DORA -- or the Digital Operational Resilience Act -- looks to improve overall ICT resilience in the financial services sector. But as our guests this week point out, its impact is likely to be felt by other sectors too.

The Cyber Resilience Act is more broadly based, and sets out baseline security requirements for both hardware and software or, as the text states, anything with a digital element.

Security Insights editor Stephen Pritchard discusses the background to the new laws, and what they mean for business with CREST EU council chair, Rodrigo Marcos Alvarez, and Dominik Samociuk, of Future Processing and the Silesian University of Technology, Poland.

CRESTCon 2023: CREST President, Rowland Johnson

In our second podcast from CRESTCon Europe 2023, we catch up with Rowland Johnson, CREST President.

CREST is a non profit organisation focused on building standards in cyber. This includes accreditation of companies and certification of individual cybersecurity professionals.

The cybersecurity sector faces a number of challenges: professionalisation, improving diversity, dealing with a stubborn skills shortage and the potential, and potential threats, of AI.

So how does the industry — and the organisations it serves — move from what Johnson describes as a “market failure” to a collaborative world based on a network of trust?

And how can cybersecurity professionals harness technology to do more?

Interview by Stephen Pritchard

Nation state cyber attacks: part 2: evolving threats, adapting defence

In this second part of our analysis of nation state cyber attacks, we look at how threats are evolving, and how increasingly private businesses are their targets.

According to research by analysts Forrester, nation state attacks are becoming both more frequent, and more severe. And attackers have widened both their objectives, and their methods.

But can organisations, especially in the private sector, defend themselves against these attacks? Forrester has put together a model setting out one way to do just that.

Our guest is Allie Mellen, senior analyst covering cybersecurity at Forrester, and lead author on the research, which is summarised here.

CRESTCon 2023: Security and integrity with Jon Geater, RKVST and IETF

Over the last few years, security professionals have become increasingly concerned about where software, and software components, come from.

A growing number of significant security breaches have been caused by vulnerabilities in the software supply chain.

But should we now start to look beyond just software, and look at data too?

Jon Geater thinks we should. The keynote speaker at this year’s CRESTCon Europe, Jon is co-founder at RKVST and co-chair if the IETF’s supply chain integrity, transparency and trust working group.

Here, he discusses with editor Stephen Pritchard how we need to go beyond just software bills of materials and start to look at documents and data too, if we are to prevent disruption to the business.

CNI, healthcare and cyber threats

Any system that is connected to the public internet is at risk of cyber attack. And any system that connects to a network or other system connected to the internet, is also at risk.

This poses dilemmas for operators of critical infrastructure.  Devices and applications developed to run on standalone infrastructure, often with specialist operating systems, are not designed to work safely online.

How, then, can organisations operating critical national infrastructure, protect their systems from cyber attack and still benefit from connectivity to the outside world, as well as the economies of off the shelf technology?

Our guests today are both experts in protecting health care systems.

Jonathan Langer is COO Claroty Medigate, which focuses on securing the Internet of Things in health care.

And Adam Zoller is cyber security lead for Providence, a system of compassionate healthcare providers on the west coast of the United States.

They joined editor Stephen Pritchard to discuss why attackers target CNI and health care technology, where the weak spots lie, and how organisations can improve their security without disrupting vital business operations.