Year: 2016

Whether the business community is ready or not, augmented reality (AR) has arrived, and it only will grow more prominent in the near future.

Consumers – mindful of this year’s Pokémon Go phenomenon – are recognizing AR’s potential benefits, a surefire indicator that the marketplace will respond quickly.

In ISACA’s annual IT Risk/Reward Barometer—a two-pronged survey that examines both consumer and IT/business perspectives—the majority of consumers see clear benefits of AR-enhanced devices in everyday life and work. For now, though, a disconnect exists, as only 21 percent of global business and technology professionals are convinced that the benefits of AR outweigh the risks.

The hesitance of many professionals to embrace AR – technology that superimposes a computer-generated overlay on a user’s view of the real world – is both understandable and predictable since it is still in the early stages. With the emergence of any new technology, the attack surface increases. AR-related privacy and security concerns are legitimate, especially when factoring in a proliferation of Internet of Things (IoT) devices. Concerted attention from device manufacturers and security professionals is a must.

Yet this natural caution must not keep enterprises from keeping up with the competitive landscape. Of critical importance, one in four enterprises has a way to detect pictures, posts and videos tagged or geotagged to their business locations and advertisements. That means there are best practices to learn from as enterprises look to move forward securely while incorporating components of AR.

While the resounding popularity of Pokémon Go alerted consumers and enterprises to the buzz that AR can generate, the potential applications of AR in the workplace are numerous. Adoption figures to be especially swift from a marketing standpoint as organizations learn to leverage AR for signage, social media and other purposes.

Enterprises can realize the benefits of AR and overcome potential barriers through some of the following steps:

• Extend social media monitoring to AR platforms. Leverage and extend current social media policies and monitoring to augmented reality platforms. Social media is a key source of information for many augmented viewing apps.
• Consider how AR can improve your business. Training, diagnostics and marketing are three areas with particularly strong potential.
• Review your governance framework and update your policies. Incorporate use of AR as part of the business into organizational policies and procedures—including BYOD (bring your own device) and privacy policies. 63% of organizations do not have a policy to address AR in the workpalace.
• Build security into every part of the process. Security is a crucial component of AR initiatives that helps ensure confidence in the data.

While AR is a new concept for many, some industries have drawn upon aspects of it for years, such as the airline industry’s use of flight simulators to train pilots on new equipment. As AR becomes more popular and more affordable, it is inevitable that more industries invest in the technology. Since today’s smartphones are capable of running AR apps, adoption could be swift and even viral, as Pokémon Go demonstrated. According to Slice Intelligence, millennials accounted for more than half the paying population of Pokémon Go during launch week, but now are only 44 percent of buyers as other age groups also gain interest.

Business and technology professionals will become more comfortable with that reality the more that they explore AR. On that front, there is much progress to be made. The IT Risk/Reward Barometer shows that only 3 percent of professionals have used AR applications for business use within the past year and only 16 percent have done so for personal purposes.

The business community will be well-served to accelerate their exposure because consumers have spoken – AR is in demand. Now it is up to security professionals to address the risks so that consumers and enterprises alike can benefit from this promising technology.

Rob Clyde, CISM, ISACA Board Director and Executive Advisor at BullGuard Software

[ISACA Now Blog]

ISACA’s inaugural CSX Europe conference convened last week in London, and I had the privilege of serving as emcee. During a panel discussion on the second day of the conference, Mark Sayers of the UK’s Cabinet Office discussed the announcement that morning of the UK Government’s £1.9bn investment in a national cybersecurity strategy—a strategy that makes clear the UK’s preparedness for cyber attacks and will include a cyber security skills strategy. Sayers made it clear that organizations like ISACA are extremely important to further the initiative.

The cyber security event left a strong impression on attendees, including several critical takeaways:

•  Collaboration is critical. Intel’s Raj Samani emphasized collaboration and communication to best contend with today’s threat landscape. Professionals on the more technical side need to be able to communicate with business decision-makers and other stakeholders to effectively solve problems. As speaker Aviram Zrahia notes, “one company’s detection become another’s protection.”
•  Internet of Things devices pose new security challenges. Security professionals are capable of preventing attacks, but consumers need to understand that connected devices have security vulnerabilities. Justine Bone, director and CEO, MedSec, presented the findings of ISACA’s new firmware security report, highlighting how easy it is for security to be overlooked when creating IoT devices.
•  New solutions are needed. In closing the conference, technology futurist Simon Moores observed that organisations will no longer be able to handle the scale of cyber threats alone. In many cases, automated, cloud-based solutions involving artificial intelligence (AI) will be part of the solution, though there is no substitute for developing a highly skilled workforce.

The conference also provided another valuable networking opportunity through ISACA’s Connecting Women Leaders in Technologyprogram, which is helping to advance female leadership within the global technology workforce.

Editor’s note: Additional insights from global security experts will be on display at CSX 2016 Asia Pacific, set to make its debut 14-16 November in Singapore. Next year’s CSX Europe conference will take place in London on 30 October-1 November 2017.

Richard Hollis, CISM, CRISC, CPP, PCI, QSA, Chief Executive Officer for Risk Factory Ltd and emcee of CSX 2016 Europe

[ISACA Now Blog]

Smart entrepreneurs have long employed differential pricing strategies to get more money from customers they think will pay a higher price. Cyber criminals have been doing the same thing on a small scale with ransomware: demanding a larger ransom from individuals or companies flush with cash, or organizations especially sensitive to downtime and service disruptions. But now it appears cyber criminals have figured out how to improve their ROI by attaching basic price discrimination to large-scale, phishing-driven ransomware campaigns. So choosing to pay a ransom could come with an even heftier price tag in the near future.

Personalization made easy: no code required
Typically, a ransom payment amount is provided by a command and control server or is hardcoded into the executable. But Malware Hunter Team recently discovered a new ransomware variant called Fantom that uses the filename to set the size of the ransom demand. A post on the BleepingComputer blog explains that this allows the developer to create various distribution campaigns using the same exact sample, but request different ransom amounts depending on how the distributed file is named—no code changes required. When executed, the ransomware will examine the filename and check if it contains certain substrings. Depending on the matched substrings, it will set the ransom to a particular amount.

Businesses beware
The news is salt in the wound for businesses, which have already been targeted by ransomware at a growing pace with higher price demands. A 2016 Symantec survey found that while consumers account for a slight majority of ransomware attacks today, the long-term trend shows a steady increase in attacks on organizations.

Those most vulnerable? Healthcare and financial organizations, according to a 2016 global ransomware survey by Malwarebytes. Both industries were targeted well above the average 39 percent ransomware penetration rate. Over a one-year period, healthcare organizations were targeted the most at 53 percent penetration, with financial organizations a close second at 51 percent.

And while one-third of ransomware victims face demands of $500 or less, large organizations are being extorted for larger sums. Nearly 60 percent of all enterprise ransomware attacks demanded more than $1,000, and more than 20 percent asked for more than $10,000, according to the Malwarebytes survey.

A highly publicized five-figure ransom was demanded of the Los Angeles-based Hollywood Presbyterian Medical Center in February. A ransomware attack disabled access to the hospital’s network, email and patient data. After 10 days of major disruption, hospital officials paid the $17,000 (40-bitcoin) ransom to get their systems back up. Four months later, the University of Calgary paid $20,000 CDN in bitcoins to get its crippled systems restored.

Now with a new price-discrimination Fantom on the loose, organizations can expect to be held hostage for even higher ransoms in the future.

Susan Richardson

[Cloud Security Alliance Blog]

Geolocation technology has become a mainstay in society, utilized for everything from navigation tools to social media platforms and even online gaming.

The recent Pokémon Go craze has shown just how pervasive location-based apps can be. But despite using the technology on a daily basis, many consumers—and even practitioners—do not have a solid understanding of how geolocation technology works. Just how does Yelp offer you a nearby dinner recommendation or RunKeeper track your daily miles?

ISACA set out to demystify geolocation technology with our new infographic, What Is Geolocation and How Does It Work? The infographic describes the types of data that are collected and how they are used to create accurate results. It also discusses the 3 main uses of geolocation technology, which include:

• Geo-referencing:  finding the physical location of an object relative to a map
• Geo-coding:  searching available types of objects or services by location
• Geo-tagging:  embedding geographic data into an object’s metadata for future reference

For many businesses, use of geolocation and mobile technologies is critical to success. The benefits of using geolocation technology can be realized in many industries, such as manufacturing, retail and financial services. Asset management, content customization and fraud detection are just a few areas where businesses are successfully using location-based technologies.

As with any technology, geolocation does come with its own set of risk. Concerns around privacy, safety and security of data abound. Mitigating the risk associated with geolocation requires a two-pronged approach of technology safeguards on the business end as well as increased awareness from users.
For individuals wanting a deeper dive into geolocation technology, including governance and assurance considerations and strategies for addressing risk, see the ISACA Journal Online-Exclusive article Geolocation: Risk and Benefits.

Betsie Estes, Research Resource Manager, ISACA

[ISACA Now Blog]