By Alain Sanchez, EMEA CISO, Fortinet.

Cyber risk is business risk. Anything that threatens IT threatens the company. We have become extremely dependent upon our digital assets. As a result, business leaders need to realize the magnitude of the change. The essence of what visionaries have shared with me in the last couple of months shows how much cybersecurity is now a permanent topic of discussion among chief information security officers (CISOs) and their corporate leadership.

Assessing Cyber Risks

Perhaps the most crucial role of the CISO is to rank cyber risks by order of actual impact.

Part of this assessment requires understanding the priorities inside the organization’s value chain and securing them accordingly. The second challenge is to look beyond the organization and see how outside forces may impact it. And among these external forces, we find the compliance framework. These new laws and regulations are necessary.

This very duality, good and complex, challenges many IT departments. They must ask themselves: How do we integrate legal considerations into what used to be a pure technological battlefield? The solution is to start from the top. The board of directors should always have this duality in mind. The more directors know about cyber risks and government regulations, the better. Consider the European Union’s Digital Operations Resilience Act (DORA). This legislation is focused on the European banking and financial system.

Mitigate Risks

In the past, resilience was more of a technical concept. It was about bringing back the servers. Today, it is a legal requirement documented by an auditable plan. We have moved from a series of technical steps to a contractual re-establishment of critical services.   

Four types of considerations underpin these plans:

• • Prioritized recovery: A very delicate ranking that can only be established through a regular exchange between the board and the operations team. The board’s sign-off is crucial here. Otherwise, who would ever qualify their own activity as noncritical? However difficult to establish, this ranking is truly a fascinating exercise that brings the CISO and team to the heart of the business.
• • Defending strategies: Assessing the right combination of products, services, staffing, and processes is crucial. Less is more in this matter. After years of accumulation, cyber officers have realized the hard way that a maelstrom of products and vendors was not very efficient. The next era of security will happen via convergence, not addition.
• • Offer options: This is about providing information and an array of solutions in which, ultimately, the board makes the call. It is part of the CISO’s job to offer scenarios as a series of documented steps: investment 1, timeline 1, benefits 1, and risk 1. Then, the CISO can suggest a second and a third sequence of the above. Choosing how to proceed is the board’s job. This way, the CISO becomes an empowered execution lever for a consensual decision instead of being pinpointed as the only one to blame for the results.
• • Executive leadership: The CISO needs to report directly to the CEO, otherwise the job is a “widow maker.” The consequences of unclear or diluted support go beyond the discomfort of the position; the survival of the company is at stake. In 2024 and beyond, submitting cybersecurity to any other consideration than the company strategy is a major governance mistake. Like the Titanic shipbuilders who traded rescue boats for rooms on the sundeck.

Cybersecurity is not only about avoiding icebergs. It is a holistic approach that embraces all the active and passive security dimensions into one integrated platform. Holistic here does not mean monopolistic. Legacy, old-school, best-of-breed, and point solutions are facts of life. However, the number of technologies, vendors, processes, and the magnitude of digital transformations call for simplification. Too often, this maelstrom turns into major incidents that operate as wake-up calls. Then the question is not about the 1 million dollars we did not spend, but about the 100 million dollars we just lost.

By: Twinkle Aswani

In this vast, digitally interconnected ecosystem, your identity serves as your passport and a target. As the digital domain continues to unfold with its intricate technologies, the type and sophistication of cyber attacks also become complex. Safeguarding your data and digital identity becomes an absolute necessity.

Cyber Security Dilemma – Safety and Vulnerability

Each individual creates their own personalized digital space that collates information about them, including bank details, online transaction records, passwords and credentials, emails, social media profiles, and more. This information forms an individual digital identity. Though it makes things easy and convenient, it can also be misused and exploited by cyber criminals through identity theft, financial fraud, privacy invasion, and more.

Cyber Security and Cyber Attacks – Two Sides of the Same Coin

The volume of personal information readily accessible online can significantly impact breaches of digital identity, enabling various forms of cyber crimes.

From cyber-attacks, privacy risks, and identity theft due to data leaks to third-party and business resiliency risks. Businesses and individuals alike must abide by stringent cyber security protocols while staying updated with cyber security trends to safeguard their digital identity, strengthen their security foundation, and preserve their privacy to ensure survival in an uncertain future.

Breach Report Cases

According to the Tech.co 2024 Report, Ticketmaster confirmed the data breach that was rumored earlier this year. Hackers had made records from the breach available for sale, which included customer names, addresses, phone numbers, email addresses, order history, and partial payment details. It was expected that over 560 million customers may be impacted.

According to the New York CNN 2024 report, an activist hacking group known as “Nullbulge” has claimed responsibility for leaking thousands of Disney’s internal messaging channels, which included details about unreleased projects, raw images, computer code, and some login credentials.

Nullbulge stated that it obtained and leaked approximately 1.2 terabytes of data from Disney’s Slack communications platform. In a Monday email to CNN, the group mentioned that access was achieved through “a man with slack access who had cookies.” The email also indicated that the group was based out of Russia.

Securing your Digital Footprints – With Digital Risk Assessment

By systematically identifying and assessing potential vulnerabilities within an organization’s digital infrastructure, risk assessments enable the implementation of proactive measures before threats can be exploited.

It aids in strengthening an organization’s defenses against cyber attacks, reducing the likelihood of data breaches, and ensuring compliance with regulatory requirements.

For individuals, digital risk assessment aids in safeguarding personal data and assets by identifying risks associated with online activities and data storage. Implementing a comprehensive digital risk management strategy not only mitigates the impact of potential threats but also enhances overall security posture, ensuring that both organizational and personal digital environments remain resilient against evolving cyber threats.

According to Gartner’s 2023 report, worldwide end-user spending on security and risk management is predicted to rise to a total of $215 billion in 2024, with an increase of 14.3% from 2023.

“In light of cyber risks increasing, cyber threats proliferating, and a changing operating environment, it is more critical than ever for organizations to build and optimize a cyber security program,” said Shailendra Upadhyay, Senior Research Principal at Gartner. “It is the cornerstone of cyber security initiatives which help SRM leaders secure new environments, protect against the expanded attack surface, consume security capabilities in new ways, and create better efficiencies through automation.”

Breach Report

According to the Cobalt 2024 report, a hacker uploaded a file named “rockyou2024.txt” on a well-known hacking forum containing about 9.9 billion unique plaintext passwords. This breach has raised alarming concerns as it included passwords from old and new data breaches, significantly increasing the risk of credential stuffing attacks, where attackers exploit leaked passwords to gain unauthorized access to user accounts where passwords may have been reused.

The Essence of Digital Risk Assessment in Light of Data Breaches

There are tools available that can aid in safeguarding against such breaches. According to the Cobalt 2024 report, Cobalt’s Digital Risk Assessment offers a proactive approach, utilizing Open Source Intelligence tools and techniques to identify potentially problematic information that may be publicly accessible about your organization. It provides a thorough overview of your digital footprint and identifies potential vulnerabilities.

By identifying these exposed assets, leaked credentials, and other sensitive information across the internet, including social media and the dark web, a Digital Risk Assessment allows you to address potential attack vectors before they can be exploited by attackers.

According to the Khaleej Times 2024 report, expenditures on Security and Risk Management (SRM) by end-users in the Middle East and North Africa region are projected to rise by 12.1%, reaching a total of $3.3 billion in 2024. This surge is attributed to the expanding “threat landscape” influenced by Generative Artificial Intelligence, as reported by a leading research and data provider in the IT sector.

By: Injila Khan, Content Writer

The world we are living in has undergone a digital transformation. While this digital revolution brings ease, it has also created a world of cybersecurity threats. Biometric authentication came as the ultimate solution to everything but now there is a growing public concern regarding biometrics. There was a surge in consumer apprehension towards biometrics observed between 2022 and 2024. Specifically, concerns regarding the misuse of biometric data jumped from 69% to 88% within this period. Simultaneously, the fear of biometric data breaches also escalated from 69% to 86%, as reported by GetApp Research.

Overall confidence in biometrics has experienced a steep decline. GetApp’s 2024 Biometric Technologies Survey of 1,000 consumers revealed a dramatic decline in people’s trust in tech companies’ ability to safeguard biometric data. The percentage of those who say they “highly trust” tech companies with this data dropped from 28% in 2022 to 5% in 2024 , while the percentage that “do not trust” them nearly doubled from 22% to 42%. The same survey conducted by GetApp found that initially the convenience of biometrics boosted consumer acceptance especially during the covid era due to touchless solutions but now this confidence has completely turned around in 2024.

Concerns About Biometric Data Breaches

There have been umpteen incidences of biometric data breaches which in turn hinder the widespread adoption of this technology. People are losing trust in biometric systems with biometric data being stolen frequently combined with the feasibility of mistaken identity and the growing power of artificial intelligence (AI).

Data breaches are one of the biggest drawbacks of biometrics because of its permanent nature. Once the biometric data is compromised, there is a constant risk of identity theft of the individual. A survey conducted by IBM Security revealed that nearly 60% of Asian-Pacific consumers raise concerns about biometric spoofing by cybercriminals, compared to a global average of 50% people. Another 2023 survey conducted by GetApp indicated consumer concerns regarding the sharing of personal information with generative AI tools. With the rise of generative AI, people are more skeptical of using biometrics. They are aware how much their personal data is at risk in this tech-savvy world where there is no data privacy.

Security Over Convenience

There is an unending debate between security versus convenience. A Gartner survey from 2022 revealed that 98% of employees find it frustrating to manage encrypted emails and documents. This highlights the need for stringent security solutions like biometric authentication that eliminates time-consuming login processes and reduces cumbersome data entries resulting in more productivity.

Biometric authentication does offer ease and convenience yet there is a question of data protection. People are well-aware about the sensitivity of personal information on social media but they often choose quick and easy access over strong security log-ins while accessing their accounts. This is especially alarming considering how many people use their Facebook, X, and Google accounts to log in to other apps and websites. A lot of popular apps such as food delivery, online shopping, and dating sites, etc. let you sign in using your social media accounts. If one account gets hacked, it will compromise the privacy of all the online data, creating a domino effect.

How Secure is Biometric Authentication?

Biometrics is as common as smartphones, but it does not come without security concerns. Fingerprint recognition ranked as the most secure authentication method in the eyes of consumers. According to the IBM Security: Future of Identity Study, 44% of respondents prioritized fingerprint technology, followed by retinal scans at 30% and alphanumeric passwords at 27%.

Concerns have been raised about how biometric data is stored and managed. The 2018 data breach affecting genomics and biotechnology company 23andMe is one such example. The personal data of 6.9 million people was stolen, including their family history based on DNA. Hackers managed to infiltrate the company’s systems and gain unauthorized access to user profiles. This shows how risky it is to keep biometric information safe.

Biometric authentication is inevitable just like our smartphones but there is a big question on security and threats along with it. Due to privacy concerns, many people are hesitant to use biometrics these days especially with the unavoidable use of AI in our lives. The same technology that makes our lives easy can also be used by hackers and scammers to execute spoofing attacks. The proliferation of digital footprints, including photos, videos, and voice recordings shared online, provides sufficient material to create highly realistic biometric replicas.

A notable example of biometric vulnerability emerged in 2015 when a biometric researcher Jan Krissler also known as Starbug, demonstrated that iris scanning can be bypassed by extracting sufficient data from a high-resolution photograph. The fact that people can unlock your phone just by looking like you shows how easy it is to fool facial recognition systems. This highlights the flaws in today’s biometric security. The future of biometric authentication depends on the development of strong security measures that can protect consumers’ data while having access to the advanced technology