Category: Feature

By Colonel B S Nagial (Retd) The concepts of soft and vulnerable targets, hard targets, and crowded public places have recently come into daily use in the counter-terrorism platform. These concepts are not included in any international legal framework. Soft and vulnerable targets such as sports complexes, shopping sites, schools and education institutions, and transportation systems, are easily reachable to large numbers of people and have limited security or protective measures in place, making them vulnerable to terrorist attacks. By attacking these targets, they (terrorists) can cause maximum destruction to life and property without much going into the detailed planning, training and mobilisation of resources. Terrorists want the maximum media attention should be drawn to such incidents. To a greater extent, the concept of ‘soft-targets’ overlaps with that of crowded public places, wherein the high density of the population gathers temporarily or permanently. This high density of the people in a place acts as a specific factor of vulnerability or attractiveness of inimical elements in society. Soft-target is usually differentiated from the critical infrastructure, which may be soft or hard target, secured or unsecured. But the disruption of critical infrastructure can potentially cause extensive negative impacts on the security and social-economic wellbeing of the society/ community. Critical infrastructure must be protected by the country’s security and law enforcement agencies. Therefore it is indispensable to distinguish between critical and non-critical infrastructure based on the severity, duration, geographical scope and economic consequences of disruptive events. The needs of site operators predict the protection of critical infrastructure and soft targets, and public authorities must follow the risk and crisis management approaches. The interplay between critical infrastructure and soft targets is a multidimensional area which needs policy, institutional and operational coordination. Threats envisaged The presence of persistent terrorist threats against places where a large number of people gather is generally highlighted by the country’s security and law enforcement agencies. So that the public is made conscious of such vulnerabilities, terrorists may shift their attention to soft targets if the security of hard targets is heightened to make them more secure and protected. For example, as the civil aviation sector responded to the threat of terrorists by adopting pre-board security measures, the terrorists shifted their attention to surrounding places. Similarly, there has been an increase in knife and heavy vehicle attacks, breaking away from the use of armed individuals or teams of gunmen accepting lesser casualties. The possibility of terrorists seeking to employ lethal weapons to cause significant destruction on soft targets can’t be ruled out. The best examples of using lethal weapons are the sarin gas attack on the Tokyo subway in the Air India Flight attack in 1985, 1995, 9/11, Mumbai 26/11 attack, etc. Another reason for terrorist attacks against soft targets is to take hostage of people to press their demands. The nature and level of threats against soft targets are influenced by local factors and the intent of terrorists to inflict damage to life and property. The choice of terrorists depends upon personal grievances, the site’s perceived threats, the crowd’s presence, security measures in place and the target’s proximity to their operational area. An analysis of past terrorist attacks worldwide has indicated the following significant forms of terrorist attacks. All these need to be considered and addressed if we want to design an efficient security system for the protection of soft targets against terrorist attacks in future: Exploding a bomb. Suicide bombing attacks. Bomb delivered by mail. Bomb in a parked unattended vehicle. Car bomb driven by a suicide attacker running into the target. Arson. Gun attack. Hostage and barricade situation. Attack with a knife. Crowd attacking a soft target. Vehicle running into the target. Soft targets face threats of numerous types by individuals or groups driven by various motives. To create an efficient and secure environment, it is imperative to deal with the threats thoroughly and consider the available security measures to blunt the attackers’ modus operandi. Protection of soft targets Soft targets comprise a vast and diverse group of subjects. The fundamental principle for protecting soft and vulnerable targets against terrorist attacks lies in the coordinated security planning by all the stakeholders at the national and local levels. United Nations for Disaster and Risk Reduction (UNDRR) describe ‘risk management’ as a systematic approach to managing uncertainty and minimising loss. While forming a security system for a particular soft target, the first step is to make clear what is to be protected. Consequently, we initiate the process by defining the entities we value and do not wish to lose or get them harmed. Secondly, it is necessary to define the likely sources of threats to soft and vulnerable targets. To do so, we need to analyse earlier such incidents. Thirdly, then it is imperative to forecast the possible forms of the attacks. Without sound analysis of potential dangers, the security system will not be effective and may lead to wasting prime resources at disposal. All incidents in question need to be handled in three stages – Before, During and After the incident. Before Incident Take preemptive measures to diminish the likelihood of an attack, enhance the rapidity and intensity of the response, reduce the seriousness of impact and facilitate recovery. Use tools to deter attackers and create ways and means to divert the attack if it can’t be avoided. Use communication to de-escalate and calm down a threatening situation and minimise conflict. During incident Early detection of objectionable activity or transgression of restricted zones, ideally before the attack has begun. The quick response of the ‘Security Personnel’ or other members of the security system, preferably following a Standard Operating Procedure(SOP).’ After incident The management deals with the situation as described in the pre-defined coordinated plan as per the SOP, with clearly defined priorities for each post-incident phase. Fast recovery from the occurrence. Particular attention should be paid to a method known as DDRMI (Deter-Detect-React-Mitigate Impact). This is a unique tool to assess the efficiency of security measures adopted. Prevention…

National security is the bedrock of a sovereign state’s stability and development. For India, a country with a vast population and a rich tapestry of diversity, achieving a robust national security culture is not only paramount, but a strategic necessity and an existential imperative. A nation characterized by its vast diversity in culture, religion, caste, creed, and community, stands as a testament to unity in diversity. However, this very diversity makes India highly vulnerable to internal and external threats, particularly from deep state actors seeking to exploit these differences. Building a robust national security culture is crucial for safeguarding India’s ethnic integrity and sovereignty. This is the sole reason why fostering such a culture is essential to eliminate and marginalize such elements who create fissures within the social framework. “A nation’s security is fortified by its internal cohesion and the ability to embrace diversity as a strategic advantage” –– Chanakya

Harikrishna Prabhu, COO, TechnoBind Data is the core of any business. Data is crucial for addressing client needs, running business operations, reacting to unexpected events, and responding to quick market movements. This makes data protection and management a high criticality for businesses. The increasing uncertainty around ransomware attacks raises this concern for data protection even higher. Data protection should indeed be the prime focus for today’s businesses. According to recent Thales research, phishing, ransomware, and malware continue to be a major problem for multinational corporations. One in five (21%) businesses have fallen victim to a ransomware assault in the past year, with operations significantly impacted in 43% of those cases. Multiple loopholes in security infrastructure and pandemic-induced disruptions are the major contributing factors to the wider spread of ransomware attacks. Data exfiltration, also known as ‘double extortion’ ransomware, is becoming a widespread method used by many ransomware criminal groups, where they exfiltrate a victim’s sensitive data in addition to encrypting it giving them additional leverage to collect ransom payments. Again, ransomware attacks are no longer prevalent in one sector of businesses. It is rather devastating for SMEs, small businesses, and non-profits, who may not have the right resources in place against such attacks or save their data. Data Protection – The Crucial Aspect in Current Era Businesses today must secure their mission critical data from unauthorized access and other hostile activities in order to prevent ransomware and data breaches. Organizations frequently prioritize network architecture security, which is one key aspect of the. Furthermore, ransomware can result in that one IT catastrophe that no firm wants to experience business interruption. Therefore, it is imperative that organizations have data protection solutions on hand and be able to access their data in an emergency to maintain business continuity. Any organization that gathers, handles, or maintains sensitive data must have a data protection strategy in place. An effective approach can lessen the effects of ransomware breach and assist prevent data loss, theft, or corruption. Businesses can always seek guidance from reputed cloud experts to have a better understanding of data protection and associated concerns. Data Protection Habits to Adopt for Business Continuity Most of the common methods that let in ransomwares into the targeted networks are conducted using relatively simple techniques, like phishing emails, stolen credentials, and vulnerable systems. In order to build a secure working environment, organizations must be aware of their network security vulnerabilities and have a multi-prong approach to security. Here are some steps that can help organizations address their data security requirements. Data Backup: It is a crucial step to always have a solid backup plan that has been tried and tested. The attack can be mitigated if organizations have a timely backup of their data and systems that can be easily reinstalled. It is highly critical to also ensure that the backups themselves are protected, as ransomware attackers are increasingly focusing on compromising the backups. Data Encryption: Encryption is the process of scrambling legible data so that only the owner of the secret code, or decryption key, can decipher it. It assists in ensuring data security for sensitive information. Data encryption is even specifically highlighted in the GDPR as a technique of data protection. Access Control: Adding access controls to a business’ workflow is a highly effective way to lower risk. The risk of a data breach is directly proportional to the lesser people that access the data. Businesses should make sure that only personnel with a justifiable cause should have access to critical information. Network segmentation: in which the network is divided into subnetworks and organizations have distinct segments, is a practice that organizations can engage in. This is helpful, especially when discussing lateral movement. If there is a separation, ransomware that has already infected your systems, it cannot spread to other subnetworks. As network segmentation and traffic monitoring go hand in hand, a solution to both problems would also be beneficial. Cyber Hygiene: A moral step in lowering the risks is to practice excellent cyber hygiene. Cyber hygiene is a set of routine behaviours that ensure the secure management of sensitive information and network security. It’s similar to personal hygiene, when you establish a pattern of quick, simple tasks to avoid or lessen health issues. Apart from these organizations can foster cybersecurity awareness culture in general. Educate the staff to distinguish malicious emails. Employees should be vigilant and alert enough to detect irregularities in the communications they receive. These could be out of place emails coming from seemingly known sources, unverified domains, misspelled email IDs, unusual requests in messages, and persistent redirects to unusual websites can all be indicators of corrupted emails. Invest in security awareness training programmes so that staff may become more adept at handling phishing emails. Final Thoughts Ransomware attacks are now more frequent and strategic than ever, and its impacts on a business can be devastating. A ransomware can be inside a network for a very long time analyzing and communicating within the network to understand all its strength and loose ends, before it finally surfaces. As data is the most targeted asset by ransomwares, it is highly critical that measures are taken by businesses to ensure a defense against ransomware attacks to negate the damage impact.  

Several landmark ransomware attacks on enterprises in energy and food industries last year remind us that we are living in a world with constant cyber threats. Every industry has now been prompted to reinforce their network security and strengthen their online protections. The security industry is no exception, as cybersecurity is also an on-going challenge for us, too. Here, we would like to offer some basic tips and practices to harden your network and keep your security devices protected. Create strong passwords and change them regularly You have heard it all before – almost every cybersecurity guidebook tells you that you need to create strong passwords. It is indeed a common instruction, but one of the most efficient methods to improve the protection of your network and devices. Passwords are just like lock on your front door, and if they are not strong enough, unwelcome visitors can easily crack them and ‘walk right in’ to your network. Creating strong passwords is a very important first step in the process of hardening the security of your network and devices. For setting strong passwords, the following list provides some good principles to follow: Include numbers, symbols, uppercase letters, and lowercase letters. Passwords should be more than eight characters long. Avoid any password based on repetition, dictionary words, letter or number sequences, usernames, relatives or pet names, or biographical information (birthdays, anniversary etc.). Change your passwords on a regular schedule. Set only the firewall rules you actually need A firewall intercepts all communications between you and the Internet, and decides if the information is allowed to pass through to your devices. Most firewalls, by default, will block all traffic both in and out. This is what we call ‘deny all by default.’ In this default state, it is as if your devices are not even connected to the Internet. While this is a very safe state to be in, it is not very useful. So, we must create a set of rules to tell the firewall what we consider safe. Everything else is, by default, considered not safe. As you create rules to allow traffic in and out, you are creating tiny holes in your firewall for the traffic to flow through. The more rules you create in your firewall, the less secure your network becomes. You should only create minimum rules that you need, which can reduce risks of cyber threats through the firewall system. Update your firmware in a timely manner Firmware is the component that enables and controls the functionality of your network devices. It is a software program or set of instructions programmed right onto your network devices. It provides the necessary instructions for how your devices communicate with other computer hardware. Firmware updates are not just for bringing additional new features, but also often provide important security patches. It is recommended that you always use the latest firmware so that you get the best possible security updates and most recent bug fixes. Encrypt your data Another key way to safeguard your network and data includes using encryptions. This is the process of encoding your data in a way that can only be accessed through a corresponding decryption process. Data encryption is encouraged, as it keeps your data privacy safe from unauthorized hands – especially in the event of a data breach. Normally, it is not necessary to encrypt all of your data; you could make an encryption strategy to classify and assess risks of your data. Be sure to choose the right encryption tools for sensitive, non-public, and confidential data. Define clear access permission policies for all users The right users need to have access to the right applications and data for organizations to function. It’s necessary to make clear access permission polices for all users. You need first to define possible users who may access your network and security devices, and then set permission levels for each user to limit unnecessary access privileges and reduce the risk of cyber breaches.  

The subject of safeguarding in schools is challenging. It has an equal effect on teachers, parents, and administrations in addition to having a negative impression on the children. While ensuring school safety is everyone’s duty, schools should periodically remind the appropriate stakeholders of their duties. These days, children spend most of their time in school, thus it is crucial for all parties involved to assure that each student is always safe both on the school property and during daily commutes to and from it. Listed below are a few recommendations that can assist to improve school safety and transform them into safe spaces. Surveillance system As an aspect of their school security system, most schools have CCTV cameras. A school’s security policy requires a little more than installing CCTV cameras in every area of the building to record activity. When deployed exclusively, CCTV cameras cannot guarantee the entire safety of students on the school grounds. However, they can be used in conjunction with the most recent security measures to track the students and raise an alarm when the youngster is in danger. Such approaches assist schools in stepping up their security procedures. Vigilance Each student should be watched while on school property since it helps schools stop them from engaging in any dubious or improper behavior. While CCTVs can be used to keep an eye on student behavior, a smart, sensor-based security system can be quite beneficial. Schools can use real-time tracking to ensure that students are in the right place & time and out of harm’s way. When the system detects an unexpected activity in a pupil, an alarm is sent to security, safeguarding their safety. By emphasizing the value of school safety and security, school management can also teach students to inform the appropriate party of any questionable activity. Fencing the premises Most of the schools, frequently take care of this as well. Schools can make use of technology, which alerts security whenever a legitimate person enters a restricted area using sensors. After their shift, employees are not permitted to enter the classroom or even remain on the property. Students are not allowed to hang out in the building after school hours or disturb other students while they are in class. Any security infringement can be corrected right away. Smart ID Cards Every student in the school is given an identity card because it enables the administration to accurately account for all the members of the school by maintaining attendance. A Smart-ID Card, which has an integrated sensor that helps track moments, modern technologies can be linked with clever algorithms. The teachers can individually mark attendance for each student during his/ her class. The use of such technology can also assist in keeping track of instances when a student is on the school’s campus but not in class. Crisis management team & plan The school administration should form a school safety team. The safety team prepares plans for unforeseen events like fire, natural disasters, and more that could potentially pose a threat to the lives of the occupants. School ID card All the student’s smart id cards should have the names of the parent/ guardian responsible to pick them up after dismissal from the school and to be contacted in case of an emergency. This practice would assist the school in taking care of the students. First-aid The school safety plan includes first aid treatment as well as registration with the nearest hospital to stay prepared for an emergency. In addition to this, school staff, Bus attendants should be trained on basic first aid techniques. Bus lady marshals All the buses must have a lady marshal to look after the safety & well-being of the children. Lady marshals to be provided with a walkie-talkie for smoother communication in case of a mishap. The lady marshal will be responsible for handing over the kid to the parent/ guardian and maintaining the record by scanning the smart ID issued to the parent/ guardian. Fire safety plan The school safety team is responsible to develop a fire safety plan and getting it approved by the police and fire department. In addition to this schools to have necessary firefighting equipment installed in the building such as smoke detectors, automatic water sprinklers, and correct types of fire extinguishers as a backup. Emergency contacts Each classroom shall be equipped with an emergency intercom and should display all the emergency contact numbers to respond to an emergency at the earliest. This could play a major role in saving lives. Inspection There have been cases when the accidents occurred due to ignorance of a threat at a site, for example, potholes on the playground. Inspections play a vital role as they eliminate risks. This routine inspection should cover aspects like damage as well as hygiene. Restrooms Many times, kids get locked in the restroom especially when there is no attendant, periodic checks facilitate in maintaining the mishaps in this scenario. Installing an emergency button, and installation of smoke detectors are just some measures to increase safety levels concerning restrooms. Elevators Lift maintenance should be done periodically as children being stuck in the lift is the most common scenario seen nowadays. Children below the age group 10 years, should not be allowed to board the elevator alone. A lift attendant must be always present, and a glass lift can be installed. Counsellor Mental health of today’s youth is sensitive, to make them feel heard and seen, schools should consider a department dedicated to student-teacher welfare. Fixed timings included in the timetable for an easy approach for students as well as teachers. A lady counsellor to be available and offer advice to help students come out of any trauma if needed. One in three students at Indian schools, according to a report published in February 2022 by the Child Fund Alliance, an international network of 11 child-focused development organizations feels dangerous. According to the findings of a global survey carried out in 41 nations, children in India…

Sergey Ozhegov, CEO, SearchInform Information security expert’s recommendations Each company possesses valuable information assets, which are of high interest for market competitors and other organizations, groups or individuals. In the first company, it may be a VIP-client database, in the second – drawings or technological maps, the third company has created a breakthrough business-strategy, the fourth company possesses crucial financial information. And there is no guarantee for any company or organization, that a spy won’t start operating within it’s framework. The spy may be motivated by plenty of prerequisites, which include, but aren’t limited to – greed, revenge, financial interest, ideological issues. Why employees become corporate spies First of all let’s figure out, which employees may become corporate spies. There are a few categories of employees, which pose the biggest threat for an organization. First category – ‘infiltrator’. In order to ensure, that you won’t be able to unmask him or her for a long time, an employee should be a qualified specialist. Such an expert easily passes interviews, has significant work experience and seems to be a ‘priceless asset’ for a company. That’s why it’s very important to be very attentive to recently hired staff members. Usually, such infiltrators apply for positions, which require work with commercial data or with databases. Case study: the information security department of one company paid special attention to a new sales manager. Vigilance was not in vain. It was revealed, that the manager worked for market competitors and his main aim was to get access to the company’s accounting system. Gaining of such access by the manager may have led to a loss of approximately 215000$ and to a reduction in the number of clients. The second group includes those employees, who start spying because of financial problems. Such employees may had been law-abiding specialists, who began to commit illegal actions only because of financial issues. The third category – risk group employees. This group includes those, who work with critical and top secret data. Thus, such employees may be blackmailed and recruited by your competitors and detractors. Another group – resentful employees. Revenge is in fact one of the most common motives for becoming a corporate spy. Case study: an employee of a large company wanted to take a revenge, as he didn’t get the desired promotion. A resentful employee decided to leak data, revealing very precisely the amount of securities, possessed by each stockholder. The employee intended to transmit the data on securities to mass media. The employee’s actions may have led to the origin and further escalation of a conflict. Such an unpleasant situation would have helped company’s market rivals. However, information security officers revealed the threat just in time and managed to prevent the leak. The damage due to the leak, in case it had happened, would be estimated at $1,241.379. How do spies gather data? There are plenty of ways for employees to steal data: to print it on a paper or save on a device; to take a photo of confidential documents; to deliberately leak data by uploading it to a cloud; to provide third party with the access to database etc. Nevertheless, there are some typical channels for data transmitting, which are the most popular ones for organizing data leaks as well. Thus, they have to be controlled more strictly. According to SearchInform annual research, email stands for the most popular channel for illegal data transmitting, as a bit less than 50% of leaks in 2021 happened via email. So, corporate spies usually take the path of least resistance and don’t create complicated schemes for a data leak. This may be illustrated with a ridiculous case of AMD. AMD’s officials filled the claim against company’s four former top-managers, who lately joined Nvidia. Former employees took away 100.000 files, containing sensitive data on AMD’s business activities. Data volume was so tremendous, that copying of files would have taken too much time. The internal investigation revealed, that one of these employees even googled how to download this tremendous amount of data. He did it during the worktime. Nonetheless, some spies act in a very creative manner. Case study: an infiltrator joined one big manufacturing company. A river flew through the area, where the company’s plant was located, so the spy built a small raft, tied papers to the raft and floated the raft with top-secret documents of the company. How to identify corporate spies Screening check helps to detect spies, who deliberately applied a vacancy in order to leak secrets to competitors. You may test candidate the following ways: By addressing to various bases in order to obtain any mismatches in person’s autobiography; By examination of person’s letter of recommendations; By assessing the results of the interview; By the implementation of the OSINT (open source intelligence) methods. It’s a bit more complicated to identify spies of other categories. Even if a specialist has been working for many years, and no problem has occurred during this period, there isn’t a guarantee, that specific critical circumstances, such as financial problems or willingness of revenge won’t stimulate this employee to commit illegal actions. That’s why it’s important for security services to cooperate permanently with top-managers. If a team isn’t big, then it’s easier to reveal problems by examination of consequential attributes, for example, disproportionate between payment ratio and expenditures or a sudden change in behavior. If the team is quite big, than assistance of special protective software – DLP system – is required. Such systems prevent data leaks. Their functionality enables to trace suspicious messages and other activities, which can indicate employee’s motives. Advanced DLP systems’ functionality also includes behavior analytics (digital profiling, UEBA and other tools). The main advantage of this ‘computer psychologist’ is that it permanently traces behavior changes and that it can’t be treated. Prevention is very important too. It’s crucial to educate your employees in the information security related issues and to present the probable outcomes of a data leak. We also recommend to sign a…

Colonel-B-S-Nagial The world is coping-up with various problems such as document fraud, identity theft, terrorism, cybercrimes etc. There are new global regulations in place to use the emerging technologies. But there is a need to strike a balance between biometrics security tools and adherence to human rights while dealing with terrorism. One of the tools to counter the threat of terrorism is the use of emerging biometrics technology carefully. Biometrics uses a person’s physical features or personality traits like fingerprints, faces, voices, or handwritten signatures to identify and verify the antecedents. Biometric systems offer automatic, almost immediate identification of a person by translating the biometric into the digital form and then collating and verifying it against a computerised database.1 The biometric tools include fingerprints, facial recognition, vein pattern, eyes, iris print, DNA, blood, voice, gait, signature etc. The United Nations Security Council (UNSC) resolutions 2322 (2016) and 2396 (2017) dwell on the use of biometrics for counter-terrorism purposes, particularly in the context of border management and homeland security. Resolution 2322 (2016) calls on the member countries to share information about Foreign Terrorist Fighters (FTFs) and other lone wolf terrorists and terrorist organisations, including biometric and biographic information.2 Further in its resolution 2396 (2017), the UNSC resolves that all member nations will evolve and put in practice various systems to gather biometric data, including fingerprints, photographs, facial recognition, and other appropriate recognising biometric data, to responsibly and adequately identify terrorists, including FTFs, as per the policies on the subject while duly complying with the domestic law as well as international law on human rights. The UNSC also encourages the nations to share this data among other nations and with appropriate worldwide organisations, together with the International Criminal Police Organisation (INTERPOL). While implementing the resolutions passed by the UNSC, various countries have encountered gaps and challenges while using biometric technologies for counter-terrorism operations. Therefore I will reconnoitre tendencies in using these types of technologies in counter-terrorism, main challenges, and guidance developed to safeguard the use of technology for its intended purpose. Various critical trends emerging in biometric technologies Using biometrics in counter-terrorism operations is a fast escalating range of counter-terrorism-related applications for biometric systems, including authentication and verification equipment such as biometric passports (e-passports), biometric smart gates, and passport readers and digital forensics.3 The COVID-19 pandemic posed unprecedented challenges concerning biometrics to facilitate domestic and international travel. The extensive use of masks and fear of transmitting the disease via touch limited the efficacy of traditional credentials checks, including facial recognition and fingerprint scanners. As a result, many countries introduced touchless devices and iris scanners to authenticate identity while masks were worn. Biometrics has become more predominant in detecting offenders, terrorists, and inimical elements in public places, with facial identification systems combined with CCTV video surveillance systems. Technology for identification has also been combined with Unmanned Aircraft Systems (UAS) in a law enforcement and border control scenario, helping control many people by channelling and identifying them. The use of biometrics in counter-terrorism operations is often linked to evolving and using emerging technologies. These techniques are used to identify individuals of interest such as high-definition cameras, matching algorithms, and Artificial Intelligence (AI), occasionally in combination with a linked database e.g., terrorist watchlists. And also use biometrics to protect critical infrastructure sites and facilities and soft targets from terrorist attacks. Biometric technologies may also help stop terrorism financing, facilitating augmentations to know-your-client (KYC) and customer due diligence (CDD) procedures and substitutions to financial institutions’ monitoring and keeping track of associated banking operations. “The world is coping-up with various problems such as document fraud, identity theft, terrorism, cybercrimes etc. There are new global regulations in place to use the emerging technologies. But there is a need to strike a balance between biometrics security tools and adherence to human rights while dealing with terrorism. One of the tools to counter the threat of terrorism is the use of emerging biometrics technology carefully” Many countries have made some progress in introducing biometrics for counter-terrorism purposes. There are strong local trends in this practice. Half of the European countries extensively use biometrics, but only a few countries have put it into practice in the Middle East region. In Africa, only fifty per cent of countries are using biometrics systems. How biometric technologies are used for counter-terrorism could be summarised as under: Countries are intensifying the array of physical spaces, from border crossings to public spaces and digital spaces, across social media, biometric data is being validated. Countries use state-of-the-art technologies to capture, collect, process, and analyse biometric data to Counter-Terrorism. Many government officials such as intelligence agencies, national and local police forces, border guards, immigration officers and some private-sector actors e.g., contractors and suppliers, have been authorised to use biometric data. Some nations have taken initiatives to hasten the sharing of biometric data as part of counter-terrorism collaboration and sharing of information methods. Countries have more developed terrorist watch lists and databases linked with biometric databases, with biometric checks against INTERPOL notices and databases to recognise and spot inimical elements and terrorists. “Many countries have made some progress in introducing biometrics for counter-terrorism purposes. There are strong local trends in this practice. Half of the European countries extensively use biometrics, but only a few countries have put it into practice in the Middle East region. In Africa, only fifty per cent of countries are using biometrics systems” Challenges concerning the optimal use of biometric technologies in counter-terrorism could be summarised as under: Technologies has shortcomings and restrictions. Inadequate capabilities. Inadequate legal and administrative contexts. Due to an oversight of safeguarding the privacy and data duration of the data retention period. Strengthening of prevailing inequalities and disparities. Likely misappropriation of freedom rights of religion, expression, and association. Restrictions on distribution of biometric data and information to others. Non-availability of efficient solutions in the event of violations. There is a risk of scams and misuse of biometric information. Though biometric technology has notably advanced its precision and steadfastness, technological shortfalls…

Prashanth G J, CEO of TechnoBind Organizations are quickly realizing the importance of IoT to their businesses. The IoT is a network of internet-connected gadgets that can gather and transmit data over a network. As it plays a critical part in the digital transformation, the IoT technology has recently progressed from the pilot stage to creating business value. The continued growth of this industry will serve as a digitalization force for all organizations. Healthcare, BFSI, energy, automotive, manufacturing, and transportation are being transformed by the IoT technology platform. As IoT is getting integrated into multiple industries, its market is expected to reach USD 6075.70 Million by 2030, growing at a 19.91 % CAGR between 2022 and 2030. Impact and Beneficial Aspect of IoT on Businesses IoT has had a massive impact on industries since 2011, acting as one of the catalysts driving the industry 4.0, representing a new stage in the organization and control of the industrial value chain. Industry 4.0 is built on cyber-physical systems, also known as smart machines. IoT is all about integrating sensors, devices, gateways, and platforms to business strategy and solutions. Businesses can make more informed decisions and structure more effective systems by centralizing all of the data. This facilitates businesses to meet the growing demand for high-quality, customized goods at a lower cost and with shorter turnaround times. However, IoT is much more than just data collection. Data must also be analysed and enriched in order to provide actionable insights to businesses. This is where AI, robotic process automation, and analytics come into play. These tools are used by intelligently designed software to uncover hidden trends, optimize business processes, and assist workers. Given the proliferation of IoT-connected devices, one may wonder, how does IoT affect business? The short answer is – in every way. IoT is an extraordinary asset to businesses. Access to large data sets, as well as autonomous data collection and exchange, make it easier to gain insights into things like customer behaviour and product performance. IoT also empowers continuous process optimization and has an effect on employee engagement and performance. When certain criteria are not met, IoT in business can direct systems to start executing operations in supply chains autonomously. If a business is thinking about how useful IoT is to their organization, they should first understand how it is already modifying management and operations. Here are some of the key areas that the IoT is transforming and empowering digital transformation today. Advanced Efficiency and Productivity: Businesses that implemented IoT technology saw increased productivity and efficiency. IoT collects data on processes, making it simple to improve them in the event of an anomaly. IoT can be used in a variety of industries, including manufacturing. IoT devices assist in tracking demand and managing part and material production accordingly. Businesses can boost their productivity by learning more about the market and its customers. In addition, IoT can aid in the orchestration of extensive automation and provide real-time feedback on operational efficiency. These innovations will enable businesses to operate at a lower cost, thereby expanding the landscape significantly as insertion becomes more cost effective and manufacturing becomes more feasible. Cost Reduction: The IoT makes cost cutting easier. Integrating IoT devices can save money on tasks that would otherwise be done by humans. Tracking of various operations or equipment, such as heating and cooling systems, might fall under this category. Since the data can be logged in real time by a central system, an unnecessary trip by an operator can be avoided. IoT benefits companies by lowering the costs of unplanned downtime, creating a digital twin that can be used to track assets and perform complex simulations, improving worker safety and satisfaction, and providing deep, actionable insights into process and equipment improvements. IoT can also provide manufacturing companies with agility and resilience, allowing them to thrive no matter what. Efficient Inventory Management: Many businesses are facing inventory management and monitoring difficulties. Poor inventory management can cause a variety of problems, including order fulfilment delays. In the long run, this will harm a company’s productivity and profits. Businesses, thankfully, now have the option of automating business inventory by implement ing IoT software in their storage facilities. This technology will help ensure that your inventory is efficiently monitored and managed, giving the company more time to focus on core business operations. Analyse Consumer Behaviour: Customer preference and behaviour analysis is critical for the success of any industry or business. IoT benefits retail companies by allowing them to retrieve, track, monitor, and analyse data collected from the internet, video surveillance, social media, and mobile usage. This scenario allocates necessary insights to predict consumption patterns and forthcoming business trends, allowing companies to design products and provide personalized services for higher levels of engagement. Companies will be able to retain their target consumers and cultivate brand loyalty with access to detailed customer profiles. How can Business Leverage IoT When it comes to how to use the Internet of Things in business, the key thing to remember is that new levels of interaction and interconnectivity have significant payoffs for almost any business. As a result, how each company decides to leverage IoT within its industry and sector is a critical decision. It is not a one-size-fits-all approach, but rather a highly customized method of developing a greater understanding of uplifting and enforcing specific business objectives. The evidence for IoT’s benefits is clear, and this is about to change how the IoT can help businesses. It not only boosts efficiency and revenue, but it also ensures that the best services and products are delivered to customers at the right time. Organizations that have implemented IoT will see increased business opportunities as they become more customer centric. That means that enabling business with IoT could put businesses on the cutting edge of changing business customer interaction trends.  

Punit Thakkar, CEO & MD, Shivaami Cloud Solution According to corporate policy and regulatory requirements, 57% of organisations find it difficult to properly protect data in multi-cloud environments. As different environments have different built-in security controls and tools, it’s difficult to achieve consistent protection. With vulnerabilities present and threats waiting to pounce, cloud security challenges are everywhere. According to a report published this year, 27% of companies have had a security incident in their public cloud infrastructure. Cloud providers are under a lot of pressure to add new services and increase uptime as they are notable to understand whether the investment made in security to protect their customers’ assets is at a proper level. Tech-based approach is no longer enough There are several moving parts that facilitate today’s cloud security challenges, but one stands out in particular – human error. It isn’t due to a lack of standards, policies, or procedures, nor is it due to a lack of technical controls. The expected oversights, unsurprising incidents and predictable breaches will continue to occur in Cloud infrastructure. Network hosts, web applications and web service endpoints can all be attacked by virtually anyone on the internet, even in commoditized cloud environments that are assumed to be secure. The enterprises may not be aware of it, particularly if cloud vendors lack the visibility and control required for detection and response. How to overcome and minimize damages resulting by human error? Customers must better employ behavioural analytics with a focus on human trends, patterns, activities and habits to ensure cloud security for the enterprise as online information access behaviour is changing at light speed. User Behaviour Analytics (UBA) solutions analyse patterns of human behaviour and use algorithms and statistical analysis to identify meaningful anomalies that may indicate potential threats. It’s preferable to be proactive rather than reactive in this situation by users testing the cloud environments if allowed to. It is good to atleast request for a copy of the vendors’ most recent security audit and security assessment reports. Behavioural analytics can be used by businesses to create and lay out a standard baseline of expected standard data usage activity. Only then it is possible to set the trap for abnormalities that could indicate malicious intent or a mistake and take up the necessary steps as needed. It’s always a good idea to verify by asking tough questions about the flaws. Only by using such a defensible approach it is possible to successfully address the cloud security challenges that might occur in the future. Cyber security will increasingly require a blended approach of technological safeguards and a focus on the human touch, as it continues to be an extremely complex and multi-layered problem caused by humans. Each of these vulnerabilities has one thing in common i.e. observable and correctable human behaviour. As a result, the cloud security landscape must now become more behavioural-based.  

Nirav Shah, VP and CTO, Forcepoint India Innovation Center Over the last two years, work has transitioned rapidly to remote and hybrid modes. Hackers embraced this move and profited from flaws and vulnerabilities in organisations’ security architecture. In 2021, corporate networks saw a 50% increase in cyber-attacks per week compared to the previous year, for example. Cybercriminals targeting business-critical and sensitive data such as personally identifiable information (PII), intellectual property (IP), and financial data, are keenly aware of how today’s cloud environments can be ideal targets. The way modern organisations operate means that legacy security approaches aren’t good enough. The boundary between an organisation’s network and the outside world is no longer as clearly defined. Data is constantly being shared, stored and accessed from all kinds of locations. With so much happening in cloudbased environments, the way organisations manage their cybersecurity and network security needs to evolve. Zero Trust is one approach that helps them face up to this new reality. Understanding Zero Trust Security Zero Trust is a network security concept based on the idea of ‘never trust, always verify’. No one individual or device in an organisation’s network should be allowed access to documents or data until they have been verified. No one is above this robust authentication and authorisation process, and any device and person must satisfy this whenever they seek access to part of a network or specific files. Part of a Zero Trust philosophy can include UEBA (user and entity behaviour analytics). By continuously monitoring network activity, and how users are interacting with data, a baseline of ‘normal’ activity is established. If there is a sudden change in that behaviour from normal patterns it can be flagged for someone to more closely monitor and increase security provisions as needed. For instance, let us take a scenario where an employee who usually signs in from Mumbai, India, is suddenly attempting to access company data from Istanbul, Turkey. UEBA would identify this abnormality in the employee’s behaviour and flag it. The employee may be served with an authentication challenge to verify their identity, even if their username and password were submitted successfully. Zero Trust takes security a step further from traditional perimeter-based security as it is location-agnostic. Even if attackers gain access to a company’s network, it doesn’t automatically mean all data and applications are up for grabs, because further authentication is required. Many firms allow far too many processes to operate openly on the network, making them easy targets for hackers hunting for enterprise networks with the bare minimum of security. Since the network is accessible for everyone inside the company, anyone can share information, which is concerning. Risks don’t just come from external actors, but insider threats too, as difficult as that may be for an organisation to face up to. A Zero Trust network is flexible enough to accommodate for these realities. How can organisations benefit from Zero Trust The best solution in a world where cybersecurity teams are struggling to keep up with the disparate tools and vendors they are juggling every day is one unified cloud service. This simplifies security, and allows distributed organisations to adapt to a hybrid workforce without putting business resources at risk. Building a zero trust philosophy into the way the corporate network and access management is designed is ideal for this. One of the benefits of this approach is that it reduces the attack surface. With Zero Trust, users connect directly to the apps and resources they need, as opposed to entire networks. A direct connection between users and apps is established, which eliminates the possibility of lateral movement to other services and data. Even if a single device gets infected, it happens in isolation – they aren’t connecting to a VPN which grants them the keys to everything, including other devices. Another important aspect of Zero Trust is that it integrates consistently into the experience users have. If a security tool is too intrusive and disruptive, employees will seek workarounds, which ultimately can open up security blind spots and flaws that cybercriminals can exploit. By operating at a network level, across all documents and data an employee might access, security teams can ensure authentication remains rigorous, without creating risks like shadow IT that come about when ‘official’ means of getting work done is seen as too challenging and convoluted. In a world where hybrid working is the norm, a simplified solution to cybersecurity is the only way business leaders can secure their users and data across all kinds of locations and services. By moving everything to one central platform, teams can ensure one set of policies is applied consistently from one cloud platform. As a business grows, this protection can also be scaled alongside it. Zero Trust is a critical element of the straightforward fix that organisations desperately need to manage their cybersecurity.