Month: September 2018

Fortinet and IBM Security will collaborate through the bi-directional sharing of cyber threat information. The goal of the agreement is to proactively combat cyberthreats and threats to privacy globally through the sharing of contextual threat information generated by the Fortinet FortiGuard Labs threat research team and IBM Security’s X-Force research team. IBM Security and Fortinet will directly collaborate through bi-directional sharing of threat intelligence using secure channels. Joint threat information sharing will deliver deep security research expertise and global threat intelligence for increased protection for the customers of each company. IBM Security and Fortinet global threat research teams monitor and analyze security threats from a variety of sources, providing valuable and near real-time threat intelligence. By integrating the threat intelligence feeds from each company, customers will now benefit from more thorough data being available. Ongoing cooperation between Fortinet & IBM While the agreement formalizes the cooperation between Fortinet and IBM Security in regards to threat information sharing, both organizations have already been working together in regards to comprehensive security protections. IBM Security has been a Fortinet fabric-ready partner since 2017. Fortinet’s open approach extends the broad visibility, integrated threat prevention, and automated response of its security fabric architecture through well-defined APIs to IBM for unified security management and security incident response. In addition, Fortinet earlier this year announced collaboration with IBM on its IBM X-Force Threat Management Services. Working with IBM Security on X-Force Threat Management Services enables both organizations to further provide mutual customers with threat insight, attack detection and prevention, and an integrated defensein-depth strategy designed to seamlessly span across an organization’s entire attack surface. Caleb Barlow, Vice President threat intelligence, IBM Security said, “By entering relationships with trusted partners like Fortinet, IBM is able to construct a clearer picture of the global threat landscape. Today, threat actors are highly skilled, organized, well resourced, and able to operate globally and swiftly. In order to defend effectively, we must operate with that same speed and develop informed, accurate counter-measures. The kind of collective defense we’ve formed with Fortinet helps IBM better protect clients and communities by equipping us with additional intelligence that enables us to respond to emerging threats more quickly and more completely.”  

Ozone Enterprise Group, an Everstone PE Capital funded company and leading player in the Architectural Hardware industry, announced its acquisition of ‘WallCam,’ a company engaged in security and surveillance business in India. The acquisition will make ‘WallCam’ a fully owned subsidiary of Ozone. The acquisition process, which is in its final stage, will be completed soon. Ozone sees a lot of synergies in the business with its existing business lines, and will accelerate and strengthen WallCam’s model of working through its R&D, manufacturing and re-seller partners. Ozone has a diversified presence in architectural hardware, safes & vaults, locks, fire & safety doors and urban furniture. The brand is among the top 3 players in safes and locks in the country. The group has been actively exploring options to diversify into new businesses, security and surveillance being one of them. Talking about its business aspirations, with its aggressive growth and diversification plans, the group is eyeing Rs.1,000Cr turnover by FY 2021. The company plans to invest over Rs.100Cr in next 2 years on diversification primarily on building manufacturing capability for CCTV cameras and other security and surveillance products and IoT in India. Ozone Group already has international tie ups for product and software and are also looking at fresh equity influx to fund expansion in electronic security and surveillance business. A significant amount of this equity influx will be dedicated for a greenfield manufacturing unit for electronic security and surveillance under the ‘Make in India’ initiative of the Government. “Security and surveillance is one of the fastest growing industry in India. The market size of the industry from the current $1Bn is likely to grow 2.5 to 3 folds by the end of 2021. We have been actively exploring options to diversify into this industry and after contemplating both organic and inorganic options, we finally narrowed down on taking the inorganic route with the WallCam acquisition. We are all geared up to make the most of the market opportunity and will soon be seen as one of the prominent players in the market,” said Mr Aggarwal. Ozone’s solution centric approach has enabled them to grow from a start-up to becoming India’s most popular architectural hardware solution provider, which has been able to prove its worth in international markets. The company has a global presence across 15 countries, 4 R&D centres in Israel, Korea, China and India, and 4 state-ofthe-art factories in India and China. Ozone offers internationally certified products & solutions through its product portfolio of more than 3000 SKUs across various product categories. Ozone has strong presence internationally with offices in India, Canada, Australia, Dubai and distributor’s network in Poland and Saudi Arabia. “The idea behind acquiring WallCam was to give a head-start to our diversification plans, get accesses to WallCam’s existing business, the brand, sales & distribution network. We are excited about this new move as it is in synergy with our growth ambitions and abilities” – Alok Aggarwal Founder & Managing Director, Ozone Enterprise Group  

Infochips (an Arrow Company) has launched Eragon 660 and 625 modules for companies to accelerate the time-to-market for products using the Qualcomm SDA660 and Qualcomm APQ8053 processors, respectively. The addition of these Qualcomm Technologies’ processors to the Eragon 600 series allows eInfochips to address the growing demand in advanced computing and video processing on handheld devices. “This work with eInfochips allows large numbers of innovators to create exciting products and solutions using the technologies that transform how the world connects, computes and communicates,” said Joseph Bousaba, Vice President of product management at Qualcomm Technologies, Inc., “These Eragon 660 and 625 modules from eInfochips deliver new and advanced capabilities that developers can use to participate in the large and growing IoT opportunity.” Eragon 660 and Eragon 625 modules can work as building blocks for embedded products requiring solutions for gaming, 4K camera, smart HMI, digital signage, medical imaging, and more using on-device AI. The Qualcomm SDA660 processor at the heart of Eragon 600 is a powerful processor, featuring the Qualcomm® AI Engine, Qualcomm Spectra™ 160 ISP, Qualcomm® Kryo™ 260 CPU and Qualcomm® Hexagon™ 680 DSP with vector extensions. At the same time, the Qualcomm APQ8053 which powers Eragon 625 is designed to provide fast connectivity, vibrant visuals, and exceptional performance for immersive experiences. The Eragon 660 and 625 modules come pre-integrated with Android, making them ideal for prototyping and parallel development of hardware and software solutions. “eInfochips offers custom hardware design and manufacturing solutions, based on Qualcomm Technologies’ processors, by leveraging comprehensive experience of 200+ designs and a strong ecosystem of contract manufacturers associated with Arrow Electronics. As an early adopter of technology, eInfochips is already engaged with its customers in the design and development of Smart HMI and IoT solutions based on the Qualcomm SDA660 processor,” said Parag Mehta, Chief Business Development Officer at eInfochips. eInfochips, an Arrow company, is a leading global provider of product engineering and semiconductor design services. The company’s service offerings include digital transformation and connected IoT solutions across various cloud platforms, including AWS and Azure.

A new report from Sophos says that since its first appearance in December 2015, the SamSam ransomware has raked in almost $6 million by targeting organisations and individuals around the world, including those in India. According to the 47-page report, 74 percent of the known victims are based in the United States. Other regions known to have suffered attacks include Canada, the U.K. and the Middle East, with India ranking sixth among the top victim countries across the world. The cybersecurity firm also revealed in a separate survey that 90 percent of the businesses in India have been either hit or expected to be hit by ransomware, and it’s expecting that Indian business will see an increase in cyber attacks in the near future, and SamSam ransomware could be one of them. One is not like the others Different from the traditional ransomware attacks, SamSam’s thorough encryption renders not only personal and work data files unusable but also any program nonessential to Windows operation, most of which are not routinely backed up. Unlike nearly all other ransomware attacks, much of the attack process is manual. Once inside a system, the attacker spread a payload laterally across the network; a sleeper cell awaits instructions to begin encrypting. The result of SamSam attacks is often that numerous victims are unable to recover adequately or quickly enough, and therefore decide to pay the ransom. You can’t secure what you can’t see While the infection method of the SamSam ransomware is still unclear, as always, cyber hygiene practic es should be the first line of defense. Preventing an attack (or being able to respond and isolate it quickly) requires a strong security foundation that is built on the complete visibility of the network. This pervasive visibility gives IT teams the ability to quickly identify potential exposures and attack paths. Skybox gives that visibility by consolidating data from more than 120 networking and security technologies that organizations have in use. The Skybox® SecuritySuite uses this information to create a dynamic model of an attack surface including physical, multi-cloud and OT networks where needed. The model provides context around all of the ingress/ egress points and complexities of the network and assets, thereby giving a detailed understanding of what a user is trying to defend. After building the model of the environment, Skybox will conduct a risk analysis to identify and prioritize weaknesses and vulnerabilities such as unprotected ingress/ egress points, misconfigured network devices, firewalls with overly permissive rules, exposed assets, exploitable attack vectors etc. Following the initial resilience assessment, the riskiest characteristics of the environment can be remediated to reduce risk quickly and in a demonstrable way – for example by addressing parts of the infrastructure for which there are no firewalls or where these are configured incorrectly; filling in vulnerability scanning blind spots; and recommending remediation and mitigation for high-risk vulnerabilities. Acting on this insight, the environment will immediately be more secure and resilient. If an attack or malware outbreak does occur, the user has a greater context to contain the attack quickly and eliminate the vectors.  

The key of the future is digital, and it offers more features than its analog predecessors – impossible to lose or steal, and there is never a need to search for it. That is because it is stored securely and specifically for each user in a smartphone app. “Our Perfectly Keyless app is making conventional vehicle keys a thing of the past. Bosch is taking the car key into the digital realm and making it available anywhere, anytime,” says Harald Kröger, President of the Bosch Automotive Electronics division. With Perfectly Keyless, the smartphone replaces the analog vehicle key. This concept can offer owners of private vehicles increased convenience, but where it really shines is in vehicle fleets with multiple drivers. No more key handovers – fleet managers and logistics providers simply use the app to give drivers access to the vehicles. “Bosch’s digital vehicle key gives fleets a boost towards greater connectivity,” Kröger says. The company believes there is a huge market for its solution, which is making its world debut at the IAA Commercial Vehicles in Hannover. The potential customers include some 15,000 logistics providers in Germany alone. Most of them manage at least a dozen vehicles and drivers. A keyless journey Row upon row of hundreds of keys hanging on large boards – logistics providers still often use this method to organize the keys to their fleet vehicles. A missing key triggers a massive search operation. But every minute counts, especially with commercial vehicles. After all, if a truck isn’t moving, it’s not making any money. At the core of the new system is an app that dispatchers and truck drivers both have on their phones. This makes it possible to grant vehicle access with just a few clicks. In the future, the Bosch solution will also allow logistics providers to completely integrate digital key management into their dispatch and scheduling systems. As soon as dispatch is assigned drivers and trucks to a route, the system automatically generates digital keys for the vehicles and sends them to the drivers’ smartphones. If the route scheduling changes, the software adjusts the keys accordingly. “Thanks to Bosch’s fully digital key management, logistics providers enjoy both security and flexibility in their planning. This is the only way the logistics of the future will be able to function efficiently,” Kröger says. Secure key management with app and cloud Bosch digital key management connects trucks and the smartphone app via the cloud. Dispatchers or fleet managers use the app to assign a truck to a driver for a particular route. Perfectly Keyless generates a personal, secure digital key and sends it via the cloud to the truck and to the driver’s smartphone. As the driver approaches the assigned truck, the sensors installed in the truck detect the smartphone via a wireless connection. The vehicle doors will open only if the key on the phone ‘fits’ the digital lock in the vehicle. These sensors can also tell when the driver is in the driver’s seat, and the engine starts up as soon as the driver presses the start-stop button. When the driver gets out of the car at the end of the journey, the system detects this and automatically locks the doors. Battery dead – No problem But what happens if the smartphone’s battery dies, or the device has gone missing? In the future, the vehicle key in the smartphone will work even if the phone battery is dead. In that case, the phone and truck will communicate using near-field communication (NFC), a wireless protocol for sharing data over short distances. Bosch plans to make it the ‘double hull’ of its solution. If the smartphone is lost or stolen, and the app with it, the digital key can be simply deactivated online, thus blocking access to the vehicle. It cannot be opened and started until the fleet manager uses the app to provide another driver or a new phone with access to the truck.

Oscar Wild in 18th century, wrote a play called, ‘Importance of being Earnest.’ The play talks about a wealthy gentleman called Jack, who uses the name of Earnest when visiting a different town. Jack’s friend Algernon (Algy) also christens an imaginary friend Bunbury. The author clearly points towards the different lifestyle that Jack lives when he switches the name. Both the characters indulge in deception, created by the two names, or the imaginary friend as per their convenience highlighting the importance of being Earnest. Earnest in English language is defined as a thing intended or regarded as a sign or promise of what is to come. The intended satire of this English classic, although first performed in 18th century fits in modern day cookie world also. The websites or the web tools use cookies to predict what you would like to see. Cookies are actually given to a browser by the server. These cookies, then help the website to determine your interests, your likes, your dislikes etc. So if you have searched for a thing on the web and find ads related to it when you are visiting social media platforms, it’s just your cookies telling your social media about your likes and dislikes. The social media is a small part of our daily life. We are living in a globalised world, where the distance is just a number. IT has revolutionised the way we communicate, the way we spend our time, the way we shop, and most importantly the way we work. We are living a data driven life, making data an important tool. Imagine, if just like our social media platforms, our work and related data are also used to predict what we wish to do. The indication in itself has two faces. One points towards Business Intelligence (BI) wherein the data is used to automate our daily process and the other points towards data access provided to users without our consent, commonly known as data leakage. The problem is exactly as has been raised in the play. Can we trust the web resources we have been relying upon? For BI the data moves in order to generate meaningful analysis, which can support business decisions, but the business is aware of the data movement and expects it to be turned into meaningful results. Apart from BI also, a huge amount of data flows from and within the organization. Be it through mail, phone calls, messages or marketing brochures. We are sharing the data, and if we are sharing the data, then what harm would a web portal sharing the data do? The answer to the dilemma is simple – when we share the data or the information, we are in total control. We can control the level of information that we share, as well as decide the receiver of the information. But in the case of our tool sharing the information, there is no control over what will be shared or how much would be shared. Recently, a social media giant was questioned for data privacy in the US. The organisation under question has a user base of millions and is a global brand. The brand is famous for not generating its own content, but has been accused of selling the customers’ information to a third party. The case for now seems to be confined to just social media, but if a similar thing happens with the web tool that we use for our official purpose, it will be a nightmares for business stakeholders. The impact of the harm from data leakage is hard to anticipate, and when we look at private security organisations the scenario turns into a complex equation. The organisation’s biggest resource is manpower which is exposed to high attrition. The manpower moves from agency to agency, and agencies are looking for guards. Hiring new guards brings training cost with it, making new hiring an expensive business. Along with the industry specific risk, the industry also faces the generic risk of exposing their contract/ tender value which can pose a direct danger to the agency’s income. The damage is not restricted to the private security organisation only but to the customer also. The customers hire private security agencies in order to protect their premises, but if the information such as guard allocation is out it can jeopardise customer’s security also. Specific to private security industry, a contradictory statement that is often heard in the industry is that the private security industry in India is highly unorganised. The ‘unorganised’ in the statement refers to the minimal usage of process solutions streamlining daily operations of the industry. But the statement is deceiving in its own terms. Most of the private security agencies rely readily upon available solutions. The commonly used solutions do not have any encryption and generate data in a format which can be easily transferred. The lack of encryption and easy availability of the solution makes the data prone to leakage. Some of the agencies have opted for offline solutions which, unlike the readily available solutions, are agency specific. These solutions need to be maintained in-house only. The private security agency has its expertise in manned guarding, and for an agency to invest in their solution maintenance is more of a cost than investment. Moreover, the technology changes rapidly, and the in-house software are often found lagging behind the latest technology, turning them into a burden for the agency rather than a solution. Cloud computing has revolutionised the world and looks like a perfect solution to the needs of the industry. Private security agencies should be able to relate to cloud computing more than any industry. Cloud computing is like giving our data to an expert to keep it secure and provide the authorised access whenever requested. Cloud solution providers deal in data and thus are well equipped to secure the data. There are solutions in the market which can work as a bridge between the agencies’ daily operations and cloud servers. These solutions…

With the growing number of schools in the United States with video surveillance, electronic access control and other traditional security systems, the number of potential ‘greenfield’ projects for suppliers falls. Declining numbers of new security system installations will lead to slowing market growth over the next five years. Even so, security manufacturers are looking to implement the following new security technologies to improve school safety, which would also help reignite market growth. HIGHLIGHTS The education sector of the market for security equipment and services reached $2.7 billion in revenue in 2017. As most schools have already implemented surveillance systems and access control systems, the market is expected to grow an average of just 1 percent annually, reaching $2.8 billion by 2021. According to survey data from the National Center for Education Statistics, the proportion of schools deploying video surveillance systems has risen from 20 percent in 1999 to over 70 percent in 2013. Likewise, the proportion of schools actively controlling the entrances to their buildings has risen from 75 percent to over 90 percent. Despite advancements in the level of security used on school premises, the number mass shootings at US schools has remained relatively constant throughout the past 30 years. When looking specifically at secondary schools, the number of mass shootings has reached an unprecedented high in the past five years. New technologies are currently being investigated to improve safety at schools, including facial recognition, logical and physical security identity management integration and high security classroom doors. Facial recognition technology Many of the video surveillance systems currently used in schools are not actively monitored and also lack any form of effective automated response. Adoption of facial recognition technology would allow the surveillance system to proactively search for potential threats and alert school administrators and security staff about unrecognized individuals in the building. Unfortunately, affordable facial recognition technologies are often unable to adequately recognize the number of faces in a typical school; plus, these systems can place a large strain on a school’s information technology network. Logical and physical security identity management integration Integrating the school’s access control database with a higher authority logical database – for example, a student directory – would allow the access rights of former staff, and students who have been expelled or already graduated, to be removed automatically. However, access control providers may find it difficult to get permission to access student records and other sensitive data. Education administrators may also be uncomfortable with possibly creating a potential avenue of cyberattack. High-security classroom doors with multipoint looking systems Higher-grade doors would create a far more effective barrier between students and potential attackers, creating numerous safe spaces throughout the building in emergencies. It’s also true, though, that purchasing thousands of doors would be expensive. Fire regulations often dictate that key entrances and exits remain fail-safe during emergencies. Locking and unlocking doors multiple times would also disrupt teaching. Weapons checks using metal detectors or x-ray machines at school entrances Using metal detectors or x-ray machines at entrances along the school perimeter makes bringing weapons into the school much more difficult. However, schools often have multiple entrances, which means each school would require multiple detectors or x-ray machines – both of which are expensive. The school would also need to hire additional security staff to operate each machine. Securing entrances in this manner would also mean long queues would form after breaks and lunchtime, reducing the free time of students and staff. Access Control Intelligence Service Entering its fourth full year, the IHS Markit Access Control Intelligence Service provides primary analysis of the equipment market, plus thorough investigation of key technology trends affecting the industry. Current topics of focus include: mobile access, logical and physical identity management integration, adoption of biometric technology and security system convergence. By Jim Dearing Security and Building Technologies, Senior Analyst, IHS Markit