Rise of the cryptojackers

BY Richard Summerfield

2017 saw the emergence of cryptojacking as the latest cyber security challenge to be overcome, according to Symantec’s 2018 Internet Security Threat Report.

The report analyses data from the Symantec Global Intelligence Network, the largest civilian threat collection network in the world, which tracks over 700,000 global adversaries, records events from 126.5 million attack sensors worldwide, and monitors threat activities in over 157 countries and territories.

Cryptojacking, where computers are unknowingly co-opted for the use of mining cryptocurrencies, increased 8500 percent in 2017, with 1.7 million attacks registered in December alone.

Cyber criminals are increasingly turning to cryptojacking due to its low barriers to entry; indeed, only a few lines of code are required to infiltrate a machine. Cryptojackers are able to use coinminers to steal a device’s processing power and cloud CPU usage in order to mine cryptocurrency. Once a device has been hijacked, it will slow down, overheat and in some cases, be rendered unusable.

On an organisational level there are additional issues caused by cryptojacking. According to the report, “Corporate networks are at risk of shutdown from coinminers aggressively propagated across their environment. There may also be financial implications for organisations who find themselves billed for cloud CPU usage by coinminers.”

“Cryptojacking is a rising threat to cyber and personal security,” said Mike Fey, president and chief operating officer of Symantec. “The massive profit incentive puts people, devices and organisations at risk of unauthorised coinminers siphoning resources from their systems, further motivating criminals to infiltrate everything from home PCs to giant data centres.”

“Now you could be fighting for resources on your phone, computer or IoT device as attackers use them for profit,” said Kevin Haley, director of Symantec Security Response. “People need to expand their defences or they will pay for the price for someone else using their device.”

Software supply chain attacks also boomed in 2017. An increasing number of attackers are injecting malware into supply chains. Last year saw a 200 percent increase in such attacks – the equivalent of one attack every month, up from the four attacks a year recorded previously.

Mobile malware is also continuing to grow. The number of new mobile malware variants increased by 54 percent last year. ‘Grayware’ applications are also affected mobile users, though grayware is not entirely malicious, it can be problematic and it is becoming increasingly common. Grayware use increased by 20 percent in 2017.

Report: 2018 Internet Security Threat Report

CEO ‘disconnect’ a cyber concern

BY Richard Summerfield

Though cyber security is one of the biggest issues of our time, a misalignment between CEOs and technical officers, including CIOs, CTOs and CISOs, is weakening many organisations’ cyber security postures, according to a new report from Centrify titled ‘CEO Disconnect is Weakening Cybersecurity’.

The report, which saw over 800 executives surveyed by Centrify and Dow Jones Customer Intelligence, suggests that discord among C-suite leaders is leaving companies increasingly vulnerable to attack. The report claims that “the CEO response to cybersecurity is misaligned with reality”.

Sixty-two percent of CEOs cite malware as the primary threat to cyber security, compared to only 35 percent of technical officers. Only 8 percent of all executives stated that anti-malware endpoint security would have prevented the “significant breaches with serious consequences” that they experienced. Technical officers believe that identity breaches – including privileged user identity attacks and default, stolen or weak passwords – are the largest threat companies face, not malware.

Poor investment decisions made by CEOs – 60 percent of CEOs are investing the most in malware prevention and 93 percent indicate they already feel ‘well-prepared’ for malware risk – and poor communication between CEOs and technical officers are further cause for concern. Eighty-one percent of CEOs believe that they are most accountable for their company’s cyber security strategy, while just 16 percent of technical officers agree. Seventy-eight percent of technical officers believe that they are most accountable for the company’s strategy.

“While the vast majority of CEOs view themselves as the primary owners of their cybersecurity strategies, this report makes a strong argument that companies need to listen more closely to their Technical Officers,” said Tom Kemp, chief executive of Centrify. "It’s clear that the status quo isn’t working. Business leaders need to rethink security with a Zero Trust Security approach that verifies every user, validates their devices, and limits access and privilege.”

To bridge the gap between CEOs and technical officers, the report suggests that all parties must share their perspectives on the issues surrounding cyber security, but ultimately CEOs must alter their understanding of the threats they face. While malware is an issue, CEOs must change their mindsets, realign their cyber security spending and focus more heavily on the importance on combating identity breaches.

Report: CEO Disconnect is Weakening Cybersecurity

AI fears abound

BY Richard Summerfield

Artificial intelligence (AI) and machine learning have the potential to revolutionise many aspects of our professional and personal lives. In the decades to come, the potential benefits to be gained from embracing technology solutions will be remarkable. That said, the negative impact of AI and machine learning is widely debated, and it may have unintended consequences.

The risk of immoral, criminal or malicious utilisation of AI by rogue states, criminals and terrorists will grow exponentially in the coming years, according to 'The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation' report. The report is authored by 26 experts in AI, cyber security and robotics from universities including Cambridge, Oxford, Yale, Stanford and non-governmental organisations, such as OpenAI, the Center for a New American Security and the Electronic Frontier Foundation.

Yet despite the potential risks posed by malicious actors, many institutions are wholly unprepared. For the authors, over the course of the next decade, the cyber security landscape will continue to change and the increased use of AI systems will lower the cost of a cyber attack, meaning that the number of malicious actors and the frequency of their attacks will likely increase.

“We live in a world that could become fraught with day-to-day hazards from the misuse of AI and we need to take ownership of the problems – because the risks are real. There are choices that we need to make now, and our report is a call-to-action for governments, institutions, and individuals across the globe,” says Dr Seán Ó hÉigeartaigh, executive director of Cambridge University’s Centre for the Study of Existential Risk and a co-author of the report.

In response to the evolving threat of cyber crime and the potential misappropriation of AI, the report sets forth four recommendations. First, policymakers should work with researchers to investigate, prevent and mitigate potential malicious uses of AI. Second, researchers and engineers in AI should take the dual-use nature of their work seriously, allowing misuse-related considerations to influence research priorities and norms. Third, organisations should identify best practices where possible in research areas with more mature methods for addressing dual-use concerns, such as computer security, and imported where applicable to the case of AI. Finally, companies should actively seek to expand the range of stakeholders and domain experts involved in discussions of these challenges.

Report: The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

Rise of the robots

BY Richard Summerfield

Automation is coming. Recent reports have suggested that millions of people around the world will be impacted by the wave of automation and other new technologies which are currently emerging.

A new report from PwC – 'Will robots really steal our jobs?' – suggests that while the financial services industry in particular could be vulnerable to automation in the short term, a variety of industries, including those in the transport space, are much more vulnerable in the longer term in the UK. Less well educated workers, too, will be increasingly susceptible to replacement. Female workers are also more likely to be replaced than their male counterparts.

PwC has identified three distinct waves of automation which will impact the global economy up to 2030: the algorithm wave, the augmentation wave and the autonomy wave.

The algorithm wave is already underway and will last until the early 2020s. It involves automating structured data analysis and simple digital tasks, such as credit scoring. This wave could see just 2-3 percent of UK employees affected – 4 percent of women and 1 percent of men.

The augmentation wave, which centres on the automation of repeatable tasks and exchanging information, as well as further development of aerial drones, robots in warehouses and semi-autonomous vehicles, could impact 20 percent of UK jobs – 23 percent of women and 17 percent of men. This wave will last until the late 2020s.

The third wave, the autonomy wave, suggests that AI will have developed to the point that it will be able to analyse data from multiple sources, make decisions and take physical actions with little or no human input. This wave will last until the mid 2030s and could affect 30 percent of the workforce – 26 percent of women and 34 percent of men.

Euan Cameron, UK Artificial Intelligence leader at PwC, said: “Our research shows that the impact from automation and AI will be felt in waves, with more routine and data tasks hit first. But just because businesses and people aren’t feeling the impacts right now, there is no excuse not to start planning for the future. AI technology is getting more sophisticated every day and businesses need to understand how, where and when their people are likely to be affected in the future. Those that understand the risks and opportunities can start upskilling their people and adapting their businesses, rather than simply reacting when it’s too late.”

Automation is expected to be a boon for the economy, however. PwC believes it could contribute as much as 10 percent to UK GDP and 14 percent to global GDP by 2030.

Report: Will robots really steal our jobs?

GDPR compliance a major concern for business leaders, claims new survey

BY Fraser Tennant

Increasing regulatory pressures such as the forthcoming EU General Data Protection Regulation (GDPR) are a major concern for business leaders, according to an EY survey published this week.

According to the third biennial EY Global Forensic Data Analytics Survey – ‘How can you disrupt risk in an era of digital transformation?’ – which examined the responses of 745 executives from 19 countries, 78 percent of respondents expressed increasing concern about data protection and data privacy compliance issues, specifically the GDPR.

Indeed, with less than four months to go until the GDPR comes into force on 25 May 2018, only 33 percent of survey respondents said they have a plan in place to comply with the EU legislation. Moreover, while the average response of respondents in Europe was more positive, with 60 percent indicating they have a GDPR compliance plan in place, the survey notes that much work remains to be done in other markets, including Africa and the Middle East (27 percent), the Americas (13 percent) and Asia-Pacific (12 percent).

“The pace of regulatory change continues to accelerate and the introduction of data protection and data privacy laws, such as GDPR, are major compliance challenges for global organisations,” said Andrew Gordon, EY global fraud investigation & dispute services leader. “But businesses that adopt forensic data analytics (FDA) technologies can achieve significant advantages, benefiting from more effective risk management and increased business transparency across all of their operations.”

The survey also found that 42 percent of businesses believe that data protection and data privacy regulations have a significant impact on the design or use of FDA. EY’s examination further revealed that 13 percent of respondents indicated that they currently use FDA to achieve GDPR compliance, with more than half (52 percent) of the respondents indicating that they are currently in the process of analysing exactly which FDA tools they would use to assist them with achieving compliance.

Overall, survey respondents stated that increased adoption of, and spending on, advanced FDA technologies, needs to be matched with greater investment in skilled resources.

Mr Gordon concluded: “While it is encouraging to see that investment in advanced FDA is increasing, companies need to hire the right talent and invest in core skills such as domain knowledge and data analytics in order to be successful in managing their risk profile.”

Report: How can you disrupt risk in an era of digital transformation? – Global Forensic Data Analytics Survey 2018