Security Insights

Most boards -- and certainly all CISOs -- now understand that it is not if a cyber attack happens, but when.

None the less, organisations are not doing enough to ensure that they can continue to operate during a cyber attack, and recover from it.

And the latest UK Government Cyber Security Breaches survey goes further, suggesting that not only are organisations failing to invest in cyber security, but in some cases, are going backwards. They are paying less attention to the basic "cyber hygiene" measures that can help prevent breaches in the first place.

Our guest this week is Prof. Steven Furnell, professor of cyber security at Nottingham University,a senior member of the IEEE, and one of the researchers for the Cyber Security Breaches survey. 

In this episode he discusses the pressures that could be prompting organisations to cut back on security, comparisons between cyber and "physical" crime, the need for awareness and resilience and what we need to do in a world where cyber attacks are now endemic.

Interview by Stephen Pritchard

Healthcare is coming under an increasing volume of cyber attacks, especially since the pandemic.

And attacks are spreading to smaller health care outfits, such as ambulance services, suppliers to the health care system, and the pharmaceutical industry.

Much of this is being driven by ransomware, but we are also seeing more complex attacks.

How can healthcare organisations protect themselves?

Our guest is Trevor Dearing, Director of Critical Infrastructure at Illumio, who reports that a growing percentage of his work now involves the health sector.

 

Is cyber war a risk that only governments can deal with? Or should enterprises be prepared to mount their own defences?

In this episode we speak to Prof Richard Benham, a UK Government adviser on cyber security, the first professor in cyber security management, Patron of The National Museum of Computing at Bletchley Park, and non-executive director at Emerge Digital.

He believes that, in some ways, a cyber war has already started. He speaks to editor Stephen Pritchard about the reasons why, and sets out what organisations can do to protect their digital assets and infrastructure.

The cloud is now a mainstream technology across both the public and private sectors. Its flexibility and scaleability are attractive to organisations of all sizes, and early concerns about security have been addressed.

Or have they?

There is growing evidence that data breaches and attacks, such as ransomware, are exploiting gaps in cloud security.

All too often, this is because security measures have not been deployed, or cloud resources are misconfigured.

And bad actors can exploit those gaps, possibly within just minutes.

Research by vendor Qualys, for their Totalcloud Security Research Insights report, found that in some cases, close to two thirds of cloud instances were misconfigured, and half of internet facing assets were not patched.

In his episode, Paul Baird, Qualys’ EMEA CTSO, discusses the findings – and explores what might be behind them – with editor Stephen Pritchard.

Without trust, we can’t have security. But the growth of the digital economy, and the wider online world, is changing our idea of trust.

A lot of the ways we identified and trusted the people, and organisations in the physical world are not easy to replicate online.

And, as well as removing the human traits that help us to establish trust – from eye contact or a handshake, to a tone of voice – it's becoming harder to identify if another person is who they say they are. In fact, it's now hard to be sure if they are a person at all.

Digital trust is one answer. And our guest this week is an expert in the field. Rolf von Roessing is one of the lead authors of ISACA's digital trust framework. And, as he explains to Stephen Pritchard, understanding digital trust will be ever more important to any organisation that operates in the digital world.

 

 

Biometric technology promises both security and convenience: there's a reason the leading smartphone makers have adopted face ID, or fingerprint scanners.

But improvements in computing power and AI, as well as more powerful sensors, have opened up entirely new fields, such as remote surveillance.

Are we comfortable with systems that can pick out a face from a crowd?

And how do we feel about artificial intelligence making decisions about those images, such as whether someone’s actions look suspicious?

Our guest is one of the leading experts on these issues. Tony Porter was formerly the UK Surveillance Camera Commissioner, and a former senior police officer. He’s now the chief privacy officer at Corsight – a developer of facial recognition software.

He argues that surveillance, biometrics and even AI will make us more secure – but only if we can secure the technology itself.

Interview by Stephen Pritchard

 

This week's episode is an insider's account of exactly what it takes to review, and build up, an business' cyber defences.

When John Stenton took over as head of IT at housing provider Thrive Homes, he admits technology was a "bit of a mess". And a lot needed to be done, both to review security and to reassure the board.

Thrive Homes is fairly typical of the type of mid-sized organisation that didn't see itself as being in the cyber front line. But, as Stenton explains, any organisation can be a target especially when they are handling seven-figure property transactions.

Here, he talks about his decision to bring in an outside consultancy, the work they did, and the impact this had on Thrive's security capabilities. And we are also joined by Kerry Jones from that partner, DigitalXRAID, where she is head of compliance and information security.

Interview by Stephen Pritchard

 

Cybersecurity is about technology, processes and above all, people.

And with CISOs' growing emphasis on resilience in the face of cyber attacks, perhaps it is time to look at the human factors involved in combatting and recovering from an incident.

How can we help our teams make the right decisions, and cope under pressure?

In this episode, we look at an investigation into workforce resilience, carried out by Osterman Research for Immersive Labs. Our guest is Immersive Labs' VP of Cyber, Max Vetter.

The next few years will see the European Union introduce new laws governing cybersecurity.

These include the Cyber Resilience Act, and DORA.

DORA -- or the Digital Operational Resilience Act -- looks to improve overall ICT resilience in the financial services sector. But as our guests this week point out, its impact is likely to be felt by other sectors too.

The Cyber Resilience Act is more broadly based, and sets out baseline security requirements for both hardware and software or, as the text states, anything with a digital element.

Security Insights editor Stephen Pritchard discusses the background to the new laws, and what they mean for business with CREST EU council chair, Rodrigo Marcos Alvarez, and Dominik Samociuk, of Future Processing and the Silesian University of Technology, Poland.

In our second podcast from CRESTCon Europe 2023, we catch up with Rowland Johnson, CREST President.

CREST is a non profit organisation focused on building standards in cyber. This includes accreditation of companies and certification of individual cybersecurity professionals.

The cybersecurity sector faces a number of challenges: professionalisation, improving diversity, dealing with a stubborn skills shortage and the potential, and potential threats, of AI.

So how does the industry — and the organisations it serves — move from what Johnson describes as a “market failure” to a collaborative world based on a network of trust?

And how can cybersecurity professionals harness technology to do more?

Interview by Stephen Pritchard