Category: Latest
Integration of VMS with Third-party Systems to Improve Business Operations & ROI
Video management software has become an indispensable part of security and surveillance applications. With the advent of cloud-based video surveillance, the power of VMS cannot be limited to just video monitoring. The new age VMS systems with intelligent video analytics are capable of offering much more than surveillance. The cloud-based VMS systems not only fulfill comprehensive surveillance needs of the businesses, but also complement other business processes, which may directly or indirectly reflect into the business ROI. Whether it is a new VMS installation or upgradation of an existing VMS system, enterprises (considering their business processes to be more interactive, connected and integrated) prefer their on premise or remote business systems to be integrated with the cloud-based Video management software. Since every business and its processes are different, the video surveillance needs of the enterprises also vary from each other. With the availability of flexible and customized video surveillance and analytics services, enterprises find it challenging to pick suitable thirdparty systems and apps to support their preferred VMS system. Therefore, most of the enterprises are shifting towards Video Surveillance-as-a-Service with their system integrators or VMS service providers. Most of the VMS service providers and system integrators are offering an open source or vendor independent cloud-based video management software to their clients for the obvious reason of making VMS compatible with third-party systems and applications. Why do third-party systems need to be compatible with video management software The third-party systems in VMS can be defined as any of the systems, applications or devices used to support and enhance the functionality of a video management software in order to improve the security and business processes of an enterprise. There are hundreds of companies manufacturing security and surveillance devices (like IP cameras, NVRs, Audio Devices, GPS systems etc.), but all the available devices are not necessarily compatible with the video management software preferred by the companies. Therefore, it is very important for VMS service providers or system integrators to check the compatibility of the surveillance software with the available thirdparty devices required for the project. Types of third-party systems and applications for VMS solution Third-party systems for a video management software are either physical devices installed at the surveillance location and office premises or widgets/ applications embedded in a video management software to enable intelligent video analytics. These systems and applications can be classified into two major categories; one as the systems for security and surveillance, and other as the system for supporting and enhancing business processes. Let us discuss them in detail. Security and surveillance systems Most of the third party systems and applications for security and surveillance are common across industries and are necessarily required to be part of a video management software. IP cameras An IP camera is a primary and mandatory requirement of any VMS system. A cloud-based video management software should support all types of IP cameras (Wired and Wireless cameras, PTZ, 360 degree, night vision, autofocus cameras etc.) from the major players/ manufacturers of the industry. VMS systems for customized surveillance projects must support IP cameras with open standards-based application programming interface (API), which allows system integrators to program the cameras for specific applications. IP surveillance cameras for video surveillance software must support multiple video streams and video compressions (H.264, MJEPEG) to send the video data with low latency. ONVIF support of the IP cameras with VMS systems can be an added advantage for the surveillance project. Access control devices Access control devices integrated with video management software provide physical security to any place or premise secured by the system. Integration of VMS with access control devices allows users to monitor, control and analyze multiple access points in real time, track the number of times access granted by the devices and react immediately in case of any event is triggered. Video surveillance along with access control helps in intrusion management, biometric attendance management and identity management. Fire and smoke detectors Fire and smoke detectors are the devices, which essentially need to be integrated with the VMS system of an enterprise. Large sized enterprises can have a large number of smoke detectors, which in case of fire, trigger the fire alarms of the building. An integrated fire alarm system with VMS allows a user to quickly identify and view the location of the fire alert. A quick response to such an emergency can help in saving lives and business assets. Video analytics for security & surveillance Video analytics in a VMS solution are a result of the structured algorithm of the software and many times inbuilt functionality of the devices connected to the VMS system. Video analytics for security and surveillance can be motion detection to prevent unauthorized access in restricted areas, perimeter protection to protect the virtual/ physical boundary within the enterprise, object detection, face recognition, people counting etc. A well-connected video management software with other surveillance and business-related devices can allow users to have complete control over business processes with security solutions and helps in improving the customer’s experience with the enterprise. Third party systems supporting business processes Cloud-based video management software is a well-accepted solution for security and surveillance across industries. Moreover, its structure of assimilating the functionalities of other business supporting systems enhances its business management capacity, incredibly. It empowers its administrators to have an inclusive approach to managing their business processes optimally without compromising on safety and security. Let us discuss the third party systems (used in different industries) that can be integrated with a VMS solution to enhance the business processes. Retail Third party systems and applications of a retail video management software are helpful for both employees of the retail stores and the customers visiting the stores. Here are some of the important systems to be integrated with retail video management software: Point of sale (POS systems): Integration of VMS with POS of any retail store can help in checking the fraudulent activities done by shoplifters or employees in a retail store. At POS, a customer pays for the shopped products,…
Safe Cities: Collaborative Monitoring
Cities across the world are constantly changing and evolving faster than at any point in their history. They have become more congested, and criminal activities have soared leading to the destruction of public assets. Compounding the problems, terrorism has become a major concern that presents communities and neighbourhoods with new security problems. Faced with a wealth of challenges, which are often elusive, cities are expected to manage and control the change to allow their communities to have a standard of living that meets modern day expectations. The terror attacks around the world reveal that most attacks are highly precise and well-coordinated, and targeted at high footfall areas to create a psychological impact along with monetary losses. Most of the citizens today are well aware of the risks and are in a state of constant anxiety about their safety and security. Hence, public safety has emerged as an important function for governments across the world. Accordingly, the federal and state government departments responsible for internal affairs and homeland security continuously assess and monitor the internal security situation, issue appropriate advisories, share intelligence inputs, extend manpower support, and offer guidance and expertise to the state governments for the maintenance of security. This also helps in establishing infrastructure for safe cities by capitalising on features from the following distinct categories of surveillance systems: Citywide police surveillance using Internet protocol (IP) based cameras, and Citywide community surveillance including private and institutional surveillance for collaborative monitoring. While the first system is becoming a standard solution for implementation to achieve the safe city vision, the latter is also gaining momentum to involve citizens and private and public institutions in collaborative monitoring. The following sections elaborate on the concept of collaborative monitoring. “Today, cities face a wide range of threats, ranging from terrorism and civil unrest to kidnapping and murder. To reduce the impact of these threats, it is critical for the authorities to capture real-time information on what is happening in and around the city. Therefore, there is a growing requirement for utilising the new and emerging technologies to make our cities safer. Given this background, one of the most user-friendly technologies that can play a crucial role is the extensive use of closed-circuit television (CCTV) cameras, which play a vital part in ensuring day-to-day surveillance, crime prevention and monitoring of illegal or suspicious activities. In addition to close supervision, CCTV cameras allow post-incident analysis and collection of indisputable legal evidence. While the government and legal authorities are also encouraging both public entities/ groups and individuals to adopt such progressive technologies, mapping each and every nook and corner of a city without seeking the help of its people is impossible. This formed the basis of a unique community policing initiative called ‘collaborative monitoring.’ As the very phrase suggests, collaborative monitoring is a unique tool, wherein the security and law enforcement agency takes advantage of the extensive network of surveillance cameras deployed by communities across the city as well as the cameras of other private and government establishments on a need basis. It is an extremely prudent enabler for the police department, as while they strengthen their bond with the communities, they can use any information or footage gathered from these security cameras to support investigation and the prosecution of criminals. The advantage provided by leveraging the extensive network of external cameras ensures enhanced crime monitoring through a cost-effective, widespread and scalabe model” – Neel Ratan India Government Leader and Regional Managing Partner, North PwC India What is collaborative monitoring? A key enabler for a safe city is the aspect of collaborative monitoring. In cities, where every government and private establishment has realised the necessity to secure its infrastructure and establish surveillance, monitoring and incident response systems, it is important that the data gathered by these agencies is shared among them. In such cities, CCTV-based surveillance systems are being deployed by federal as well as state government agencies at places like bus stands, metros, railway stations, airports, and other critical infrastructure spots and public places. These collaborative monitoring systems can conveniently share their data in real time with security agencies of the city. Similarly, live feeds from CCTV systems deployed by private establishments such as malls, hospitals, business parks and entertainment houses can be provided to the security and law enforcement agencies, which can make effective use of the information. Leveraging the extensive network of external cameras ensures additional eyes are monitoring crime. In addition, the higher penetration of cameras helps in lowering costs. Why collaborative monitoring? In her famous work ‘Participation and Democratic Theory,’ Carole Pateman, the renowned political theorist, advocated a greater role for common people in democratic selfrule and argued that development projects are more effective when beneficiaries have a role in the way projects are chosen, planned, implemented and evaluated. Giving citizens a role in initiatives designed for their benefit is considered to be an ideal way to ensure the sustainability and success of any project. Many cities across the world have surveillance systems deployed by multiple public and private establishments. These cities are using the collaborative framework to receive video feeds from these systems to ensure real-time responses and as an invaluable source of crime detection and evidence for the law enforcement departments. For an instance, the British Security Industry Authority (BSIA) estimated that there are up to 4.9 million CCTV cameras in the UK including 7,50,000 in ‘sensitive locations’ such as schools, hospitals and care homes. This translates to one camera for every 14 people in the UK. The collaborative framework shall help to meet the following objectives: Safety and security. Improved responsiveness. Effective policing Improved management Ensuring safety and security in fragile settings remains the key objective of law enforcement agencies, in addition to crisis management during serious incidents. The strategic objectives include the following in the given table: PwC’s framework for collaborative monitoring The entire ecosystem of cameras available to law enforcement agencies becomes significant when in addition to the law enforcement cameras, these agencies also…
Advanced Threat Landscape Report 2018 by CyberArk
CyberArk survey shows organizations are failing to secure privileged accounts and credentials in the cloud, on endpoints and across IT environments. According to the CyberArk Global Advanced Threat Landscape Report 2018, nearly half (46 percent) of IT security professionals rarely change their security strategy substantially – even after experiencing a cyber-attack. This level of cyber security inertia and failure to learn from past incidents puts sensitive data, infrastructure and assets at risk. Security starts with protecting privileged accounts An overwhelming number of IT security professionals believe securing an environment starts with protecting privileged accounts – 89 percent stated that IT infrastructure and critical data are not fully protected unless privileged accounts, credentials and secrets are secured. Respondents named the greatest cyber security threats they currently face, including: Targeted phishing attacks (56 percent), insider threats (51 percent), Ransomware or malware (48 percent), unsecured privileged accounts (42 percent), unsecured data stored in the cloud (41 percent). IT security respondents also indicated that the proportion of users who have local administrative privileges on their endpoint devices increased from 62 percent in 2016 survey to 87 percent in 2018 – a 25 percent jump and perhaps indicative of employee demands for flexibility trumping security best practices. The Inertia that could lead to data compromise The survey findings suggest that security inertia has infiltrated many organizations, with an inability to repel or contain cyber threats – and the risks that this might result in – supported by other findings: 46 percent say their organization can’t prevent attackers from breaking into internal networks each time it is attempted; 36 percent report that administrative credentials were stored in Word or Excel documents on company PCs; Half (50 percent) admit that their customers’ privacy or PII (personally identifiable information) could be at risk because their data is not secured beyond the legally-required basics. Inertia and a ‘Hands-Off’ approach to securing credentials and data in the cloud create cyber risk The automated processes inherent in cloud and DevOps mean privileged accounts, credentials and secrets are being created at a prolific rate. If compromised, these can give attackers a crucial jumping-off point to achieve lateral access to sensitive data across networks, data and applications, or to use cloud infrastructure for illicit crypto mining activities. Organizations increasingly recognize this security risk, but still have a relaxed approach toward cloud security. The survey found that: Nearly half (49 percent) of organizations have no privileged account security strategy for the cloud; More than two-thirds (68 percent) defer on cloud security to their vendor, relying on built-in security capabilities; and 38 percent stated their cloud provider doesn’t deliver adequate protection. Changing the security culture Overcoming cyber security inertia necessitates it to become central to organizational strategy and behavior, not something that is dictated by competing commercial needs. According to the survey: 86 percent of IT security professionals feel security should be a regular board-level discussion topic; 44 percent said they recognize or reward employees who help prevent an IT security breach, increasing to nearly three quarters (74 percent) in the U.S.; and Just 8 percent of companies continuously perform Red Team exercises to uncover critical vulnerabilities and identify effective responses. “Attackers continue to evolve their tactics, but organizations are faced with cyber security inertia that is tipping the scales in favor of the attacker,” said Adam Bosnian, Executive Vice President, Global Business Development, CyberArk, “There needs to be a greater urgency in building cyber security resilience to today’s attacks. This starts by understanding the expanding privileged account security attack surface and how it puts an organization at risk. Successfully battling inertia requires strong leadership, accountability, clearly defined and communicated security strategies, and the ability to adopt a ‘think like an attacker’ mindset.”
The Convergence of Physical & Logical Access
For many security professionals, recent high-profile data breaches have shifted attention to external cyber threats. Despite this newfound focus, the Institute for Critical Infrastructure Technology reports that more than half of all cybersecurity incidents can be traced to insiders with legitimate access to corporate facilities and networks. Another survey from the Ponemon Institute reveals that the majority of respondents are more concerned by outside threats than those that originate internally. While external threats are very real, working to confront internal vulnerabilities can prevent incidents from happening in the first place. By addressing both physical and logical access in a more unified approach, organizations can reduce their risk for a costly breach while also improving user experience and operational efficiency. This idea is frequently referred to by the industry buzzword of ‘convergence.’ From a technical standpoint, convergence is defined as “the merging of distinct technologies, industries, or devices into a unified whole.” In terms of access control, convergence can be viewed as “the merging of physical and logical access control technologies to provide a more unified and simplified approach to identity management.” “Convergence means a simplified approach,” said Sheila Loy, Director of Healthcare Industry, Identity and Access Management at HID Global, “That can mean many different things, but it’s essentially making it easier for the user to get both digital access and door access. That usually comes in the form of a card or a mobile device – something that can do both.” While the notion of convergence is nothing new, this approach to security is becoming an increasingly viable way to mitigate threats. To explore this further, ASIS International recently partnered with HID Global to survey security professionals regarding their experience and related plans on convergence projects. The data in this paper is based on the responses of 745 ASIS International members who have direct responsibilities in physical and/ or information security. The benefits of convergence: Improved user experience, operational efficiency and security Security administrators are looking for solutions that are easy, convenient and fast. By introducing solutions that better blend physical access control (PACS) with logical access control (LACS), organizations of all types will enjoy three key benefits including: 1) positive user experience, 2) enhanced administrative experience, and 3) improved security. Positive user experience Oftentimes, the weakest link in even the strongest of security systems lies within the end user. If interactions with security technologies are confusing or cumbersome, employees will take shortcuts that introduce unnecessary vulnerabilities. Converged PACS and LACS solutions help reduce this risk by boosting convenience, particularly by requiring employees to only carry one card or mobile device. This type of solution also eliminates the need to constantly refresh passwords. In today’s world, most end-users wear an ID badge to access facilities, which is a form factor they are accustomed to using. Even more, many employees either use a user name and password or a one-time password fob or token to access networks. While this approach may provide an additional layer of security, it is prohibitive in terms of convenience. Alternatively, providing a single form factor for both physical and logical access creates a more streamlined user experience, which ultimately increases user adoption to desired security policies. “Building occupants who have entitlements to both physical areas and logical applications will see an enhancement in their experience,” said Brandon Arcement, Director of Product Marketing at HID Global, “Convergence results in greater employee efficiency and a more pleasant work environment for building occupants. It’s easier for employees to carry one card or one mobile device to access both systems, rather than having to carry a card for the door as well as a fob for the computer or having to remember passwords.” In terms of logical or network access, one major pain point for end users is the need to remember and frequently reset their passwords. When ASIS International members were asked, “How access to network and logical applications is done today,” a resounding 85% of respondents indicated that they use a user name and password. 85% of respondents also indicate that they have an organizational policy regarding the creation of passwords such as requiring numbers or special characters. Not only is this inconvenient for users and administrators, it presents another common security risk – employees writing their passwords on notes left visible on their desk. Enhanced administrative experience Converged access control solutions provide an improved administrative experience. When survey respondents were asked to rank a series of benefits of PACS and LACS convergence, the top response was ‘easier to manage employee credentials,’ followed by ‘one card for multiple applications.’ These top responses reflect two key angles within an improved administrative experience. First, many applications used to manage credentials are now web-based with secure, simple access for administrators. This allows security teams to issue, modify, or revoke credentials away from the office or during off-hours. The second angle is the ability to deploy a converged ‘high value’ form factor that allows for multiple applications. For example, using one card for multiple uses reduces costs for additional or replacement cards, as well as reduces the time required to produce multiple credentials for individual applications. According to survey data, the value of leveraging smartcards for applications beyond physical access is more than theoretical – 73% of respondents agree that they have interest in using smart cards for applications beyond traditional physical access control. Finally, more converged access control solutions provide security administrators with more visibility into audit data. This makes achieving compliance easier, thus reducing the potential for associated fines and damaged reputations. Improved security The most important benefit of any technology is improved security. Innovative technologies for physical access include contact and contactless cards with encryption that adds additional layers of security upon entering doors, elevators or parking garages. Meanwhile, digital certificates loaded onto that same smart card can ensure trusted login to networks and applications, as well as encrypt e-mails and digitally sign documents. Converged solutions improve security in three key areas: Increased adoption rate of converged…
Safeguards for Securing Virtualized Servers By NIST
This bulletin outlines the security recommendations that NIST recently provided in Special Publication (SP) 800-125A – security recommendations for Hypervisor Deployment on Servers. The document provides technical guidelines about the secure execution of baseline functions of the hypervisor, regardless of the hypervisor architecture. In the past, a user wishing to set up a computing server generally needed to use a dedicated host with dedicated resources such as a central processing unit (CPU), memory, network and storage. Modern systems have technology that lets one create virtual machines to emulate what used to be physical, dedicated resources. This practice is known as virtualization and supports more scalable and dynamic environments. A critical component of this technology is the hypervisor, the collection of software modules that enables this virtualization and thus enables multiple computing stacks – each made of an operating system (OS) and application programs – to be run on a single physical host. Such a physical host is called a Virtualized Host and is also referred to as a Hypervisor Host. The individual computing stacks are encapsulated in an artifact called a Virtual Machine (VM). To make a VM an independent executable entity, its definition should include resources such as CPU and memory, allocated to it. The VMs are also called ‘Guests,’ and the OS running inside each of them is called ‘Guest OS.’ The resources associated with a VM are virtual resources, as opposed to physical resources associated with a physical host. The hypervisor forms part of the virtualization layer in a virtualized host and plays many of the same roles that a conventional OS does on a non-virtualized host, or server. Just as a conventional OS provides isolation between the various applications, or processes, running on a server, the hypervisor provides isolation between one or more VMs running on it. Also, like an OS, the hypervisor mediates access to physical resources across multiple VMs. Therefore, all other functions needed to support virtualization – such as emulation of network and storage devices and the management of VMs and the hypervisor itself – can be accomplished using kernel-loadable modules, although some hypervisor architectures accomplish these tasks using dedicated VMs. The hypervisor can be installed either directly on the hardware, or bare metal (Type 1 Hypervisor), or on top of a fullfledged conventional OS, called Host OS (Type 2 Hypervisor). Here, we discuss the baseline functions of a hypervisor, how these functions are distributed in a hypervisor, and how this information is used to develop security recommendations that provide assurance against potential threats to the secure execution of tasks involved in the hypervisor’s baseline functions. Hypervisor baseline functions It might appear that all activities related to the secure management of a hypervisor and its hardware host – collectively called the hypervisor platform – should simply consist of established best practices for any server class software and its hosting environment. However, closer examination reveals that the unique functions provided by the Hypervisor Platform require a dedicated set of security considerations. These functions are called hypervisor baseline functions (HY-BF) and are labeled HY-BF1, HY-BF2, HY-BF3, HYBF4, and HY-BF5. They are described below: HY-BF1: VM process isolation Scheduling of VMs for execution, management of the application processes running in VMs (e.g., CPU and memory management), and context switching between various processor states during the running of applications in VMs; HY-BF2: Devices mediation & access control Mediates access to all devices (e.g., network interface card [NIC], storage device such as IDE drive etc). One mediation approach is to emulate network and storage (block) devices that are expected by different native drivers in VMs by using emulation programs that run in the hypervisor kernel; HY-BF3: Direct execution of commands from guest VMs Certain commands from Guest OSs are executed directly by the hypervisor instead of being triggered through in terrupts and context switching. This function applies to hypervisors that have implemented para-virtualization instead of full virtualization; HY-BF4: VM lifecycle management This baseline function involves all functions from creation and management of VM images, control of VM states (start, pause, stop etc), VM migration, VM monitoring, and policy enforcement; and HY-BF5: Management of Hypervisor This baseline function involves defining some artefacts and setting values for various configuration parameters in hypervisor software modules including those for configuration of a Virtual Network inside the hypervisor. NIST SP 800-125A provides detailed security guidance based on an analysis of threats to the integrity of all the above functions. The only exceptions are the set of guidelines for configuration of virtual network (subset of HYBF5), which are covered in a separate document (NIST SP 800-125B). The above functions are carried out by different hypervisor components, or software modules. There are some minor differences among hypervisor products in the way that they distribute these functions. The mapping of these functions to hypervisor components and the location of these components within a hypervisor architecture are described in the table below: Approach for developing security recommendations Developing security recommendations for the deployment and use of a complex software such as the hypervisor requires knowledge of potential threats which, when exploited, would affect the three basic security properties – confidentiality, integrity, and availability – of hypervisor functions. The approach adopted for developing security recommendations for the deployment of hypervisors in NIST SP 800125A is as follows: Ensure the integrity of all components of the hypervisor platform, starting from the host BIOS to all software modules of the hypervisor. This action is accomplished through a secure boot process, outlined as recommendation HY-SR1; Identify the threat sources in a typical hypervisor platform. The nature of threats from rogue or compromised VMs is briefly discussed in SP 800-125A; and For each of the five baseline functions HY-BF1 through HY-BF5 (except for HY-BF3, the direct execution of certain commands from guest VMs by the hypervisor), identify the different tasks under each function, and for each of the tasks, identify the potential threats to the secure execution of the task. The countermeasures that will provide assurance against exploitation of these threats…
Global Access Management Market By IHS Markit
Access management can be defined as the process of granting authorized users the rights to use a service, while preventing access to non-authorized users. Following are the key access management growth factors over the next five years. GDPR deadline fast approaching Traditionally, finance, banking, insurance, government, utilities and other heavily regulated end-user sectors have focused on identity- and accessmanagement solutions. However, over the past year there has been growth in non-traditional markets. Not only have the manufacturing and retail sectors become more security conscious, but the increase in the number of data breaches and the looming legislation around General Data Protection Regulation (GDPR) in May 2018 has also piqued renewed interest in security and identity and access management (IAM) solutions. ● Highlight ● The global access management market is projected to increase from $5.4 billion in 2016 to $9.6 billion in 2021. ● Companies with 5,000 or more employees are projected to contribute the largest revenue growth to the access management market over the next five years. ● Over the past year, there has been growth in non-traditional market sectors such as manufacturing and retail. Smaller organizations using access management solutions Access management solutions have traditionally been deployed by larger organizations. In fact, companies with 5,000 or more employees are projected to contribute the largest revenue growth over the next five years, increasing from $4.38 billion in 2016 to $5.4 billion in 2021. The proportional importance of this segment is forecast to decline from 80 percent of total access management revenue in 2016 to around 56 percent in 2021. Small and medium-sized enterprises (SMEs) will steadily increase the amount of access management solutions they deploy. For example, revenue from companies with between 1 and 499 employees is projected to increase from $109.6 million in 2016 to $705 million in 2021. This segment managed to grow from 2 percent of total revenue in 2016 to 7.3 percent in 2021. The introduction of more cloud solutions within the access management market is likely to help SMEs, in particular, because cloudbased access management solutions can be more cost effective and scalable for small and medium enterprises. On-premises hybrid and cloud solutions As there are still a lot of applications running on premises at companies, a significant portion of larger organizations still want some on-premises solutions. Larger organizations are more likely to move to a hybrid model, with some applications running in the cloud as a stepping stone toward full adoption of cloud solutions. Hybrid solutions are projected to increase from $1.1 billion in 2016 to $1.7 billion in 2021. In contrast, smaller organizations are more likely to deploy software-as-a-service (SaaS) solutions, which for them can be more cost effective than on-premises solutions. Technological developments and the battle with hackers There is a continuous battle being waged as hackers increasingly try to gain control of the networks they want to compromise. It is important for organizations to take into account people’s locations, to help detect fraudulent activity and ensure the right people have the right access, at the right time and at the correct location. Technologies like machine learning (ML) and artificial intelligence (AI) are also important weapons in this battle. Leveraging emerging technologies, such as behavioral biometrics, will help to reduce the burden on end-users and increase the validity of identity proofing. Organizations can learn a lot about how people interact with their networks, to give a full picture of how things are evolving, but these technology developments are a bit of a cat-and-mouse game. Blockchain makes security cheaper and more accessible Many organizations have isolated and centralized identity management systems, but the current landscape demands federation and single sign-on (SSO). These systems make identity management, protection and verification very cumbersome, costly and risky for industry enterprises and government agencies. Blockchain has the potential to introduce improvements that can make security more accessible and budget friendly. With smart contract capabilities, there can even be a secondary market where users benefit from sharing resources back to the network. Smart contracts automatically execute pieces of code carrying valuable data or performing other condition-based executions. A permissioned blockchain technology provides core capabilities that enable a trusted digital identity network to build and operate the following: A shared, append-only ledger, with one version of the facts shared across all permissioned network participants in real time. Smart contracts that ensure verifiable and signed business logic is executed in each transaction. Trust between known participants, to verify transactions and ensure records are valid. Privacy and security measures that grant access only to permissioned parties. Cybersecurity – Access Management Report 2018 This two-volume report provides coverage in several key areas of the identity and access management market, including access management and identity governance and administration. It provides detailed analysis of individual vertical markets from market-specific operating models to key trends and development opportunities.
Top 7 Reasons for using A Multi-Tier Storage Solution
Lower storage spend Organizations are keeping as much as 40% of their inactive data on their most expensive infrastructure. With unstructured video growing exponentially, fueled by the rise of new video surveillance programs, one can’t afford to have this kind of inefficiency. The solution is to adopt a multi-tier storage system that automatically migrates the video to the most cost efficient tiers of storage. Whether that’s high-performance disk storage, object-based storage or high-capacity primary storage, file-based tape or the cloud – the organization can cost-effectively store data based on various policy requirements. Easy, immediate access Finding a file in the system should be no more difficult than finding a document on a C: drive. Quantum’s solution for video surveillance is a single file system, built specifically for video applications. On the backend, retention and access policies can be set to handle data migration and simplify organization and file recall. High performance Storage performance that performs inefficiently prevents companies from capturing usable data. Quantum’s StorNext software retains data cost-effectively, supports complex video management systems and analytic applications, and ingests video from 4 times as many cameras per server to deliver time-to-decision results, allowing proactive protection and crime prevention. Quantum’s storage infrastructure not only handles this sheer volume of data with ease, but also delivers streaming performance regardless of whether it’s on disk, tape, or in the cloud. Scale with storage needs The ability to seamlessly integrate more sources of information into modern analytical tools is becoming more important, as is the capacity to scale and accommodate increased camera and sensor counts, panoramic coverage and higher image resolution. As more cameras are added, image resolutions increase and retention times become longer, Quantum’s solution can scale to handle the need for more capacity. Compliant with current infrastructure Quantum’s storage solutions support all major platforms, operating systems and networks, and integrate seamlessly with VMS and other systems. This enables security professionals to integrate the solution into their existing infrastructure without being locked into a single vendor or platform as well as to configure the file interface to receive input from a variety of devices and systems. No trade-off necessary To gain more insight and an increased return on investment from video surveillance data, a storage solution must balance high performance, high capacity and high retention. These three parameters can be flexed to provide the best trade-off between budget and mission whilst minimizing sacrifice of redundancy, accessibility or scalability. Gateway storage architecture Upgrading storage capabilities while also satisfying budgetary restrictions is a challenging part of building a comprehensive storage infrastructure. Instead of replacing the pre-existing storage system, why not build onto it? Artico™ offers an easy, nondisruptive choice for adding Quantum tape, FlexTier™, and Lattus™ scale-out storage to an existing security environment. Quantum’s StorNext platform is a policy-driven tiering software, allowing users to extend primary storage with scalable, more cost-effective tiers of storage. Our multi-tier solution is ideal for security and surveillance organizations with large amounts of video dealing with the challenges that come with scaling storage with your data growth. End users can set up policies to automatically migrate data across tiers, utilizing less costly types of storages like file-based tape and cloud, thus delivering the total capacity needed more cost effectively.
Corruption Perceptions Index 2017 By Transparency International
An index recently released by Transparency International, which marks its 25th anniversary this year, reveals some disturbing information. Despite attempts to combat corruption around the world, the majority of countries are moving too slowly in their efforts. While stemming the tide against corruption takes time, in the last six years many countries have still made little to no progress. Even more alarming, further analysis of the index results indicates that countries with the lowest protections for press and nongovernmental organisations (NGOs) also tend to have the worst rates of corruption. The index, which ranks 180 countries and territories by their perceived levels of public sector corruption according to experts and business people, uses a scale of zero to 100, where zero is highly corrupt and 100 is very clean. This year, the index found that more than two-thirds of countries score below 50, with an average score of 43. Over the last six years, several countries significantly improved their CPI score, including Côte d’Ivoire, Senegal and the United Kingdom, while several countries declined including Syria, Yemen and Australia. This year, New Zealand and Denmark rank highest with scores of 89 and 88 respectively. Syria, South Sudan and Somalia rank lowest with scores of 14, 12 and 9 respectively. The best performing region is Western Europe with an average score of 66. The worst performing regions are Sub-Saharan Africa (average score 32) and Eastern Europe and Central Asia (average score 34). Every week a journalist is killed in a highly corrupt country Analysis of the index results by Transparency International further examined the relationship between corruption levels, the protection of journalistic freedoms and engagement of civil society. It found that almost all journalists killed since 2012 were killed in corrupt countries. fear for their lives when speaking out against corruption,” said Patricia Moreira, Managing Director of Transparency International, “Given current crackdowns on both civil society and the media worldwide, we need to do more to protect those who speak up.” The analysis, which incorporates data from the Committee to Protect Journalists, shows that in the last six years, more than 9 out of 10 journalists were killed in countries that score 45 or less on the Corruption Perceptions Index. This means that, on average, every week at least one journalist is killed in a country that is highly corrupt. In addition, one in five journalists that died were covering a story about corruption. Sadly, justice was never served in the majority of these cases. The efforts of Transparency International and its first-hand experience working with more than 100 chapters worldwide confirm close linkages between corruption and freedom of the press. For example, in Brazil, which scored 37 on this year’s index, 20 journalists died in the last six years. Targeted for their investigations into local government corruption and drug-related crime, among other issues, reporters in Brazil risk their lives everyday by simply doing their jobs. Corruption linked to shrinking space for civil society Transparency International also looked at the relationship between corruption levels and the freedom with which civic organisations are able to operate and influence public policy. The analysis, which incorporates data from the World Justice Project, shows that most countries that score low for civil liberties also tend to score high for corruption.] “Smear campaigns, harassment, lawsuits and bureaucratic red tape are all tools used by certain governments in an effort to quiet those who drive anti-corruption efforts,” said Moreira, “We’re calling on those governments that hide behind restrictive laws to roll them back immediately and allow for greater civic participation.” Hungary, which saw a ten-point decrease in the index over the last six years, moving from 55 in 2012 to 45 in 2017, is one of the most alarming examples of shrinking civil society space in Eastern Europe. If enacted, recent draft legislation in Hungary threatens to restrict NGOs and revoke their charitable status. This would have disastrous implications for many civil society groups already experiencing the constraining effects of a previous law that stigmatises NGOs based on their funding structures. “CPI results correlate not only with the attacks on press freedom and the reduction of space for civil society organizations,” said Delia Ferreira Rubio, Chair of Transparency International, “High levels of corruption also correlate with weak rule of law, lack of access to information, governmental control over social media and reduced citizens’ participation. In fact, what is at stake is the very essence of democracy and freedom.” India appears at the 40th position of CPI. About the corruptions perceptions index Since its inception in 1995, the Corruption Perceptions Index, Transparency International’s flagship publication, is the leading global indicator of public sector corruption. The index offers an annual snapshot of the relative degree of corruption by ranking countries from all over the globe. Their latest analysis, which looks at the relationship between corruption and freedom of the press, association and expression, uses statistics collected by the Committee to Protect Journalists, Reporters without Borders, the Varieties of Democracy Project and the World Justice Project.
Be Cautious: You could be Giving out your Own Passwords
There are two types of hacking or unauthorized access to accounts. The first involves password cracking tools, but most organizations have cyber security features in place to prevent these attacks. However, it’s the second type of attack that can cripple any organization or person’s accounts and databases, and that is a social engineering attack. 〈 “ Social engineers are criminals who take advantage of human behaviour to pull off an online scam or hacking attack. Successful social engineers are confident and in complete control of the situation “ 〉 Social engineers generally use two techniques – one is by simple observation while the other is the proactive effort. In the first case, the social engineer simply observes a person’s social networking profiles such as Linkedin profiles etc., and all other data available about him. Most people have passwords that they can easily remember, and for that they use the words that are closely related to them. People share every detail of their lives on social networking sites including their date of birth, favourite colour, pet’s name and everything possibly related to them. This information is freely available. This makes it pretty easy for the hackers/ social engineers to guess passwords in such a scenario and fix it. It’s always advisable to be discrete with respect to the data shared on social media. Such data is also collected by the online questionnaires and market research forms that people request to fill in public places. In the second case, the attack is pre-planned and a complete checklist is made of the person or companies including likes and dislikes, passions, hobbies and professional credentials etc. The second stage of physical access now comes into the picture. For example, three income tax officials turn up at your office for an inspection along with relevant badges and check all the office computers and documents. In the process they lodge key loggers into your computers, whereby they will receive an email of every key stroke made on the computers, thereby giving out your passwords and confidential data. An example of this kind of attack would be where a social engineer researches about a person let’s say Mr. A, and collects that the person is fond of foreign holidays. The social engineer calls up this person as the authorized representative from a reputed travel agency and offers a mind-blowing holiday package. He asks Mr. A the version of PDF reader he is using on his laptop. The conversation is very friendly and inspires trust in the mind of Mr. A. The social engineer sends the holiday proposal in a PDF format which is not compatible with the PDF reader installed by Mr. A, and along with the proposal sends a compatible PDF reader for Mr. A to download and read the proposal. The PDF reader has malware attached that gives the social engineer access into Mr. A’s computer Another example of this type of social engineering attack is where a very pretty woman, who is a journalist, goes to meet the system administrator of a big company, to get his opinion on cyber security. She goes easy and flirts with him and after taking his opinion pushes off. In the course she ‘accidently’ leaves her pen drive behind with him. The ensuing impact of the girl would make him curious to know more about her and hence he accesses her pen drive. The pen drive is infected with key logger and Trojan malware, which make the company’s networks very vulnerable. The 4 basic principles which most social engineers follow are: They project confidence: They do not sneak around, they proactively approach people and draw attention towards themselves. They give you something: Probably just a small favor which creates trust and a perception of indebtedness. They use humor as that is one tool which is endearing and disarming. They make a request and offer a reason and research shows people are likely to respond to any reasoned request. Attacks by social engineers are offences in India under Section 43 of the Information Technology Act, 2000. This section reads as under: Penalty and compensation for damage to computer, computer system etc. If any person without the permission of the owner or any other person who is in-charge; Accesses or secures access to such computer, computer system or computer network or computer resource; Downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium; Introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network; Damages or causes to be damaged any computer, computer system or computer network, data, computer database or any other programmes residing in such computer, computer system or computer network; Disrupts or causes disruption of any computer, computer system or computer network;] Denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means; Provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder; Charges the services availed by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network, Destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means; he shall be liable to pay damages by way of compensation to the person so affected. 〈 “A victim is required to make a Complaint in the prescribed format along with the applicable fees to The Adjudicating Officer, Information Technology Act, 2000. Under the provisions of the Rules for the conduct of Adjudicating Proceedings, the Adjudicating officer shall decide every application in 4 months and the whole matter in 6 months “ 〉 The biggest weakness lies not in computer systems, but lies in human…
INTERPOL Digital Security Challenge
Do you know how to protect your webcam from being hacked? Would you know if a cybercriminal was using your printer to carry out cyberattacks? While most of us are aware of the dangers that cybercriminals can pose to our computers and mobile phones and take steps to protect them, we seldom consider how these threats can affect the growing number of Internet vc connected devices we use in our daily lives. The ‘Internet of Things’ All devices which can connect to the Internet – collectively called the ‘Internet of Things’ or IoT – are potentially at risk of a cyberattack. Everyday personal items like video cameras, refrigerators and televisions can be used by cybercriminals for malicious means. Cyberattacks targeting or using IoT devices have increased significantly in the past two years, according to several reports from the private cybersecurity industry. An example was the Mirai botnet, which in 2016 infected tens of thousands of devices, mostly Internet routers, with weak password security. These were then used in coordinated distributed denial of service (DDoS) attacks against websites worldwide including a university and several media sites. In the world of cybercrime, the number of IoT devices a criminal has access to is seen as a sign of their status. Although police around the world are developing the skills necessary to forensically examine computers and mobile phones, they are often not aware of how to collect evidence from other connected devices. The latest edition of the INTERPOL Digital Security Challenge tackled this threat, with 43 cybercrime investigators and digital forensics experts from 23 countries investigating a simulated cyberattack on a bank launched through an IoT device. “Cybercrime investigations are becoming more and more complex and operational exercises such as the Digital Security Challenge, which simulate some of the hurdles that investigators face every day, are vital for the development of our capacities,” said Peter Goldgruber, Secretary General of the Austrian Ministry of the Interior. Meeting the challenge I n the scenario, cybercriminals attacked a bank in an attempt to steal large sums of money. The investigators analysed the bank’s computers to identify the date, time and files where the malware installed by the criminals. Through this digital forensic examination, the teams discovered the malware was contained in an e-mail attachment sent via a webcam which had been hacked, and not directly from a computer. This is an emerging modus operandi, as it is more difficult to identify the source of the attack. Once the teams accessed the digital data held by the compromised webcam, they identified the command and control server being used to remotely control the device to conduct the cyberattack. Further evidence led to the identification of a second command and control server, and the investigators identified technical vulnerabilities of the servers which could be used to prevent further attacks. Noboru Nakatani, Executive Director of the INTERPOL Global Complex for Innovation said the scenario provided a learning experience on how to conduct real-world investigations more effectively. “The ever-changing world of cybercrime is constantly presenting new challenges for law enforcement, but we cannot successfully counter them by working in isolation. “A multi-stakeholder approach which engages the expertise of the private sector is essential for anticipating new threats and ensuring police have access to the technology and knowledge necessary to detect and investigate cyberattacks,” said Mr Nakatani. Tips for safeguarding IoT devices: Change the factory default passwords – these can be the same for hundreds or thousands of devices, making it easy for criminals to hack; Regularly update all software; Disable features which allow the device to be accessed remotely; Take extra care when buying used devices – you don’t know what the previous owner installed on the device. Sharing expertise Conducted annually, INTERPOL’s Digital Security Challenge helps police worldwide develop the skills necessary to tackle the latest cybercrime threats. The first two events in 2016 and 2017 simulated cyber blackmail involving bitcoin and a ransomware attack. This year’s three-day (19-21 February) event was organized in close I n the Americas, hurricanes, tornadoes and earthquakes are occurring more frequently, so unimpeded mass communication during these events is critical. MNS software is often employed so companies can communicate with their employees, federal agencies, university students and the general public. More channels of communication available in these types of events, means more people can reach safety faster and more lives can be saved. In Western Europe, the second-largest market for MNS software, weather-related incidents occur less often, How Catastrophic Events are Changing Mass-Notification System Market By Robert Brooks – Analyst, Security and Building Technologies, IHS Markit cooperation with the INTERPOL National Central Bureau in Vienna and private sector partners NEC Corporation and Cyber Defense Institute. “NEC has contributed as a strategic partner to INTERPOL’s commitment to improve the cybersecurity skills of investigators throughout the world. For the third year, NEC is honored to have helped develop the Digital Security Challenge by providing our expertise at this cutting-edge event,” said Kozo Matsuo, Vice President of NEC Corporation’s Cyber Security Strategy Division.’ Training sessions to develop participants’ practical knowledge on IoT device analysis and the latest trends in malware-related crime were delivered by specialists from NEC Corporation, InfoSec, Meiya Pico, SECOM, Kaspersky Lab and Trendso the need for MNS software is lower than in the Americas. While individual countries might deal with specific weather threats – like blizzards and freezes in Sweden and flooding in the UK – in 2017 the United States alone experienced four major hurricanes. Mass-notification system (MNS) software used in emergency communication, the primary segment used during a catastrophic event, is expected to grow in the Americas at a compound annual growth rate (CAGR) of 6.8 percent from 2017 to 2021, reaching $293.1 million in 2021. Micro. Support was also provided by the UN Office on Drugs and Crime (UNODC). Kenji Hironaka, President of Cyber Defense Institute said, “We are proud to have provided forensic content and technical support during all three INTERPOL Digital Security Challenge events. We will…