TweetChat Archives - IT Security Guru https://www.itsecurityguru.org/category/events/tweetchat/ The Site for our Community Tue, 13 Apr 2021 17:26:41 +0000 en-US hourly 1 https://www.itsecurityguru.org/wp-content/uploads/2019/12/cropped-Guru_Transparent-PNG-1-32x32.png TweetChat Archives - IT Security Guru https://www.itsecurityguru.org/category/events/tweetchat/ 32 32 Tweet Chat: The Social Dilemma https://www.itsecurityguru.org/2021/04/12/tweet-chat-the-social-dilemma/?utm_source=rss&utm_medium=rss&utm_campaign=tweet-chat-the-social-dilemma Mon, 12 Apr 2021 15:31:54 +0000 https://www.itsecurityguru.org/?p=40948 Released in 2020, the documentary-drama, ‘The Social Dilemma’, offers a thought-provoking and alarming depiction of our reality today. The film exposes the ruthless nature of tech giants seeking to reinforce marketing algorithms for monetary gain and the consequences that have emerged as a result; from eliciting mental health issues and nurturing addictions to promoting the […]

The post Tweet Chat: The Social Dilemma appeared first on IT Security Guru.

]]> Released in 2020, the documentary-drama, ‘The Social Dilemma’, offers a thought-provoking and alarming depiction of our reality today. The film exposes the ruthless nature of tech giants seeking to reinforce marketing algorithms for monetary gain and the consequences that have emerged as a result; from eliciting mental health issues and nurturing addictions to promoting the spread of fake news, and threatening democracy.

Whilst it certainly offers a somewhat biased, or one-sided take on the social media phenomenon, the film nevertheless raises a number of important concerns that are worth addressing.

As part of Eskenzi PR’s latest initiative, the Eskenzi Cyber Book & Film Club, cybersecurity and cyberpsychology experts were invited to take part in a Tweet Chat to discuss some of these very issues. Specifically, we were joined by Brian Higgins, Director at ARCO Cyber Security and Security Specialist at Comparitech; Anete Poriete, UX Researcher and Cyber Psychologist at CyberSmart; Madeline Howard, Director at Cyber Cheltenham (CyNam); and Neil Stinchcombe, co-founder of Eskenzi PR.

To read up on all of their insights, check out the Eskenzi Twitter or look under the hashtag #EskenziClubSD !

What is the biggest problem with social media?

In the same way the documentary began, the event kicked off with a rather broad question:

“What do you think is the biggest problem with social media today? Is there a problem?”

A general consensus suggested that a lack of regulation and ownership of responsibility has played a central role in the failings of social media.

For Brian Higgins, part of the problem can be attributed to our ignorance. Indeed, if we are unaware that we are in the matrix, how can we then solve the issue, let alone recognise the problem in the first place?

Social Media: Tool or Manipulation Instrument?

During the film, Tristan Harris, former design ethicist at Google and co-founder of Centre for Humane Technologies, suggested that we had “moved away from a tools based technology environment, to an addiction and manipulation used technology environment. Social media isn’t a tool waiting to be used. It has its own goals, and it has its own means of pursuing them by using your psychology against you.”

The argument suggests that algorithms and artificial intelligence are increasingly adept at understanding who we are, and are leveraging this knowledge to curate our reality as well as influence our thoughts and decisions.

In addition to algorithms, however, is the platform offered to ‘influencers’.

Unfortunately, it seems our habit of consuming bite-size information has also made us conducive to being manipulated as both our attention spans and critical thinking are negatively impacted.

To Intervene or Not to Intervene

Recognising the imperfect nature of social media design then, we wondered if intervention by tech giants is required, particularly with regards to disinformation/misinformation.

Yet, the issue of misinformation is not always clear cut. In fact, a recent study conducted by Facebook suggests that it is not necessarily false information that creates problems but content that doesn’t “outright break the rules”.

The study sought to understand the spread of ideas on social media and how it was having an impact on Covid-19 vaccine hesitancy. Despite banning false and misleading statements about the vaccine, many statements including expressions of concern or doubt, are often too ambiguous to be removed but have been found to play a harmful, contributing role to hesitancy. This is especially true when the message is promoted by influencers and are concentrated within like-minded communities, acting as an echo chamber.

Anete Poriete explains this further:


To address the issue, Madeline Howard believes proactive engagement is necessary.

This then led us to question whether it is ever okay to amplify a message.

The Privacy Paradox

The news is full of concern about privacy, we all think of it as very important, but the way we act in reality is often contradictory. There appears to be cognitive dissonance in that we claim to value our privacy, and yet we continue to engage in services such as Facebook, that undermines it. Moreover, we often choose to overshare details of ourselves and our lives on such platforms.

Interestingly, our offline behaviours also make us susceptible to cybercrime.

Recommendations and Solutions

To conclude the Tweet Chat, we asked the experts what they thought about the use of verified ID in helping to make us safer online and the concept of ethical-by-design.

In response to verified ID, the verdict was clear that it would encourage accountability. Nevertheless, as Anete points out, anonymity can also serve as a safety measure. As such, ID verification should be subject to choice. Neil added that the security of one’s identification should also be considered before ID verification is implemented on a wider scale.

In respect to the concept of ‘ethical-by-design’, it was agreed that ethics is ever-evolving and subjective; and should, therefore, be regularly evaluated. The key is in ensuring that technological design is working in the user’s best interest and operates with transparency.

A Concluding Note

While the Tweet Chat mainly focused on the negative consequences of social media, it is important to recognise that it has also brought us many benefits which cannot and should not be neglected. We just hoped this discussion provided you with some food for thought.

The post Tweet Chat: The Social Dilemma appeared first on IT Security Guru.

]]> Fake news, disinformation and cybersecurity https://www.itsecurityguru.org/2020/11/03/fake-news-disinformation-and-cybersecurity/?utm_source=rss&utm_medium=rss&utm_campaign=fake-news-disinformation-and-cybersecurity Tue, 03 Nov 2020 11:47:51 +0000 https://www.itsecurityguru.org/?p=38758 The spread of fake news and the rise of disinformation is plaguing the modern world by destroying the very fabric that is keeping our society safe and democracy standing. Separating fact from fiction has never been harder, and with the popularity of social media misleading information is spreading like wildfire. It is swaying elections, distorting […]

The post Fake news, disinformation and cybersecurity appeared first on IT Security Guru.

]]> The spread of fake news and the rise of disinformation is plaguing the modern world by destroying the very fabric that is keeping our society safe and democracy standing.

Separating fact from fiction has never been harder, and with the popularity of social media misleading information is spreading like wildfire. It is swaying elections, distorting truth and putting people in harm’s way. So, what can be done to ensure there is balance between free speech and the accuracy of information shared? We asked a panel of experts to discuss this further in a live Tweet Chat as part of the wider Security Serious campaign Action Against Disinformation.

The panel:

  • Neira Jones – Fraud, Cybersecurity and FinTech Consultant
  • Madeline Howard – Socio-Technical Engagement Manager at Cygenta
  • Tony Morbin – IT Security Guru Editor
  • Eoin Keary – CEO/Founder at Edgescan
  • Javvad Malik – Security Awareness Advocate at KnowBe4

Firstly, we asked the panel what Fake News meant to them and had they ever been duped. Seeing as these are professionals from a variety of roles within the cybersecurity industry, it was interesting to see their reactions with some even admitting to being duped:

Funnily enough, a hoax story regarding the re-formation of Highstreet retailer Woolworths was circulating in the news and on social media on the same day as the tweet chat which clearly shows the reality of fake news today:

But what role do algorithms, bots, and trolls play in the spread of fake news and disinformation? They are often considered the devious messengers designed to mislead the masses…

The media landscape has also changed, and we seem to have transcended into a culture whereby news has started to be driven by content designed to draw responses and interest

from the public which would encourage them to then click on the titles of the aforesaid pages. This has quickly introduced the click-bait culture which has certainly blurred what we now view as ‘news’.

When we think of fake news and disinformation some will assume it just affects the mainstream media but in truth it can impact any industry. So, has it crept into the cybersecurity sector and what lengths have our panellists gone too in stopping it?

Given the negative impact fake news has, should it be viewed as a cybersecurity threat? When you observe how it is used, it can damage the reputation of an individual, organisation or country while also having the ability to manipulate opinions – both of which can lead to wrongfully harming the entity in question either physically or financially. So, what role can the cybersecurity sector play as a whole in preventing its spread?

While it appears further education and raising awareness to the issue of fake news is important in thwarting it, what would be the best solution to better regulate what information and news is posted to the public?

To close out the discussion, we wanted to find out how much fake news has impacted the notion of free speech. It’s a dilemma we currently face, and while we agree it’s a balancing act, it seems to be spiralling out of control as the demand for more information grows…but is it necessarily the right information that is getting published and how much is being construed as opinion?

Lastly, will we see a time where Free Speech exists without Fake News…most have an optimistic view:

While we deal with the global pandemic, it is clear that we are also fighting against the virtual disease that is fake news & disinformation. Thankfully there are those that are making a stand and the Action Against Disinformation campaign as part of Security Serious Week 2020 has brought the topic to the forefront to make more people aware. Education is key and source checking can go a long way to ensuring you are well informed. To view all the content related to Security Serious Week 2020, click here.

The post Fake news, disinformation and cybersecurity appeared first on IT Security Guru.

]]> Tweet Chat: Exploring the hidden world of Shadow Code https://www.itsecurityguru.org/2020/09/21/tweet-chat-exploring-the-hidden-world-of-shadow-code/?utm_source=rss&utm_medium=rss&utm_campaign=tweet-chat-exploring-the-hidden-world-of-shadow-code Mon, 21 Sep 2020 12:30:29 +0000 https://www.itsecurityguru.org/?p=37889 In the latest IT Security Guru Tweet chat, we were joined by PerimeterX, a leading voice in the world of application security, and a host of other voices from across the Infosec spectrum: Analysts, technical experts, members of the C-suite and professional bodies came together to discuss the emergence of shadow code, a new term […]

The post Tweet Chat: Exploring the hidden world of Shadow Code appeared first on IT Security Guru.

]]> In the latest IT Security Guru Tweet chat, we were joined by PerimeterX, a leading voice in the world of application security, and a host of other voices from across the Infosec spectrum: Analysts, technical experts, members of the C-suite and professional bodies came together to discuss the emergence of shadow code, a new term to describe the use of third-party scripts in applications, without authorisation or safety validation. Our assembled influencers came ready to discuss this hidden world, and below is a snippet of the insights they provided. To take a look at the full results of the Tweet Chat, simply head to the IT Security Guru Twitter, or look under the hashtag #ShadowCode. 

What is shadow code?

Our influencers seemed broadly aware of the term of shadow code and displayed an understanding of the term. The next challenge for those hoping to defend against the issues brought about by shadow code will be to encourage the term to go mainstream within technology circles, in the same way that ‘Shadow IT’ has become a term omnipresent in technology, developer and security circles. 

Why should we care?

Here, our influencers make the case for an understanding of shadow code across the business. Making the point that data breaches or compliance issues can lead to diminishing brand reputation, PerimeterX CMO Kim DeCarlis flew the flag for marketing professionals gaining an awareness of shadow code, and working with security and IT teams to ensure that code is reviewed and tools are implemented in order to protect the brand. 

Jamie O’Meara, who heads up global partner solutions at Snyk also made the point that a businesses website is the access portal by which customers are found, dealt with and hopefully, retained – as good a reason as any to understand and be aware of the potential issues caused by shadow code. 

The security implications

Here we see a discussion of a much-forgotten element of the shadow code discussion: It does have some positives. Kim DeCarlis suggests that the agility that using Shadow Code can provide can be potentially helpful. 

However, from an infosec perspective, we still see the negatives outweigh the positives. Quentyn Taylor, who heads up information security for Canon in Europe, makes the connection between shadow code and supply chain security, suggesting it is perceived as this it might escape the more rigorous auditing other areas of the business might be subjected to. Ameet Naik of PerimeterX summed the concerns up succinctly too, stating that “You cannot secure what you cannot see.”

Shadow Code and job function

The influencers here wax lyrical on the subject of how different job functions are affected by shadow code. As the resident CISO in the room, Quentyn Taylor suggested that the impact is more stringently felt on the DevOps side, and that Shadow code presents both an opportunity and a risk or CISOs. 

The RH-ISAC made the case for shadow code not always being as a result of malicious activity, stating something that a developer is simply on a deadline, and needs to finish the job fast, which in itself speaks to the skills gap in security and IT teams, and the far-reaching consequences. 

Shadow code in the real world

Bridging the gap between the infosec world and the real world, here we see our influencers discussing how this has impacted people in the real world! The infamous Magecart cybercrime syndicate was listed as a main example, with attacks aimed at Best Buy and Delta also referenced. 

Who needs to be the most concerned?

Question 6 asked who has the most at risk from shadow code. With more mature security postures found in financial and healthcare organisations, e-learning is identified as one area which has a less mature security posture, but a staggering amount of PII in their digital ecosystems. 

It’s worth hammering home the point however, as Kim DeCarlis did, that any business using shadow code to speed up their time to market is at risk. 

Moving forward: How to mitigate 

Here, the advice was as you might expect: Review, understand and monitor. RH-ISAC, PerimeterX’s Ameet Naik, and security analyst and author Richard Steinnon all recommended surveying and monitoring, as well as having increased visibility as ways to mitigate the risks associated with shadow code. 

Are CSPs enough?

In the most technical aspect of the chat, Quentyn, Richard and Ameet discussed content security policies, and whether they are enough to protect from shadow code, concluding fairly comprehensively that while a CSP is useful from an authorship and source perspective, it cannot tell what the code actually does: It is not a “set and forget” solution.

Shadow code and legislation

Discussing whether the recent legislative trend towards protecting consumer data, as encapsulated by the CCPA and GDPR legislations passed will have any effect on shadow code, our influencers agreed that the legislation is far too new for us to have a true impact. They also highlighted how some of the world’s biggest brands – Marriott Hotels, British Airways – thought they were compliant, but were sorely mistaken. 

What will the future hold?

We saved the big question for last: What now? All of our influencers agreed that shadow code is not going anywhere, with carrying degrees of optimism: While Quentyn Taylor suggested that “This will be a issue that will get far worse before it gets better” due to the products that can’t be update, Richard Stiennon was more positive in his outlook, stating that signing code would be a great start. 

Jamie O’Meara argued the natural proclivity for change and development in Application development will mean we are likely to see far more shadow code over the next decade, and Kim DeCarlis agreed that the desire for speed and agility in web development means that shadow code is absolutely not going anywhere soon! 

To find out more about shadow code, and how your business can defend against it, please visit the resources on the PerimeterX website.

 

 

The post Tweet Chat: Exploring the hidden world of Shadow Code appeared first on IT Security Guru.

]]> Tweet Chat Roundup with KnowBe4 https://www.itsecurityguru.org/2020/08/05/tweet-chat-roundup-with-knowbe4/?utm_source=rss&utm_medium=rss&utm_campaign=tweet-chat-roundup-with-knowbe4 Wed, 05 Aug 2020 10:41:21 +0000 https://www.itsecurityguru.org/?p=36761 We are now more than halfway through the year, and what a crazy half it has been, both in terms of the global pandemic but also when you consider the volatile climate that the cybersecurity industry finds itself in. We wanted to find out what trends had been seen, how organisations should go about ensuring […]

The post Tweet Chat Roundup with KnowBe4 appeared first on IT Security Guru.

]]> We are now more than halfway through the year, and what a crazy half it has been, both in terms of the global pandemic but also when you consider the volatile climate that the cybersecurity industry finds itself in.

We wanted to find out what trends had been seen, how organisations should go about ensuring security is being kept as a priority, the impact Covid-19 will have and the importance of having a strong security culture during this time of uncertainty. To help us answer these questions, we were joined by KnowBe4’s security awareness evangelists. KnowBe4 is the provider of the world’s largest security awareness training and simulated phishing platform so they are best placed to give the necessary insight into the phishing trends which was where we started the Tweet Chat…the evangelists were certainly happy and eager to get started…

 

Noticeable trends and surprise tactics used by Hackers

Will we see a rise in DeepFakes?

We then moved onto the impact the pandemic will have given that face-to-face contact will be limited for the time being and how criminals will leverage this for their own nefarious means…

 

Humans will continue to be important

We then transferred the discussion to the vital role the human workforce plays in keeping organisations safe, especially when facing out of the ordinary threats seen today. Technology will always have its place in cybersecurity, but the importance of the human factor cannot be underestimated. Yet, this also begs the question: how much should be spent on technology vs training?

Digging deeper into the training aspect of security, many may overlook the significance security awareness plays in the overall protection of an enterprise. Is there a perception that security awareness training is not necessary?

It also created a discussion amongst the evangelists as can be seen in this thread:

Surviving the current waves of cyberattacks requires the implementation of strong security culture – this should be paramount, but who within an organisation should be leading the way for this approach and how can one measure if they actually have a solid security culture foundation?

Lastly, we moved onto password security.

We continuously read about poor password practises, whether its password reuse or sharing it with another person. So, has the password become obsolete or is there a future for this common layer of security?

If you agree or disagree or wish to continue the discussion, feel free to reach out to the Guru or any of the KnowBe4 evangelists on twitter with your thoughts.

 

The post Tweet Chat Roundup with KnowBe4 appeared first on IT Security Guru.

]]> Tweet Chat: The Human factor in Security https://www.itsecurityguru.org/2020/06/15/tweet-chat-the-human-factor-in-security/?utm_source=rss&utm_medium=rss&utm_campaign=tweet-chat-the-human-factor-in-security Mon, 15 Jun 2020 14:33:55 +0000 https://www.itsecurityguru.org/?p=36077 In our first-ever IT Security Guru Tweet Chat, we were joined by Javvad Malik, Dr. Jessica Barker, Mo Amin, Ed Tucker and Lisa Forte as they debated the human factor in security. These leading figures from within the cybersecurity community, whom have a wealth of experience and are best placed to talk about the importance […]

The post Tweet Chat: The Human factor in Security appeared first on IT Security Guru.

]]> In our first-ever IT Security Guru Tweet Chat, we were joined by Javvad Malik, Dr. Jessica Barker, Mo Amin, Ed Tucker and Lisa Forte as they debated the human factor in security. These leading figures from within the cybersecurity community, whom have a wealth of experience and are best placed to talk about the importance of the human element, are deeply passionate about this widely discussed topic.

Too much technology?

We began with a question that focussed on technology and the pivotal role it is playing within cyber today. It could be said that organisations have become too dependent on this component of security. But why? Well, the community certainly feel that technology offers an element of convenience that perhaps humans can’t provide.

You are the weakest link, goodbye

Humans also have the added stigma of being referred to as the ‘weakest link’ within security, and so this reliance on technology may seem justified. Yet, by disregarding or not addressing this mindset, organisations are essentially missing the chance to solve a critical problem within the overall security of their organisation, especially as the human factor is essential for any business. Building education and awareness from within is key.

What resources should be prioritised?

We then asked whether businesses are investing their resources in the wrong places to tackle security and if compliance was driving this? With global data security and privacy regulations severely punishing those found non-compliant, there is a strong possibility that many business decision-makers wrongfully believe that being compliant automatically means the business is secured.

What is more detrimental – poor knowledge or poor security?

Next, it was time to find out what the security community viewed more dangerous for a business: a cyber unaware workforce or a security system that has been misconfigured. Well it depends…

CISO/Security Leaders take note

Where do CISO’s and security leaders go wrong when trying to obtain sufficient backing from the boardroom to enable them to build a security programme? it is clear they have an up-hill battle convincing management on how to invest when it comes to security.

Invest is needed, but make it the right investment

But what happens if investments are made? We still continue to see data breaches and successful cyberattacks plague organisations of all sizes. So, why shouldn’t we lose hope? Where should CISOs and security leaders focus their efforts?

Building a security culture

For security professionals looking to establish a strong security culture or at least have a platform to build from, here is some advice from our panellists:

To close the chat…

The previous questions generated a great discussion and provided insight around the difficulties, problems and issues security professionals are faced with when trying to tackle cybersecurity. But the last question nails home the significance and importance of having the human element in security.

And if you needed any more clarification as to why we shouldn’t solely depend on technology, I shall revert you to this reply…


If you were unable to make the Tweet Chat, no worries, simply follow the IT Security Guru or search the hashtag #ITSecGuru to see the Q&A.

The post Tweet Chat: The Human factor in Security appeared first on IT Security Guru.

]]>