Tech Features

Making Sense of Identity Threat Risks

Published

11 months ago

September 5, 2024

By David Warburton, Director, F5 Labs

The growing maturity of cloud computing, including shifts towards decentralized architectures and APIs, has highlighted the complexity of managing credentials in increasingly interconnected systems. It has also underlined the importance of managing non-human entities like servers, cloud workloads, third-party services, and mobile devices.

F5 Labs’ 2023 Identity Theft Report defines identity as an artifact that an entity uses to identify itself to a digital system – such as a workload, a computer, or an organization. Examples of digital identities include username/password pairs and other personally identifiable information or cryptographic artifacts such as digital certificates.

Digital identities cannot stand on their own. They require a system to accept and validate them. In other words, for a digital identity to function there must be at least two parties involved: an entity and an identity provider (IdP) that are responsible for issuing and vetting digital identities. However, not all organizations that provide resources are IdPs—many digital services rely on third-party IdPs such as Google, Facebook, Microsoft, or Apple to vet identities.

Based on our recent analysis, the three most prominent forms of attack in the identity threat arena currently are credential stuffing, phishing, and multi-factor authentication (MFA) bypass.

Credential stuffing

Credential stuffing is an attack on digital identity in which attackers use stolen username/password combinations from one identity provider to attempt to authenticate to other identity providers for malicious purposes, such as fraud.

It is a numbers game that hinges on the fact that people reuse passwords,
but the likelihood that any single publicly compromised password will work on another single web property is still small. Making credential stuffing profitable is all about maximizing the number of attempts, which requires automation.

Phishing

Phishing is perhaps rivaled only by denial of service (DoS) attacks in being fundamentally different from other kinds of attacks. It is an attack on digital identity, to be sure, but since it usually relies on a social engineering foothold, it is even more difficult to detect or prevent than credential stuffing.

Phishing attacks have two targets: there is the end user who is in possession of a digital identity, and there is the IdP, which the attacker will abuse once they’ve gotten credentials. Depending on the motives of the attacker and the nature of the system and the data it stores, the impact of a successful phishing trip can land primarily on the user (as in the case of bank fraud), solely on the organization (as in the case of compromised employee credentials), or somewhere in the middle.

On the attacker side, phishing can range from simple, hands-off solutions for unskilled actors to custom-built frameworks including infrastructure, hosting, and code. The most hands-off setup is the Phishing-as-a-service (PhaaS) approach in which the threat actor pays to gain access to a management panel containing the stolen credentials they want, and the rest is taken care of by the “vendor.”

Dark web research indicates that the most popular subtype of phishing service is best described as phishing infrastructure development, in which aspiring attackers buy phishing platforms, infrastructure, detection evasion tools, and viable target lists, but run them on their own.

Brokering phishing traffic, or pharming, is the practice of developing infrastructure and lures for the purposes of driving phishing traffic, and then selling that traffic to other threat actors who can capitalize on the reuse of credentials and collect credentials for other purposes.

Finally, the attacker community has a niche for those who exclusively rent out hosting services for phishing.

The most important tactical development in phishing is undoubtedly the rise of reverse proxy/ man-in-the-middle phishing tools (sometimes known as real-time phishing proxies or RTPPs), the best known of which are Evilginx and Modlishka. This is largely because it grants attackers the ability to capture most multi-factor authentication codes and replay them immediately to the target site facilitating MFA bypass but also making it less likely that the user victim will detect anything is amiss.

Multi-factor authentication (MFA) bypass

Recent years have seen attackers adopt a handful of different approaches to bypassing multi-factor authentication. The differences between these approaches are largely driven by what attackers are trying to accomplish and who they are attacking.

Nowadays, the reverse proxy approach has become the new standard for phishing technology, largely because of its ability to defeat most types of MFA.

MFA bypass tactics include:

Malware. In mid-2022, F5 malware researchers published an analysis of a new strain of Android malware named MaliBot. While it primarily targeted online banking customers in Spain and Italy when it was first discovered, it had a wide range of capabilities, including the ability to create overlays for web pages to harvest credentials, collect codes from Google’s Authenticator app, capture other MFA codes including SMS single-use codes, and steal cookies.

Social engineering. There are several variations of social engineering for bypassing MFA. Some target the owner of the identity, and some target telecommunications companies to take control of phone accounts.

Social Engineering for MFA Code—Automated. These are attacks in which attackers make use of “robocallers” to make phone calls to the target, emulating an identity provider and asking the victim for an MFA code or one-time password (OTP).

Social engineering for MFA code—Human. This is the same as the above approach except that the phone calls come from humans and not an automated system.

SIM swaps. In this kind of attack, a threat actor obtains a SIM card for a mobile account that they want to compromise, allowing them to assume control of the victim’s phone number, allowing them to collect OTPs sent over SMS. There are several variations of this approach.

So, what does it all mean?

Identity threats are constant and continuous. Whereas a vulnerability represents unexpected and undesirable functionality, attacks on identity represent systems working exactly as designed. They are therefore “unpatchable” not only because we can’t shut users out, but because there isn’t anything technically broken.

This brings us back to the question of what digital identity really is. To go from real, human identity to digital identity, some abstraction is inevitable (by which we mean that none of us is reducible to our username-password pairs). We often teach about this abstraction in security by breaking it down to “something we know, something we have, and something we are.” It is this abstraction between the entity and the digital identity that attackers are exploiting, and this is the fundamental basis of identity risk.

By thinking about digital identities in this way, what we are really saying is that they are
a strategic threat on par with, but fundamentally different from, vulnerability management. With nothing to patch, each malicious request needs to be dealt with individually, as it were. If modern vulnerability management is all about prioritization, modern identity risk management is essentially all about the ability to detect bots and differentiate them from real human users. The next logical step is quantifying the error rate of detecting these attacker-controlled bots. This is the basis on which we can begin to manage the risk of
the “unpatchables.”

Tech Features

AI and Digital Currencies Transform MENA Into Rising Fintech Leader

Published

1 week ago

July 9, 2025

Integrator Web-Editor

abstract representation of AI and digital currencies

By Naser Taher, Chairman of MultiBank Group

The Middle East and North Africa (MENA) region has become the leading laboratory for financial innovation, where artificial intelligence (AI), central bank digital currencies (CBDCs), and sovereign wealth fund (SWF) strategies converge to reshape global cash flows. According to the World Economic Forum, venture capital investments in MENA grew by about 33% a year from 2015 to 2023, with funding reaching $644 million in 2024. This surge reflects deliberate efforts to position the region as a fintech powerhouse for the new economy.

One of the most significant developments is the strategic collaboration between the Abu Dhabi Investment Office (ADIO) and the Trump Organization to establish an AI and Web3 Free Zone. The $6.6 billion initiative aims to attract global tech firms, AI researchers, and fintech ventures to the UAE, further cementing MENA’s leadership in next-generation digital infrastructure.

Machine learning algorithms now process trades worth billions on Saudi Arabia’s Tadawul exchange daily, while automated risk assessment systems evaluate loan applications in real time from Dubai to Riyadh. Saudi Arabia’s Financial Sector Development Program has embedded AI throughout its capital markets ecosystem as part of Vision 2030’s broader economic transformation. PwC analysis projects this technological integration will generate almost $135 billion for the country’s economy by 2030, fundamentally altering how banks manage liquidity, assess credit risk, and compete regionally.

Central banks across the Gulf have moved beyond theoretical frameworks into live testing of digital currencies. The UAE’s Digital Dirham is set to enter retail circulation through licensed banks and fintech companies by late 2025, enabling near-instant cross-border payments where traditional banking requires days and charges hefty fees. Meanwhile, Saudi Arabia and the UAE have jointly piloted Project Aber, issuing a single wholesale CBDC.

Gulf SWFs are reshaping the region’s infrastructure landscape, no longer content with simple portfolio plays. These institutions now control $4.9 trillion in assets, with projections reaching $7.3 trillion by 2030. In the first nine months of 2024, they accounted for 40% of all international SWF transactions, deploying $55 billion across 126 deals. Notably, Abu Dhabi’s Investment Authority and Saudi Arabia’s Public Investment Fund (PIF) are increasing allocations to blockchain and digital projects. In Qatar, the Qatar Investment Authority is working through the Qatar Financial Centre’s new Digital Asset Regulations 2024 to trial real-world asset tokenization.

Alongside these public sector moves; private institutions are also innovating on a scale. MultiBank’s new Electronic Communication Network (ECN) will introduce the Gulf’s first interbank trading and prime brokerage ecosystem, linking BRICS and GCC jurisdictions. Designed to compete with Western counterparts such as Bloomberg and Reuters, it connects conventional trading desks to machine-driven order routing and the MultiBank Chain’s tokenization layer. Cross-border deals become faster, safer, and more transparent, with settlements possible in gold or a mix of currencies instead of U.S. dollars alone. By opening the door to tokenized real-world assets and other decentralized products, the network sharpens the Gulf’s bid to serve as a global finance hub.

However, important challenges remain. Fintech ventures still need to navigate a maze of rules that shift from one border to the next; a single, region-wide framework would let ideas—and capital—move faster. As more money flows online, hackers gain fresh openings, and cybersecurity becomes even more critical. And while Gulf youth embrace tech with ease, the GCC needs far more specialists who can work with blockchains, train risk models, and secure CBDC payment rails. That calls for a push on everything from university courses to mid-career reskilling.

The next breakthrough won’t come from technology alone but from how well policymakers, entrepreneurs, and the sovereign heavyweights backing them work in sync. CBDC pilots are live, AI already guides trading desks, and deep pools of patient capital sit ready to fund new ideas. If the region’s key players keep pulling in the same direction, the Gulf won’t just join the digital finance conversation—it could end up leading it.

Tech Features

Unleash Unmatched Cyber Defense: Sophos Firewall v21.5’s Breakthrough NDR-Essential

Published

1 week ago

July 8, 2025

Integrator Web-Editor

Colleagues collaborating around a table in a modern office, captured candidly in natural light.

Chris McCormack, Senior Product Marketing Manager at Sophos

Sophos, a global leader in innovative security solutions for defeating cyberattacks, recently announced an update to its Sophos Firewall. Now, Sophos Firewall includes Sophos NDR Essential—free for all customers with an XStream Protection license.

With this integration, Sophos Firewall leverages two dedicated artificial intelligence engines to detect malware communications and algorithmically generated domain names. This new capability, powered by the Sophos Network Detection and Response probe, identifies previously unknown threats and complements the Active Threat Response features already in place.

According to Chris McCormack, Senior Product Marketing Manager at Sophos, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.”

Sophos Connect Integrates EntraID for SSO

The VPN client bundled with Sophos Firewall now supports EntraID (Azure AD) for single sign-on. This enhancement secures SSL and IPsec VPN connections and improves user experience by adding multi-factor authentication for both Sophos Connect and the user portal.

Other VPN-related improvements include:

–Intuitive interface updates: “Site-to-site” is now “policy-based,” and “route-based” tunnel interfaces are renamed for clarity.
–Dynamic IP pool validation: Prevents address conflicts across SSL VPN, IPsec, L2TP, and PPTP.
–Strict profile enforcement: Excludes default IPsec profile values to ensure algorithm synchronization and eliminate session negotiation issues.
–Enhanced scalability: Supports up to 3,000 route-based VPN tunnels, 1,000 SD-RED site-to-site tunnels, and 650 concurrent SD-RED devices.

Additional Management Enhancements

Furthermore, Sophos has rolled out several management improvements to streamline daily operations:

–Flexible IPv6 DHCP-PD: Supports /48 to /64 prefixes for better ISP compatibility.

–RA and DHCPv6 server enabled by default: Simplifies IPv6 deployments.

–Resizable table columns: Improves the admin interface on ultra-wide screens.

–Advanced search: SD-WAN routing and local ACL rules now support name, ID, and content-based searches.

–Default configuration updates: Only the default network and MTA rules are provided; custom gateway probes and rule groups default to “None.”

Secure by Design

Moreover, Sophos continues to harden its firewall platform with a secure-by-design approach. Specifically, features are containerized, and integrity checks on critical OS files use mathematical checksums—any mismatch triggers an alert. Consequently, monitoring teams can swiftly identify potential compromises and react accordingly.

Availability

Customers can download and deploy this update manually on any Sophos Firewall with a valid license.

For more on Sophos’s Middle East strategy, check out our previous coverage:
Sophos Announces Intent to Expand Middle East Operations with New Data Center in the UAE

Tech Features

Driving the Future: How Logical Data Management Powers EV Innovation in the UAE

Published

1 week ago

July 8, 2025

Integrator Web-Editor

EV assembly line showing virtual data dashboards and logical data management overlays.

By Gabriele Obino, Regional Vice President and General Manager, Southern Europe, Middle East and CIS, Denodo

Logical data management is revolutionizing EV production in the UAE by replacing slow, siloed systems with a virtualized data layer. Consequently, manufacturers like Seres report an 88% reduction in data delivery time, empowering on-shop-floor decision-making and accelerating Industry 4.0 initiatives.

The Rise of Logical Data Management in EV Manufacturing

Under the UAE’s Operation 300bn strategy, EV production faces surging data volumes. Traditional ETL pipelines buckle under real-time demands. By contrast, logical data management—often called data virtualization—creates a semantic layer that unifies multiple stores without replication. This approach slashes latency, reduces storage overhead, and accelerates analytics across design, production, and operations.

Limitations of Traditional Data Systems for EV Production

Legacy batch-driven data warehouses delay critical actions. In a high-stakes assembly line, even millisecond lags can compromise quality or safety. Moreover, centralized silos inflate storage and governance costs, especially under strict UAE data-sovereignty laws. Static architectures simply cannot keep pace with AI-driven analytics or digital twin simulations.

Adopting Logical Data Management for Real-Time Insights

Firstly, Logical data management platforms (Denodo) let shop-floor teams query live data instantly. For example, EV manufacturer Seres cut data delivery time by 88% and built 600+ self-service analytics apps. Furthermore, virtualized data services simplify compliance with role-based security, ensuring governed access to sensitive vehicle-PII under UAE regulations.

Implementation Strategy for Logical Data Management

1-Identify critical data sources affecting safety, cost, and sustainability

2-Pilot virtualization on latency-sensitive processes such as battery-pack assembly

3-Enforce governance policies to maintain data integrity and security

4-Train non-technical staff on user-friendly analytics tools

5-Monitor production metrics improvements to scale across the factory

Additionally, regular reviews help refine and scale each phase effectively.

Future Outlook for Logical Data Management in the UAE EV Market

Looking ahead, as the EV sector grows beyond the current US$1.8 billion market, data becomes as vital as any physical component. Therefore, by valuing data on par with hardware, UAE factories can slash defects, boost efficiency, and maintain a competitive advantage. Consequently, early adopters of logical data management will lead the next wave of automotive innovation.

For more on cutting-edge EV innovations in the region, check out our feature:
NIO’s Industry-Leading Innovations Set New Benchmarks for Intelligent Premium Electric Mobility