Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label business risks. Show all posts
Nation-State Attacks
AI Attacks business risks Cyber Security Machine learning Nation-State Attacks

How to Shield Businesses from State-Sponsored AI Attacks

 

In cybersecurity, artificial intelligence is becoming more and more significant, both for good and bad. The most recent AI-based tools can help organizations better identify threats and safeguard their systems and data resources. However, hackers can also employ the technology to carry out more complex attacks. 

Hackers have a big advantage over most businesses because they can innovate more quickly than even the most productive enterprise, they can hire talent to develop new malware and test attack techniques, and they can use AI to change attack strategies in real time. 

The market for AI-based security products has also helped malicious hackers to target businesses frequently. According to a report published in July 2022 by Acumen Research and Consulting, the global market had a value of $14.9 billion in 2021 and was expected to grow to $133.8 billion by 2030.

Nation-states and hackers: A lethal combination 

Weaponized AI attacks are inevitable, according to 88% of CISOs and security executives, and for good reason. A recent Gartner survey showed that only 24% of cybersecurity teams are fully equipped to handle an AI-related attack. Nation-states and hackers are aware that many businesses are understaffed and lack the knowledge and resources necessary to defend against such attacks in the form of AI and machine learning. Only 1% of 53,760 cybersecurity applicants in Q3 2022 had AI skills. 

Major corporations are aware of the cybersecurity skills shortage and are working to address it. Microsoft, for example, is currently running a campaign to assist community colleges in expanding the industry's workforce. 

The ability of businesses to recruit and keep cybersecurity experts with AI and ML skills contrasts sharply with how quickly nation-state actors and cybercriminal gangs are expanding their AI and ML teams. According to the New York Times, the Department 121 cyberwarfare unit of the elite Reconnaissance General Bureau of the North Korean Army has about 6,800 members total, including 1,700 hackers spread across seven different units and 5,100 technical support staff. 

According to South Korea's spy agency, North Korea's elite team stole an estimated $1.2 billion in cryptocurrency and other virtual assets over the last five years, with more than half of it stolen this year alone. Since June 2022, North Korea has also weaponized open-source software in its social engineering campaigns aimed at businesses all over the world. 

North Korea's active AI and ML recruitment and training programs aim to develop new techniques and technologies that weaponize AI and ML in order to fund the country's nuclear weapons programs. 

In a recent Economist Intelligence Unit (EIU) survey, nearly half of respondents (48.9%) named AI and machine learning as emerging technologies that would be most effective in countering nation-state cyberattacks on private organizations. 

Cybercriminal gangs pursue their enterprise targets with the same zeal as the North Korean Army's Department 121. Automated phishing email campaigns, malware distribution, AI-powered bots that continuously scan an enterprise's endpoints for vulnerabilities and unprotected servers, credit card fraud, insurance fraud, and generating deepfake identities are all current tools, techniques, and technologies in cybercriminal gangs' AI and ML arsenals. 

Hackers and nation-states are increasingly using this tactic to target the flaws in AI and ML models built to detect and prevent breach attempts. One of the methods used to lessen the effectiveness of AI models created to predict and prevent data exfiltration, malware delivery, and other things is data poisoning. 

How to safeguard your AI 

What can the company do to safeguard itself? The three essential actions to take right away, in the opinion of Great Learning's Akriti Galav and SEO expert Saket Gupta, are: 

  • Maintain the most stringent security procedures possible throughout the entire data environment. 
  • Make sure an audit trail is created with a log of every record related to every AI operation. 
  • Implement reliable authentication and access control. 

Additionally, businesses should pursue longer-term strategic objectives, such as creating a data protection policy specifically for AI training, educating their staff about the dangers of AI and how to spot flawed results, and continuing to operate a dynamic, forward-looking risk assessment mechanism.

No digital system, no matter how intelligent, can be 100% secure. The enterprise needs to update its security policies to reflect this new reality now rather than waiting until the damage is done because the risks associated with compromised AI are more subtle but no less serious than those associated with traditional platforms.
Read more »
User Security
business risks Cyber Security data security Data Theft IIoT IoT devices User Security

IoT Security: A Major Concern for Businesses Worldwide

 

As technology continues to evolve and more industries across the globe become connected, understanding the security challenges linked with the industrial internet of things (IoT) deployments is increasingly important. 

Businesses planning to roll out a manufacturing or industrial IoT initiative, or link existing technology for automated and remote monitoring or access, will need to consider all of the potential threats and attack vectors linked with those decisions. The most common security challenges with industrial IoT security are as follows: 

Security Breach Via Old Systems 

The surge in the volume of IoT apps has made it easier for malicious hackers to identify vulnerabilities to infiltrate organizational data. The operation of multiple IoT devices through the same internet connection makes it easier for attackers to exploit them as a point of illegal access to other resources. This lack of network segmentation can be devastating, as one successful assault on an IoT device can open the door to attackers to siphon sensitive data. 

To safeguard IoT-powered enterprises from data breaches, it’s important to boost the security of the devices with a hardware-based VPN technology and execute a real-time monitoring solution that will continuously scan and report the behavior of the linked devices. 

DDoS Attack 

The hackers can target businesses' endpoint devices by flooding them with overwhelming traffic so that they cannot complete the work they were intended to do. 

For example, when an industrial thermostat is linked to unprotected internet, a coordinated DDoS attack on the entire system could lead to system downtime. One of the best ways to mitigate this type of IIoT threat is to safeguard internet connection with a firewall. 

Device Spoofing  

In IIoT, a device spoofing assault is launched when the hackers pose themselves as a legitimate device to send information between businesses' centralized network and the IIoT endpoint device. For example, the hacker can pose a trusted IoT sensor to send back false information that could alter an organization’s manufacturing process. However, this risk can be mitigated by employing a hardware-based security solution.

Device Theft 

Another common issue, particularly with devices out in the field, is the theft of the physical devices themselves. This threat increases when endpoint devices are storing critical data that may cause concern if that information is stolen by the attackers. 

To minimize the threat, it’s necessary to avoid storing sensitive information on endpoint devices and use cloud-based infrastructure to store critical data. 

Data Siphoning 

The smooth deployment of data by endpoint devices can be blocked via an eavesdropping attack. What the hacker does here is eavesdrop on the network traffic from the endpoint device to secure access to collected data. 

The industries most impacted by this type of IoT attack are the health, security, and aerospace industries. To mitigate the threat, organizations must have a security policy ensuring that all transmitted data is adequately encrypted using the best encryption software. 

“Organizations need to think through this. There are a lot of requirements and they need to figure out a strategy. When looking at product security requirements, I see this as a challenging aspect as organizations get a handle around what they are manufacturing,” Robert M. Lee, CEO at Dragos Incorporation raised a concern regarding organizations' security. 

“There are organizations for example in industries such as health care, medical devices, and power and utilities that are starting to ask questions of their suppliers as they consider security before they deploy devices into their customer ecosystem. Where I see a lot of organizations struggle is in understanding system misconfiguration or not having the architecture, they thought they did in order to make sure their manufacturing environment is reliable.”
Read more »
Sophos
Business business risks customer privacy Cyber Attacks ransomware. Sophos

Cyberattacks In Companies Result in Customer Prices, Cost of Doing Business

 

If a person visits his favorite store that suffers cyberattacks frequently, he might think that someone stole his wallet. These types of data breach or cyberattack, the sense of fear, isn't new to the users. The rise in number of attacks, impact and the cost of these breaches, however, are new, customers notice. In today's date, a customer is up-to-date about these attacks, compared to earlier times. They affect the customers directly more in present times after all, like when threat actors steal personal data from a big organization. 

How do the customers think about such attacks? 

When threat actors target organizations, consumers pay the cost too. In simple terms, customer suffers from the price increase of goods and services. "When attackers sell customer data on the dark web and other criminals buy that data, they can turn an enterprise attack into hundreds of others. It can spin off into credit card fraud, identity theft, and a world of social engineering scams. Cyberattacks may strike once, but identity- and personal data-related fraud is forever," reports Security Intelligence. 

Cyberattacks affect costs because of ransomware payments, lawyer fees, increased insurance rates, cost of returning everything back online, and operational failure. The costs are paid by the companies, but at the last, the customers have to pay the prices. The costs of these attacks are increasing every year. According to Sophos survey, the average cost of a ransomware attack, for example, was $1.85 million in 2020 — double the previous year. 

The future keeps getting dark, cyberattacks costs across the world are said to increase by 15% per year for the next five years, said to reach $10.5 trillion per year by 2025, as per the cybersecurity experts. The rise is in the cost of doing business, which will affect the customer prices. According to Security Intelligence, "the rise in cyberattacks on businesses has heightened consumer worries in the past year. Some 44% feel more at risk from cybercrime than they did before the COVID-19 pandemic began, according to the Norton survey."
Read more »
Cyber Crime
business risks Cyber Crime

Cyber Security Incidents- the biggest risk to Businesses!

According to a survey of 2,718 executives from across 100 countries, cyber security incidents ranked as the biggest risk to businesses globally. 


The survey was participated by CEOs, risk managers, brokers and insurance experts and 39% of them said cyber risks were the biggest fear for a business. 

"Seven years ago, cyber ranked 15th on the business risk list, compiled by Allianz Global Corporate & Specialty (AGCS), with just 6% of respondents picking it."

Among cyber security issues, ransomwares got the most attention and seem to worry executives the most. They are increasing rapidly over the years and even after the encryption has been removed, businesses face extra cost (apart from the ransom cost)  in the form of expensive litigation from consumers or investors who have been affected by data breach.

Mergers and acquisitions can also lead to security threats, as acquiring a company with poor cyber security measures can be liable for your company as well. 

"Incidents are becoming more damaging, increasingly targeting large companies with sophisticated attacks and hefty extortion demands. Five years ago, a typical ransomware demand would have been in the tens of thousands of dollars. Now they can be in the millions," says Marek Stanislawski, deputy global head of cyber at AGCS.

Business Interruptions drops to second behind cyber security concerns. Interruptions can be caused due to fire, explosion or natural catastrophes to digital supply chain failures or political violence. Changes in legislation and regulation comes third , with tariffs, sanctions, Brexit and protectionism. 

" Around 1,300 new trade barriers were implemented in 2019 alone, the report said."

Climate change ranked 7th biggest risk to business.

 "If a digital platform is unavailable due to a technical glitch or cyber event, the losses for multiple companies reliant on it could be in the hundreds of millions of dollars or higher if they cannot provide services or products," the report said.

Cyber attacks was among the top three risks in countries like Austria, Belgium, France, India, South Africa, South Korea, Spain, Sweden, Switzerland, the UK and the US. 

Read more »
Subscribe to: Posts (Atom)