Connect with us

Market Research

Digital Transformation and Workplace Evolution Driving Demand for PKI and Digital Certificates

Published

on

Driven by organizational changes, enterprise use of Public Key Infrastructure (PKI) and digital certificates has never been higher, while the related skills to manage PKI are in historically short supply, according to research from Ponemon Institute, sponsored by Entrust, a global leader in trusted identity, payments and data protection. The 2021 Global PKI and IoT Trends Study also revealed that IT professionals continue to see a lack of clear ownership, resources, and skills as the top challenges in deploying and managing PKI.

PKI is at the core of nearly every IT infrastructure, enabling security for critical digital initiatives such as cloud, mobile device deployment, identities, and the internet of things (IoT). As such, PKI holds the key to enabling the digital transformation that these technologies underpin, something that has been thrown into sharp focus over the course of the global pandemic and its impact on working practices.

Drivers and challenges of PKI adoption
When it comes to the most important trends driving the deployment of applications using PKI in the Middle East market, the Internet of Things (IoT) remains the fastest-growing trend at 46%, with consumer mobile applications being the second-highest driver, cited by 44% of respondents, and Cloud-Based services coming in third at 37%. The top challenge that impedes the deployment and management of PKI is a lack of clear ownership – cited by 84% of respondents in the Middle East. Globally, respondents have raised this issue as a top challenge for the past 5 years, indicating a key area of concern for many enterprises.

Insufficient resources and insufficient skills were rated as the second and third challenges in the Middle East at 57% and 53% respectively. Similarly, on a global level, the top challenges to enabling applications to utilize PKI were the existing PKI being incapable of supporting new applications (55%) and insufficient skills (46%). The areas expected to experience the most change and uncertainty according to respondents in the Middle East were external mandates and standards, which took the top spot for 30% of those surveyed, while newer applications, such the Internet of Things (IoT) came second (28%).

“PKI has never been in such high demand in the Middle East region – whether from the pressure of securing a remote or hybrid workforce this past year, or the continued growth of IoT and cloud-based services,” said Hamid Qureshi, Regional Sales Director, Middle East, Africa, and South Asia at Entrust. “At the same time, the skills and resources required to deploy and manage PKI continue to be in short supply – an issue exacerbated by lack of clear organizational ownership over PKI deployments. To deal with this complexity, organizations need a strategy first and products second to support this transformation. This means that they need a partner like Entrust who not only has the technological capabilities, but the heritage and expertise to help succeed in this environment.”

“Over the years we have been doing this study, it is clear that that the gap between the rising demand for PKI adoption and the challenges hindering it appear to be growing,” said Dr. Larry Ponemon, chairman and founder of the Ponemon Institute. “This has the potential to exacerbate the headaches organizations already feel and create gaps in their security postures. When you factor in that environments are more distributed with remote working, cloud and IoT, it’s clear that there’s an immediate need for many organizations to gain additional visibility, automation and centralized control.”

The Rise of Machine Identities
TLS/SSL certificates for public-facing websites and services are the most often cited use case for PKI credentials (81% of respondents globally). Private networks and VPN applications came in second (67%, up from 60% in 2020) and email security was third (55%, up from 51% in 2020), overtaking last year’s second and third positions of public cloud applications and enterprise user authentication. This change highlights the shifting focus on ensuring remote workers and distributed IT workloads can be kept secure.

The research also revealed that the average number of certificates organizations issue or acquire is still on the rise, up 4.3% from 56,192 in 2020 to 58,639 this year (and up 50% since 2019). While the number of human identities being secured has been relatively flat over the past few years, there are now more machine identities (devices and workflows) than human ones. This growth in machine identities is primarily driven by the growing use of IoT, cloud services, and new applications.

Regardless of the reason for the growth, the more certificates an organization needs to manage, the more critical proper management becomes. With one in five (20%) of respondents stating they use a manual certificate revocation list and nearly a third (32%) admitting they have no certificate revocation technique, these organizations risk being vulnerable to attacks and facing outages to critical systems and the consequent business disruption and cost that comes with that.

Market Research

Trellix Predicts Heightened Hacktivism and Geopolitical Cyberattacks in 2023

Published

on

Trellix has released its annual threat predictions report for 2023. Forecasts from the Trellix Advanced Research Center anticipate spikes in geopolitically motivated attacks across Asia and Europe, hacktivism fueled by tensions from opposing political parties, and vulnerabilities in core software supply chains. “Analysing current trends is necessary but being predictive in cybersecurity is vital. While organizations focus on near-term threats, we advise all to look beyond the horizon to ensure a proactive posture,” said John Fokker, Head of Threat Intelligence, Trellix. “Global political events and the adoption of new technology will breed novel threats from more innovative threat actors.”

The Trellix Advanced Research Center brings together hundreds of the world’s most skilled security analysts and researchers to serve the global threat intelligence community and organizations with the latest threat indicators and insights collected from Trellix’s extensive sensor network. Trellix Advanced Research Center forecasts the following threats in 2023:

  • Geopolitics and grey-zone conflict. Geopolitical factors will continue to be a high motivation for misinformation campaigns and cyberattacks timed with kinetic military activity.
  • Hacktivism takes center stage. As groups of loosely organized individuals fueled by propaganda align for a common cause, they will ramp up their use of cyber tools to voice their anger and cause disruption across the globe.
  • Skeletons in the software closet will multiply. Both threat actors and security researchers will heighten their study of underlying software frameworks and libraries resulting in an increase in breaches related to software supply chain issues.
  • Increasing activity by teen cybercriminals. Teens and young adults will engage at increasing levels in cybercrime – everything from large-scale attacks on enterprises and governments to low-level crimes that target family, friends, peers, and strangers.
  • Declining accuracy of code-based attribution. The outsourcing of malware creation and operation, diversification of malware development, and use of leaked source code will make attribution of cyberthreats to specific threat actors increasingly challenging.
  • Imminent global cyberthreat to critical infrastructure as cyberwarfare evolves. A significant rise in advanced cyberactors causing disruptions to critical infrastructure in vulnerable targets will be observed.
  • With more collaboration comes more phishing. Weaponised phishing attacks will increase across commonly used business communication services and apps, like Microsoft Teams, Slack, and others.
  • “Alexa, start mining bitcoins.”The advanced capabilities of consumer and enterprise IoT devices will be leveraged by hackers to mine cryptocurrencies.
  • Space hacking: only going up from here. The compromise of satellites and other space assets will increase and become more public in 2023.
  • Here’s my number, so call me, maybe. There will be a huge jump in reverse vishing – or voice phishing – attacks, with fewer tech-aware users being the primary target.
  • Attacks against the Windows domain will scale. More domain privilege escalation vulnerabilities will be discovered as well as more real-world attacks against Microsoft Windows with the explicit goal of complete network takeover.

“We started 2022 with an industry-wide vulnerability in Log4J, which was closely followed by cyber and physical war targeting Ukraine. We’re closing the year observing hacktivists taking matters into their own hands, new actors in operation, and a changed but increasingly active ransomware landscape. As stress continues to weigh on the global economy, as we head into the new year, organizations should expect increased activity from threat actors looking to advance their own agenda – whether for political or financial gain,” commented Vibin Shaju, VP EMEA, Solutions Engineering, Trellix. “To outwit and outpace bad actors and advance defenses proactively, security must be always-on and always learning.”

Continue Reading

Market Research

North Korea-Linked Group Launches Dolphin Backdoor: ESET Research

Published

on

ESET researchers analyzed a previously unreported sophisticated backdoor used by the ScarCruft APT group. The backdoor, which ESET named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices, exfiltrating files of interest, keylogging, taking screenshots, and stealing credentials from browsers. Its functionality is reserved for selected targets, to which the backdoor is deployed after the initial compromise using less advanced malware. Dolphin abuses cloud storage services — specifically Google Drive — for Command and Control communication.

ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012. It primarily focuses on South Korea, but other Asian countries have also been targeted. ScarCruft seems to be interested mainly in government and military organizations, and companies in various industries linked to the interests of North Korea.

“After being deployed on selected targets, it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive. One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims’ Google and Gmail accounts to lower their security, presumably to maintain Gmail account access for the threat actors,” says ESET researcher Filip Jurčacko, who analyzed the Dolphin backdoor.

In 2021, ScarCruft conducted a watering-hole attack on a South Korean online newspaper focused on North Korea. The attack consisted of multiple components, including an Internet Explorer exploit and shellcode leading to a backdoor named BLUELIGHT.

“In the previous reports, the BLUELIGHT backdoor was described as the attack’s final payload. However, when analyzing the attack, we discovered through ESET telemetry a second, more sophisticated backdoor deployed on selected victims via this first backdoor. We named this backdoor Dolphin based on a PDB path found in the executable,” explains Jurčacko.

Since the initial discovery of Dolphin in April 2021, ESET researchers have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.

While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims. Both backdoors are capable of exfiltrating files from a path specified in a command, but Dolphin also actively searches drives and automatically exfiltrates files with interesting extensions.

The backdoor collects basic information about the targeted machine, including the operating system version, malware version, list of installed security products, username, and computer name. By default, Dolphin searches all fixed (HDD) and non-fixed drives (USBs), creates directory listings, and exfiltrates files by extension. Dolphin also searches portable devices, such as smartphones, via the Windows Portable Device API. The backdoor also steals credentials from browsers, and is capable of keylogging and taking screenshots. Finally, it stages this data in encrypted ZIP archives before uploading it to Google Drive.

Continue Reading

Market Research

Kingston Reiterates the Role of Encrypted Hardware in Mobile Healthcare Data Security

Published

on

Kingston Technology Europe has emphasised the importance of hardware-based encryption in strengthening mobile healthcare data protection efforts across the globe. The company made the statement as data breaches remain one of the biggest digital threats within the healthcare industry, thereby raising the need for stronger data security protocols and stringent compliance with relevant policies.

The average total cost of a healthcare data breach worldwide rose by almost $1 million to reach $10.10 million in 2022, according to IBM Security analysis of research data compiled by Ponemon Institute. Healthcare breach costs have been the most expensive industry for 12 consecutive years, increasing by 41.6% since the 2020 report.

Kingston maintained that hardware encryption can help bridge gaps by providing a fortified layer of data protection through an encryption process designed to be unbreakable or hard to intercept. Whether stored or transported, the medical data saved in encrypted hardware devices such as USBs can be accessed only through authentication codes set by authorised individuals.

The encryption feature is also separate from any PC, mobile phone, or network systems to keep the data out of reach in the event cybercriminal breaks into the gadgets or online networks. Security is also assured even if the encrypted device ends up being misplaced, lost, or stolen. “Encrypted drives such as IronKey encrypted USBs are made to keep the data from falling into the wrong hands. Many are equipped with top-notch features that can also detect and respond to physical tampering and provide automatic data protection upon drive removal for added peace of mind,” said Antoine Harb, the Team Leader for Middle East and North Africa at Kingston Technology.

“Such capabilities are vital given that human error is considered one of the common causes of data breaches. One recent example took place in Japan where a worker reportedly lost a memory stick that contained the personal data of all residents of a Japanese city after a night out. The data had been encrypted and password-protected, preventing unauthorized access, Hardware-based encryption not only offers strong and reliable protection but is also a practical and easy-to-use approach to safeguarding private healthcare-related information,” added Harb.

According to Harb, it offers out-of-the-box cybersecurity measures minus the need for regular updates like those required in the software-based encryption processes. “Cybercrimes are on the rise worldwide, resulting in astronomical financial and reputational costs. In the Middle East, IBM Security reported that the region had the second highest average total data breach cost reaching $7.46 million in 2022 from $6.93 million last year,” the company said.

Among other factors, the Middle Eastern countries’ financial and economic status has been cited as one of the main reasons behind the online network attacks. In the Gulf region, the attacks on Dubai-based NHS Moorfield Hospital and GlobeMed Saudi were considered one of the top breaches in the UAE and Saudi Arabia, respectively.

Calls for improved data security levels are, therefore, mounting. Across the globe, laws, and regulations, including the General Data Protection Regulation, have already been enforced for a higher level of data privacy and security. In the UAE, the government has also imposed strict compliance of healthcare providers with its Health Data Law. “We can only expect that online network intrusions will grow and become even more sophisticated and bold as the world transitions to an ultra-connected society. Implementing or using encrypted devices is an important cybersecurity protocol that both individuals and corporations can adopt for stronger and easier-to-use data protection. Understanding one’s needs and, in the case of healthcare providers, knowing the importance of protecting the patients’ private mobile data, among others, play an important role in choosing the right encrypted hardware,” Harb added.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.