By Kevin Bocek, VP of Security Strategy and Threat Intelligence, Venafi
The White House has been forced to rapidly issue new cyber security rulings for government agencies after it emerged that a second security breach against the U.S government’s Office of Personnel Management (OPM) has exposed the files of millions of federal workers, as well as information on their friends, families and colleagues.
The breach could leave federal workers and their contacts open to blackmail or spear phishing attacks by cyber criminals, or users may be duped into downloading dangerous malware.
The OPM breach was the second attack in as many weeks – and comes on the back of other high profile security attacks such as the Community Health Systems breach in the US, which affected 4.5 million patients and the attack on Sony Pictures. It therefore comes as no surprise to seethe White House announce major developments to ramp up encryption and intensify website security across the board.
In the wake of this second attack, The White House has directed all federal agencies to take a series of rapid measures to lock down government systems. U.S. Chief Information Officer Tony Scott has launched what is being referred to as a 30-day cyber security sprint. During this time, agencies are being asked to patch all known vulnerabilities and shore up systems using information provided by Homeland Security, the Government department designated to protect the nation. Agencies will all be asked to report on their progress during this period.
The U.S. Office of Management and Budget (OMB) has also announced that all federal agencies will be required to use HTTPS to improve website security. On its coat tails, the House Energy Commerce Committee sent letters to the CEOs of Apple, Google, Microsoft and Mozilla expressing concern that Certificate Authorities (CAs) owned by national governments have the power to issue certificates which could be used for fraudulent purposes. Although these two initiatives are unrelated – they are linked.
The Committee is seeking industry direction on whether limiting CAs can actually improve the way the certificate system is run, if it is technically possible, what adverse effects such restrictions would have, and how security can be improved overall?
Federal agencies will be required to inspect all inbound TLS/SSL traffic for potential risks as they move to 100 percent encryption.All traffic will need to be carefully examined as cyber criminals are happy to play the waiting game and hide out for as long as it takes to launch a successful attack.
Agencies will also need to search out the malicious use of forged, compromised, or fraudulent certificates across the Internet to brick wall so called spoofing and man-in-the-middle (MITM) attacks. With a compromised, stolen, or forged key and certificate, attackers can impersonate, surveil, and monitor their targets’ websites, infrastructure, clouds, mobile devices, and system administrators, and decrypt communications thought to be private.
While the motives behind increasing encryption are largely positive – the OMB’s announcement to use HTTPS has some gaping holes. If HTTPS isn’t properly implemented with an immune system to protect the cryptographic keys and digital certificates, the increased use of HTTPS may actually increases the security risks. More encrypted traffic will require bad guys to use HTTPS and either forge or compromise certificates to mount effective attacks. Unfortunately, we live in a world without trust today because there is no immune system to detect keys and certificates that do not belong and are being misused as the bad guys accelerate their attacks.
In its directive, the OMB has yet to specify or mandate any type of key or certificate management system to ensure it is efficiently managed and safeguarded. There has also been no reference to the U.S government’s National Institute of Standards and Technology(NIST) guidance issued two years ago for preparing for a CA breach. NIST guidelines are aligned with internationally accepted best practices and standards on computer security. This is what makes the Committee’s letters to the industry seeking advice on limiting CA’s all the more intriguing.
Governments should be anxious about who we trust in our browsers and if we can have confidence in the security of websites. This is why we welcomed Google’s decision to block CNNIC, the Chinese CA, earlier this year, following the discovery that the state-run organisation had issued unauthorised certificates for Google domains that left it exposed to man-in-the-middle attacks capable of intercepting private communications.
Shockingly, any CA in the world, through fraud or compromise, could issue malicious certificates for .gov domains, as well as more obvious .com sites and others. It is imperative that CAs cannot abuse certificates or issue malicious ones that could be used as ammunition against the US or its allies. Google Certificate Transparency (CT) is undoubtedly a help – butit only covers the high-level extended validation (EV) certificates, and does not address compromise or misuse after issuance. This is why we are seeing a rise in so called Certificate Reputation, which allows website operators to monitor their web domains to help ensure there are no fraudulent issued SSL certificates.
The move that the US Government have taken is undoubtedly a step in the right direction – but unfortunately more encrypted traffic makes them an even more inviting target for cyber criminals. Unless we have an Immune System for the Internet – a system that that can identify certificates, safely deliver them for use with SSL/TLS inspection, and detect and stop the misuse of certificates for governments and enterprises – we will continue to see a frightening number of attacks take place.
How to use data to protect and power your business
By Dave Parker, Group Head of Data Governance, Arrow Global
Employees need to access data to do their jobs. But as data governance professionals, it’s our job to protect it. Therefore, we must perform a fine balancing act to weigh robust data protection against the productivity of workers who need the data to maintain business-as-usual working processes.
Data grows exponentially, and most organisations will admit that they simply don’t know what data they have, where it is, and the controls that exist around it. This creates 2 challenges:
- Burgeoning amounts of unstructured data makes the business increasingly vulnerable from external attackers or internal data breaches.
- Because data is the key to understanding a customer’s wants and needs, if the business can’t identify its data and unlock its value, it’s at a competitive disadvantage.
As a European investor and alternative asset manager, here at Arrow Global we take care of £50bn of assets and own a data estate exceeding 160TB. How we manage our data is key to our success. We understand the difficulties involved in opening up environments to allow people to work productively, while at the same time locking them down to protect our organisation.
When it comes to analytics, I believe that Arrow is highly proficient because we employ a talented team of data scientists. But even for us, the sheer volume of raw and processed data, that resides in both our structured systems and unstructured data repositories, has the potential to put our business at risk.
We know there’s always more that can be done to strengthen our security posture and ensure regulatory and contractual compliance, while at the same time using our data to drive the business forward.
Data protection isn’t just about compliance
For many organisations, data protection has centred on demonstrating compliance with the GDPR. At Arrow, our efforts have gone one step further to include our contractual exposure.
Being a more mature data organisation, we had previously tried to develop an application in-house to manage our data estate. However, with 160TB across the company in production data alone, we simply couldn’t achieve the scale we needed to handle the sheer volume of data. Of course, the volume is just the start – once you know what data you have, you then need to be able to categorise the data and put it into a structure, so the business can analyse it for a specific use case.
We knew we needed to go to market to find an industrial-strength data discovery product to replace our in-house application. By aligning our choice of product to our overall IT and change strategy, meant that ultimately, we ended up with a far better outcome than we’d anticipated.
Position data as both a risk and an asset
Data touches every part of an organisation, so when it came to building a business case for buying-in a data discovery software platform, we approached it in a way that would speak to different people at the same time. We did this by posing the question:
“What do we want to do with data in a way that is GDPR-compliant, contractually-compliant and enables us to better service our clients?”
These are the black and white tests of data governance – to recognise the importance of securing and protecting data. They’re applied in a way that enables us to commoditise data and use it to drive the business forward, by forcing us to consider how we would use the data – for example, creating value-based pricing for our clients.
In aligning the business case to initiatives that were already priorities within the boardroom, we knew that we’d gain the attention of the senior leadership team and it would be easier to get the buy-in and budget we needed. And in the end, everyone wins – we get what we need to protect the data, and the business gets to distil the data’s value to better meet our customers’ expectations.
Get visibility of data at scale
For us, things got really exciting once we were able to see all of our data at scale. We chose Exonar because it allowed us to discover our data in ways that other products couldn’t. And the interface between the user and Exonar meant that everyone – both technical and non-technical users – could understand the technology and the findings it revealed.
When we saw exactly what data was in the estate, where it was and who had access to it, data security became much easier and the risk of data being compromised was dramatically reduced. We can see exactly where the vulnerabilities are and restructure how our data is stored to strengthen security. Then over time, we can use search, workflow and analysis to optimise the infrastructure and continually identify new areas to improve.
Commercialise the data
From a wider-business perspective, once people can see the data, they can start asking “What if…” to query it and distil its value. But it’s more than just the data itself. It’s not uncommon for data relating to the same thing to exist in unconnected systems across the business. For example, customer interactions and incidents or events.
Exonar is capable of joining the dots in disparate data sets. By stitching these data sets together, we can get a better overall view of our customers and use the outcomes to think of new, different or better ways of serving them through enhancing or adapting our offerings.
Why other financial services businesses should also take a smarter approach to data
- By changing the way you approach data, you can use it to protect and power your business and the people you serve.
- By positioning data as both a risk and an asset, you elevate its position to give it priority in the boardroom. Ultimately, it’s data that helps the business make informed strategic decisions about how to strengthen its competitive advantage.
- By gaining visibility of data at scale, you can see exactly what data you have and where it is. This gives the business confidence about the actions needed to ensure it is secured in both a regulatory and contractually compliant way, and that people are doing the right thing with data at all times.
- And joining different data sets provides you with a single view of ‘X’ within your data, no matter where it is. Helping to support your wider-business strategy and priorities, it gives you the information you need to secure a business advantage and generate value.
How business leaders can find the right balance between human and bot when investing in AI
By Andrew White is the ANZ Country Manager of business transformation solutions provider, Signavio
The digital world moves quickly. From keeping up with consumer behaviour patterns, to regulation and compliance, the most successful organisations are always on the cutting-edge of technological developments.
However, when it comes to investing in artificial intelligence (AI), a hard and fast strategy does not guarantee a top spot amongst the league of tech greats. Instead, it pays to take a considered approach to balancing reliance on automated processes with a human touch. Why? Because creative and strategic thinkers are the true propellers of innovation; automation is simply the enabler.
The International Monetary Fund (IMF) developed the ‘Routine Task Intensity’ (RTI) index as a measure of which processes are likely to benefit most from automation. According to this metric, jobs requiring analytical, strategic, communicational and technical skills score low on the RTI index, while simple, repetitive tasks scored highly.
The lesson for business leaders here is simple; your digital investments are just as important as your stake in talent. When deciding which processes to automate, start simple, and remember to value the skills and potential of your people.
Keep customer-centricity at your core
Customer-centricity means that every business decision, dollar spent and new hire is centred on one question: how does this benefit my customer? Investments in AI are no different. To be truly successful, they must have a customer-focused outcome.
Where companies get this wrong is by implementing cost-saving measures or ‘copy and paste’ software that fails to improve the customer experience – often having the adverse effect.
Take the virtual chat-bot, for example; if implemented poorly, it can send your customers into a frustrating and seemingly infinite cycle of dead-ends. The modern consumer is far too digitally savvy for this shortcut, and will quickly move onto the next merchant offering a more seamless customer service experience.
To guarantee your investments are delighting rather than infuriating your customers, it helps to take an outside-in perspective of your business processes, aided by Customer Journey Mapping (CJM).
Before you commit to digital investments, CJM can trace and map each customer touchpoint, signalling pain points or conversion rates throughout their journey. These data-driven insights lead you to the areas that would benefit the most from automation, instead of implementing a broad band-aid solution.
Avoid the ‘set and forget’ method
When investing in enterprise-wide AI, the ‘set and forget’ method rarely works. Real transformation requires an ongoing dedication to refining and improving AI-driven processes, as well as adapting them to the evolving needs of your customers. This is the best way to achieve customer loyalty, by proving that your organisation listens to, and understands its users.
A human perspective is invaluable here, paired with process mining – a method that thrives on finding process inefficiencies – to create a consistent feedback loop of improvement.
During periods of uncertainty, customer loyalty is everything, so aim to protect it at all costs.
The power of your people
The rise of automation can be linked to the corporate world’s obsession with speed and efficiency. However, the psychology behind this goes deeper than being the biggest and fastest producer; it’s also about reallocating resources into attracting and retaining the brilliant minds that drive companies into the future.
When communicating digital change, it’s critical to highlight the valuable impact AI has on augmenting jobs; removing the burden of mundane, repetitive tasks and allowing for more strategic skill-sets to shine through. For lower-skilled workers, invest in upskilling or re-education where possible.
Successfully rolling-out digital transformation plans means that every employee across all tiers of your company understands the value of AI. The starting point here is education to achieve buy-in. Change communications must be accessible, constructive and value-focused, supported by key culture influencers who champion automation within teams.
Enterprise-wide buy-in is an important element of refining and improving digital processes, as cross-functional collaboration can offer valuable insights into common pain points or inefficiencies ripe for automation. Supported by process mining, collaboration provides a holistic view of how each investment will impact other processes. There is no point investing in automation that streamlines one process and makes another more people-centric, so be sure to take a balanced approach to your investments.
Remember, AI is not about creating an army of robot workers; it’s about increasing efficiency and productivity so that an organisation, and its people, can work smarter.
Are you a fighter or a freezer? The 4 “F’s” of Surviving Danger
By Dr.Roger Firestien, Author of Create In a Flash.
The fight, flight, freeze survival response – or FFF for short – is designed to mobilize our brain and body to fight an enemy, run from a tidal wave or freeze to hide from a predator.
FFF is how humans react when they encounter a dangerous situation. It is a primal response that happens instinctively even before we are able to think about the situation we are confronting.
The FFF alarm causes our brain to focus on negative memories, probably to scan them to avoid repeating dangerous situations and negative outcomes. We get tunnel vision as our pupils dilate to increase our focus and long-range vision, but as a result we lose our peripheral vision.
Humans use the FFF response and so do organizations.
When organizations encounter dangerous situations, like, say, trying to survive a global pandemic, they can respond by either fighting the situation, fleeing from the situation, or freezing and waiting for the situation to pass.
I would like to propose a fourth strategy for organizations to deal with a danger like the pandemic. It is the fourth “F.” The farm response. More on that later.
What kind of organization is yours?
The fighter organizations were the ones that fought the idea of a global pandemic or pushed back against the research that reported how serious the virus was. Think of the meat processing plants that didn’t provide proper protective gear or the religious organizations that refused to take a break from large services.
The results were catastrophic for the organizations and deadly to the employees and worshippers.
It is pretty easy to identify the fleeing organizations. You don’t see them anymore. Unfortunately, this is the organization that just doesn’t have the resources or the energy to fight. You will recognize them by the “For Rent” signs in the windows of the buildings they used to occupy.
The organizations that freeze are a little more difficult to identify. They are still around but are frozen by fear. They are the organizations that, although they are in a position to move forward, are too frightened to take a risk or even look at the periphery of their business. Their tunnel vision blinds them to opportunity. The freezers hide and wait for the danger to pass. They are the ones who miss out on possibilities.
For example, if you are in the business of supplying concessions to sporting events, airports and national parks, your business is in deep trouble now. So, what are some ways to keep people buying food and drinks with so many venues closed?
Many national parks are now open and visitors need to eat. How can you sell food while supporting social distancing? Answer: Sell picnic meals to your patrons. And, sell a blanket that commemorates the park that diners can spread out and have lunch while social distancing with their families. Then, they’ll keep the blanket that reminds them of their visit to the park.
Sound like a good idea? It sure does. You can keep your park concession business, allow people to social distance and add to your product line with that commemorative blanket. Did the company implement the idea? Unfortunately, they did not. They froze and missed the opportunity.
However, businesses are finding ways to optimize their organization and capture opportunities. They are the farmers. The farmer organizations study the situation, just like farmers study the weather and the land. They look at the resources available to them and get to work.
Farmer organizations pivot and get creative.
Distillers, who before the pandemic, were making vodka, whiskey, gin and other spirits quickly changed their operation from distilling booze to distilling sanitizer.
Telemedicine, which had limited acceptance before the pandemic, almost immediately became the accepted way to deliver care. Now, the doctor comes to you.
Fitness trainers are conducting their sessions via Zoom or in person outside on sidewalks in front of their gyms so they can social distance.
My favorite ranch, SK Herefords, sells their beef at local farmer’s markets in the Western New York area. This spring when the large packing houses shut down and grocery stores were limiting the amount of beef customers were able to buy, my farmer friends were there at the markets with locally produced farm-raised beef. Sales soared and demand skyrocketed.
Why? The farmers were ready. They used their resources and were not afraid to optimize them in a rapidly changing and volatile environment. Farmers live with constantly changing weather conditions and market prices and are accustomed to rapid change.
To operate with constant change, all of us, like farmers, need to be constantly creative. Phil Keppler, my philosopher farmer friend from SK Herefords says, “Creativity helps you to not look at things as a problem. It’s trying to find the solution – and that’s the exciting thing about it. Things aren’t problems anymore. It’s just difficult situations and you’re trying to find a solution to that situation.”
A good mindset for what our world is experiencing now… it’s a difficult situation and we are creating solutions daily.
Fight, flight, freeze or farm. What kind of organization is yours? And, what can you learn from “the farmers?”
The importance of app-based commerce to hospitality in the new normal
By Jeremy Nicholds CEO, Judopay As society adapts to the rapidly changing “new normal” of working and socialising, many businesses...
The Psychology Behind a Strong Security Culture in the Financial Sector
By Javvad Malik, Security Awareness Advocate at KnowBe4 Banks and financial industries are quite literally where the money is, positioning...
How open banking can drive innovation and growth in a post-COVID world
By Billel Ridelle, CEO at Sweep Times are pretty tough for businesses right now. For SMEs in particular, a global financial...
How to use data to protect and power your business
By Dave Parker, Group Head of Data Governance, Arrow Global Employees need to access data to do their jobs. But...
How business leaders can find the right balance between human and bot when investing in AI
By Andrew White is the ANZ Country Manager of business transformation solutions provider, Signavio The digital world moves quickly. From...
Has lockdown marked the end of cash as we know it?
By James Booth, VP of Payment Partnerships EMEA, PPRO Since the start of the pandemic, businesses around the world have...
Lockdown 2.0 – Here’s how to be the best-looking person in the virtual room
By Jeff Carlson, author of The Photographer’s Guide to Luminar 4 and Take Control of Your Digital Photos suggests “the product you’re creating is...
Banks take note: Customers want to pay with points
By Len Covello, Chief Technology Officer of Engage People ‘Pay with Points’ – that is, integrating the ability to pay...
Are you a fighter or a freezer? The 4 “F’s” of Surviving Danger
By Dr.Roger Firestien, Author of Create In a Flash. The fight, flight, freeze survival response – or FFF for short...
Why the FemTech sector might be the sustainability saviour we have been waiting for
By Kristy Chong, CEO & Founder Modibodi ® Taking single use plastics out of circulation is no easy feat, but...