Tech Features

Making Sense of Identity Threat Risks

Published

2 years ago

September 5, 2024

By David Warburton, Director, F5 Labs

The growing maturity of cloud computing, including shifts towards decentralized architectures and APIs, has highlighted the complexity of managing credentials in increasingly interconnected systems. It has also underlined the importance of managing non-human entities like servers, cloud workloads, third-party services, and mobile devices.

F5 Labs’ 2023 Identity Theft Report defines identity as an artifact that an entity uses to identify itself to a digital system – such as a workload, a computer, or an organization. Examples of digital identities include username/password pairs and other personally identifiable information or cryptographic artifacts such as digital certificates.

Digital identities cannot stand on their own. They require a system to accept and validate them. In other words, for a digital identity to function there must be at least two parties involved: an entity and an identity provider (IdP) that are responsible for issuing and vetting digital identities. However, not all organizations that provide resources are IdPs—many digital services rely on third-party IdPs such as Google, Facebook, Microsoft, or Apple to vet identities.

Based on our recent analysis, the three most prominent forms of attack in the identity threat arena currently are credential stuffing, phishing, and multi-factor authentication (MFA) bypass.

Credential stuffing

Credential stuffing is an attack on digital identity in which attackers use stolen username/password combinations from one identity provider to attempt to authenticate to other identity providers for malicious purposes, such as fraud.

It is a numbers game that hinges on the fact that people reuse passwords,
but the likelihood that any single publicly compromised password will work on another single web property is still small. Making credential stuffing profitable is all about maximizing the number of attempts, which requires automation.

Phishing

Phishing is perhaps rivaled only by denial of service (DoS) attacks in being fundamentally different from other kinds of attacks. It is an attack on digital identity, to be sure, but since it usually relies on a social engineering foothold, it is even more difficult to detect or prevent than credential stuffing.

Phishing attacks have two targets: there is the end user who is in possession of a digital identity, and there is the IdP, which the attacker will abuse once they’ve gotten credentials. Depending on the motives of the attacker and the nature of the system and the data it stores, the impact of a successful phishing trip can land primarily on the user (as in the case of bank fraud), solely on the organization (as in the case of compromised employee credentials), or somewhere in the middle.

On the attacker side, phishing can range from simple, hands-off solutions for unskilled actors to custom-built frameworks including infrastructure, hosting, and code. The most hands-off setup is the Phishing-as-a-service (PhaaS) approach in which the threat actor pays to gain access to a management panel containing the stolen credentials they want, and the rest is taken care of by the “vendor.”

Dark web research indicates that the most popular subtype of phishing service is best described as phishing infrastructure development, in which aspiring attackers buy phishing platforms, infrastructure, detection evasion tools, and viable target lists, but run them on their own.

Brokering phishing traffic, or pharming, is the practice of developing infrastructure and lures for the purposes of driving phishing traffic, and then selling that traffic to other threat actors who can capitalize on the reuse of credentials and collect credentials for other purposes.

Finally, the attacker community has a niche for those who exclusively rent out hosting services for phishing.

The most important tactical development in phishing is undoubtedly the rise of reverse proxy/ man-in-the-middle phishing tools (sometimes known as real-time phishing proxies or RTPPs), the best known of which are Evilginx and Modlishka. This is largely because it grants attackers the ability to capture most multi-factor authentication codes and replay them immediately to the target site facilitating MFA bypass but also making it less likely that the user victim will detect anything is amiss.

Multi-factor authentication (MFA) bypass

Recent years have seen attackers adopt a handful of different approaches to bypassing multi-factor authentication. The differences between these approaches are largely driven by what attackers are trying to accomplish and who they are attacking.

Nowadays, the reverse proxy approach has become the new standard for phishing technology, largely because of its ability to defeat most types of MFA.

MFA bypass tactics include:

Malware. In mid-2022, F5 malware researchers published an analysis of a new strain of Android malware named MaliBot. While it primarily targeted online banking customers in Spain and Italy when it was first discovered, it had a wide range of capabilities, including the ability to create overlays for web pages to harvest credentials, collect codes from Google’s Authenticator app, capture other MFA codes including SMS single-use codes, and steal cookies.

Social engineering. There are several variations of social engineering for bypassing MFA. Some target the owner of the identity, and some target telecommunications companies to take control of phone accounts.

Social Engineering for MFA Code—Automated. These are attacks in which attackers make use of “robocallers” to make phone calls to the target, emulating an identity provider and asking the victim for an MFA code or one-time password (OTP).

Social engineering for MFA code—Human. This is the same as the above approach except that the phone calls come from humans and not an automated system.

SIM swaps. In this kind of attack, a threat actor obtains a SIM card for a mobile account that they want to compromise, allowing them to assume control of the victim’s phone number, allowing them to collect OTPs sent over SMS. There are several variations of this approach.

So, what does it all mean?

Identity threats are constant and continuous. Whereas a vulnerability represents unexpected and undesirable functionality, attacks on identity represent systems working exactly as designed. They are therefore “unpatchable” not only because we can’t shut users out, but because there isn’t anything technically broken.

This brings us back to the question of what digital identity really is. To go from real, human identity to digital identity, some abstraction is inevitable (by which we mean that none of us is reducible to our username-password pairs). We often teach about this abstraction in security by breaking it down to “something we know, something we have, and something we are.” It is this abstraction between the entity and the digital identity that attackers are exploiting, and this is the fundamental basis of identity risk.

By thinking about digital identities in this way, what we are really saying is that they are
a strategic threat on par with, but fundamentally different from, vulnerability management. With nothing to patch, each malicious request needs to be dealt with individually, as it were. If modern vulnerability management is all about prioritization, modern identity risk management is essentially all about the ability to detect bots and differentiate them from real human users. The next logical step is quantifying the error rate of detecting these attacker-controlled bots. This is the basis on which we can begin to manage the risk of
the “unpatchables.”

Tech Features

ENGINEERING INTELLIGENCE IN EDUCATION: PREPARING YOUNG WOMEN FOR FUTURE TECH LEADERSHIP

Published

17 hours ago

June 23, 2026

Integrator Web-Admin

Dr Esraa Khatab, Assistant Professor at the School of Mathematical and Computer Sciences, Heriot-Watt University Dubai

As we celebrate International Women in Engineering Day (INWED), attention is increasingly focused on how to prepare young women not only to participate in engineering but to lead its future. In a world shaped by artificial intelligence, sustainability challenges, and rapid digital transformation, education must go beyond technical instruction. It must cultivate what we can call engineering intelligence, a combination of technical expertise, problem-solving ability, creativity, and leadership confidence.

For young women, this preparation is most effective when education is intentionally designed to inspire, support, and position them as future innovators and decision-makers.

Inspiring Young Women Through Meaningful Learning

Engaging young women in engineering begins with making learning relevant and purposeful. When engineering is connected to real-world challenges, such as improving healthcare systems, designing sustainable cities, or developing climate solutions, it resonates strongly with students who are motivated by impact.

Project-based learning plays a key role here. When young women work on designing smart applications, building prototypes, or solving community challenges, they begin to see themselves as capable engineers contributing to society. Thes experiences move engineering from an abstract concept to a meaningful pathway where their ideas matter.

Initiatives such as the UAE’s “One Million Arab Coders” and international programs like “Girls Who Code” have successfully introduced thousands of young women to coding, AI, and digital innovation. These initiatives are powerful not just because of the skills they teach, but because they create an early sense of belonging in technology-driven environments.

Mentorship: Unlocking Potential and Building Confidence

For young women, mentorship is a transformative element of engineering education. It provides not only guidance but also reassurance, helping students navigate academic and career pathways with clarity and confidence.

Connecting young women with mentors, whether through universities, industry partnerships, or outreach programs, offers them valuable insights into emerging fields such as artificial intelligence, robotics, and renewable energy. These relationships make career paths more tangible and achievable.

In classroom settings, mentorship can be embedded into learning through project collaborations and industry engagement. When young women receive feedback from

professionals, present their ideas, and engage in real-world problem-solving, they begin to develop both confidence and professional identity.

Mentorship also nurtures leadership. By observing and interacting with experienced professionals, young women gain exposure to decision-making, teamwork, and innovation processes, essential components of future tech leadership.

Expanding Opportunities Through STEM Outreach

STEM outreach initiatives are vital in reaching young women early and sustaining their interest in engineering pathways. Programs that focus on hands-on, creative engagement, such as robotics competitions, coding bootcamps, and innovation labs, are particularly effective in building confidence and curiosity.

These initiatives create safe and encouraging environments where young women can experiment, take risks, and learn collaboratively. Importantly, they shift the narrative from simply learning technology to actively creating it.

Digital platforms have further expanded opportunities for young women in engineering. Virtual labs such as “MIT OpenCourseWare” and interactive simulations (e.g., PhET) allow learners to experiment and build practical skills remotely, with research showing strong gains in engagement and motivation. Online hackathons, including initiatives like the “UAE InnovAIte AI” Hackathon, provide young women with collaborative spaces to design real-world solutions using emerging technologies. At the same time, AI-powered tools such as “Khan Academy’s Khanmigo” offer personalized guidance, helping learners build confidence through continuous, self-paced support.

Together, these platforms create flexible and inclusive pathways that enable young women to actively engage, experiment, and grow within today’s rapidly evolving technological landscape. By introducing young women to emerging technologies early, outreach programs help them build familiarity and confidence in fields that will define the future of work.

Encouraging Young Women to Lead in Emerging Fields

Emerging engineering domains, such as artificial intelligence, smart systems, biotechnology, and sustainable energy, offer significant opportunities for innovation and leadership. Encouraging young women to explore these areas requires intentional effort within education systems.

This can be achieved through:

Early integration of advanced topics: Introducing AI, data science, and sustainability concepts at foundational levels.
Interdisciplinary approaches: Encouraging young women to apply engineering skills in healthcare, environmental science, and social innovation.
Experiential learning: Providing opportunities for internships, research projects, and innovation challenges in emerging fields.

These experiences allow young women to build not only technical expertise but also the confidence to navigate complex, real-world challenges. They begin to see themselves as contributors to cutting-edge developments, rather than observers.

Building Confidence and Leadership Identity

For young women to thrive in engineering, education must also focus on building confidence and leadership skills. This includes creating environments where their voices are heard, their ideas are valued, and their contributions are recognized.

Encouraging young women to lead team projects, present their work, and participate in competitions helps them develop essential soft skills such as communication, collaboration, and critical thinking.

Representation also plays an important role. Highlighting the achievements of women engineers and innovators, both globally and within local communities, reinforces the message that leadership in engineering is both attainable and expected.

Importantly, leadership development should be embedded into the learning journey. Innovation challenges, entrepreneurship programs, and community-based projects provide platforms for young women to take initiative and drive impact.

Looking Ahead: Empowering Young Women to Shape the Future

The future of engineering will be defined by those who can think creatively, solve complex problems, and lead with vision. Preparing young women for this future is not just about education, it is about empowerment.

By combining meaningful learning experiences, strong mentorship, expanded outreach, and opportunities in emerging technologies, we can create an ecosystem where young women thrive as engineers and leaders.

As we celebrate INWED, the focus is clear: to ensure that young women are equipped not only with skills, but with the confidence and ambition to lead. When this happens, they do more than contribute to technological advancement, they shape it.

Tech Features

FIVE WAYS UAE WORKFORCE PLANNING IS CHANGING IN 2026

Published

5 days ago

June 19, 2026

Integrator Web-Admin

The UAE is entering a more complex phase of workforce growth. Hiring momentum remains strong, with the country recording a Net Employment Outlook of 60% for Q2 2026, placing it among the strongest employment markets globally. Yet the main challenge for companies is whether their employment structures, immigration planning, compliance systems, and HR leadership can support growth at scale.

Aethra Advisory, a UAE-based global hiring strategy and mobility architecture firm, outlines five shifts companies should prepare for as compliance, immigration, and HR become more connected.

HR is becoming workforce architecture

HR can no longer be treated as an administrative function focused only on recruitment, onboarding, contracts, and employee relations. In 2026, HR leaders are expected to help design the workforce model itself. That includes where a company hires, which employment structures it uses, how talent moves across borders, and where compliance risk may appear. A hiring decision is now linked to visa eligibility, payroll structure, sponsorship, worker classification, relocation timelines, and long-term operating needs.

Many companies still hire first and address structure later. The consequences often emerge months afterwards, when employment models become costly, difficult to manage, or unable to support growth.

AI is entering recruitment and workforce planning

Companies are using AI to screen CVs, match candidates to roles, automate outreach, schedule interviews, assess skills, and generate workforce insights. Used well, it can make hiring faster and more consistent, especially in high-volume recruitment environments.

A 2025 field experiment involving around 37,000 applicants found that 54% of candidates assessed through an AI-assisted recruitment pipeline passed the final human interview, compared with 34% of candidates assessed through a traditional pipeline. However, AI does not replace human judgement. Companies still need clear hiring criteria, documented decision-making, oversight and an understanding of how recommendations are generated and reviewed.

Companies are moving into global talent systems

Many companies make the UAE a base for regional and international expansion due to its business-friendly policies and strategic location. Local companies are hiring across borders, global firms are entering the UAE, and leadership teams are being built across multiple jurisdictions. In fact, the cross-border workforce and migration solutions market is projected to reach $11.37 billion by 2033, growing at an annual rate of 11.8%.

For employers, hiring can no longer be treated as a local HR process. Companies must make deliberate decisions about how they enter new markets and engage talent. Some may use an Employer of Record to hire quickly, while others may establish a local entity to gain greater control. In some cases, relocating and sponsoring employees will be the right approach or engaging contractors or building a longer-term market entry structure may be more suitable. Each route carries different implications for cost, compliance, operational control, and future scalability.

Employment models are becoming more hybrid

As companies scale, informal arrangements become harder to manage. A single UAE business may now have locally sponsored employees, remote workers, consultants, contractors, relocating workers, etc. This gives companies more flexibility, but also creates operational risk when obligations are not understood from the start. Worker classification, payroll treatment, benefits, visa eligibility, contract terms, management control, and termination rules can vary depending on how a person is engaged. Employers need clear structures defining employment status, work location, applicable law, and how each relationship is governed.

Regulation is influencing hiring decisions

In the UAE, hiring depends on more than finding the right candidate. Companies need the right regulatory setup before they can move quickly. Licensing gaps, unclear sponsorship routes, incomplete documentation, or a mismatch between the role and the employment structure can still delay a strong hire.

This makes compliance and immigration planning an early hiring priority. Companies should understand the requirements before entering a market, confirming a hire, or committing to a relocation timeline.

Tech Features

Networks Must Evolve Before AI Can Scale

Published

2 weeks ago

June 11, 2026

Integrator Web-Editor

Rohit Chowdhary, Head of Advanced Consulting Services at Nokia, sat down with The Integrator to share insights into the company’s vision for enabling the AI supercycle. He outlined how Nokia’s end-to-end portfolio spans everything from AI-ready connectivity and energy-efficient 800G data centre networking to intelligent, self-optimising home Wi-Fi experiences powered by AI.

A key focus of the discussion was Nokia’s shift from strategic advisory to real-world execution through its dedicated Automation Excellence Practice, helping operators translate ambitious transformation roadmaps into measurable outcomes. The conversation also highlighted the growing importance of integrated, intelligent and secure networks that can support rising AI workloads, eliminate infrastructure bottlenecks and unlock tangible business value, while maintaining the highest standards of security, privacy and resilience

Could you begin by telling us about your role at Nokia and the journey that brought you here?

I lead Nokia’s Advanced Consulting Services business across Europe, the Middle East and Africa. My journey with Nokia spans nearly seventeen years, beginning at a time when consulting was largely focused on network transformation initiatives. Over the years, I have worked closely with operators around the world on transformation programmes, analytics adoption, customer experience management and digital modernization.

As the industry evolved, so did our consulting focus. Following the Nokia and Alcatel Lucent merger, we established what is today known as Advanced Consulting Services. The organization now spans several domains, including security, business monetization, cloud and technology transformation, autonomous operations, and data and AI.

More recently, we launched an Automation Excellence Practice. The idea was simple. Customers often appreciated our strategic blueprints but needed practical expertise to implement them. Today, we have specialized engineers who combine telecom expertise, AI capabilities and software development skills to turn strategic visions into real automation pipelines, AI-driven workflows and production-ready use cases. Our role is to help customers move from concept to measurable business outcomes.

Nokia is often associated with connectivity, but the company is increasingly talking about AI readiness. How does Nokia’s infrastructure portfolio support this transition?

AI is creating what we describe as an AI supercycle. It is transforming everything from data centres and cloud infrastructure to network architectures and edge computing. Supporting this shift requires a complete ecosystem rather than isolated technologies.

Nokia’s portfolio addresses this across multiple layers. On the network side, we continue to innovate in radio technologies, including AI-RAN capabilities developed alongside strategic partners such as Nvidia. We also have a strong optical networking and IP portfolio that enables the high-capacity connectivity required between data centres, edge locations and cloud environments.

One area that excites me is our innovation in data centre networking. We are introducing highly efficient coherent optical technologies and advanced switching platforms that significantly reduce infrastructure footprints while improving performance and energy efficiency. These innovations are becoming increasingly important as organizations invest in AI factories, AI grids and large-scale inference environments.

Beyond connectivity, we also provide intelligent automation layers through our autonomous networking platforms, enabling operators to manage complex, multi-vendor environments more efficiently and intelligently.

What are some of the biggest infrastructure bottlenecks you see operators and enterprises facing as AI adoption accelerates?

One of the biggest challenges is understanding that AI infrastructure is not just about compute power. Organizations often focus heavily on GPUs and processing capabilities, but connectivity can quickly become the limiting factor.

You can deploy the most powerful AI infrastructure available, but if the network cannot support the required data movement between racks, data centres and edge locations, performance suffers. This is where intelligent networking becomes critical.

At Nokia, we are helping customers design what we call AI-ready connectivity. This includes high-capacity optical networking, intelligent routing and the seamless interconnection of compute environments. As AI workloads become increasingly distributed, the ability to move data efficiently becomes just as important as the ability to process it.

On the consumer side, Nokia has been showcasing AI-driven Wi-Fi management capabilities. How does this improve the end-user experience?

The home network has become far more complex than it was a few years ago. Consumers expect flawless connectivity across multiple devices, applications and services.

Our AI-enabled Wi-Fi solutions continuously monitor network performance and user experience. They can identify coverage gaps, detect congestion, analyze interference patterns and even recommend or automatically implement corrective actions.

The goal is to create a self-optimizing network environment where many issues can be resolved autonomously before they impact the user. This reduces support requirements for service providers while delivering a more consistent and reliable experience for customers.

The Middle East is witnessing an unprecedented surge in data centre investments. How do you see this shaping Nokia’s opportunities in the region?

The Middle East has emerged as one of the most dynamic markets globally for AI infrastructure investments. Governments and enterprises are actively investing in sovereign AI capabilities, advanced data centres and digital ecosystems.

This creates significant opportunities, not only for Nokia but for the broader technology industry. The success of these initiatives depends on having secure, scalable and efficient connectivity between compute resources, cloud environments and end users.

Our role is to help customers build these foundations. Whether it is data centre interconnectivity, optical networking, intelligent routing or autonomous operations, Nokia’s technologies are designed to support the scale and performance requirements of AI-driven economies.

As data volumes continue to grow, security and data sovereignty are becoming increasingly important. How is Nokia addressing these concerns?

Security is deeply embedded into Nokia’s strategy and innovation roadmap. As a European technology company, trust, resilience and security have always been fundamental principles in how we design and operate our solutions.

While we continue to invest heavily in AI innovation, we are equally focused on strengthening security capabilities across our portfolio. This includes advanced network security architectures, AI-driven threat detection and preparations for future technologies such as quantum-safe networking.

We are actively engaged with industry bodies, standards organizations and ecosystem partners to help define the next generation of secure digital infrastructure. As AI becomes increasingly pervasive, security must evolve alongside it, and that is an area where Nokia continues to invest significantly.

Looking ahead, what excites you most about the future of AI-driven networks?

What excites me most is the convergence of AI, automation and connectivity. Networks are evolving from passive transport layers into intelligent platforms that can learn, adapt and optimize themselves.

The future will be defined by autonomous operations, AI-native networks and real-time decision-making at scale. Organizations that successfully combine these capabilities will unlock entirely new business models and levels of operational efficiency.

For us, the opportunity is not just about deploying technology. It is about helping customers transform the way they operate, innovate and create value in an increasingly AI-driven world.