Month: March 2017

• Free training funded by the Government’s National Cyber Security Programme produces 55 industry-ready cyber professionals
• Students receive Global Information Assurance Certification (GIAC) scores, placing them in top 5% of GIAC students worldwide
• Graduates interviewing with leading organisations including NCA, Fujitsu and JP Morgan

A former bartender and a military intelligence operator have become the first graduates to be offered roles at leading cyber security companies after graduating from the HM Government-backed Cyber Retraining Academy with flying colours.

The academy, a ground-breaking initiative funded by the Government’s National Cyber Security Programme, was launched to fast track the next generation of security experts and help defend the nation against cyber-attacks. The programme commenced on January 23rd and concludes this week with a graduation ceremony in London.

Conor Kelly, a former bartender and Joel Potts, who had previously studied spanish, are amongst those to be offered jobs at world-renown organisations in advance of the programme finishing.

Fifty-five of the UK’s most talented amateurs were originally chosen from a nationwide search to undergo the academy’s free training programme. Trained by leading industry practitioners from SANS Institute, the students have mastered a cross-section of in-demand cyber skills and have graduated with two separate Global Information Assurance Certifications, an internationally renowned cyber security qualification.

Despite having no previous experience of cyber security, students have graduated with outstanding exam results, many achieving 90% or above in their GIAC tests, placing them in the top 5% of all GIAC students worldwide.

The programme was designed to connect course graduates to industry and, through an online portal unique to the Cyber Retraining Academy, offer leading UK cyber security employers a chance to track students’ performance and progress. Graduates are now either interviewing for, or have been offered jobs with major organisations, including the NCA, JP Morgan, Fujitsu, Amazon, e2e, Huawei and the DFID (Dept for International Development).

During the programme, students completed hands-on exercises in real-world scenarios, including how to respond to virus outbreaks, studied the ‘psychology’ of hackers, built watertight business networks, found vulnerabilities in Internet of Things (IoT) devices and learnt how to help firms tackle the most common threats.

Minister of State for Digital and Culture Matt Hancock said:

“We are determined to create a world-leading digital economy that works for everyone and make the UK the safest place to do business online. We have recently published our Digital Strategy which sets out how we will achieve this and, through our National Cyber Security Strategy, have committed to invest £1.9 billion in cyber security over five years.

“The Cyber Retraining Academy is a key part of this work and it’s fantastic to see the first students graduate and begin to move into cyber security roles in industry. They will bring a diverse range of skills and experiences from different walks of life to help the fight against cyber threats and attacks.”

UK Managing Director at SANS Institute Stephen Jones said:

“The Cyber Retraining Academy has been a huge success. Our assessment process uncovered more than 50 individuals with no prior cyber security experience, but who possessed the traits required to succeed in the profession. Now, after 8 weeks of intensive training they are qualified and ready to embark on a new career path, working in vital roles within many of the UK’s most important organisations.”

(171)

In light of today’s meeting between the home secretary, Amber Rudd, and tech giants Google, Microsoft, Facebook and Twitter, Please find a comment below on the ongoing efforts to combat terrorism.

Comments from Stuart Nash, managing director at www.alchemyglobal.co.uk:

“Rapidly evolving technology creates a broader and more complex environment for national security services that need to be policed. New generations of criminals, terrorists and state sponsored hackers that have been born in the tech era are putting readily available consumer technology to use alongside more secretive areas of the dark web.

Governments now have some very difficult questions to try to find answers to. Nationally each country must now decide how to balance personal privacy with national security. In democracies, especially those with strong judicial oversight, this is a very contentious area.

This is complicated by the practical acts of policing such quickly evolving technology. In an ecosystem that is not bound by national borders, and where code can be replicated and moved to non-regulated jurisdictions or hidden on the dark web in minutes, the challenge is daunting and can only be met with well planned and executed policy and close cooperation between nation states.”

(63)

The latest research from Kaspersky reveals just how easy and profitable it is to carry out large-scale DDoS, or denial of service, attacks. Running an attack can cost as little as $7 an hour, while inflicting damages ranging from thousands of pounds to millions. To date, they have crippled numerous organisations by severing internet services, such as with the DYN DNS attack which was bombarded by the Mirai botnet using over 150,000 compromised devices. EfficientIP’s 2016 Global DNS Threat Survey additionally revealed the worst type of DDoS is DNS-based attacks. They believe: Using traditional firewalls to secure DNS servers is putting services and data in the danger zone. Massive attacks can quickly swamp overwhelmed systems based around traditional firewalls. DNS-based DDoS attacks are particularly easy to execute and THE main source of data exfiltration. Techniques used by attackers, like DNS exfiltration and DNS tunneling tools, are now commonly used and have been added to the toolkits of attackers. In a world where networks are increasingly complicated and risky, a modern DNS not only simplifies things, it’s also its own police force; it ‘serves and protects’.

(77)

Bryan Lillie, CTO of Cyber, QinetiQ

When one compares cyber security today to what it was ten years ago, the two are almost unidentifiable as the same industry. The iPhone had only just launched; Facebook was still in it’s infancy; the Internet of Things (IoT) was still a dream. The routes a hacker could use to access a system were limited, and because of this, cyber security was built around walls. One was encouraged to block attacks with firewalls and other perimeter security that could be plugged into existing systems. There was no wider strategy, with little thought given to what would happen if those walls were breached. This created a very segmented landscape, made up of a multitude of different products, all with varying capabilities and from different suppliers.

Today’s landscape is utterly different. The routes into a system are so numerous they are impossible to police effectively, with the IoT making this problem greater by the day.

Yet this same technology that is causing a headache for cyber security professionals is the exact same technology that can help drive a business forward. Consider the transformational potential of IoT. Data between previously distant departments or operations can now be collected, shared and used automatically, dramatically improving the efficiency with which those two business areas work.

The consequences for cyber security, however, are serious. Access across a large multinational corporations’ systems can be gained through one chink in the armour of one small department. Recent hacks have shown this time and again. The hack against Target, one of the biggest ever and responsible for the loss of details of 110 million customers, stemmed from a phishing attack on a contractor. USB sticks infected with malware are an ever-present threat; once plugged in, hackers quickly spread throughout an organisations system and begin to do serious damage. This has been proven to chilling effect in the health sector, where patient monitors have even been accessed.

To counter this, the cyber industry must work to develop a security protocol – a standard – that can operate effectively across all different elements of modern, large-scale computer systems; a system of systems. Such a protocol will allow for the effective identification and quantification of any security and privacy issues in any part of a business’ IT systems. Other industries have used similar models of ever-presenting testing and evaluation to ensure their services are as rigorous as can be. Engineering, constantly evolving since the industrial revolution, is built upon testing. From product design through to end-of-life decommissioning, the industry constantly tests the performance and capabilities of its devices.

A system of systems will allow cyber security to the same. All parts of the IT supply chain, from the service provider to the OEM; the management consultancy to the market researcher; all will be able to scrutinise their business operations from a cyber security stand point, and all to the same high level of quality.

This will align with and be underpinned by the National Cyber Security Strategy, supported by the NCSC. It aims to create an “ecosystem” of “innovative and thriving cyber security” by bringing together the “best minds from government, academia and the private sector” to deliver this system of systems, solving the issues presented by a divergent and complex online world. It will be the beginning of a new era of cyber security protection, based not on unrealistic goals but on our ability as a nation to mitigate and minimise risk through collaboration. It will give the UK and its population assurances that its data and systems are safe and the base from which a successful digital economy can flourish.

(67)

Author: Etienne Greeff, CTO & Founder of SecureData

Earlier this month, it was revealed that UK unemployment is at its lowest level since 1975. The jobless rate of 4.7% makes for encouraging reading, but in a report published in the US by Cyber Ventures late last year the IT security sector boasts zero percent unemployment. Today, if you are a security professional you probably feel like the world is your oyster, but if you are trying to recruit talent in to your organisation then you may take a different view.

The director of GCHQ has in recent weeks warned of a “huge skill shortage” by the middle of the next decade, and this shortfall should give everyone cause for concern. Without wanting to sound too over dramatic, the world is at war with the cybercriminals and right now there simply are not enough troops to fill the trenches – we can’t introduce conscription in to the industry! And, to compound matters the regulators are clamping down on malpractice.

A recent Cyber Ventures report suggests that in 2016 there were one million cybersecurity job openings in 2016 and predicts this to rise to 1.5 million by 2019. This is great news, as the message is being heeded that organisations need specialist expertise to help safeguard themselves from inevitable attack, and we are not just talking about larger enterprises.  It is estimated that in 2015, 74% of SMEs in the UK were breached.

What’s more the attacks are growing in volume, with in the region of seven million new malware variants and 17,000 security alerts each week. They are also becoming more complex and sophisticated, with ‘innovative’ new ransomware, phishing and social engineering attacks.

As is the nature of supply and demand, the deficient of cybersecurity professionals with the right CV means that those with the necessary credentials come with high salaries – a CISO can command between £98,250 and £149,500, whilst an Information Security Manager can expect up to £97,500 per annum). However, it is also true that they are under increasing pressure, not just from the external threat vectors, but the internal challenges placed upon them to be a ‘cybersecurity everyman’, with one person expected to perform the diverse duties of two or even more people.  The Center for Cyber Safety and Education found that 66% of UK companies do not have enough information security personnel to their needs.

A word of warning, if you are lucky enough to have one or more of these people in your organisation right now, know that other businesses (both private and public, domestic and overseas) are trying to lure them away this very moment.

To confuse matters further, organisations are being bombarded with promises from technology vendors that if you buy solution X, Y and Z all your security and compliance problems will be solved. Walk the lanes at Infosec in London in June and you will probably walk away with more questions than answers.

What is happening today (I add the caveat – in some instances) is that in the absence of the requisite experience, skills and strategy, organisations are operating on a purely tactical basis, unable to see the ‘big picture’. This is especially true at the smaller end of the SME community for whom paying a CISO or Information Security Manager’s salary is out of the question, and as such have been priced out of the market. So, as attack vectors grow exponentially, so too does the amount of ‘kit’ that is being deployed (often in vain) to counter them. In fact, it is predicted that spending will exceed $1 trillion from 2017 to 2021. Furthermore, as businesses evolve through digital transformation and Cloud adoption, the scale of the task at hand grows too. However, it does not all make for bleak reading and there is light at the end of the tunnel.

Organisations are getting a handle on things and many have realised that one way to tackle the skills shortage is to turn to Managed Security Service Providers (MSSP’s) for some or all the IT security function. It is no coincidence that in the face of a skills shortage that shows little sign of righting itself soon, the MSSP sector is the fastest growing services segment. Today, it is growing at a rate faster than the security software market, with reports of CAGR of 13.2% for MSSP and 7.4% for security software.

MSSP’s are an increasingly attractive proposition for crème de la crème of security professionals, giving them the opportunity to utilise their skills across a range of different organisations and infrastructures, as well as working alongside other experts, helping them to develop their knowledge and expertise further. For the organisations, they get access to this talent pool without the worry, or associated costs of finding and replacing personnel. What happens if you get hit with a ransomware attack and your security guy is on holiday or off sick?

Crucially, MSSP’s know the latest skills, qualifications and experience that are required to perform in this ever-changing environment, whether it is perimeter and application security, vulnerability scanning, threat detection or compliance monitoring.

Looking to the future, there is much work to be done to attract the very best talent to the cybersecurity industry and that means addressing the gender gap and getting cybersecurity education in to schools (currently only 12% of the workforce is under 35). It was heartening to hear last month that the UK Government has earmarked £20 million to teach teenagers about cybersecurity. If we can engage them early it is addressing two problems, namely the personal threat of cybercrime and the subsequent national impact, as well as making the industry one that is appealing to build a career in.

(166)

(53)

(79)

18-19 April 2017 | Mövenpick Hotel Riyadh | KSA

Event focus: critical infrastructure protection; advanced persistent threat prevention; securing the cloud, mobile, big data and social platforms; risk management, business continuity and disaster recovery; and many more.

Event Top Features:

• 200+ Public & Private sector delegation including Ministry of Interior, National Centre for Cyber Security, Ministry of National Guard, National Centre for Digital Certification, SABIC & Saudi Aramco
• Exclusive CISO Breakfast Briefing – First Hand View on Threats including recent wiper-style attacks in Saudi Arabia
• FBI Hotspot on Grizzly Steppe: Russian efforts to effect the US Election
• Prime Insight from Ministry of Foreign Affairs and Cooperation (Spain) on Critical National Infrastructure Protection
• CIO Leadership dialogue to align security to business performance including Ministry of Defense, Arab National Bank, The Shura Council, Saudi Aramco & Royal Saudi Airforce
• Securing Smart City & Government Panel consisting of Saudi Health Information Systems, Holy Makkah Municipality, General Authority of Meteorology & Environmental Protection, SAMA & Ministry of National Guard, Health Affairs
• 8 Techtalks complimenting nation’s cyber resilience as a Vision 2030 enabler

Discount code: DFM10

Web: https://fleming.events/en/events/security/kingdom-cyber-security-conference

(43)

(53)

by Jeremy Coward, Community Manager, IoT World News

Bosch is a brand most everyday households are familiar with — particularly anyone who’s ever held a drill or attempted DIY. But now more than ever, the company’s considerable prestige among consumers is being superseded by its reputation in industrial circles.

This is in no small part thanks to Bosch’s work within the industrial internet of things (IIoT) where they provide sensors, cloud services and more. The company is frequently named alongside the likes of Cisco, Dell and IBM as one of the most powerful and important companies in the IoT space. Last year Bosch CEO Volkmar Denner claimed they “offer all the ace cards for the connected world from a single source”.

Partnering could speed up time-to–market for IIoT

However, in 2017 it’s clear that few companies can afford to be an island where IoT is concerned. From the smart home to agriculture, collaboration between would-be competitors is becoming more common as everyone seeks to implement and utilize the next level of mass connectivity across businesses and homes.

Eli Share is head of mobile and IoT for Bosch Power Tools, where he drives strategy, process and “points of entry” relevant to IoT across the entire Power Tools division, which encompasses everything from DIY tools to industrial devices.

“Our user segments are very diverse when we look at IoT solutions; the needs of a ‘DIY-er’ are very different from those working in, say, construction,” Share explains.

As with most decision makers working in the IoT space, he’s in favour of partnering to enhance how far any single connected device can go, and generally push progress in IoT and IIoT forward.

“This might be the first time that Bosch is looking at these industries [manufacturing, construction etc.] as ‘open standards’.

“We have a lot of point solutions, but if we don’t build them on open standards that other companies can integrate into we’re missing the mark because, in this day and age, with these applications, you can’t plan on one company owning everything. Because you’re customizing solutions, you have to allow people to work within your open standards.

“So Bosch is definitely taking steps in that direction to not only provide the solutions and get some of these early adopters into play, but also allowing others to come into the picture.”

Two to three years until industrial internet hits the mainstream

In four months’ time Share will have sat on a panel with Centrica and Leica Microsystems predicting how IoT solutions will improve customer experience and increase process productivity at Internet of Things World Europe in London.

He’s adamant that IoT is “the biggest driver” towards the much-acclaimed Industry 4.0 and that Bosch is “primed in to lead the development of consumer and industrial solutions in this area”. This suggests Bosch is well placed to fill the void of comprehensive industrial IoT case studies that currently exists.

“The way I see it is that, especially with IoT and Industry 4.0, we do have some isolated success stories but not a lot of case studies,” Share says.

“Most of this is because a lot of industry is still built upon legacy systems – companies are hesitant to change. Across all of the different facets and functions they’ll all agree that’s where they need to go, but then you say ‘here’s what you need to do to get there’ and the response is ‘well… this requires high investment, there’s a high resource cost to implement, and it doesn’t necessarily give us the returns we need right away’. So it’s tough to justify. A lot of the potential success stories are held back by that.”

Share can allude to several fledgling case studies involving Bosch systems and devices, covering predictive maintenance, manufacturing analytics, enhanced product performance and more. However, the actual scope of application is currently narrow compared to what it will become – unsurprisingly Bosch and other key industry players are waiting to showcase their new products until they can be demonstrated to their full extents.

That said, he’s confident Bosch Power Tools has already collected evidence proving that long-term ROI is very achievable with these applications:

“In our power tool manufacturing lines we have some cells that we know are very agile and highly adaptable, based on the data that we’re getting in real time,” Share says.

“These studies show a huge impact, but they’re currently very narrow applications and the cost to implement is still quite high, so we still need to build out the long-term returns and demonstrate with data that these tools prevent users from making mistakes, and save so much time in rework and quality analysis, and have ‘this much’ impact on production times.

“This is where I feel the industry is at right now – where we have a lot of point solutions in general, that speak to one niche application, and we need to broaden what those applications look like to really drive value. We need two to three years to build the large-scale case studies and get to the tipping point where people start adopting the best solutions at a quicker rate.”

Eliminating mistakes on the factory floor

When it comes to industrial IoT case studies that are widely integrated across many touchpoints, providing efficiencies in every one of those areas, there’s one Bosch application in particular that Share is thinking of.

“We have a solution where some of our tools provide better usability within manufacturing and industrial settings thanks to the internet of things,” he claims, “where a user or line worker?can’t?make a mistake because the tool won’t allow them to if they’re in a certain area. Say, where a user can’t over-torque a bolt when building an airplane, because the tool knows they’re in on a certain section of that airplane where it shouldn’t be done.”

The solution sits within Bosch’s Rexroth division, and is applicable beyond power tools to worker flow, information flow, robotic applications and more.

“The concept can scale to any type of point solution,” Share tells me. “It links to a system within the production environment so that the tool understands where it’s located within the factory floor and adjusts its settings based on the parameters of where it is and what job it’s doing, even to the point where if it moves outside the cell the tool would intentionally become non-functional.”

The ubiquitous use of such a device seems to be an absolute no-brainer, positively impacting costs, efficiency and safety for the workers and the end-users:

“It’s already been put to use in a couple of locations within Bosch and a few other companies, but it’s not widely distributed at this point. It’s not just buying a drill – it’s setting up a whole system.

“Integrating these with the legacy systems that are still in use today really causes a lot of companies to be hesitant. Once the [digital] infrastructure inside these facilities gets built everything will become a lot easier.”

The end-goal is fully connected factory floors – with individual areas and locations identified and mapped out digitally – robust connectivity across all applications, and process flexibility in case something needs to change within the production process. These are the kinds of fully-fledged industrial internet case studies that we can look forward to before the end of the decade.

The leadtime is lengthy, but that’s understandable considering what it takes to ensure the stability, security and contingencies that will be necessary for the long term. 2016 saw numerous consumer IoT products rolled out where cybersecurity flaws were callously ignored, with the end-users paying a high price.

This alternative approach makes it far more probable that the industrial side of IoT will enhance safety and security where it’s used as intended – not the other way around.

Get a 20% discount on your ticket with VIP code IOT20. Apply code now >>

Identify the key trends and players for Industry 4.0 at Internet of Things World Europe this June. Download the brochure, claim your free visitor ticket, get your free enterprise conference pass or book your place at Europe’s most comprehensive IoT event!

(113)