// archives

Internet of Things

This category contains 4 posts

Cybersecurity: greater opportunity, less risk

Trust in sharing economy businesses is built primarily on peer group usage and ratings. The fact that peers not only reveal their opinions, but a huge amount of information as well, inevitably raises the question of cybersecurity. Providers, users and regulators all share responsibility for providing a satisfactory response.

cyber_blog

Trust: the key ingredient of success

Consumers making use of conventional business offerings place their trust in a combination of proprietary brand reputation and industry-specific regulation. But the recipe for success in the sharing economy includes another basic ingredient: the trust of the peer group. Peers share ratings and recommendations that are visible everywhere in real time, in personalised form. For example Uber passengers rate their ride and the driver; in turn, drivers get to rate their passengers. This way, depending on the trust they place in the judgement of their peers, new customers can decide whether or not to do business with a particular provider. Monolithic, laws-based regulation thus gives way to a peer-to-peer trust model. This creates enormous opportunities for providers for new, interesting business.

Blessing and a curse

The trust model on which the sharing economy is based can enable companies to respond more quickly and precisely to changing customer needs, market developments or their own weaknesses. It also provides highly relevant information for people with similar interests. Broad-based ratings create transparency – for better or for worse. Because the system can cut both ways: just as a positive rating can help attract new customers, bad marks can destroy the trust of prospective customers before they’ve even been able to try out the offering for themselves.

The main disadvantage of the sharing economy is its vulnerability to manipulation. An aggressive competitor, frustrated customer or disgruntled former employee can easily torpedo a platform’s reputation by posting fake ratings.

Where there’s data there are also people wanting to steal it

The security and data privacy risks of a sharing economy structure shouldn’t be underestimated. A peer-to-peer provider very rapidly gathers, processes and saves a huge mass of personal data, including credit card or user information and consumer profiles. This information is what cybercriminals are after. Just imagine the economic, social and emotional damage that would ensue if someone were to steal and make public the entire bookings made by regular customers of a hotels platform. Unfortunately, the levels of protection defined for data of this type vary from country to country around the world. Each provider is basically free to do what they think is right.

Taking responsibility as a provider

Data security is in large part the responsibility of sharing platform providers. In other words, peer-to-peer providers have to adapt their systems and technologies to the information they gather, and assure appropriate protection. In concrete terms this means a sharing provider should only gather data relevant to their core business, and publish clear, concise terms and conditions governing their use. A layperson must be able to understand and accept these terms in good conscience.

Given the lack of standards and the complexity of the issue, at the moment there are big differences in how conscientiously providers fulfil this duty. And there are also big differences in the rules and regulations governing these matters in different countries and industries. Most digital players capture more data than they need for their core business and have terms and conditions designed to cover them for any eventuality – pages and pages of legal fine print that the average reader will have problems reading through, never mind understanding.

Anyone shifting all or part of their business model to the digital space should start thinking about and incorporating the data privacy issues right from the conceptual phase. New technologies can help bring a market-ready idea to success by delivering it in a contemporary package. But by the same token the rigours of cybersecurity can nip a sharing economy idea in the bud or derail a digital project before it’s reached its goal.

Users: take responsibility for yourself!

The people who use sharing platforms have only limited tools at their disposal to prevent the data privacy rules from being violated. So if you choose to engage in this type of business you should take responsibility for your own actions. For example you should be careful about what personal information you reveal to what providers. This means that you should pay attention to how the platform’s trustworthiness is rated, read the terms and conditions, and decide for yourself whether you’re prepared to take the described risks. If you want to avoid credit card fraud, for example, you may want to use a prepaid card with a limited amount on it for sharing purchases, or make payments via a separate account which you don’t keep much money in.

Assuring cybersecurity also means protecting your own platform, making sure that your computer, tablet and smartphone are sufficiently shielded from attach from cyberspace. There are already many powerful applications available to do so.

Regulators: create a basic framework

The role of the regulator in the digital economy is to require basic protection of customer data and make sure the legislation keeps pace with the times and technology. Against this backdrop the European Parliament has revised the EU’s General Data Protection Regulation (GDPR), scheduled to come into force at the end of May 2018. The regulations contain important additional rights, provisions to protect users, and substantial penalties for violation.

Also relevant is the PCI DSS, the international credit card standard (Payment Card Industry Data Security Standard). The PCI DSS, formulated in 2006 by a council established by credit card organisations, is designed to ensure a uniform approach to implementing security requirements for credit card transactions.

The data privacy legislation in Switzerland incorporates most of the existing international data protection rules, and is likely to adopt many of the new ones. Although the implications of the revised GDPR on a national and European level aren’t yet clear, we believe the enforcement of the regulation and any penalties that are imposed will prompt companies to tighten their data privacy rules and security controls on their customer data.

In a nutshell

Providers, users and regulators all share responsibility for cybersecurity. We can only keep the internet healthy, clean and economically beneficial if everyone involved plays their part. Regulation should create the framework for basic protection and transparency. Users have to act circumspectly to ensure their personal data don’t end up in the wrong hands. And last but not least, peer-to-peer providers have to comply with the data protection requirements.

Modern technologies such as the cloud enable companies to deliver new business models very rapidly. It’s rarely the technical implementation that stands in the way of success, but rather a failure to translate a promising idea into a business model capable of responding to change and the needs of the market. Looked at this way, cybersecurity is no longer an obstacle to success but a welcome springboard.

 

In the spirit of happy holidays

It isn’t quite the holidays yet but browsing through my LinkedIn feed I liked the video from HP Enterprise and while it is an obvious marketing video it is cute and it brings a little bit more of the anticipation for the holidays into my morning. It also has a nice tagline of thanking people that make things happen and gives a glance on how modern cloud and hybrid services can increase the efficiency of processes. While I don’t have an independent verification that Santa’s operations adopted cloud for scale, big data analytics for improving the insight into kids behavior and IoT to track shipments it is not so far off what technology can do. As my passion lays in security I especially appreciate the cyber threat map of course and overall the “bah humbug meter” should be adopted much more widely also in the non-holiday world.

So in the spirit of enabling people and organizations to reach their full potential enjoy this little video!

RSA 2015 – Microsoft Key Announcements in Security

 

The US RSA conference is probably the world’s leading security conference with about 30’000 participants and took place last week in San Francisco. Scott Charney, Microsoft’s CVP Trustworthy Computing, gave a noteworthy keynote on Enhancing Cloud Trust that can be watched here. It is well worth the time.

The announcements made by us and the presence that Microsoft had at the conference was impressive. The main theme was very clearly that we truly live in a mobile first, cloud first world and that with the explosion of devices and apps come new challenges. Security has been a top priority for Microsoft for a long time already and Microsoft is committed to providing customers with transparency and control over their data in the cloud. Here are the highlights that we announced:

  • New Security & Compliance signals and activity log APIs so that customers can access enhanced activity logs of user, admin and policy related actions through the new Office365 Management Activity API.
  • New customer Lockbox for O365 that brings the customer into the approval workflow if one of our service engineers would have to troubleshoot an issue that requires elevated access. With the customer lockbox the customer has the control to approve or reject that request.
  • Device guard is the evolution of our malware protection offering for Windows 10 and brings a new capability to completely lock down the Windows desktop such that it is incapable of running anything other than trusted apps on the machine.
  • Increasing levels of encryption where O365 will implement content level encryption for e-mail in addition to the BitLocker encryption we offer today (similar to OneDrive for Business’ per-file encryption). In addition we expect enabling the ability for customers to require Microsoft to use customer generated and controlled encryption keys to encrypt their content at rest.
  • Microsoft Passport is a new two factor authentication designed to help consumers and businesses securely log-in to applications, enterprise content and online experiences without a password.
  • Windows Hello which will provide that Microsoft Passport can be unlocked using biometric sensors on devices that support that (most notably iris and face unlock feature in addition to fingerprint).
  • Azure Key Vault which helps customers safeguard and control keys and secrets using FIPS 140-2 Level 2 certified Hardware Security Modules in the cloud with ease and at cloud scale and provides enhanced data protection and compliance and control.
  • New Virtual appliances in Azure where we work with industry leaders to enable a variety of appliances so that customers have greater flexibility in building applications and enabling among others network security appliances in Azure.
  • Enterprise Mobility where we have the Enterprise Mobility Suite (EMS) bringing customers enterprise grade cloud identity and access management, mobile device management and mobile app management and data protection (Reto’s comment: not new but worthy to call out having grown our install base by 6x just in the last year)

More information can be found on Scott Charney’s blog on “Enabling greater transparency and control” that also has further links to more in-detail information on the individual technologies mentioned above.

European Union’s recent activities on Security

The European Union is quite active on security and especially cybersecurity issues but is less present in the media for it than for example the US. To raise awareness on current reports and recommendations that I see as relevent please find some links below. We can now debate if this is too much, just raight or not enough but for that discussion knowing more about what actually exists or is in process is a prerequisite of course.

Joint Supervision Tool for Telecom Security
On 9 April, ENISA published a joint framework to supervise the security of services and personal data processing by telecom providers in the EU in accordance with Article 13a and Article 4. Full report is available here.

Electronic Evidence – a Basic Guide for First Responders
On 25 March, ENISA published a report based on past work done in the field of good practices for CERTs and LEAs in the fight against cybercrime. The main aim of the report is to provide a guide for first responders with a special emphasis in evidence gathering.

National/Governmental CERTs – ENISA’s Recommendations on Baseline Capabilities
On 20 March, ENISA published recommendations on baseline capabilities. The document covers ENISA’s updated considerations for capabilities of so called national / governmental CERTs, thus teams who serve the government of a country to protect critical information infrastructure. The primary target audience of this document are these CERTs and those policy-making bodies in the European Union Member States that are responsible for initiating and planning the establishment and operation of a national / governmental CERT. Still quite an interesting reading.

Standardisation in the Field of Electronic Identities and Trust Service Providers
On 24 March, ENISA published a paper that explains why standards are important for cybersecurity, specifically in the area of electronic identification and trust services providers. Additionally, the paper also discusses concrete standardisation activities associated with electronic IDs and trust service providers, providing an overview of standards developed under the mandate from the European Commission and others, related to eIDAS Regulation. It concludes with a proposal of a standard on cryptographic suites for electronic signatures and infrastructures, put forward by ENISA and related to the ETSI TS 119 312. Full report is available here.

Motion for a European Parliament Resolution on Cybersecurity
On 30 March, Italian MEP Nicola Caputo published a motion for resolution on cybersecurity and calls on the Council and the European Commission to strengthen the EU’s response capability to this global threat, to strengthen network and information security and to support Member States in their research and innovation aimed at promoting public and private digital security. steps on the dossier were not disclosed. Interesting though that the security of IoT (Internet of Things) starts to become also a policy topic. I expect that we will see more to come and hope that it will help in addressing the real challenges that we face.

About the Author

Reto is partner at PwC Switzerland. He is leading the Cybersecurity practice and is member of PwC Digital Services leadership Team. He has over 15 years work experience in an information security and risk focused IT environment. Prior to working at PwC he was Microsoft's Chief Security Officer for Western Europe and also has work experience as group CIO, Chief Risk Officer, Technical Director and Program Manager.

more about me and contact info

replica Rolex