Рубрика: Cybersecurity

These days the Internet of Things (IoT) is multiplying at a rapid pace as more connected devices are hitting the consumer, commercial, and industrial markets. However, this proliferation has also created a new ground for cyber criminals seeking actively to compromise IoT devices with injecting malware. Considering a report, almost 21 percent of companies reported a data breach or cyber attack due to unsecured IoT devices last year, while 16 percent reported IoT-based attacks.

However, some countries’ governments now are taking a step further to secure IoT devices as the numbers of these devices are set to make a big leap beyond 41 billion by 2025. In this way, California is going to introduce a new Internet of Things Security Law on January 1, 2020, which will require all IoT devices to be outfitted with reasonable security protection.

How Attackers Target Connected and IoT Devices

In home networks, most attacks are easily able to circumvent the security of low-cost models of IP cameras. And most of these inexpensive devices are all based on a similar blueprint, which means if a vulnerability is found in one device, it may also work against other models.

In IoT devices, as most of these are known to have vulnerabilities and allowing attackers to remotely access or control them, some have been found to have feeble passwords that can’t be changed. Thus, this weakness in the IoT products can potentially provide the opportunity to hackers with an easy way to enter in other devices connected to the network.

So, there is a need that groups or individuals that deploy IoT devices in their environments should strengthen their security measures. Conversely, manufacturers that make connected products should make sure that they are secure by design.

Best Practices to Safeguard IoT Devices

Ensuring enterprise security in today’s emerging connected world should be a major concern for businesses. But taking the right step can be optimistic.

Take the Risks Seriously

Safeguarding any connected device these days is just like buying insurance as most threats are newer and continue to evolve. Despite all the known risks, several companies have not done much to protect their IoT devices. They delude themselves by thinking that these are not issues they have to worry about and get a bit complacent. IoT attacks are distinct from other sorts of attacks, and this may lead to a general lack of awareness and urgency. So, companies need to have proper expertise in IoT security and awareness and strong passwords in IoT devices.

Note Every Network Endpoint Added

Each endpoint added to a business network can create more areas to vulnerable and make a room for cybercriminals to compromise. According to Deloitte, organizations should bring as much of their endpoint footprint as possible under their security management. Once more of these connected devices are properly managed, incorporating security tools can become a more effective process. The global spending on IoT endpoint security is anticipated to reach over US$630 million by 2021.

Keep an Eye on Suppliers and Vendors

The source of a security breach can also be the interconnectivity of third-party hardware, software, or services. This would be a major concern for businesses. Thus, organizations need to consider how a connected device interacts with these third parties. Contracts with third, fourth, and fifth parties should address security updates and concerns. Also, enterprises should deploy a third-party risk management program to analyze the cyber risks of their third-party and supply chain partners.

Leverage Emerging Technologies

Evolving technologies such as artificial intelligence, machine learning, among others have the ability to accomplish significant IoT security needs. In this context, Artificial Intelligence for IT operations (AIOps) has grown from an emerging category into a necessity for IT, as per Deloitte. The platform is distinctively apt to build a baseline for normal behavior and for finding out subtle deviations, oddities and trends. So, organizations can ensure their security through the design approach in tandem with an AIOps approach to avert and detect cyberattacks.

In brief, as IoT devices will increase rapidly, hackers will also become more creative, resulting in the risks that will become more profound and potentially devastating. However, making a foundational step towards security can be adequate for IoT devices.

The post Securing IoT Devices Against Potential Cyber Attacks appeared first on Analytics Insight.

In an always advancing cyber threat landscape where antivirus programming and firewalls are viewed as tools of antiquity, companies are currently searching for all the more technologically advanced methods for protecting classified and sensitive data. Artificial intelligence (AI) is accepting the situation as a warrior against digital threats over the globe. It has gotten mainstream in military space, yet security organizations are likewise consolidating AI technologies for using deep learning to discover likenesses and differences within a data set. Organizations like Microsoft are putting 1 billion USD in AI-based organizations, for example, Open AI.

As indicated by ESG research, 29% of security experts would like to utilize AI innovation to accelerate the virus detection process. Furthermore, 27% are looking to this innovation to accelerate their incident response time. Interest for AI security stems from the complexity of code AI can analyze in a short amount of time.

Despite the fact that AI can be useful in the cybersecurity space, for the most part, it’s not AI that is driving these solutions. As a rule, trained machine learning and AI are terms that get confounded. Where AI and machine learning differ in their capacity to think without legitimate programming. Security organizations utilize machine learning to write complex algorithms for these technologies to best identify security breaches. However, an AI system can reach new resolutions without being nourished any new algorithms or data.

A challenge for machine learning in the security space is that malware codes are constantly changing, which implies the coders behind machine learning cybersecurity innovation should always be perfect and change algorithms to show the innovation how to detect these new codes. However, can the defenders truly stay aware of hackers? That is certainly begging to be proven wrong. This is an issue AI could understand. If a conscious machine can develop at the rate of its malware partners, we have a much better shot of defending against it.

Artificial intelligence has the ability to get converged with new, complex yet untried weaponry, for example, cyber offensive capabilities. This improvement is alarming as cyber offensive weapons have the ability to destabilize the equalization of military power among the leading countries. With the advent of AI and machine learning, cyberattacks have become all the more commonly available dangers for critical infrastructure like airport flight tracking, banking systems, hospital records, and programs that run the country’s basic infrastructure and nuclear reactors.

Disappointment by governments to take proactive measures to ensure the security of AI frameworks “is going to come back to bite us,” Omar Al Olama, minister of state for artificial intelligence for the United Arab Emirates, warned. Studies recommend one of the most noteworthy issues which lie in the destabilizing impacts of cyber weaponry, increased by AI technologies on the regional balance of power.

In spite of the fact that there is no definite proof that critical infrastructure command and control systems are inclined to cyberattacks yet because of the digitization of these systems, thus the vulnerability exists. The destabilizing impact of AI cyber weaponry stays a huge matter of concern for each country. Undoubtedly, protecting against these weapons, and shielding the country’s software, hardware and private information against cyberattacks have become a vital issue for national security.

As not out of the ordinary, the utilization of machine learning to advance cyber threats is developing alongside the utilization of these advancements for security and protection, explicitly while producing new malware samples. It’s anticipated that programmers will utilize these technologies to modify code in new samples dependent on how security systems identified more older diseases. This will build the lifespan of an infection in a system since it will be smaller and increasingly hard to detect.

Policymakers should intently work with technical experts to investigate, prevent and counter potential threatening uses of AI. Studies recommend that AI zero-day vulnerabilities are being made which are not openly known at this point, so it gets hard to build up its fix until its first experiment. Moreover, conducting red team exercises in the AI domain area like DARPA Cyber Grand Challenge will likewise assist better with understanding the level to do attacks and find the barriers. Present research in the public domain is restricted to white hat hackers just which is planned for utilizing machine learning to discover vulnerabilities and recommend fixes.

The speed AI is developing, won’t take a lot of time that attackers would utilize AI abilities on a mass scale. Artificial intelligence could demonstrate a cybersecurity threat in an unobtrusive manner. As AI-driven and machine learning products are set to be utilized as a major aspect of defense technique, there are chances that it could calm IT experts and employees into a false sense of security. Today AI solutions are in the experimenting stage, and complete dependence on them could be a botch.

The post Cybersecurity and AI in Today’s World appeared first on Analytics Insight.

Several data-driven startups have gained rapid growth in the past few years. Their business development, innovation and thrive to hustle in the commercial space has made them significant technology vendors in the market. However, being a data-oriented firm, it is mandatory for them to look after their data protection policies and regulations as well.

As the incidents of social media manipulation by foreign governments, unethical data gathering and the growing impact of technology in daily life are increasing day by day, companies must incorporate protective measures since the beginning, especially startups.

However, experts believe that regulation can be particularly hard on startups, but they need to take such steps today to benefit their businesses as they grow. They need to be prepared with the following practices that can totally make sense to their early regulation adoption initiative.

For better regulation, there is an utmost need for security updates. Specifically, the businesses that develop apps and release through app stores, should be already working on this area. Updating the system is beneficial for both customers and vendors to deliver ongoing value to customers and provide a reason to maintain contact.

For a better system update, businesses need to think ahead of the possibilities and provide their customers with a simple and effective means for updating apps and devices through internet device “inspection” standards. This will make it simple and easy for customers to see that what they’re updated with. This will subsequently make the relationship between a business and customers healthier and build brand loyalty that is necessary for start-ups in particular.

The regulations put forward by GDPR and others have almost guaranteed the wide implementation of regulatory norms that can actually benefit businesses. Through this, start-ups can provide their customers the ability to see their data and delete it which can make the organizations more responsive to this regulatory push and serve their customers better.

Any startups’ inability to curb data breach and a botched response can truly destroy the company. Therefore, in case of being a victim of a data breach, as the regulations suggest, fast notification is required. This means looking ahead for future regulation, growing companies should stay prepared accordingly.

Christopher Budd, former Microsoft employee, in one of his articles, cited that, “Outside of the current and likely future direction of regulation, I can attest that speed of response, especially around communication, is the single most important factor in how the total situation ultimately plays out. If you don’t have a data breach response plan already, now is the time to start building it. Especially since. If/when you need it, you can’t build it.”

He further said that for startups it is quite easy to follow the old path of hostility to regulation but today it won’t work: it’s already happening. He believes that by accepting the inevitability of regulation and working towards smarter, more reasonable regulation, startups and the technology industry can be a partner to shape better outcomes.

According to him, instead of looking at regulation as a hindrance, startups can look at it as a floor that governs everyone, and use that as a way to pull past and shine in contrast to their competitors.

The post What Practices Should Startups Adopt for Better Data Protection and Privacy? appeared first on Analytics Insight.

The pace of this data-driven ecosystem is as fast as a blink of an eye where anything can change or regulate changes in a few moments. The boons are out but what about the banes? We all know what optimistic advancements technology can bring into life but little do we know that its negative potentials are equally hazardous. One biggest price companies pay today to be technologically advanced is data protection and privacy. When it comes to data protection, the next step obviously involves cybersecurity tools and solutions but how many of them know the right strategy for their implementation? Not many.

So here is are the way through which you can build a successful cybersecurity strategy for your organization’s healthy operations.

Companies should develop a well-planned and well-executed risk assessment that should ideally be completed during the earliest stages of the company. This will help them to be prepared for any unforeseen circumstances and help structure a plan to mitigate the damage. One must enlist the potential issues that can occur, be it employee error or terrorist attack. After listing them, the company must prioritize them as per their possibility to occur. Also, the risk assessment should include action plans for harmful scenarios including phishing, spam emails, ransomware attacks, and certain others.

However, the risk assessment is useful when the potential threats can be imagined but for those which are unthinkable, one must opt for preventive measures beforehand.

Companies must adopt preventive measures to keep potential threats away. They can analyze their past to to know their mistakes in order to make their preventive measures more effective. Companies can have their new hires and employees sign confidentiality agreements to restrict the sharing of confidential information. Also checking the background for these people is extremely necessary.

Moreover, the company leaders should understand the vitality of effective backup systems that can help during a data breach, in order to retrieve their business and customer data. Having their data backed up over the cloud is a great way to keep them completely off the grid in case of any data breach.

In order to keep their systems secure, companies must opt for antivirus software with their compulsory regular updates. This will potentially secure their systems and websites with solid firewalls and encrypt them for security.

Cybersecurity through Data Management

As businesses are in charge of noteworthy amounts of data including – both internal business information as well as conceivably customer recognizing data like addresses, medical data, financial details and so forth. The companies are in urgent need to protect and deal with such data efficiently. A full cybersecurity strategy should incorporate an effective data management strategy that would keep an eye on – the manner by which data is accessed by clients; the manner in which data is stored and verified within a framework; and the manner by which data is moved among clients and networks.

Cyber-secured Culture in Office

• Companies should create a culture of security throughout their business.

• They need to train their employees so that they can understand the risks and their preventive measures.

• The companies can have some of their staff to become certified in cybersecurity.

• Such certified professionals can understand the deeper issues and communicate them to their peers and co-workers.

• Even if they are not certified, they can still follow some policies that will help them secure their business, let’s say passwords, which need to be complex, including a combination of letters, numbers, and special characters.

• The companies should implement two-factor authentication that will urge the employees on all levels to enter a second passcode before they can access their computer.

Cybersecurity Across Mobile Devices

The strictness of cybersecurity also applies to mobile devices. As several businesses are encouraging a “bring your own device” environment, the risk has increased even more with remote-working culture. Such devices can be easily hacked when workers are out and about. Therefore, these devices must be updated regularly, and all information must be encrypted.

The post Ready to Build Effective Cybersecurity Strategy? Here are the Guidelines appeared first on Analytics Insight.

The development and advancements and the unprecedented use of technologies have created a threat ground where organizations now need to leverage effective cybersecurity strategy. From securing networks and hardening systems to safeguarding data from cyberattacks, cybersecurity has become a bedside approach than ever. With the average cost of a data breach rising year over year, and estimates being close to US$4 million, it accentuates the significance of why cybersecurity needs to be taken seriously.

So, let’s rewind the significant developments that took place in the field of Cybersecurity in 2019.

Cybersecurity Mergers & Acquisitions

For successful delivery of business operations, network systems, data and their storage account for the most valuable digital assets. And such assets pose extreme threats causing significant business risks, in addition to the reliance of business on these augments potential vulnerability to cyber threats. Thus, to enhance the possibilities to create a risk-free atmosphere, companies are pouring a huge amount of their funds into cybersecurity mergers and acquisitions. These M&A deals not only benefit them financially but also assist them to secure their networks better.

The year 2019 has been a significant one from the M&A perspective in the cybersecurity space. As per the industry reports, over US$7 billion deals befell during the first quarter of 2019 alone, and over 150 deals totaling more than US$23 billion in value took place this whole year.

Here is the list of significant cybersecurity M&A deals in 2019.

Broadcom – Symantec Enterprise Security Business

Broadcom, a global tech leader, acquired Symantec’s enterprise security business for US$10.7 billion. With this acquisition, the Enterprise Security business of Symantec Corporation will now operate as the Symantec Enterprise division of Broadcom. The acquisition will also significantly expand Broadcom’s infrastructure software footprint as it continues to build one of the world’s leading infrastructure technology companies.

VMware – Carbon Black

VMware, a leading innovator in enterprise software, acquired a leader in cloud-native endpoint protection, Carbon Black, for US$2.1 billion. With this acquisition, VMware has become a full-blown security provider and Carbon Black will form the nucleus of VMware’s security offerings going forward. VMware will pay US$26 per share in cash for the company and expects the deal to close by the end of January 2020.

OpenText – Carbonite

OpenText, an enterprise information management software giant, acquired Carbonite, a leading provider of internet-based backup solutions, for US$1.42 billion. The acquisition will fortify OpenText as a leader in cloud platforms, complete endpoint security and protection. This deal should also enable OpenText to make use of Carbonite’s existing offerings and go-to-market channel, while potentially assisting the buyers to integrate data backup and endpoint-protection capabilities into its existing security offering.

Cisco – Sentryo

Cisco recently has acquired a Lyon, France-based company, Sentryo that provides asset visibility and cybersecurity solutions for industrial control systems (ICS). The acquisition reflects the market demand for systems that secure components of ICSes. Many of those devices, such as programmable logic controllers and remote terminal units, do not have security mechanisms capable of fending off modern-day hackers. With this acquisition, Cisco is now able to combine with its products to assists customers lock down ICS.

Palo Alto – Demisto

Palo Alto Networks, the global leader in cybersecurity, acquired Demisto, a leading cybersecurity company which specializes in security orchestration, automation and response (SOAR), for US$560 million. The acquisition expedites Palo Alto Networks Cortex, and AI-based continuous security platform strategy and further advances the company’s ability to deliver automated threat prevention and response for security teams.

Robust and Strategic Cybersecurity Partnerships

Cybersecurity is a team effort. As criminal attacks that can range from merely annoying to devastating, it is significant for companies to provide complete protection to their customers. That is why key vendors in this space are increasingly forging strategic alliances to either deliver protection against a wide array of threat vectors or to address various phases in the cybersecurity life cycle.

Here are some key cybersecurity alliances established in 2019.

AppDome – VMware

Appdome, the mobile industry’s first mobile integration as a service company, partnered with VMware to assist customers to deliver Workspace ONE security, privacy and intelligent analytics capabilities. VMware Workspace ONE is a new no-code solution that will enable enterprise customers to quickly and easily deliver the complete Workspace ONE SDK into any mobile application, with full support for all modern frameworks, push notifications and Wkwebview.

Anomali – Symantec

Anomali, a leader in intelligence-driven cybersecurity solutions, established a strategic partnership with cybersecurity firm Symantec Corp. This partnership is intended to meet global demand for threat intelligence-driven solutions. The alliance also establishes a platform for sharing information on cyber threats and focuses on improving the methods of dealing with cyber threats. Both companies also expand the availability of threat data, information, and intelligence to drive effective cybersecurity decisions.

Canon – McAfee

Canon and McAfee, the device-to-cloud cybersecurity companies, in mid-2019 announced a strategic partnership to assist businesses with embedded protection against malware for applications running on Multi-Function Devices (MFDs). The alliance enables McAfee to integrate its Embedded Control platform as an additional security feature on the new Canon imageRUNNER ADVANCE Generation 3 MFDs, which aids businesses to bolster endpoint security.

AXA XL – Accenture

AXA XL, AXA’s property & casualty (P&C) and specialty risk division, teamed up with Accenture to provide cybersecurity services to AXA XL’s underwriters, brokers and clients. Through this partnership, AXA XL is now able to offer its clients globally additional bespoke services, delivered by Accenture, that will assist them to understand and ease cyber risks. Additionally, Accenture will provide post-breach security services to AXA XL clients outside the U.S., including incident management and IT forensics.

Kaspersky – INTERPOL

Cybersecurity giant, Kaspersky and INTERPOL have signed a new five-year agreement to strengthen their collaboration in the fight against cybercrime around the world. The agreement follows in the footsteps of the original deal made between the two parties back in 2014. Under the latest agreement, Kaspersky will provide human resources support, training, and threat intelligence data on the latest cybercriminal activities to INTERPOL, which will reinforce the organisation’s cyber threat hunting capabilities.

Investments in CyberSecurity

The cyber space is one of the crucial areas, where hackers just want to win once and businesses need to get it right every single time. The sector will likely continue to remain a perennial industry as long as the internet and its accompanying threats persist. Thus, to dodge the potential threats, funding is obviously a major component for organizations in the cybersecurity.

As per the industry reports, the global spending on information security products and services is anticipated to be valued at US$106.6 billion in 2019, which is up from 10.7 percent in 2018. The amount is also predicted to reach US$151.2 billion by 2023, with a CAGR of 9.4 percent.

Let’s have a look at the top cybersecurity investments/funding that took place in 2019.

Cybereason

Amount Funded: US$200 Million

Transaction Type: Series E

Lead Investor: SoftBank Group Corp

In June, Cybereason, an Antivirus startup, raised US$200 million in Series E investment from Japan’s SoftBank Group Corp. The funding round doubles the total investments raised by the company so far to about US$400 million. Cybereason has planned to use the capital to expand its global footprint and focus on developing its core offering, Endpoint Protection Platform (EPP), a suite of endpoint protection technologies like antivirus, data encryption, intrusion prevention and data loss prevention that detects and stops threats at the endpoint.

Acronis

Amount Funded: US$147 Million

Transaction Type: Venture

Lead Investor: Goldman Sachs

Acronis, a global leader in cyber protection, in September, secured US$147 million investment round led by Goldman Sachs. With this venture round, Acronis’ valuation reached over US$1 billion, enabling the company to expand its engineering team in Singapore, Bulgaria and Arizona. Acronis plans to use the fresh capital to speed up the business growth in North America in partnership with Acronis SCS, an independent software vendor and distributor for the public sector.

Menlo Security

Amount Funded: US$75 Million

Transaction Type: Series D

Lead Investor: J.P. Morgan Asset Management

Menlo Security, a leader in Internet isolation, raised US$75 million in Series D funding in July, led by clients advised by JP Morgan Asset Management. With this funding, Menlo Security’s total valuation has reached to US$235.5 million. The company provides a cloud-based isolation platform that safeguards organizations from cyberattacks by eradicating the threat of malware from websites, documents, and emails. It will use the latest funds to expand its global sales team to meet the growing industry demand for Internet Isolation.

TPG Capital

Amount Funded: US$60 Million

Transaction Type: Investment

Invested In: AU10TIX

TPG Capital, a private equity firm, made a US$60 million investment in AU10TIX, an identity verification and biometric onboarding company, to pay down the company’s debt. The investment gives AU10TIX a post-money valuation of US$260 million. AU10TIX offers solutions for customer onboarding and KYC automation across a diverse set of verticals over the past decade, with the portfolio of its level ID authentication, identity verification, screening, and advanced biometrics. Its solutions cover the banking, payments, transportation, travel, and gaming industries.

BigID

Amount Funded: US$50 Million

Transaction Type: Series C

Lead Investor: Bessemer Venture Partners

The leader in data-centric personal data privacy and protection, BigID, in September, clinched US$50 million in Series C funding from lead investor Bessemer Venture Partners. The funding round is aimed to assist enterprises to comply with global privacy regulation and meet their data protection needs. BigID has raised nearly US$100 million in the last 18 months. And the new funds will help the company to meet the growing demand for its technology, expand global sales and engineering and launch new products for data privacy, data governance and protection.

Cybersecurity Breakthroughs & Innovations

Over the years, making sure cybersecurity has always been a challenge for businesses across the globe. And it is anticipated that the quantity of data theft by cybercriminals could rise by an enormous percentage over the next five years. In the current scenario, it has become the primary concern not only for protecting citizens’ data from cyberattacks but also to protect the corporate, public and private sectors data itself.

Though, the surging developments in technologies such as AI, IoT, and increasing clusters of connected devices have driven the adoption of cybersecurity solutions. Now companies worldwide are taking a step further to sort and check the integrity of data efficiency. Here are the list of top breakthrough and innovation took place in 2019.

Ransomware and Cryptojacking

With the evolution of cryptocurrency, cybercriminals now are increasingly turning to cryptojacking over ransomware for a bigger payday. These attacks require similar tactics to ransomware but entail less technical expertise. Cryptojacking is illegally mining cryptocurrencies, encompassing embezzlement by making use of the computer and graphics processing power from naive users’ devices to mine crypto, without their permission or consent.

Endpoint Detection and Response (EDR)

EDR is an emerging cybersecurity solution that collects, records, and stores a large amount of data from endpoint activities to provide a different capability to the security stack. It advances threat detection far beyond the capabilities of traditional EPP solutions and actively finds out anomalies using behavioral monitoring and AI tools. By leveraging EDR, security teams in an organization can continuously monitor access data points, which provide them with surveillance-like visibility that can be used to inspect a past incident or to proactively hunt for threats in their environment.

Deep Fake Videos

Mobile camera applications have become increasingly sophisticated now as users can easily modify their faces by removing pimples, add on animal ears and more. It has even reached a point where anyone can create false videos that look very real and this process called deep fake videos. Automated AI technologies have been built to both create and detect deep fake videos. These kinds of videos can be used to influence masses for bad activities by depicting a celebrity or politician engaged in illegal activity or making inflammatory comments with a head of state.

Cloud Security

In today’s digital world, enterprises are progressively shifting their data to the cloud computing environment. But, with the increased use of cloud computing that has brought many benefits, it has also opened up new areas of risk. This is where cloud security technology comes in. It encompasses a set of policies, controls, processes, and technologies that work together to safeguard cloud-based systems, data and infrastructure.

IoT and Cybersecurity

For the last few years, the internet of things (IoT) has been increased by an unprecedented rate, making its way across all sectors. From smartwatches and Internet-connected washing machines to smart home appliances and electrical devices, all have grown by leaps and bounds in just a short period of time. However, with the growing demand for IoT devices, one of the primary challenges to securing it is a lack of comprehensive security standards.

Top Rising Cybersecurity Startups

The cybersecurity market is one of the promising areas for IT innovation and funding and has given rise to a huge ecosystem of security startups. Most up-and-coming security vendors are looking to leave their mark on everything, from identity protection and control to complying with new privacy regulations and securing cloud infrastructure and IoT devices.

Here we have accumulated top rising startups in the field of cybersecurity that have made themselves a more germane channel in 2019.

Darktrace

CEO: Nicole Eagan

Founded by mathematicians in 2013, Darktrace is an AI-driven company for cybersecurity. The company’s Enterprise Immune System leverages machine learning and AI algorithms to identify and retort to cyber threats across diverse digital environments, including cloud and virtualized networks, IoT and industrial control systems. By deploying its unique machine learning, Darktrace has acknowledged 63,500 previously unknown threats in over 5,000 networks, including zero-days, insider threats, and subtle, stealthy attacks.

Cyberwrite

Founder and CEO: Nir Perry

Founded by cyber risk experts and insurance actuaries, Cyberwrite delivers cyber insurance technologies and solutions for the huge SMB cyber insurance market. The company was established in 2016 to enable insurance companies with a technology that automates cyber risk underwriting for cyber insurance policies. Its technology integrates machine learning algorithms with proprietary cyber insurance algorithms to envisage the likelihood and impact of various types of insurance coverages like data destruction, stolen records, ransom events and more.

Cylus

Founder: Amir Levintal, Miki Shifman

Cylus, an Israel-based cybersecurity company, which was founded in 2017 with an aim to help mainline and urban railway companies avoid safety incidents and service disruptions caused by cyberattacks. The company offers solutions designed to address the unique requirements and needs of the railway industry. It also enables companies in the sector to detect cyber threats in signaling and control networks, trackside and onboard, facilitating an effective response before any incident takes place.

Balbix

Founder and CEO: Gaurav Banga

Founded in 2015, Balbix offers comprehensive and continuous measurement of enterprise breach risk and resilience, on premise and in the cloud, across hundreds of attack methods. The company leverages AI to analyze risks of various platforms on the web, focusing on providing solutions not just for apps but also for other assets in a network.

PerimeterX

CEO and Co-Founder: OmriIluz

PerimeterX is a provider of scalable, behavior-based threat protection technology for the web, cloud, and mobile. Founded in 2014, the company leverages machine learning technologies for various threat identification methods. It has invested heavily in studying security threats that are not carried out by humans but by bots. By assessing the behavior of humans, applications, and networks, PerimeterX catches in real-time automated attacks with unparalleled accuracy.

Countries in Cybersecurity

Cybersecurity is not an issue limited in any specific area or region; it is a global issue. Cyber threats to any country represent an actual risk to governments, economies, organizations and people to that region. Now these risks have shifted beyond data breaches and privacy concerns to sophisticated schemes that are disrupting entire businesses, industries and nations as well. These are also costing billions of dollars and affecting governments and companies in all sectors.

However, taking a step further against cyber risks, governments as well as organizations are progressively putting resources into advancing their cyber security conventions. Everyone is now attempting to remain on track against the most potential cyber attacks, and there are a few nations committing most to cybersecurity.

Here are the top countries around the world committing most to cybersecurity, best prepared against cyber attacks, and made robust cybersecurity strategies in 2019.

United States of America

The United States of America is one of the countries across the globe that is encountering a large number of phishing or cyber attacks every year. That is why nearly 58 percent of the digital security organizations are located in the country and endeavor to ascertain better approaches to tackle against potential cyber attacks. The growth in Information Technology and eCommerce sector in the US has given rise to cyber crimes, resulting a huge loss to the government and people in the nation. Looking at the number of data breaches, the US government and companies are constantly ensuring transparency, productivity and development concerning data security. To do so, the country year over year is attempting consolidated endeavors with accomplices in implementing robust cybersecurity strategies, principles, and addressing cybercrime and securing susceptible framework from cyber threats.

New Zealand

With the million threats and cybercrimes that hit larger countries around the world, New Zealand has issued its Cyber Security Strategy 2019, which covers the country’s plans and priorities to create safe cyberspace for citizens. Since technology is a part of most households, and people’s lives, and around 90 percent of New Zealand’s population is hooked on the Internet that gives malicious actors more opportunity to steal germane data and defraud more people. However, with new strategy, every single device, including appliance, gadget, and even cars, can now be connected to the Internet, and annually updating the cybersecurity policy is a good measure to safe everyone from all the traps lurking on the Internet in the country.

India

India has also taken major steps toward securing the citizens data by clearing the paths to introduce the National Cybersecurity Strategy. Currently, the Information Act, 2000 is the primary law for dealing with cybercrime and digital commerce in the country. In an attempt to bolster the cybersecurity ecosystem, the Ministry of Electronics and Information Technology (MeitY) of India has launched Cyber Surakshit Bharat initiative, in association with the National e-Governance Division (NeGD). Also, many crucial steps have been taken against potential cyber attacks, including National Critical Information Infrastructure Protection Centre (NCIIPC), appointment of chief security officer, crisis management plan, training and mock drills, and more. Now the country is going to publish the National Cybersecurity Strategy in January 2020.

The post Report: Top Cybersecurity Developments in 2019 appeared first on Analytics Insight.

As the current situation between the US and Iran is unpleasant, with Iran’s take on hacking US government site will potentially ignite the cyberwar which can even worsen the situation further. Reportedly, a hacking group has recently hacked a US government website. The group claimed to work for the Iranian government.

The hack targeted the US Federal Depository Library Program. It has been claimed by those behind it to be a revenge attack for a drone strike in Iraq that took place on January 3, 2020. The strike killed Iranian Major General Qassem Soleimani.

The hackers left a note on the website saying “This is a message from the Islamic Republic of Iran. We will not stop supporting our friends in the regions, the oppressed people of Palestine, the oppressed people of Yemen, the people, and the Syrian government, the people and government of Iraq, the oppressed people of Bahrain, the true mujahideen resistance in Lebanon and Palestine… This is only a small part of Iran’s cyber ability. We’re always ready. To be continued.”

Moreover, the cyber breach was confirmed by the US Department of Homeland Security Cybersecurity and Infrastructure Agency. The agency added published a statement on Saturday, January 4, 2020, saying, “At this time there is no specific, credible threat against the homeland. The Department issued this bulletin to inform, share protective measures, and reassure the American public, state and local governments, and private sector partners that the Department of Homeland Security is actively monitoring and preparing for any specific, credible threat, should one arise”

After the drone strike, Iran vowed to retaliate for it and cyberwarfare is considered as a way the Islamic republic is expected to take. As the Financial Times reported that both the US public and private sectors are on high alert, the threat is considered is harmful and real as well. As noted by Silicon Angle, the US government officials can expect attacks to be focused on disrupting anything from corporate and municipal information technology systems to transit, logistics, healthcare or U.S military facilities.

What Experts Think About the Potential Cyberwar?

Hank Thomas, chief executive officer at venture capital firm Strategic Cyber Ventures said, “Iran will retaliate. There is no doubt about this. However, they will be looking for a way to appear both powerful and credible militarily at this pivotal point, without appearing to be a regional bully that traditionally relies on two-bit terrorist actions because they lack a robust advanced military response capability that could challenge the U.S. head-on.”

He further added that “showing off their offensive cyber capabilities and the reach it provides them beyond the region could very well be a part of their most likely course of action. A most dangerous course of action includes a combination of cyber and kinetic strikes both inside the region and beyond.”

Moreover, noted by Silicon Angle, according to Chris Morales, head of security analytics at cybersecurity firm Vectra AI Inc., Iran identified cyberwar capabilities as part of its attack strategy a decade ago and has gradually been building up capabilities since the country’s nuclear centrifuges were hit by the Stuxnet virus in 2010.

He said, “Cyber offensive actions have been ongoing and instigated by both sides through that time period. Iran is not as sophisticated in its cyber capabilities as it primarily leverages black market malware as opposed to the customer built malware used by U.S. and Israel cyber command. I do think Iran would prompt a cyberstrike, but they also would measure that response with the threat they know they face from a US ongoing offensive.”

Rick Holland, chief information security officer and vice president of strategy at digital risk protection firm Digital Shadows Ltd., affirmed that Iran is not the minnow some suggest. He added, “Iran’s offensive cyber capabilities have grown significantly since the 2012 days of banking sector denial of service attacks and Saudi Aramco/Shamoon destructive malware. In 2019, both the US and UK governments released multiple public alerts regarding Iranian cybersecurity threats… That’s likely to escalate as a result of Soleimani’s death.”

Additionally, Holland said, “The good news for defenders is security controls like multi-factor authentication can mitigate against account takeover attempts. Email security controls like ‘defanging’ email attachments by creating PDFs of them can mitigate malicious attachments in spear-phishing emails. Up-to-date anti-malware protection can help reduce the risks of wiper malware. The benefit of these controls is that they protect against a multitude of threats, not just Iranian attackers.”

The post Warning for Intense Cyberwar: Iran Hacks US Government Website for Revenge appeared first on Analytics Insight.

The technological advancement took a boom with the invention of the internet. Heavy mobile phones were gradually replaced by smartphones, e-libraries took the place of traditional libraries, big computers were transformed into lightweight gadgets, and usage of tech gadgets is still increasing day by day. Back then, there was no concept of smartphones, and nowadays, we are talking about smart homes! This all became possible because of rapid technological advancements.

In previous years term “cyber security” – protection of hardware, software, or electronic data, was not so commonly used. Most common people were not concerned about cyber security. The Internet was limited to tech hubs and techies. Time passed on, usage of smartphones, Wi-Fi connection, and the internet in daily life made our life a lot easier, but cyber attacks also increased. At that time, people became concerned about the protection of their devices and online information and took security measures like using a VPN service.

Nowadays, smart homes are the latest in tech that everyone can use. The use of artificial intelligence and machine learning in smart homes will people’s lives more comfortable and convenient like never before, but the point to remember is that all devices are connected with the internet! Now, it is not limited to phones and computers, but hackers can track residents’ activities and sensitive data from these devices. We are enlisting the reasons why smart homes need cyber security.

The Explosion of the Internet of Things (IoT)

Smart devices are not limited to intelligent lights and burglar alarms. The explosion of internet things has made it possible to detect baby movements, monitor elders with the help of smart devices, lock doors with the help of your home security camera, and much more. These technological advancements to our home seem great – until they get hacked. Hacking these devices means taking control of the house entirely.

Wi-Fi’s Vulnerability

IoT works because of the internet, and these things are connected to Wi-Fi. The hacking of Wi-Fi is not a new story. Cybercriminals readily have the expertise to hack Wi-Fi connections. Hacking this spot of the internet means getting access to all the smart devices that are operating on it.

Cybercriminals Damaged Large Companies in the Past

Everyone is aware of the fact that giant companies spend a stupendous fortune in saving their data from hackers. However, statistics show that even they became victims of cyber attacks in the past, and repercussions included enormous costs of recovery. We are providing a few case studies to make clear the importance of cyber security.

• Facebook: Hundreds of millions of the world’s most extensive social network user records were publicly exposed on the Amazon cloud server. The data of over 540 million users was leaked!
• First American Corporation: 885 million records were exposed. Those records contained sensitive information, including bank account info, social security numbers, wire transactions, and mortgage paperwork.
• Yahoo: This name faded away gradually after a data breach of its three billion customer accounts. A lot of costs were spent to recover, but they failed to recover reputational damage.

There are many more stories related to cyber security. Cyber attacks hurt users as well as destroy the company’s reputation. So, cyber security is necessary for all things which are operating with the help of the internet.

Cyber Attacks Statistics

Cyber attack stats are alarming. There is no doubt that the ratio will go up related to smart home attacks as well if proper parameters are not taken by smart appliances designers and developers. As per CNBC, cybercrime ‘pandemic’ may have cost the world $600 billion in 2017. Till now the numbers have increased every year. The average cost of recovering from cyber attacks for reputed businesses is $5 million. This figure is related to big companies. The small companies cannot bear the loss and wipe out shortly.

Along with financial planning, smart homeowners must do security planning. It is necessary for modern-day consumers to become aware of the level of cyber security companies or developers of IoT are offering.

Owners should take an inventory of and know all of the various network-connected devices in your home. Apply security updates to home computers and all smart devices. Back up with sensitive information and make sure that all your passwords are secure. You should consult companies in this regard as well.

Cyber crime is now commercialized industry and with technological advancements hackers have access to modern hacking tools. Unfortunately, developers behind new network-connected equipment do not think much about security. Cyber security on many IoT devices is woefully inadequate. It has become a significant concern for companies now because people are entirely aware of severe repercussions. Now, it is more important than ever to take protective measures because lagging cyber security measures can result in huge losses.

The post Why Your Smart Home Needs Cyber Security appeared first on Analytics Insight.

The threats across cyber network are like moving target, as soon as you reach near such vectors, a new emergence comes into being. However, the ever-evolving nature of technology is considered as an anecdote for these situations. As 2019 was a hot mess for cybersecurity business, 2020 is more likely to promise good at its various touch points. To understand what is actually about to happen in cybersecurity industry, lets understand the layers and background through which threat vectors have moved from 2019 to 2020 in terms of global scenario, technological landscape and cyber background. Kevin Townsend the current founder of itsecurity.co.uk, considers 2020 as the rise of the world’s elite hackers. In one of his blogs he explained the cyber threats for the year.

Rise of Cyber Threats: Global Scenario

The year 2019 has seen a upsurge in geopolitical tensions between China, North Korea, Iran, and Russia and the liberal democracies which is fought economically and in cyberspace. This war is more likely to increase throughout 2020. In terms of technology, it simply implies accelerated efforts to disrupt public opinion and affect elections.

Where Iran and North Korea seek to punish the West for real or imagined slights, with increase in tensions, Iran may feel justified and motivated for cyberattacks on America. Moreover, Russia is looking forward to weaken the West while China, however, seeks to learn from, emulate, and overtake the west in economical as well as military aspects.

Observing the global scenario, Kevin says that “in all cases, there is a blurring (and sometimes an elimination) of lines between the elite criminal hackers and the state hackers. Both benefit. The state acquires increased expertise while the criminals get access to resources and state protection.”

Throughout 2020, world will witness the increase in sophisticated attacks by the world’s elite hackers. While Russian attacks will be disruptive, Iranian and North Korean attacks are likely to be noisy and dramatic. Besides, the Chinese attacks are expected to be the most dangerous but less dramatic as China seeks to infiltrate western companies, steal military and technology secrets, dominate western economies, and learn how to disrupt critical industries.

Rise of Cyber Threats Across Technological Landscape

For IoT and Drones developments, 2019 has been a great year where for former it was the proliferation of wireless connected devices and for latter, it was tipping point for emergence.

It has been predicted that many new IoT devices will be manufactured in China; and even when they are designed and assembled in the West, the components will mostly belong to China. However, amid this Kevin has sensed two primary threats – first in terms of supply chains where there is the potential for hidden backdoors that can be exploited in the future, or methodologies for sending data back to the country of origin; and second is more widespread of lack of security. In second scenario, with the growing market, manufacturers rush to get new products to that market and in such rush security gets compromised.

Both nation-state and criminal hackers are more likely to target IoT devices across business IoT, smart devices in the home, and personal devices in 2020. Moreover, autonomous vehicle will be a local collection of many IoT devices and here the potential for hijacking smart cars becomes more threatening.

When it comes to Drones, 2019, saw them transition from specialty to commodity items. This means that their nuisance and privacy intrusion activity will flourish this year as well. Indicating towards the threats possessed by drones, Kevin quotes, “higher up the criminal chain, drones will be equipped with Raspberry Pi computers and Wi-Fi sniffers to intercept and listen in on telecommunications. These will be listening for sensitive information and for credentials to access corporate networks. Activists will also use drones to disrupt events or to make a political point – such as flying into commercial airspace to protest environmental pollution. At the opposite end of the same purpose, law enforcement agencies will use drones with facial recognition capabilities to monitor suspects and disrupt criminal activity.”

It has been observed that activist use is a short step from terrorist use. Top recall, in September 2019 a successful drone attack against Saudi oil facilities was almost certainly directed by Iran which involved nation-state support, and the use of drones as a weapon. This is one such significant danger that will grow throughout 2020.

Besides IoT and drones, AI (Artificial Intelligence) which is so far seen as the great hope for cybersecurity, in future, it will also be used as a weapon by cybercriminals. Emerging from deepfakes and high targeted malwares, its potential threat will increase through 2020.

As deepfakes involve the use of ML to transpose the static image and recorded voice of a target onto a video of an actor, the technology will be used in various scams, particularly business email scams. Moreover, it can be used to sow discord and ruin reputations ahead of elections.

Additionally, according to Kevin, the ability to build intelligence into malware will enable highly targeted malware that is virtually undetectable. Such malware could be trained to detonate only if it recognizes a specific person or target. With this level of precision targeting, it can be used by average criminals seeking to infect as many victims as possible.

Cyber Background for Rising Threats

Magecart, targeted ransomware and Malware-as-a-service is expected to boom in 2020.

Magecart

In case of financial fraud, it is easier to get card numbers from online databases but alone card numbers are not enough without the CVV number, which has given ignition to growth in Magecart-style attacks. Such attacks involve “skimming” the details from the retailer’s website as the payment details are entered in plain text and before the number is encrypted and the CVV number is discarded. Magecart attacks are more likely to become more sophisticated through 2020.

Targeted ransomware

According to Kevin, “until all organizations refuse to pay ransoms – which is unlikely if not impossible – criminals will continue to use ransomware. The bigger the target, the more it can afford to pay; so ransomware will increasingly be targeted at large organizations: manufacturing, healthcare, and municipalities.”

Malware-as-a-service (MaaS)

Malware-as-a-service is growing rapidly and this is where elite or competent hackers develop malware that is then hired out to less tech-savvy criminals. MaaS appears as a quick, easy, and cheap way for wannabe criminals to steal money online and through 2020, this will grow even more.

The post Understanding Various Backgrounds of Cyber Threat Rise in 2020 appeared first on Analytics Insight.

The smart connected devices of the modern era are way ahead from traditional internet as they do not rely on human intervention to function. Sensors attached to them collect, communicate, analyze, and act on information, offering new ways for technology, media and telecommunications businesses to create value. However, such efficiency at times creates new opportunities for all that information to be compromised. Not only is more data being shared through the connected network, among many more participants, but more sensitive data is being shared. As a result, the risks are exponentially greater, noted Deloitte. Among all the security risks that hang over the head of the connected network, botnet attacks is one quite dangerous and chilling nightmare for techies. To understand this, lets first understand what is botnet and botnet attacks.

According to Norton, “Botnets are the workhorses of the Internet. They’re connected computers performing a number of repetitive tasks to keep websites going. It’s most often used in connection with Internet Relay Chat. These types of botnets are entirely legal and even beneficial to maintaining a smooth user experience on the Internet.”

Moreover, Kaspersky explains botnet attacks as “Cybercriminals use special Trojan viruses to breach the security of several users’ computers, take control of each computer and organize all of the infected machines into a network of ‘bots’ that the criminal can remotely manage.”

It further explains that often, the cybercriminal will seek to infect and control thousands, tens of thousands or even millions of computers – so that they can act as the master of a large ‘zombie network’ – or ‘bot-network’ – that is capable of delivering a Distributed Denial of Service (DDoS) attack, a large-scale spam campaign or other types of cyberattack. Moreover, in some cases, cybercriminals will establish a large network of zombie machines and then sell access to the zombie network to other criminals – either on a rental basis or as an outright sale. Spammers may rent or buy a network in order to operate a large-scale spam campaign.

How can one protect against Malicious Bots?

As it is a constantly evolving threat, according to experts, it requires constant vigilance and paying attention to the rapidly evolving bot landscape. Bruce Beam, CIO of the (ISC)² IT security professional non-profit group suggests to start with the basics. He says, “That means making sure you’re always up to date on patches because botnets explode when they hit unpatched networks. You also need to have a defense in depth, which starts with training your workforce about what to look for. And you should have rules-based access with firewalls inside your environment both east and west so that if bots get in, they can’t spread throughout your entire network.”

To this Kenneth Wilder, a cybersecurity expert working for the healthcare industry, and vice president of ISACA’s Austin chapter, adds, “Enterprises need to look where they’ve most vulnerable, including in automation, mobility and cloud computing. API security is also extremely important for closing out bots. With APIs, you have applications talking to other applications directly, so you have to make sure you have the proper authentication and security monitoring controls.”

As noted by Symantec, Wilder further says that the DevOps continuous delivery model of constant updates and application development, if done improperly, can lead to an increase in security holes through which bots can crawl. He says that security needs to be built directly into the DevOps process, rather than being handled separately after development is done.

Finally, Wilder suggests to “ensure you have a strong security training and awareness program. Human interaction with software is not going away any time soon, and humans are the weakest link in the chain. So, we have to do better in making sure that employees are aware of bot threats and know how to protect themselves and the enterprise.”

Most Dangerous Botnet Attacks of 21st Century

As noted by EC-Council Blog, here are the most dangerous botnet attacks of the last 20 years.

EarthLink Spammer (2000) – It is the first botnet to be recognized by the public in 2000. EarthLink Spammer was created to send phishing emails in large numbers, masked as communications from legitimate websites. Over 1.25 million malicious emails were sent to collect sensitive information, such as credit card details, in the span of a year.

Cutwail (2007) – It is a malware that targets Windows OS through malicious emails that were discovered in 2007. Cutwail was distributed via the Pushdo Trojan to turn the infected system into a spambot. Message Labs, a security organization, identified that Cutwail had compromised 1.5–2 million infected systems and was capable of sending 74 billion spam emails per day.

Storm (2007) – It may not be the most malicious piece of malware in the history of a botnet, but it is on track to be the most successful, with the number of systems infected at more than 1 million. The storm is one of the first peer-to-peer botnets that can be controlled from several different servers. The storm is activated in victims’ systems by sending messages that encourage them to visit a malicious website where the malware downloads on the system.

Grum (2008) – It is a massive pharmaceutical spammer bot that was identified in 2008. Grum appeared to be more complex and larger beyond the imagination of the experts. During Grum’s demise in July 2012, it was able to send 18 billion email spams per day. Law enforcement discovered 136,000 internet addresses that were sending spam for Grum.

Kraken (2008) – It is twice as powerful as Storm. Damballa which is an internet security company was the first to report Kraken. Unlike, peer-to-peer techniques, Kraken uses command and control servers located in different parts of the world. The botnet infected 50 of 500 Fortune companies’ infrastructures. Damballa claimed that botnet infected machines were sending over 500,000 spam messages per day.

Mariposa (2008) – Mariposa was originated in Spain in 2008 and it hijacked around 12.7 million computers around the world in 2 years duration. The word “Mariposa” stands for butterfly in French. The botnet got its name because it was created with a software called Butterfly Flooder, which was written by Skorjanc illegally. Mariposa infected computers in more than 190 countries via various methods, such as instant messages, file sharing, hard disc devices, and more.

Methbot (2016) – It is the biggest ever digital ad malware that acquired thousands of IP addresses with US-based ISPs. The operators first created more than 6,000 domains and 250,267 distinct URLs that appeared to be from premium publishers, such as ESPN and Vogue.

Mirai (2016) – It infects digital smart devices that run on ARC processors and turns them into a botnet, which is often used to launch DDoS attacks. If the default name and password of the device are not changed then, Mirai can log into the device and infect it. In 2016, the authors of Mirai software launched a DDoS attack on a website that belonged to the security service providing company. Soon after a week, they published the source code to hide the origins of the attack, which was then replicated by other cybercriminals who believed to attack the domain registration service provider, Dyn, in the same year.

3ve (2018) – It gave rise to three different yet interconnected sub-operations, each of which was able to evade investigation after perpetrating ad fraud skillfully. Google, White Ops, and other tech companies together coordinated to shut down 3ve’s operations. It infected around 1.7 million computers and a large number of servers that could generate fake traffic with bots. The malware also counterfeits 5,000 websites to impersonate legitimate web publishers along with 60,000 accounts of digital advertising companies so that fraudsters can earn from the ads received.

What Happened in 2019?

The notable events in space of botnet attacks that took place in the past year are as follows.

• The Ecuadorian government claims it suffered 40 million cyber-attacks a day as a result of its action to evict Julian Assange.

• Finland suffered a Distributed Denial of Service attack targeting Parliamentary Election results services used by the government to communicate the outcome of the elections with the general population.

• The Muhstik Botnet exploited CVE-2019-2725, an Oracle WebLogic Server.

• AESDDoS Botnet exploited the Atlassian Confluence Server via CVE-2019-3396. The botnet was also seen exploiting an API misconfiguration found in Docker Engine-Community.

• A hacker was able to brute-force the back end and hijack 29 IoT botnets.

• The Telegram suffered from a large-scale DDoS attack that they claim originated from China and related to the protests in Hong Kong.

• South African ISP Cool Ideas struggled to stay online amid an advanced persistent DDoS attack where criminals targeted random IP addresses on the network and used multiple amplification vectors.

• Gaming companies began to take legal action last year against DDoS’ers. Blizzard announced that the attacker they believe that was behind the recent World of Warcraft Classic DDoS had been arrested while Ubisoft begins to ban players suspected of attacking Rainbow Six Siege with DDoS attacks.

The post Botnet Attacks: Severity, Protection and Most Dangerous Invasions in Past Years appeared first on Analytics Insight.

The recent cyberattacks and data breaches have shown that cybersecurity is not just an IT concern, it has now become the whole organizational concern. Cybersecurity has been traditionally seen as an IT job. But today there is a need to carry this challenge to company-wide as cyber threats will keep growing. HR professionals here can play a significant role in minimizing these emerging challenges by ensuring workforce skills are updated to drive cybersecurity initiatives.

Considering a report, most companies have assigned chief information security officer for cybersecurity initiatives, while just a slight number has assigned this to HR. Despite this, as cybersecurity cultural initiatives acknowledged as a team effort involving HR and the CISO, many organizations’ HR teams have taken vital steps towards it by augmenting data protection measures under the GDPR.

Why Cybersecurity Matters to HR?

With increased cyber-related incidents, cybersecurity these days has moved from the tech silo to the business frontlines. And as a business front door, the HR departments should be a key enabler for this. They also should be acting as a leader in implementing cybersecurity culture within their department.

So, here are the reasons why it does matter to the HR team and how they can mitigate cyber threats.

Identifying Employees with Bad Security Behaviors

The first and foremost reason for any cyber incident in an organization is employees with bad security habits. They often lead to data breaches that are not only defaming a company’s reputation but also costing a huge amount. This scale of attack would also result in the loss of trust between both clients and consumers. Thus, HR professionals can ease this challenge by recognizing people within the organization that present the most threats.

Inspecting Potential Cyber Attacks

Most of the cyberattacks, around 60 percent, come from either malicious intent or accident from an insider, an IBM report found. It indicates that the employees were either directly involved in the leak of private and personal information. So, the HR department here can thwart this by investigating triggers and potential employees that could result in a security breach.

Hiring Cybersecurity Employees

While recruiting the right candidate for the job, it becomes essential to understand what is needed from the job and if that aspirant is fit for the organizational culture. The HR team also needs to comprehend the cyber security requirements the company seeks. So, when it comes to cybersecurity, HR can become a safety guard for an organization only by understanding the different roles that fulfill the companies demand.

Moreover, how HR can get started into cybersecurity?

Collaborating with IT Team

As cybersecurity is a company-wide responsibility, it is significant that HR and other departments need to work closely with IT teams to manage cyber-related concerns. To do so, there should be an organizational framework that can bring various elements together, such as technology, policies and procedures, ensuring everyone understands their roles and responsibilities.

Learning Basics of Cybersecurity

The HR departments only need to learn the basics of cybersecurity rather than learning all the technical details and aspects. The most essential thing HR professionals need to know is to control user access. For that, they should have just enough access to software, settings, online services and devices connectivity functions, as per the government’s Cyber Essentials guide.

Placing Right Policies and Procedures

Putting the right policies and procedures in place is vital for driving the cybersecurity initiative within an organization. It is also imperative that access rights should be outlined in a user access control policy, approved as part of the onboarding process, reviewed on a daily basis, then withdrew when an employee leaves the organization. Thus, policies and procedures should be determined by the organization’s circumstances and meet with its legal obligations.

The post How HR Teams Help Mitigate Cybersecurity Challenges? appeared first on Analytics Insight.