Connect with us

Market Research

Digital Transformation and Workplace Evolution Driving Demand for PKI and Digital Certificates

Published

on

Driven by organizational changes, enterprise use of Public Key Infrastructure (PKI) and digital certificates has never been higher, while the related skills to manage PKI are in historically short supply, according to research from Ponemon Institute, sponsored by Entrust, a global leader in trusted identity, payments and data protection. The 2021 Global PKI and IoT Trends Study also revealed that IT professionals continue to see a lack of clear ownership, resources, and skills as the top challenges in deploying and managing PKI.

PKI is at the core of nearly every IT infrastructure, enabling security for critical digital initiatives such as cloud, mobile device deployment, identities, and the internet of things (IoT). As such, PKI holds the key to enabling the digital transformation that these technologies underpin, something that has been thrown into sharp focus over the course of the global pandemic and its impact on working practices.

Drivers and challenges of PKI adoption
When it comes to the most important trends driving the deployment of applications using PKI in the Middle East market, the Internet of Things (IoT) remains the fastest-growing trend at 46%, with consumer mobile applications being the second-highest driver, cited by 44% of respondents, and Cloud-Based services coming in third at 37%. The top challenge that impedes the deployment and management of PKI is a lack of clear ownership – cited by 84% of respondents in the Middle East. Globally, respondents have raised this issue as a top challenge for the past 5 years, indicating a key area of concern for many enterprises.

Insufficient resources and insufficient skills were rated as the second and third challenges in the Middle East at 57% and 53% respectively. Similarly, on a global level, the top challenges to enabling applications to utilize PKI were the existing PKI being incapable of supporting new applications (55%) and insufficient skills (46%). The areas expected to experience the most change and uncertainty according to respondents in the Middle East were external mandates and standards, which took the top spot for 30% of those surveyed, while newer applications, such the Internet of Things (IoT) came second (28%).

“PKI has never been in such high demand in the Middle East region – whether from the pressure of securing a remote or hybrid workforce this past year, or the continued growth of IoT and cloud-based services,” said Hamid Qureshi, Regional Sales Director, Middle East, Africa, and South Asia at Entrust. “At the same time, the skills and resources required to deploy and manage PKI continue to be in short supply – an issue exacerbated by lack of clear organizational ownership over PKI deployments. To deal with this complexity, organizations need a strategy first and products second to support this transformation. This means that they need a partner like Entrust who not only has the technological capabilities, but the heritage and expertise to help succeed in this environment.”

“Over the years we have been doing this study, it is clear that that the gap between the rising demand for PKI adoption and the challenges hindering it appear to be growing,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “This has the potential to exacerbate the headaches organizations already feel and create gaps in their security postures. When you factor in that environments are more distributed with remote working, cloud and IoT, it’s clear that there’s an immediate need for many organizations to gain additional visibility, automation and centralized control.”

The Rise of Machine Identities
TLS/SSL certificates for public-facing websites and services are the most often cited use case for PKI credentials (81% of respondents globally). Private networks and VPN applications came in second (67%, up from 60% in 2020) and email security was third (55%, up from 51% in 2020), overtaking last year’s second and third positions of public cloud applications and enterprise user authentication. This change highlights the shifting focus on ensuring remote workers and distributed IT workloads can be kept secure.

The research also revealed that the average number of certificates organizations issue or acquire is still on the rise, up 4.3% from 56,192 in 2020 to 58,639 this year (and up 50% since 2019). While the number of human identities being secured has been relatively flat over the past few years, there are now more machine identities (devices and workflows) than human ones. This growth in machine identities is primarily driven by the growing use of IoT, cloud services, and new applications.

Regardless of the reason for the growth, the more certificates an organization needs to manage, the more critical proper management becomes. With one in five (20%) of respondents stating they use a manual certificate revocation list and nearly a third (32%) admitting they have no certificate revocation technique, these organizations risk being vulnerable to attacks and facing outages to critical systems and the consequent business disruption and cost that comes with that.

Cyber Security

The Rising Risk of Ransomware Attacks on Organisations and How to Mitigate it

Published

on

According to the 2022 SonicWall Cyber Threat Report, “ransomware volume increased 105% year over year and is up 232% since 2019.” With the risk of ransomware attacks continuing to rise, it’s crucial to shield your organization from these attacks to avoid unwanted financial fallout.

Ransomware attacks commonly target an organization’s file servers and databases using malicious code to encrypt files such as documents, images, and videos on the system. Ransomware can also be programmed to find vulnerabilities on the network and use these to spread to other systems in an organization. Ransomware attacks are typically executed through social engineering like widespread phishing attacks, but cybercriminals can also specifically target a certain entity, sometimes a popular one. These attacks have the potential to cripple an entire organization’s database.

Once encrypted by ransomware, files are almost impossible to retrieve without the decryption key. To get this key, the victim is demanded to pay a ransom—often millions of dollars—within a short timeframe, usually 24 to 48 hours. If the victim organization keeps a backup of its files, then it’ll be able to restore those files and avoid paying the ransom. If not, the organization often has no option but to pay the ransom.

However, if you fall victim to a ransomware attack, it’s strongly recommended that you don’t pay the ransom to regain access to your encrypted files. This is because you are relying on the integrity of a cybercriminal. The cybercriminal may not give you the decryption key after the transaction or, even worse, they may continue to target your organization and repeatedly demand higher ransoms now that they know you’re willing to pay.

In recent years, it has become much easier to develop ransomware, resulting in the continued rise in ransomware attacks. Cybercriminals can develop and execute a ransomware attack with readily available open-source code and with easy-to-use drag-and-drop platforms. It is also hard to track these cybercriminals because transactions involving ransomware are commonly made using cryptocurrency.

Ransomware attacks can result in exploitation and loss of your organization’s critical and confidential data. But there are steps you can take to prevent and mitigate these attacks.

Back-Up Your Data
Take regular backups of all your files and data; this way, even if your system is infected, you can erase the infected files and recover them using your backups. This cannot prevent a ransomware attack, but it can mitigate the risk of losing all your data.

Keep Your System and Software Up-to-Date
Maintain a healthy patching routine. This includes updating your software as soon as possible when patches for security vulnerabilities are released by vendors. To keep your device secure from ransomware attacks, use a security solution that can identify these attacks at their earliest stages and mitigate their impact.

Be Careful Where You Click
Beware of social engineering attacks and email scams, and avoid downloading files from untrusted sources as these can result in your system being exploited by malicious software like ransomware. What makes social engineering attacks so dangerous is that they take advantage of human error rather than system vulnerabilities.

Create Awareness Among Employees About Ransomware Attacks
Since human error is a major vector cybercriminal manipulate to carry out ransomware attacks, it is essential to educate and train employees on social engineering and email phishing attacks to effectively secure your organization against them.

ManageEngine’s security information and event management (SIEM) solutions protect your enterprise network from cyberattacks and insider threats. SIEM solutions collect and analyze the security data generated by your devices in real-time, alerting you about vulnerabilities, indicators of compromise, and any suspicious activity to help you mitigate the risk of ransomware attacks.

Continue Reading

Cyber Security

Ransomware Hit 59% of UAE Organizations Surveyed for Sophos’ Annual “State of Ransomware 2022”

Published

on

Sophos has released its annual international survey and review of real-world ransomware experiences in the State of Ransomware 2022. The report shows that 59% of UAE organizations surveyed were hit with ransomware in 2021, up from 38% in 2020.

The report summarizes the impact of ransomware on 5,600 mid-sized organizations in 31 countries across Europe, the Americas, Asia-Pacific, and Central Asia, the Middle East, and Africa. The main findings for the UAE in the State of Ransomware 2022 global survey, which covers ransomware incidents experienced during 2021, as well as related cyber insurance issues, include:

  • Many organizations rely on cyber insurance to help them recover from a ransomware attack – 85% of mid-sized organizations had cyber insurance that covers them in the event of a ransomware attack – and, in 100% of incidents, the insurer paid some or all the costs incurred.
  • Ninety-eight percent of those with cyber insurance said that their experience of getting it has changed over the last 12 months, with higher demands for cybersecurity measures, more complex or expensive policies, and fewer organizations offering insurance protection.

“The findings suggest we may have reached a peak in the evolutionary journey of ransomware, where attackers’ greed for ever higher ransom payments is colliding head-on with a hardening of the cyber insurance market as insurers increasingly seek to reduce their ransomware risk and exposure,” said Wisniewski. “In recent years, it has become increasingly easy for cybercriminals to deploy ransomware, with almost everything available as-a-service. Second, many cyber insurance providers have covered a wide range of ransomware recovery costs, including the ransom, likely contributing to ever higher ransom demands. However, the results indicate that cyber insurance is getting tougher and in the future ransomware victims may become less willing or less able to pay sky-high ransoms. Sadly, this is unlikely to reduce the overall risk of a ransomware attack. Ransomware attacks are not as resource intensive as some other, more hand-crafted cyberattacks, so any return is a return worth grabbing and cybercriminals will continue to go after the low hanging fruit.”

Sophos recommends the following best practices to help defend against ransomware and related cyberattacks:

  1. Install and maintain high-quality defenses across all points in the organization’s environment. Review security controls regularly and make sure they continue to meet the organization’s needs.
  2. Proactively hunt for threats to identify and stop adversaries before they can execute their attack – if the team lacks the time or skills to do this in house, outsource to a Managed Detection and Response (MDR) specialist.
  3. Harden the IT environment by searching for and closing key security gaps: unpatched devices, unprotected machines, open RDP ports, etc. Extended Detection and Response (XDR) solutions are ideal for this purpose.
  4. Prepare for the worst. Know what to do if a cyber incident occurs and keep the plan updated.
  5. Make backups, and practice restoring from them so that the organization can get back up and running as soon as possible, with minimum disruption.
Continue Reading

Cyber Security

Cybersecurity Skills Gap Contributed to 80 Percent of Breaches: Fortinet Report

Published

on

Fortinet has released its 2022 Cybersecurity Skills Gap Report. The new global report reveals that the cybersecurity skills shortage continues to have multiple challenges and repercussions for organizations, including the occurrence of security breaches and subsequently loss of money. As a result, the skills gap remains a top concern for C-level executives and is increasingly becoming a board-level priority. The report also suggests ways the skills gap can be addressed, such as through training and certifications to increase employees’ education.

Sandra Wheatley, SVP Marketing, Threat Intelligence, and Influencer Communications at Fortinet says, “According to the Fortinet report released today, the skills gap isn’t just a talent shortage challenge, but it’s also severely impacting business, making it a top concern for executive leaders worldwide. Through Fortinet’s Training Advancement Agenda (TAA) and Training Institute programs, we are committed to tackling the challenges revealed in the report through various initiatives, including programs focused on cybersecurity certifications and recruiting more women into cyber. As part of this commitment, Fortinet has pledged to train 1 million professionals to increase cyber skills and awareness and make a dent in the skills gap by 2026.”

The Widespread Global Impact of the Cybersecurity Skills Shortage
According to (ISC)2’s 2021 Cyber Workforce Report, the global cybersecurity workforce needs to grow 65 percent to effectively defend organizations’ critical assets. While the number of professionals needed to fill the gap has decreased from 3.12 million down to 2.72 million in the past year, this is still a significant void that leaves organizations vulnerable.

Fortinet’s report demonstrates multiple risks resulting from the cybersecurity skills gap. Most notably, 8 in 10 organizations surveyed have suffered at least one breach they could attribute to a lack of cybersecurity skills or awareness. The survey also showed that globally 64 percent of organizations experienced breaches that resulted in the loss of revenue, recovery costs and/or fines.

Given the increasing costs of breaches on organizations’ profits and reputation, cybersecurity is becoming more of a board-level priority. Globally, 88 percent of organizations that have a board of directors reported that their board asks questions specifically about cybersecurity. And 76 percent of organizations have a board of directors who has recommended increases in IT and cybersecurity headcount.

Advancing Cybersecurity Skills Through Training and Certifications
Fortinet’s skills gap report demonstrated that training and certifications are critical ways organizations seek to further tackle the skills gap. The report revealed that 95 percent of leaders believe technology-focused certifications positively impact their role and their team, while 81 percent of leaders prefer to hire people with certifications. Additionally, 91 percent of respondents shared they are willing to pay for an employee to achieve cyber certifications. One major reason for certifications being highly regarded is due to their validation of increased cybersecurity knowledge and awareness.

In addition to valuing certifications, 87 percent of organizations have implemented a training program to increase cyber awareness. However, 52 percent of leaders believe their employees still lack the necessary knowledge, which raises questions about how effective their current security awareness programs are. For organizations looking for security awareness training, Fortinet offers a Security Awareness and Training service through the award-winning Fortinet Training Institute. The service further protects organizations’ critical digital assets from cyber threats by building employee cybersecurity awareness. This service receives updates from Fortinet’s FortiGuard Labs threat intelligence so that employees are learning and keeping up with the latest evolving cyberattack methods to prevent company breaches and risks from being introduced.

Addressing Recruitment and Retention Challenges with Diversity Commitments
A significant challenge for organizations has been finding and retaining the right people to fill critical security roles ranging from cloud security specialists to SOC analysts. The report found that 60 percent of leaders admit their organization struggles with recruitment and 52 percent struggle to retain talent.

Among hiring challenges is the recruitment of women, new college graduates, and minorities. Globally, 7 out of 10 leaders see the recruitment of women and new graduates as a top hiring hurdle and 61 percent said hiring minorities has been challenging. As organizations look to build more capable and more diverse teams, 89 percent of global companies have explicit diversity goals as part of their hiring strategy according to the report. The report also demonstrated that 75 percent of organizations have formal structures to specifically recruit more women and 59 percent have strategies in place to hire minorities. Additionally, 51 percent of organizations have efforts in place to hire more veterans.

Continue Reading
Advertisement


Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.