Connect with us

Market Research

A Third of Saudi and UAE Employees Think They Have Put Highly Sensitive Data at Risk in the Past 12 Months



Western Digital has released data exploring the attitudes and behaviours of over 634 employees (data users) and employers (data managers) around highly sensitive data in the Middle East. The research found that 77 percent of data managers believe employee behaviour is a bigger threat to their highly sensitive data than external hackers and that almost a third (32 percent) of data security incidents originates with employees.

In summer 2021, Western Digital spoke to 210 managers and 424 data users in Saudi Arabia and the UAE. Respondents work in media and entertainment, the public sector, legal professional services, healthcare and financial services, and in businesses ranging in size from small (10-99 employees) to enterprise (5000+ employees).

Data users are aware of the risks. In fact, 32 percent of data users surveyed think they have put highly sensitive data at risk in the past 12 months. This is further confirmed by just under two-thirds (60 percent) of data managers stating that they have seen security threats and incidents increase over the same time period.

However, data users continue to fall into the trap of using poor security practices, especially when it comes to data sharing and storage. Almost three-quarters (73 percent) of data users have access to data they shouldn’t, this is worrying as 82 percent of data managers think data security could be improved in how they store and transmit highly sensitive data.

Risky Security Practices
Remote and hybrid working styles have become the new norm with 89 per cent of data users claiming that they work on collaborative projects that require data sharing. But, these collaborative and remote ways of working have widened the evolving threat landscape and exposed some major risks. The top five risks cited by data managers are just the tip of the iceberg. Almost two in five (39 per cent) of data users said that they share physical hard disks (HDDs) and solid-state drives (SSDs) with colleagues at work in order to share data. While, 36 per cent of data users admitted to sharing their work devices with family and friends, and 32 per cent admitted to taking sensitive data with them when they left an organisation. 

Sharing Data
There remains a clear gap in employee behaviour between the data sharing method used and their assumption of what the most secure way to share sensitive data is. The most common methods for sharing or transmitting highly sensitive data by employees were email (49 per cent) and cloud or online file sharing (40 per cent), ahead of HDD / SSD (39 per cent) and USB drives (28 per cent). These figures suggest ease of use and familiarity are key factors in the decision-making process for data users when it comes to how to share sensitive data.

However, 93 per cent of data managers want more control over how their data is stored and shared. Coupled with the belief that data security needs immediate improvement, almost two thirds (63 per cent) of data mangers expect to see their use of physical drives (HDDs and SSDs) increasing in the next two years, due to the encryption and security features these technologies can offer. Some features that organisations believe are very important when it comes to using physical drives for highly sensitive data include:

  • Consistent performance and reliability (78 per cent)
  • Encryption (70 per cent)
  • Enhanced control / being able to protect data remotely if the drive is lost or stolen (66 per cent)
  • Large capacity (64 per cent)
  • Improved authentication (61 per cent)

Ultimately, 84 per cent of data managers say HDDs or SSDs with encryption or security features address many of the concerns companies may have had about this technology.

Khwaja Saifuddin, Senior Sales Director for Middle East, Africa & South Asia at Western Digital concluded: “In today’s business environment, increased security risks, employee behaviour and the sheer volume of data produced, can make it difficult for organisations to stay on top of security and storage challenges. As technology advances, employees and employers are looking for ways to store and share sensitive data more securely. The combination of the right infrastructure, integrated with encryption platforms, to store and share sensitive data, and the education of employees of the threats they may be exposing their organisation to will go a long way to improving the threat landscape and reducing risk.”

Country Stats

Saudi Arabia

  • Over a quarter (26 per cent) of data users in Saudi Arabia think they’ve put highly sensitive data at risk in the last 12 months
  • 52 per cent of data managers in Saudi Arabia have seen data security threats and incidents increase in the last 12 months
  • 78 per cent of data managers from Saudi Arabia agree that employee behaviour is a bigger threat to highly sensitive data than external hackers
  • Saudi Arabian data managers estimate that just over a quarter (27 per cent) of security incidents originate from employees. The most common methods for sharing or transmitting highly sensitive data by employees in Saudi Arabia were email (48 per cent), cloud or online file sharing (41 per cent), and HDD / SSD (41 per cent), ahead of USB drives (21 per cent)


  • Over a third (37 per cent) of data users in the UAE think they’ve put highly sensitive data at risk in the last 12 months
  • 69 per cent of data managers in the UAE have seen data security threats and incidents increase in the last 12 months
  • 76 per cent of data managers from the UAE agree that employee behaviour is a bigger threat to highly sensitive data than external hackers
  • Data managers from the UAE estimate that over a third (36 per cent) of security incidents originate from employees. The most common methods for sharing or transmitting highly sensitive data by employees in the UAE were email (50 per cent) and cloud or online file sharing (39 per cent), ahead of HDD / SSD (28 per cent) and USB drives (24 per cent)

Market Research

Trellix Predicts Heightened Hacktivism and Geopolitical Cyberattacks in 2023



Trellix has released its annual threat predictions report for 2023. Forecasts from the Trellix Advanced Research Center anticipate spikes in geopolitically motivated attacks across Asia and Europe, hacktivism fueled by tensions from opposing political parties, and vulnerabilities in core software supply chains. “Analysing current trends is necessary but being predictive in cybersecurity is vital. While organizations focus on near-term threats, we advise all to look beyond the horizon to ensure a proactive posture,” said John Fokker, Head of Threat Intelligence, Trellix. “Global political events and the adoption of new technology will breed novel threats from more innovative threat actors.”

The Trellix Advanced Research Center brings together hundreds of the world’s most skilled security analysts and researchers to serve the global threat intelligence community and organizations with the latest threat indicators and insights collected from Trellix’s extensive sensor network. Trellix Advanced Research Center forecasts the following threats in 2023:

  • Geopolitics and grey-zone conflict. Geopolitical factors will continue to be a high motivation for misinformation campaigns and cyberattacks timed with kinetic military activity.
  • Hacktivism takes center stage. As groups of loosely organized individuals fueled by propaganda align for a common cause, they will ramp up their use of cyber tools to voice their anger and cause disruption across the globe.
  • Skeletons in the software closet will multiply. Both threat actors and security researchers will heighten their study of underlying software frameworks and libraries resulting in an increase in breaches related to software supply chain issues.
  • Increasing activity by teen cybercriminals. Teens and young adults will engage at increasing levels in cybercrime – everything from large-scale attacks on enterprises and governments to low-level crimes that target family, friends, peers, and strangers.
  • Declining accuracy of code-based attribution. The outsourcing of malware creation and operation, diversification of malware development, and use of leaked source code will make attribution of cyberthreats to specific threat actors increasingly challenging.
  • Imminent global cyberthreat to critical infrastructure as cyberwarfare evolves. A significant rise in advanced cyberactors causing disruptions to critical infrastructure in vulnerable targets will be observed.
  • With more collaboration comes more phishing. Weaponised phishing attacks will increase across commonly used business communication services and apps, like Microsoft Teams, Slack, and others.
  • “Alexa, start mining bitcoins.”The advanced capabilities of consumer and enterprise IoT devices will be leveraged by hackers to mine cryptocurrencies.
  • Space hacking: only going up from here. The compromise of satellites and other space assets will increase and become more public in 2023.
  • Here’s my number, so call me, maybe. There will be a huge jump in reverse vishing – or voice phishing – attacks, with fewer tech-aware users being the primary target.
  • Attacks against the Windows domain will scale. More domain privilege escalation vulnerabilities will be discovered as well as more real-world attacks against Microsoft Windows with the explicit goal of complete network takeover.

“We started 2022 with an industry-wide vulnerability in Log4J, which was closely followed by cyber and physical war targeting Ukraine. We’re closing the year observing hacktivists taking matters into their own hands, new actors in operation, and a changed but increasingly active ransomware landscape. As stress continues to weigh on the global economy, as we head into the new year, organizations should expect increased activity from threat actors looking to advance their own agenda – whether for political or financial gain,” commented Vibin Shaju, VP EMEA, Solutions Engineering, Trellix. “To outwit and outpace bad actors and advance defenses proactively, security must be always-on and always learning.”

Continue Reading

Market Research

North Korea-Linked Group Launches Dolphin Backdoor: ESET Research



ESET researchers analyzed a previously unreported sophisticated backdoor used by the ScarCruft APT group. The backdoor, which ESET named Dolphin, has a wide range of spying capabilities, including monitoring drives and portable devices, exfiltrating files of interest, keylogging, taking screenshots, and stealing credentials from browsers. Its functionality is reserved for selected targets, to which the backdoor is deployed after the initial compromise using less advanced malware. Dolphin abuses cloud storage services — specifically Google Drive — for Command and Control communication.

ScarCruft, also known as APT37 or Reaper, is an espionage group that has been operating since at least 2012. It primarily focuses on South Korea, but other Asian countries have also been targeted. ScarCruft seems to be interested mainly in government and military organizations, and companies in various industries linked to the interests of North Korea.

“After being deployed on selected targets, it searches the drives of compromised systems for interesting files and exfiltrates them to Google Drive. One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims’ Google and Gmail accounts to lower their security, presumably to maintain Gmail account access for the threat actors,” says ESET researcher Filip Jurčacko, who analyzed the Dolphin backdoor.

In 2021, ScarCruft conducted a watering-hole attack on a South Korean online newspaper focused on North Korea. The attack consisted of multiple components, including an Internet Explorer exploit and shellcode leading to a backdoor named BLUELIGHT.

“In the previous reports, the BLUELIGHT backdoor was described as the attack’s final payload. However, when analyzing the attack, we discovered through ESET telemetry a second, more sophisticated backdoor deployed on selected victims via this first backdoor. We named this backdoor Dolphin based on a PDB path found in the executable,” explains Jurčacko.

Since the initial discovery of Dolphin in April 2021, ESET researchers have observed multiple versions of the backdoor, in which the threat actors improved the backdoor’s capabilities and made attempts to evade detection.

While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims. Both backdoors are capable of exfiltrating files from a path specified in a command, but Dolphin also actively searches drives and automatically exfiltrates files with interesting extensions.

The backdoor collects basic information about the targeted machine, including the operating system version, malware version, list of installed security products, username, and computer name. By default, Dolphin searches all fixed (HDD) and non-fixed drives (USBs), creates directory listings, and exfiltrates files by extension. Dolphin also searches portable devices, such as smartphones, via the Windows Portable Device API. The backdoor also steals credentials from browsers, and is capable of keylogging and taking screenshots. Finally, it stages this data in encrypted ZIP archives before uploading it to Google Drive.

Continue Reading

Market Research

Kingston Reiterates the Role of Encrypted Hardware in Mobile Healthcare Data Security



Kingston Technology Europe has emphasised the importance of hardware-based encryption in strengthening mobile healthcare data protection efforts across the globe. The company made the statement as data breaches remain one of the biggest digital threats within the healthcare industry, thereby raising the need for stronger data security protocols and stringent compliance with relevant policies.

The average total cost of a healthcare data breach worldwide rose by almost $1 million to reach $10.10 million in 2022, according to IBM Security analysis of research data compiled by Ponemon Institute. Healthcare breach costs have been the most expensive industry for 12 consecutive years, increasing by 41.6% since the 2020 report.

Kingston maintained that hardware encryption can help bridge gaps by providing a fortified layer of data protection through an encryption process designed to be unbreakable or hard to intercept. Whether stored or transported, the medical data saved in encrypted hardware devices such as USBs can be accessed only through authentication codes set by authorised individuals.

The encryption feature is also separate from any PC, mobile phone, or network systems to keep the data out of reach in the event cybercriminal breaks into the gadgets or online networks. Security is also assured even if the encrypted device ends up being misplaced, lost, or stolen. “Encrypted drives such as IronKey encrypted USBs are made to keep the data from falling into the wrong hands. Many are equipped with top-notch features that can also detect and respond to physical tampering and provide automatic data protection upon drive removal for added peace of mind,” said Antoine Harb, the Team Leader for Middle East and North Africa at Kingston Technology.

“Such capabilities are vital given that human error is considered one of the common causes of data breaches. One recent example took place in Japan where a worker reportedly lost a memory stick that contained the personal data of all residents of a Japanese city after a night out. The data had been encrypted and password-protected, preventing unauthorized access, Hardware-based encryption not only offers strong and reliable protection but is also a practical and easy-to-use approach to safeguarding private healthcare-related information,” added Harb.

According to Harb, it offers out-of-the-box cybersecurity measures minus the need for regular updates like those required in the software-based encryption processes. “Cybercrimes are on the rise worldwide, resulting in astronomical financial and reputational costs. In the Middle East, IBM Security reported that the region had the second highest average total data breach cost reaching $7.46 million in 2022 from $6.93 million last year,” the company said.

Among other factors, the Middle Eastern countries’ financial and economic status has been cited as one of the main reasons behind the online network attacks. In the Gulf region, the attacks on Dubai-based NHS Moorfield Hospital and GlobeMed Saudi were considered one of the top breaches in the UAE and Saudi Arabia, respectively.

Calls for improved data security levels are, therefore, mounting. Across the globe, laws, and regulations, including the General Data Protection Regulation, have already been enforced for a higher level of data privacy and security. In the UAE, the government has also imposed strict compliance of healthcare providers with its Health Data Law. “We can only expect that online network intrusions will grow and become even more sophisticated and bold as the world transitions to an ultra-connected society. Implementing or using encrypted devices is an important cybersecurity protocol that both individuals and corporations can adopt for stronger and easier-to-use data protection. Understanding one’s needs and, in the case of healthcare providers, knowing the importance of protecting the patients’ private mobile data, among others, play an important role in choosing the right encrypted hardware,” Harb added.

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.