Connect with us

Market Research

Building Trust Through Cybersecurity and Privacy



KPMG has released its “Cyber trust insights 2022” report that analyses the five crucial steps to building trust through cybersecurity and privacy. The report surveyed 1,881 executives and conducted a series of discussions with corporate leaders and professionals worldwide to explore the extent to which the C-suite recognizes this, how they are meeting the challenge and what they need to do next. 

KPMG says it has identified five crucial steps toward building trust through cybersecurity:

  1. Treat cyber and privacy as a golden thread woven into the business
  2. Build internal alliances
  3. Reimagine the Chief Information Security Officer (CISO role
  4. Secure leadership support
  5. Reach out to the ecosystem 

Emerging technologies such as distributed ledger technology (DLT), quantum computing, 5G networks, artificial intelligence (AI)/machine learning (ML), and augmented and virtual reality are developing rapidly and promise to transform how businesses operate. However, the successful rollout of future applications (connected economy, smart systems, NFT, metaverse, etc.) that rely on these technologies will likely be governed by an organization’s ability to instill trust across multiple dimensions. This means embedding security and privacy controls with transparency, reliability, and integrity, the report said. 

Organizations know they must become data-driven or risk irrelevance. Many are scaling AI to automate data-driven decision-making, but AI brings new risks to brands and profitability. The technology has the potential to drive inequality and violate privacy, as well as limit the capacity for autonomous and individual decision-making. 

“You can’t simply blame the AI system itself for unwanted outcomes. Trustworthy, ethical AI is not a luxury, but a business necessity. Growing numbers of business leaders recognize thisbut trust is not secured without effort or challenges,” stated Ton Diemont, Head of Cybersecurity and Data Privacy at KPMG in Saudi Arabia and the Levant.

He stated that trustworthy AI can only be achieved with a holistic, technology-agnostic, and broadly endorsed approach to awareness, AI governance, and risk management. Globally, the growth of cybersecurity and privacy regulation is accelerating. More than 137 countries now have some form of data-protection regime, often claiming extra-territorial jurisdiction over services offered in the country or the data of citizens of that country. 

More mature privacy regimes are moving into the second generation of regulation while confronting new privacy challenges driven by technology adoption, Diemont said, indicating discussions about the regulation of AI are now being formalized in the draft legislation. In addition, countries are implementing increasingly strict critical infrastructure cybersecurity regulations as concerns grow around attacks on industrial control systems. These regulations move from self-assessment to more directive control frameworks, including mandatory incident reporting and external audits. 

Regulators are also being more prescriptive in their control frameworks, while also seeking to reinforce the independence of the CISO and their role in setting internal control standards, the report stated. Corporate requirements for transparency over cyber risks are under debate, along with growing requirements for the disclosure of ransomware incidents. Companies should invest in automating compliance monitoring and reporting; maintain a regulatory watch, and consider privacy and security regulatory trends when developing new services and products, advised Diemont. 

Organisations embracing the ESG agenda can earn their customers’ trust and reinforce their brands’ strength. In today’s digital world, boardrooms, investors, regulators, customers, and the wider public expect transparent reporting on the organization’s cybersecurity and privacy posture. Stakeholders want to feel confident that boards and executives appreciate the social implications of striving to ensure the resilience and integrity of critical services while protecting the information they hold in trust. 

In the KPMG Cyber trust insights 2022 survey, almost half of the respondents (44 percent) say that collaboration on cybersecurity across the broader ecosystem will help them anticipate attacks. Although collaboration may be desirable, it’s not always straightforward. More than one-third of respondents (38 percent) say that privacy concerns stand in the way of external cybersecurity partnerships, and 36 percent worry about revealing too much about their own security arrangements. Other problems include regulatory restrictions, lack of support from the C-suite, and lack of resources. 

According to the KPMG report, CISOs are now in a position to play a crucial role as enablers. By operating as one of the organization’s ultimate guardians of trust, it can be a driving force for its success. “CISOs themselves recognize what is at stake,” Diemont noted, adding more than three-quarters of respondents (77 percent) say increased trust is a key objective of their cyber risk programs. 

Forty-five percent of C-suite respondents now see the CISO as a key executive and the profile of the CISO role has grown rapidly over the last five years, driven by digital transformation, growth in cybercrime, and rising regulatory expectations, he stated.

Cyber Security

Kaspersky Reports Growth in Gamer Cyberattacks in 2023



The global gaming community, which currently accounts for nearly half of the world’s population, has found itself increasingly under fire by cybercriminals, according to a comprehensive investigation by Kaspersky. In the period spanning from July 2022 to July 2023, the cybersecurity company discovered the growing vulnerability of the gaming user base. Cybercriminals exploited this vast community to access personal data, launching a range of attacks, including web vulnerabilities, Distributed Denial of Service (DDoS) attacks, cryptocurrency mining, and complex Trojan or phishing campaigns.

In the period from July 1, 2022, to July 1, 2023, Kaspersky’s solutions detected a substantial 4,076,530 attempts to download 30,684 unique files masked as popular games, mods, cheats, and other game-related software. These incidents affected 192,456 users worldwide. These files – primarily classified as unwanted software and often labelled as not-a-virus:Downloader (89.7%), – are not innately perilous, but they are capable of downloading various other programs, even malicious ones, onto the user’s device. Adware (5.3%) and Trojans (2.4%) were also noteworthy threats to desktop gamers.

Minecraft emerged as the favoured target among cybercriminals, responsible for triggering 70.3% of all alerts. The threats using Minecraft as bait impacted 130,619 players across the globe during the reporting period. Roblox was the second most targeted game title, contributing to 20.4% of all alerts affecting 30,367 users. Counter-Strike: Global Offensive (4.8%), PUBG (2.9%), Hogwarts Legacy (0.6%), DOTA 2 (0.5%), and League of Legends (0.3%) were also among the prominent games subjected to cyber threats.

The mobile gaming community, which, according to the Newzoo 2023 report consists of over three billion gamers or nearly 40% of the world’s population, is characterized by its significant growth and accessibility and has become an enticing target for cybercriminals. Between July 1, 2022, and July 1, 2023, Kaspersky documented 436,786 attempts to infect mobile devices, impacting 84,539 users.

Various game titles were employed as bait to target mobile gamers. Minecraft enthusiasts once again were the primary targets, as 90.4% of attacks focused on the 80,128 gamers who fell victim. Indonesian users in particular faced exploitation through Minecraft, resulting in a Trojan.AndroidOS.Pootel.a attack, discreetly registering mobile subscriptions. Iran witnessed the highest prevalence of these attacks, with 140,482 alerts impacting 54,467 Minecraft players.

PUBG: Battlegrounds Battle Royale, was the second most exploited mobile game among cybercriminals, accounting for 5.09% of all alerts, with the majority of incidents originating from Russian Federation users. Roblox (3.33%) ranked third in terms of detections but second in the number of affected users.

A noteworthy discovery involves the emergence of SpyNote, a spy Trojan distributed among Roblox users on the Android mobile platform under the guise of a mod. This Trojan exhibits various spying capabilities, including keylogging, screen recording, video streaming from phone cameras, and the ability to impersonate Google and Facebook applications to deceive users into divulging their passwords.

Phishing and counterfeit distribution pages continue to pose a significant threat to gamers. Malicious and undesired software often masquerades as popular games, disseminated through third-party websites offering pirated versions. These deceptive pages typically display inflated download counts, potentially misleading users into a false sense of security. Nonetheless, clicking the download button typically results in an archive that may contain harmful or unrelated elements, diverging from the promised content.

“In the dynamic gaming industry, which hosts a wealth of personal and financial data, cybercriminals are seizing enticing opportunities. They exploit gaming accounts by pilfering in-game assets, and virtual currency, and selling compromised gaming accounts, often with real-world value. The relentless pursuit of personal data has led to a surge in ransomware attacks, even affecting professional gamers who depend on uninterrupted play. This underscores the critical need for enhanced cybersecurity awareness within the gaming community,” comments Vasily Kolesnikov, a cybersecurity expert at Kaspersky.

To stay safe while gaming, here are some recommendations:

  • It is safer to download your games from official stores like Steam, Apple App Store, Google Play or Amazon Appstore only. Games from these markets are not 100 % secure, but at least they are checked by store representatives and there is some kind of screening process: not every app can be made available in these stores.
  • If you wish to buy a game that is not available through the main stores, purchase it from the official website only. Double-check the URL of the website and make sure it is authentic.
  • Beware of phishing campaigns and unfamiliar gamers. Do not open links received by email or in a game chat unless you trust the sender. Do not open files you get from strangers.
  • Do not download pirated software or any other illegal content, even if you are redirected to it from a legitimate website.
  • A strong, reliable security solution will be a great help to you, especially if it will not slow down your computer while you are playing, but at the same time, it will protect you from all possible cyber threats.
  • Use a robust security solution to protect yourself from malicious software and its activity on mobile devices.
Continue Reading

Cyber Security

The Average Time to Investigate a Cybersecurity Incident is Around 26.1 Days, says Binalyze



With the intricacies of the digital world growing exponentially, the relevance of effective and timely Digital Forensics and Incident Response (DFIR) cannot be overstated. Recognising this need for insight, Binalyze, in collaboration with the global market intelligence firm IDC, is excited to publish a compelling new report: “The State of Digital Forensics and Incident Response 2023”.

Based on an extensive survey conducted in June 2023, the study brings into focus the perspectives of over 100 cybersecurity professionals from five Middle Eastern countries. This diverse respondent pool consists of individuals directly influencing the cybersecurity functions within their organizations, with roles spanning SOC analysts, DFIR professionals, Incident responders, Threat hunters, SOC managers, and Directors.

The key findings of the report are critical for anyone involved in DFIR, from SOC teams to individual analysts and investigators. Report highlights include:

  • According to the research and subsequent analysis, the average time to investigate an incident is approximately 26.1 days, and the time to resolve incidents is an additional 17.1 days.
  • The importance of reducing “detection-to-resolution” times for efficient incident management.
  • The ongoing skills shortage: 81% of respondents identified this as a major challenge.

“Our world thrives on digital connections, but with this connectivity comes vulnerabilities. As the frequency and intensity of cyber threats surge, the importance of DFIR in understanding, mitigating, and learning from these threats is paramount. There is a real and urgent need for forensic visibility at speed and scale. AIR is a game changer here and should be at the centre of all SOCs DFIR effort,” says Ahmet Öztoprak, Senior Sales Director of META at Binalyze.

This report serves as both a wake-up call and a guide. By leveraging the insights from the top cybersecurity professionals in the Middle East, ‘The State of Digital Forensics and Incident Response 2023’ aims to provide companies with the knowledge and solutions they need to combat emerging cyber threats effectively and maintain resiliency.

Continue Reading

Cyber Security

Cybercriminals Used Malware in 7 Out of 10 Attacks on Individuals in the Middle East



Positive Technologies analyzed attacks on individuals in Middle Eastern countries between 2022 and 2023. Malware was used in 70% of successful attacks. More than half of these attacks involved spyware. The vast majority of attacks used social engineering techniques. In 20% of phishing campaigns, the attack was multi-pronged, exploiting multiple social engineering channels simultaneously.

“According to our data, cybercriminals employed malware in 7 out of 10 successful attacks on individuals in the Middle East region. More often than not, the attackers infected users’ devices with spyware (three out of five malware attacks). This type of malware collects information from the infected device and then passes it on to the attacker. Depending on the task, spyware can steal personal and financial data, user credentials, as well as files from the device’s memory,” the company said.

Positive Technologies Information Security Research Analyst Roman Reznikov said, “By using spyware, attackers can compromise not only personal and payment information and personal accounts, but also corporate credentials, network connection information, and other sensitive data. The stolen data is then offered for sale on the dark web forums. As a result, a skilled attacker can gain access to an organization and carry out a successful attack, leading to non-tolerable consequences: disruption of technological and business processes, theft of funds, leakage of confidential information, attacks on customers and partners.”

In the vast majority (96%) of successful attacks on individuals in Middle Eastern countries, social engineering techniques were employed. Most often, these were mass attacks in which the criminals aimed to reach the maximum number of victims. To achieve this, they actively leveraged current news about significant global and regional events, including the 2022 FIFA World Cup Qatar.

In every fifth (20%) phishing campaign, the attack was multi-pronged, exploiting multiple social engineering channels simultaneously. Criminals led the victims through a series of steps until the device was infected and data stolen. For instance, users could be lured through social media accounts that contained links to a messenger channel from which the victim would install a malicious application.

One of the reasons for the success of social engineering is the numerous data leaks from various organizations. “According to our research on the cybersecurity threatscape in the Middle East, 63% of successful attacks on individuals in the region resulted in leaks of confidential information. The majority of stolen information consisted of personal data (30%) and account credentials (30%). Cybercriminals were also interested in payment card data (10%) and user correspondence (8%).” the company added.

On the dark web, malicious actors sell information about users and also provide stolen data archives for free. Criminals use the compromised information in subsequent attacks on users. For example, a successful attack on a bank could result in fraudulent actions against its customers. Cybersecurity experts recommend that users follow cyber-hygiene rules.

Companies also need to ensure the security of employee and customer data. Data breaches cause reputational and financial damage and put at risk users whose information has been compromised. To maintain cyber-resilience, it’s essential to regularly assess the effectiveness of security measures and pay special attention to the verification of non-tolerable events.

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.