Security Advisor Middle East | Issue 29 by Security Advisor Middle East

ISSUE 29 | AUGUST 2018 www.tahawultech.com

DDOS PREPARING THE BEST DEFENCES AGAINST DISTRIBUTED DENIAL OF SERVICE ATTACKS

Streaming piracy

Threat intelligence sharing

Password protection

CYBER EXPOSURE PARTNER

FOUNDER, CPI MEDIA GROUP Dominic De Sousa (1959-2015)

CYBERSECURITY SOLUTIONS PARTNER

CONTENTS

The Cyber Exposure Company

Publishing Director Natasha Pendleton natasha.pendleton@cpimediagroup.com +971 4 440 9139

EDITORIAL Managing Editor Michael Jabri-Pickett mjp@cpimediagroup.com +971 4 440 9158 Online Editor Adelle Geronimo adelle.geronimo@cpimediagroup.com +971 4 440 9135 Contributing Editors James Dartnell james.dartnell@cpimediagroup.com +971 4 440 9153 Janees Reghelini janees.reghelini@cpimediagroup.com +971 4 440 9167 Glesni Holland glesni.holland@cpimediagroup.com +971 4 440 9134 DESIGN Senior Designer Analou Balbero analou.balbero@cpimediagroup.com +971 4 440 9140 Designer Mhar Delaben marlou.delaben@cpimediagroup.com +971 4 440 9156 ADVERTISING Group Sales Director Kausar Syed kausar.syed@cpimediagroup.com +971 4 440 9130

Senior Sales Manager Sabita Miranda sabita.miranda@cpimediagroup.com +971 4 440 9128 Sales Manager Nasir Bazaz nasir.bazaz@cpimediagroup.com +971 4 440 9147

DDOS

Business Development Manager Youssef Hariz youssef.hariz@cpimediagroup.com +971 4 440 9111

How to ﬁght back against distributed denial of service attacks

PRODUCTION Operations Manager Shweta Santosh shweta.santosh@cpimediagroup.com +971 4 440 9107 DIGITAL SERVICES Web Developer Jefferson de Joya Abbas Madh Photographer Charls Thomas Maksym Poriechkin webmaster@cpimediagroup.com +971 4 440 9100

SECURITY AT YOUR FINGERTIPS How to craft a strong password

WHAT’S IN A NAME? Why identity theft is becoming one of the largest cyber threats today

Published by

Registered at Dubai Production City, DCCA PO Box 13700 Dubai, UAE Tel: +971 4 440 9100 Fax: +971 4 447 2409

Printed by Al Ghurair Printing and Publishing

Regional partner of

© Copyright 2018 CPI All rights reserved While the publishers have made every effort to ensure the accuracy of all information in this magazine, they will not be held responsible for any errors therein.

RED TEAMING (PART 1) FireEye’s Mohammed AbuKhater on examining IT security issues from an adversary’s perspective

STRENGTH IN UNITY Infoblox’s Ashraf Sheet on why security data sharing and collaboration is vital in the connected era

5 SECURITY ROLES IN DIGITAL ERA

SOMETHING PHISHY How to identify and avoid phishing scams

Why CISOs must evolve the talent strategy to reﬂect the changing IT landscape

NEWS

OMAN THWARTED OVER 800M CYBERATTACKS: ITA Oman has reportedly warded off over 880 million cyber-attacks on government networks in 2017, three times more than 2016 when the country recorded 279 million such attacks. While 1.41 million attacks specifically targeting government websites were successfully prevented in 2017, which came down from 1.75mn in 2016, according to Information Technology Authority’s (ITA) Annual Report 2017. According to the International Telecommunications Union’s (ITU) Global Cybersecurity Index (GCI) 2017, Oman is among the top five most cybersecure countries in the world and first in the Arab world. Oman’s ITA has two main divisions focus on cybersecurity: Information Security Division (ISD), which is responsible for the security of government entities, and the Oman Computer Emergency Readiness Team (OCERT), which is responsible for the security of cyberspace in Oman and public awareness in the field.

$10M+

value earned by cybercriminals from crypto-related schemes over the last year Source: Kaspersky Lab

08.2018

ETISALAT TO MAKE DUBAI “THE SAFEST PLACE IN THE WORLD”

Etisalat Digital has announced its new set of challenges for the 5th cohort of Dubai Future Accelerators (DFA) focusing on creating smart innovative solutions based on emerging technologies like artiﬁcial intelligence (AI) and blockchain. The partnership with the governmentsupported accelerator is part of Etisalat Digital strategy to bring the latest technologies and innovations to enable a smart ecosystem. The technology themes for the challenges under the ﬁfth cohort of this programme revolve around using AI and Blockchain to address key areas of any smart city.

In support of UAE 2021’s vision of making the country the safest place in the world and to enhance transportation, the ﬁrst challenge focuses on reducing crime and road congestion using AI on video surveillance systems by analyzing behaviour, predicting crime-related patterns, congestion, and road accidents. It also includes enabling automated decisions that alert the concerned authorities. The second challenge focuses on using Blockchain to reduce transactional costs and complexity in B2B processes between banks, government, and private sectors by 40% within ﬁve years. For its third challenge, Etisalat Digital would like to adopt Blockchain to allow exchange across various loyalty currencies and to transform a loyalty currency into a crypto currency that can be used to perform online and physical transactions.

DATA BREACHES COST SAUDI ARABIA, UAE FIRMS UP TO $5.31M IBM Security has announced the results of a Middle East study examining the full ﬁnancial impact of a data breach on businesses located in Saudi Arabia and the UAE. Overall, the study found that the average total cost of a data breach in Saudi Arabia and UAE combined is $5.31 million, a 7.1 percent increase since 2017. The study revealed that breaches cost companies in Saudi Arabia and UAE $163 per lost or stolen record on average. It also revealed that the root cause for 61 percent of breaches in the two GCC nations is malicious or criminal attacks, followed by system glitches at 21 percent and human error at 18 percent. The 2018 report revealed that the major

cause of a data breach is malicious or criminal attacks for organisations in Saudi Arabia and UAE. It revealed that in the two countires, the average time to identify a data breach was 260 days, and the average time to contain a data breach once identiﬁed was 91 days, the study noted. Financial services, services and technology in Saudi Arabia and UAE have topped the list as the most expensive industries for data breaches, costing organisations $219, $201 and $188 per record, respectively. The study revealed that major factor impacting the cost of a data breach in Saudi Arabia and UAE was the reported cost of lost business, which was $2.2 million.

www.tahawultech.com

NEWS

SAUDI ARABIA TELCO TO TRAIN CYBERSECURITY TALENTS

Saudi Arabia’s STC has reportedly launched a new programme aimed at educating and training 150 students in cybersecurity. The initiative was announced by Saudi Minister of Communications and Information Technology Abdullah Al-Sawaha, in the presence of Nasser Al-Nasser, STC Group CEO, and Abdul Aziz Al-Ruwais, governor of CITC. The “Cyber Craft” programme aims to train more than 150 students in Riyadh, Jeddah and Alkhobar, in collaboration

with two leading global companies in cybersecurity learning. Under the programme the students will go through summer training for a month, and they will have veriﬁed certiﬁcates at the end of the training. Al-Sawaha praised the STC’s initiative of launching the “Cyber Craft” programme, which seeks to build local and professional capabilities in cybersecurity based on best practices and global standards to lead the Kingdom to the ranks of developed countries in modern technical knowledge. “The objectives of the programme are compatible with the increasing demand for specialists in cybersecurity, especially as the services in the Kingdom witness an accelerating digital transformation in line with the Kingdom’s Vision 2030,” he added.

RUSSIA BLOCKED 25M CYBERATTACKS DURING THE WORLD CUP

Russia became the target of nearly 25 million cyber-attacks during the FIFA World Cup tournament, according to President Vladimir Putin. “During the World Cup almost 25 million cyber-attacks and other criminal attempts on Russia’s information infrastructure, connected in one way or another to the running of the football World Cup, were neutralised,” the president is quoted in a transcript of a meeting with security forces. Putin revealed the data at a meeting dedicated to the security of the World Cup. www.tahawultech.com

During the meeting, the Russian president also thanked the representatives of 55 special services and law enforcement agencies from 34 countries which helped ensure security during the month-long tournament. Russia, which hosted the World Cup from June 14 to July 15 in 11 cities and 12 stadiums, has been repeatedly accused by Western countries of conducting cyber-attacks including hacking the 2016 US elections. The government has denied previous accusations that it carried out cyber-attacks on the United States and other countries. Putin remarked that the tournament was huge success and promised to create a ﬂexible visa regime for the fans who “have fallen in love with Russia,” and allow those who have Russia 2018 fan IDs to freely travel the country until the end of the year.

SYMANTEC UNCOVERS NEW THREAT ACTOR TARGETING MIDDLE EAST GOVERNMENT FIRMS Cybersecurity firm Symantec has uncovered the operations of a threat actor named Leafminer that is targeting a broad list of government organisations and business verticals in various regions in the Middle East since at least early 2017. The group tends to adapt publicly available techniques and tools for their attacks and experiments with published proof-of-concept exploits, according to the cybersecurity firm Leafminer attempts to infiltrate target networks through various means of intrusion: watering hole websites, vulnerability scans of network services on the internet, and brute-force/dictionary login attempts. The actor’s postcompromise toolkit suggests that the group is looking for email data, files, and database servers on compromised target systems. Symantec detection telemetry shows malware and custom tools used by Leafminer on 44 systems across four regions in the Middle East. The investigation uncovered that Leafminer has a list of 809 targets used by the attackers for vulnerability scans. The list is written in the Iranian language Farsi and groups each entry with organisation of interest by geography and industry. The below figure shows a breakdown of the industry verticals. Targeted regions included in the list are Saudi Arabia, United Arab Emirates, Qatar, Kuwait, Bahrain, Egypt, and Afghanistan.

08.2018

FEATURE

Winning the ﬁght against digital piracy in the Netﬂix era By Daniel Bardsley

he television series “13 Reasons Why” has been a major hit for Netﬂix, making stars of its cast members – some have secured ﬁlm roles and commercial contracts – and cementing the streaming service’s appeal with younger viewers including, news reports have indicated, many in the UAE. Based on a bestselling young adult novel about the factors behind a high school pupil’s suicide, “13 Reasons

08.2018

Why” drew in enough viewers to its recent second season that Netflix announced in early June that there would be a third round in 2019. The show has, however, sparked the interest of some viewers that company executives are unlikely to want to attract: people who do not pay a Netflix subscription Along with another Netflix programme, “Orange Is The New Black”, the series has been highlighted as being one of the most watched

programmes on a popular pirate streaming website. Such sites are drawing in vast numbers of users. MUSO, a technology company offering products that help organisations measure and combat piracy, said in ﬁgures released in March that video piracy sites receive more than 0.5 billion visits a day, with over half going to streaming sites. The company’s 2017 global piracy report also detailed the eye-wateringly www.tahawultech.com

FEATURE

high popularity of music piracy sites, reporting that they attracted almost 74 billion visits last year. Indeed, music piracy is said to have reached new highs in the first half of 2017, while increases were also seen in gaming and film piracy. MUSO’s figures appear to represent a sharp dose of reality after suggestions from some observers that piracy was fading thanks to the affordable and easy access to large amounts of material offered by paid-for streaming services. Traffic through BitTorrent – a peerto-peer file-sharing protocol – has, indeed, fallen dramatically. In 2003, peer-to-peer file sharing reportedly had a 60 percent share of peak downstream traffic in North America, while recent figures suggest that this has dropped to less than two percent. The inconvenience of finding a file and downloading it, along with other steps, has put viewers off. Yet in a statement released to coincide with the publication of the 2017 report, Andy Chatterley, MUSO’s co-founder and CEO, said that the suggestion that the piracy problem had been resolved by the popularity of ondemand services like Spotify and Netflix “doesn’t stack up”. This is because pirate viewers, in moving away from

BitTorrent, have turned instead to pirate streaming services. “With the data showing us that 53 percent of all piracy happens on unlicensed streaming platforms, it has become clear that streaming is the most popular way for consumers to access content, whether it be via legitimate channels, or illegitimate ones,” says Chatterley in a previous statement. The scale of piracy is such that an

This is a technological race between the pirates and the content providers. The pirate community, those who come up with illegal copies, they’re quite advanced in their race. - Janne Riekkinen, University of Jyväskylä in Finland

www.tahawultech.com

estimate from last year put the ﬁnancial effects on the likes of Netﬂix and other streaming sites, including Amazon Prime Video, at more than $50 billion between 2016 and 2022. The United States is the largest market for piracy, followed by Russia, although other parts of the world are also seeing growth. Janne Riekkinen, a researcher at the University of Jyväskylä in Finland who recently completed doctoral research looking at streaming media piracy, says that “piracy appears to be particularly common in the Middle East and Asia”. Current efforts to combat streaming piracy, he says, “don’t work that well,” with efforts to block and take down illegal sites only effective “to a certain degree”. “This is a technological race between the pirates and the content providers,” says Riekkinen. “The pirate community, those who come up with illegal copies, they’re quite advanced in their race.” But efforts to combat piracy go well beyond the technological: appealing to people’s better nature may yield results. Pirates regularly employ mental techniques to justify and defend 08.2018

FEATURE

their actions, something known as “neutralisation techniques”. “They may take forms such as, ‘Everybody else is pirating, so I can too’ [and], ‘Piracy causes no harm.’ In the criminology tradition, countering or discrediting these neutralisation techniques is seen as a method to curb offending,” says Riekkinen. Research indicates, says Riekkinen, that neutralization is especially common in Asian societies, possibly because they are more collectivist, with social standing and conforming to norms being more highly valued. A 2012 study suggested, he says, that, “The moral obligation to not pirate has less effect on piracy intentions and behaviours in the Middle East (Kuwait) than in the west (USA).” “Religion is central in Middle Eastern cultures, and researchers have studied the possibility of utilising religious leaders in anti-piracy communication. Based on their ﬁndings, this approach might have some merit,” he says. “[Also], based on my research, the introduction of legal SVOD [Streaming/ Subscription video on demand] services has weakened neutralisation and made piracy less acceptable in the eyes of the public. The improvement

and expansion of SVOD services may continue this trend.” Although content producers have made efforts to clamp down in piracy – just over a year ago, Netflix and Amazon became founder-members of the Alliance for Creativity and Entertainment, which aims to cut online piracy – some researchers are unsure that piracy does significant damage. Particularly with music piracy, the net effect could sometimes be beneficial, suggests Dr Joao Quintais, one of three researchers at the University of Amsterdam involved in the ongoing “Global online piracy study”, an initiative run in association with the Dutch-based research and consultancy company Ecorys. For example, Quintais says that research has shown that people who have illegally sampled a particular artist’s work might be more likely to go to one of that artist’s concerts. “Most studies have shown there’s some negative effect [of piracy]; in some cases it’s outweighed by the positive,” he adds. Even the likes of Netflix might not be suffering significant harm. Professor Tilman Baumgärtel, editor of “A Reader on International Media Piracy,” sees Netflix as being more concerned

Netﬂix is more concerned with extending the reach of its brand and its shows. Making money is not what they’re about right now; they just want to reach anybody, by whatever means necessary. - Professor Tilman Baumgärtel

08.2018

with extending the reach of its brand and its shows. “Making money is not what they’re about right now; they just want to reach anybody, by whatever means necessary,” he explains. “If piracy makes more people familiar with ‘Daredevil’ or ’13 Reasons Why’, there is nothing wrong with piracy. “That also explains the huge investments they are making in content – nobody knows if they will ever be able to earn that money back, but it does not matter. It is all about getting people’s attention. The same goes for the supercompetitive pricing.” Recent results indicate, though, that Netflix is adding subscribers at a breathless pace, and its turnover and income are also increasing rapidly, suggesting that its heavy investments in content are paying off. In any case, some observers do not think that attempts to enforce antipiracy rules are the best approach. With sufficient income and reasonably priced legal services, “people are generally willing to pay”, says Quintais. “If people have enough money, most will likely go for the convenience [of legitimate streaming services]; it’s much easier to go on Spotify than go on Pirate Bay and download,” he says. “This calls into question whether you always need more enforcement, or whether the solution isn’t better sought in the business side of things.” Baumgärtel, who teaches at the University of Applied Sciences, Mainz, also questions the value of enforcement. There is not much, he says, that providers can do about piracy. “For every illegal streaming service that goes down, three new ones pop up. Fighting piracy with legal means is a longterm affair, as fighting peer-to-peer piracy has shown. In the end, the death knell for these services was not the number of people that the media industry dragged into court, but the more convenient services like Spotify,” he adds. www.tahawultech.com

REDEFINING technology transformation

+971 4 440 9100

@TahawulTech

info@cpimediagroup.com

www.tahawultech.com

facebook.com/tahawultech

twitter.com/tahawultech

linkedin.com/in/tahawultech

FEATURE

SECURITY AT YOUR FINGERTIPS: How to craft a strong password 10 08.2018

www.tahawultech.com

FEATURE

magine all of the ways in which people think up their passwords. Some go for the name of the football team they support, a favourite film or their date of birth, with a couple of extra characters thrown in for added security. “Humans will try to find ways of coming up with passwords that they can remember easily, which makes sense, but on the other hand, these passwords are going to be fairly weak,” says Professor Luca Vigano, a member of the cybersecurity group at King’s College London. Others select a string of random numbers and letters, a jumble that, it is hoped, will defy even the most accomplished fraudsters. Each of us has to find ways to come up with passwords because there is little sign that they are disappearing. There have been predictions that password use would decline thanks to alternative methods of authentication, yet the need to register for countless websites and online services means that we are actually employing more of them than ever.

Indeed a 2017 report from the password manager LastPass suggested that the average business user has to deal with as many as 191 passwords. No wonder password reuse for multiple accounts is rife, despite the security risks. Although passwords are central to so much of what we do on our computers, some of the advice people are given when choosing their password, such as being told to incorporate particular types of character, can be of limited value in preventing fraud. “If you are a security manager for a company and you’re told to make sure your company stays secure and has good passwords, if you add requirements you’re not going to be accused of not doing enough. Nobody could say whether it was a useful requirement,” says Professor Lorrie Faith Cranor, a former US Federal Trade Commission chief technologist who researches password security at Carnegie Mellon University in Pittsburgh, United States. The common request that users should regularly change passwords, for example, can be counterproductive,

Humans will try to ﬁnd ways of coming up with passwords that they can remember easily, which makes sense, but on the other hand, these passwords are going to be fairly weak. - Professor Luca Vigano, King’s College London

www.tahawultech.com

as it increases the burden of memorisation, which may lead to unsafe practices. The United States’ National Institute of Standards and Technology has updated its password advice to take account of improved knowledge in recent years of what works when it comes to passwords. Cranor and her collaborators have been involved with many of the studies over the past decade that have led to this greater understanding. They and others have been helped by the availability of leaked datasets of passwords, which can yield useful information when analysed without causing any additional harm to those whose data was leaked. “People started becoming interested in using these for research purposes,” says Dr Michelle Mazurek, assistant professor in the Department of Computer Science at the University of Maryland. This strengthened knowledge helps to balance out factors that have helped fraudsters in their efforts to guess passwords. These include, says Cranor, the faster speed of today’s computers, and the availability of computers that are part of botnets able to run “brute force” attacks to guess passwords, testing billions of potential passwords in a few hours. Botnets make light work of the tricks that many of us employ when choosing a password, such as adding a number or letter at the end of a common word. Employing online experiments in which thousands of people participated, Cranor, Mazurek and others have used a scientiﬁc approach to understand password security. One set of tests saw more than 50,000 volunteers come up with a password that conformed to certain requirements, such as being at least 12 characters long and including 08.2018

FEATURE

digits, symbols and lower and uppercase letters. This type of research suggests that adding such characters is worthwhile – but these characters should be put somewhere in the middle of words. If they are added at the end, the password is much easier to guess. Another suggestion is to think up a sentence that has probably never been said before, and to use the initials of each word as the password. A further idea is to take the initials from the words of an obscure song or poem. Password security is, however, about more than just choosing a good password, because there are myriad ways in which passwords can be compromised apart of being identiﬁed through a brute force attack (automated guessing by computer) or manual guessing (such as trying out dates of birth). As Britain’s National Cyber Security Centre details in guidance notes, passwords can be intercepted while being transmitted, and are vulnerable to social engineering attacks, key logging, shoulder surﬁng (when a person observes another individual

typing the password) or the searching of IT infrastructure. All these have to be considered when it comes to security. How passwords are used – or reused – is also important. “The key thing is to make all of your passwords unique and not reuse, and make it hard to guess. It has to be different to what other people [choose],” says Cranor. Choosing unique, strong passwords is especially vital for more important accounts. But which accounts are the most important? “People think a bank account is, but email is where all you other accounts send to. If the password for your email account gets compromised, that makes every other account vulnerable,” says Mazurek. Remembering the dozens upon dozens of passwords that each of us has is next to impossible, unless we reuse passwords. This is seen as particularly unwise, since if one online account is compromised, or if the attacker correctly guesses one password, then access to all other accounts with the same password is easy. There is an alternative to such reuse.

Don’t use the same password for multiple accounts. If a company suffers a data breach and your login and password is compromised, the attackers can use the same credentials to compromise other online accounts. - Ramy Al Damati, Kaspersky Lab

08.2018

“Reusing them is much more dangerous than storing them, if you store them in a sensible way. A Post-it Note on your monitor is maybe not the best way,” says Mazurek. A better solution is keeping a note of passwords on an encrypted file on a computer, or using a good-quality password manager. Multi-factor authentication, in which an additional security measure is used in addition to the password, offers another safety net for those not good at remembering complex passwords. “It’s OK to have a short password that’s easy to remember, if it’s combined with proving your identity in another way, like receiving a text message with a one-time code that you input in addition to your password, or biometric face scanning or fingerprints. The trend is towards multifactorial or two-form [authentication],” says Vigano. Advice on choosing passwords from Ramy Al Damati, the UAE-based enterprise security expert for the Middle East, Turkey and Africa region at the antivirus and internet security company Kaspersky Lab: Use unique, complex passwords. This means passwords that combine letters, numbers and special characters. Passwords should be at least eight characters long – ideally 15. Don’t use personal information, such as a spouse’s or a pet’s name. Don’t use the same password for multiple accounts. If a company suffers a data breach and your login and password is compromised, the attackers can use the same credentials to compromise other online accounts. If you find it hard to remember lots of complex passwords, install a password manager that can remember them – you just need to remember a single master password. Alternatively, write down your passwords, preferably in the form of a “code”. Don’t keep them where someone else could easily find them, or in the same place as your device. www.tahawultech.com

FEATURE

What’s in a name? With cybercriminals inventing new tricks every day it’s hard to stay safe. The damage can be more than ﬁnancial. As the amount of personal information stored and shared on electronic devices, identity theft is becoming one of the largest cyber threats today, Daniel Bardsley reports.

t is remarkable how much information about a person can be picked up by a trawl through through the Internet. Thanks to the likes of LinkedIn, Facebook, Twitter and Instagram, it is often not difﬁcult to work out with just a few minutes’ work where they last went on holiday, the names of their closes relatives, their car’s registration plate (if they have posted photos of the vehicle), which school they attended and where they work.

www.tahawultech.com

08.2018

FEATURE

As Professor David Chadwick, a professor of information systems security at the University of Kent in the United Kingdom puts it, “people are very happy to release information on their Facebook pages.” “People give names and other information, and [other] people [go through] the internet and pick that information up,” he says. “You have to assume that most of the information that you put into [a proﬁle] is going to be made public in one way or another. That’s behaving in a safe manner. Don’t post anything to a Facebook page or Tumblr or email that you’re not prepared to be made public.” Given the fondness that many people have for sharing their lives online, it is no surprise that identity theft is soaring, with a reported doubling in its frequency taking place between 2007 and 2017. The UAE is among the many countries to have experienced growth in identity theft. “Research ... suggests that due to the speed at which social-networking sites are ﬂuorishing, it has become a lot easier to steal content and conduct identity manipulation,” Dr Zeenath Reza Khan, Salma Rakhman and

Arohi Bangera, from the University of Wollongong in Dubai, wrote in a 2016 paper entitled “Who Stole Me? Identity Theft on Social Media in the UAE”. Presented at the 4th Global Conference on Business and Social Sciences in Dubai, the paper highlighted the vast scale of the problem. In 2015, more than 5 billion dirhams were said to have been lost by individuals in the Emirates because of cybercrimes like social media identity theft (SMIDT). In a survey by the researchers, a remarkable 59 percent of respondents (of whom there were 128) reported falling victim to one type of SMIDT or other, with young people particularly at risk. “Instances of SMIDT are high among student victims, particularly in the age bracket above 18. Furthermore, the impact of SMIDT on the student victims reported was quite grave, from humiliation to trust issues to feeling violated,” the researchers wrote. Studies have indicated, they said, that “victims of SMIDT are left with permanent wounds and the constant lingering of an irreversible experience”. The vast majority of identity theft takes place online and, where once

People give names and other information, and [other] people [go through] the internet and pick that information up. You have to assume that most of the information that you put into [a proﬁle] is going to be made public in one way or another. - Professor David Chadwick, University of Kent

08.2018

bank accounts and credit cards were the key target for fraudsters (whether through “new account fraud”, in which a new account is set up, or “account takeover fraud”, involving an existing account being compromised), today more is said to centre on the likes of online shopping accounts or mobile phone contracts. These tend to have less rigorous security controls than bank accounts. The type of material that could prove compromising when posted online can be surprising, as it goes well beyond the obvious, such as passwords, banking details and date of birth. Some experts advise users against posting where they were raised, their workplace, where they live and their family members’ names. Such information may be used to answer secondary security questions required to gain access to a bank or other type of account. Simply giving details on a Facebook page of a forthcoming, current or previous holiday could open up a line of attack for fraudsters by helping them, for example, to masquerade as a friend, either through email or a fake social media account. This could lead to conﬁdential details being divulged. Details that might be safe to post on their own could cause problems when added to information available elsewhere, and privacy settings on social-media accounts are not a foolproof way of preventing the wrong people from getting viewing online posts. Login information for compromised social media accounts is traded on the dark web, with prices starting at just a few dollars for the credentials for a dating site account, which could be used by fraudsters to gain the conﬁdence of other users to extract money from them. No wonder, then, that extra caution is advised when using online accounts. “When you do anything that requires authorisation, that requires security, then make sure you use strong www.tahawultech.com

FEATURE

There’s a lot of data out there that demonstrates positive effects of engaging with social media and sharing and feeling that you have a wide network of people that you’re keeping in touch with and [from whom you are] getting positive responses to your posts. - Professor Jonathan Freeman, i2 media research and University of London

credentials – a very strong password and do not give it out to anybody,” says Prof Chadwick. Given the pitfalls, it begs the question as to why people are willing to share so much online, whether it is what they had for breakfast, their relationship status or their thoughts on the latest political controversy. One reason is that individuals “seek social connection in a fragmented world”, according to Professor Jonathan Freeman, managing director of i2 media research and a professor of psychology at Goldsmiths, University of London. “[They are] trying to portray an image of themselves, even if n their subconscious. Most of it is to curate the image of themselves that they’re happy with, whether that’s a political stance, an environmental stance, an equality stance, how cool and trendy they are – a kind of personal branding,” he explains. Although such online sharing is seen by some as narcissistic, Freeman argues that social media use has many upsides. “There’s a lot of data out there that demonstrates positive effects of engaging with social media and sharing and feeling that you have a wide

network of people that you’re keeping in touch with and [from whom you are] getting positive responses to your posts,” says Freeman. Balancing this out, he cites research indicating that “image-based sites” can have a negative effect on body image and well-being. Also, seeing the endless positives associated with the lives of others – users tend to detail the best aspects of their lives on social media – can make others feel down. “It’s a question of moderation and being aware of the pitfalls and being mindful of your reactions,” says Freeman, whose company has carried out scores of research projects for clients including social media companies. Although often regarded as being keener to share more about themselves online, and despite reports that they in particular are more often

targeted for identity theft, young people, who have grown up with social media in a way that most adults have not, may be more savvy about what not to share than might be thought. Freeman says that they will often have been educated at school about what not to do online. “I would expect older and less techsavvy [people] may be more likely to post more risky content online in terms of identity theft,” he adds. A ﬁnal thing users are advised to remember when going online is not to unthinkingly follow the example of others. The social media herd may be exposing themselves to risks without realising it. “When something becomes the norm – posting your whereabouts on Instagram or Facebook hoping for as many likes as you can – when everyone else is doing it, it probably spreads the perception of it being safe even when it may not be,” says Freeman. “In lots of situations it may well be safe, but it is important to stay smart to enjoy the upsides of engaging on social media while avoiding risk.”

FEATURE

HOW TO DEFEND AGAINST DDOS ATTACKS Distributed denial-of-service (DDoS) attacks are becoming bigger and more severe than ever. Unfortunately, this cyber threat will continue to haunt chief information security ofﬁcers (CISOs) and IT teams for the foreseeable future.

n October 2016, Internet domain name system (DNS) infrastructure firm Dyn (now Oracle + Dyn) fell victim to a malicious wave of DNS queries from tens of millions IP addresses. The attack, executed through the Mirai botnet, infected over 100,000 IoT devices, including IP cameras and printers. The attack reached 400,000 bots and disrupted services to major companies, including Amazon, Netflix, Reddit, Spotify, Tumblr and Twitter. Earlier this year, a new and bigger DDoS attack emerged and hit hosting service GitHub. The impact of the attack was massive with 1.35 TB per second of traffic hitting the popular site. Although GitHub was only knocked offline intermittently and managed to beat the attack back entirely after less than 20 minutes, the

08.2018

sheer scale of the incident was alarming. DDoS attacks compromise Internet devices to generate enormous volumes of data and direct that data at a particular target such as a web server or router. A recent study by F5 Labs highlighted how DDoS attacks continue to grow and evolve in EMEA. According to customer data from F5’s Poland-based Security Operations Center (SOC), 2017 saw a 64 percent rise in mitigated incidents. EMEA is also firmly in the firing line, accounting for over 51 percent of reported global DDoS attacks. “DDoS attacks have grown in all possible dimensions,” says Alaa Hadi, regional director, High Growth Markets (Russia/CIS and Middle East), NETSCOUT Arbor. “More than the size of the attacks, DDoS is also growing in frequency. Our worldwide traffic analysis system called ATLAS, that monitors

around 1/3 of total Internet trafﬁc, registered 10 percent increase in attack amount in 2017 compared to 2016. “The attacks have also become more complex: almost half of the respondents of last year Worldwide Infrastructure Security Report have observed multivector DDoS attacks, that are harder to mitigate,” Hadi says. Increased IoT adoption is the primary source of this growth, explains Hadi. “With millions of IoT devices connected to the Internet on a daily basis, there is a huge potential for attackers to infect them and turn into DDoS bots.” In the past, DDoS attacks have been regarded as more of a nuisance than a serious threat to businesses, but now it has been regarded as one of the most serious cyber threats. This is in large part due to the huge proliferation of the easily-hackable Internet of www.tahawultech.com

Things. Furthermore, these attacks are simultaneously cheap to carry out and expensive to defend against. “Every company is vulnerable to DDoS attacks,” says Shah H. Sheikh, senior cybersecurity consultant and advisor/ co-founder, DTS Solution. “This type of threat can impact organisations of all shapes and sizes from e-commerce to banking, civil defence, telcos aviation and more as long as they rely on the Internet. Increased connectivity of Industrial Control Systems makes it vulnerable to DDoS, which could up new doors for would be and nation state actors.” Unfortunately, preventing DDoS attacks is almost impossible. Therefore, it is now more important than ever for organisations to understand how to stop a DDoS attack after it has started to affect their systems. Early detection is key ways to avoid devastating outcomes of an attack and the ﬁrst step to ensuring this is having a DDoS mitigation strategy in place. “As in every aspect of information security, it all starts with right people,” says Hadi. “Organisations should have a team from networking and security departments that would handle cooperation with service providers and cloud services to develop an anti-DDoS strategy. It is an industry-accepted best practice: the best DDoS protection consists of few layers.

When done right, automation becomes a ‘force multiplier’ for a defender, because when a DDoS attack hits, a couple of seconds can mean the difference between successful mitigation and costly network downtime. Automation buys this precious time. - Alaa Hadi, NETSCOUT Arbor

Large attacks are stopped upstream by ISPs or cloud, while stealth and more sophisticated application layer are handled by organisations onsite and of course, there is a full-time synchronisation between these two layers.” Automation and machine learning technologies can also be instrumental in the early detection of DDoS threats. “They both help a lot and we prefer to see automation as something more generic and useful, leaving machine learning to address very speciﬁc problems,” explains Hadi.

Security teams should also conduct regular DDoS cyber drills with attack simulations to ensure that the end to end processes are functioning as they should. It is important to keep in mind that when an attack happens, it does so without any warning. - Shah H. Sheikh, DTS Solution

“When done right, automation becomes a ‘force multiplier’ for a defender, because when a DDoS attack hits, a couple of seconds can mean the difference between successful mitigation and costly network downtime. Automation buys this precious time.” According to Sheikh, identifying the right technical solution that involves large coverage of both volumetric and application-based DDoS attacks ensures that the detection time of the DDoS attack is as short as possible. “It is also important to deﬁne a wellstructured SLA to ensure there are clear roles and responsibilities, timely response and action plan when an attack does materials with speciﬁc escalation points and go to communication model,” he says. “Lastly, security teams should also conduct regular DDoS cyber drills with attack simulations to ensure that the end to end processes are functioning as they should. It is important to keep in mind that when an attack happens, it does so without any warning.” As cybercriminals perfect their DDoS attacks, the technology and tactics of organisations need to evolve as well. To ensure a quick recovery, security teams should adopt a proactive approach to avoid the damaging effects of DDoS attacks.

PREVIEW

SPOTLIGHT ON SECURITY TahawulTech.com Future Security Awards will put the spotlight on organisations and projects that have shown excellence in security innovation.

he journey towards digital transformation coupled with the rise of cyber incidents is driving enterprises to invest in cybersecurity. Analyst ﬁrm Gartner predicted that worldwide cybersecurity spending will climb to $96 billion in 2018 as organisations across the globe are spending more on security as a result of regulations, shifting buyer mindset, awareness of emerging threats and the evolution to a digital business strategy. TahawulTech.com is putting the spotlight on organisations and projects that have invested in innovative security initiatives that brought unprecedented value to their businesses. To be held on 17th September 2018 at the Habtoor Grand Resort in Dubai, TahawulTech.com Future Security Awards will recognise individuals, businesses, and vendors that have delivered ground-breaking business

08.2018

value through innovative application of security technologies. The Awards welcomes companies from across the Middle East. It acclaims the best security minds and projects in the region whose technologies, products or solutions are deemed to have a great potential in meeting the needs of the digital era. The nominations will then be reviewed and judged by an expert panel based on their achievements as demonstrated by the depth and breadth of initiatives, innovation and speciﬁc measurable results. TahawulTech.com enlisted top technology and security leaders as part of the judging panel: Bhavani Suresh is currently the President of ISACA UAE Chapter and has over 20 years of experience in various Information Systems ﬁelds encompassing, business continuity management, information security management and IT operations management among others.

Irene Corpuz is currently a Manager for Transformational Projects at a UAE Federal Entity (undisclosed). Having previously held the position of Head of Information Security Section at an Abu Dhabi government entity among her key expertise are governance, risk and compliance. The panel also includes, Javed Abbasi who is the Principal Consultant and Founder at GISBA, which currently serves three continents and has clients from Switzerland, Middle East, Nigeria and South Africa with a focus on banking, telecom and certiﬁcation against international IT standards. Last but not the least, Megha Kumar who heads the software research and advisory practice at IDC Middle East, Africa, and Turkey. As a research director, she is responsible for managing and delivering projects across technology areas such as artiﬁcial intelligence, information security, blockchain, Big Data, and mobility. www.tahawultech.com

17th September 2018 Habtoor Grand Hotel & Resort

#FutureSecurityAwards facebook.com/ tahawultech

twitter.com/ tahawultech

linkedin.com/in/ tahawultech

instagram.com/ tahawultech

https://www.tahawultech.com/securityadvisorawards/2018/ For sponsorship enquiries Natasha Pendleton Publishing Director natasha.pendleton@cpimediagroup.com +971 4 440 9139 / +971 56 787 4778

Kausar Syed Group Sales Director kausar.syed@cpimediagroup.com +971 4 440 9130 / +971 50 758 6672

Youssef Hariz Business Development Manager youssef.Hariz@cpimediagroup.com +971 4 440 9111 / +971 56 665 8683

NETWORK SECURITY PARTNER

HOSTED BY

Michael Jabri-Pickett Managing Editor mjp@cpimediagroup.com +971 4 440 9158 / +971 50 668 3288

GOLD PARTNER

OFFICIAL PUBLICATION

ORGANISER

INSIGHT

RED TEAMING: WHEN THE COMPROMISE IS DESIRED (PART 1) In the first half of this two-part series, Mohammed AbuKhater, vice president, MEA, FireEye, discusses why it is crucial for organisations to examine IT security issues from an adversary’s perspective. ny compromise of an organisation is cause for concern, from groundlevel employees up to the CEO. But a compromise by a Red Team is desirable because the professional red teamers help companies understand their weak links before attackers exploit them. By acting like attackers, but in an ethical manner and at the direction of the organisation that hired them, red teams conduct a controlled compromise of their environment, often with specific objectives, or targets, in mind. Many people are likely already familiar with penetration testing, a typically broad-based security assessment with the ultimate goal of discovering as many security gaps and configuration flaws as possible

20 08.2018

www.tahawultech.com

INSIGHT

in an enterprise network in a given time. These vulnerabilities must then be “exploited” so the associated risk for the company can be determined. A penetration tester has fulfilled their mission when they have reached a specified target, such as access to Personally Identifiable Information (PII). Red Teaming – Penetration Testing at the Highest Level A Red Team assessment (often referred to as red teaming) is similar to penetration testing, but with key differences. Red teams are often not burdened with exploitation restrictions, to accomplish their objectives, usually have more specified objectives to identify all possible vulnerabilities and often test the response capabilities of an organisation. Red teams aim to identify whether in-house security teams prioritise alerts, follow up on critical alerts, detect potential attackers, secure data access and measure time taken for a breach. The tactics, techniques and procedures (TTPs) used on a Red Team engagement may vary depending on the security level of the client. If the organisation has its own in-house security team (often referred to as the Blue Team), then the Red Team may use the abilities and tactics of a nation-state adversary to test the client’s defenses. A successful Red Team engagement should provide the following for an organisation: • A comprehensive summary for executives and senior-level management, written in a way that enables them to take immediate action. • Technical details with step-by-step information that allows Blue teams to recreate the Red Team’s findings. • Fact-based risk analysis, which helps organisations understand if a finding is relevant to their environment. • Strategic and tactical recommendations for short and long-term improvement to the organisation’s security and other infrastructure. www.tahawultech.com

Red teams aim to identify whether inhouse security teams prioritise alerts, follow up on critical alerts, detect potential attackers, secure data access and measure time taken for a breach.

• Invaluable experience responding to a real-world incident, preparing the entire firm’s workforce for when – not if – a breach occurs. How do Red Teams Proceed? Red Team assessments have clearly defined rules to follow, such as whether the Red Team may access computers physically or use only digital methods. The client and the Red Team must also determine any goals of the operation. These may include obtaining financial data or gaining access to restricted networks. Within the permissions granted, a Red Team will do anything it takes to achieve its goal. For example: • Attack on the WLAN: WLANs allow for easy access to the corporate network, which may enable the Red Team to work its way through the network, gain access to user data with increased privileges, and ultimately get closer to accomplishing their objectives. • Social Engineering: Red Teams frequently send phishing or spear phishing emails to employees. Similarly, a member of the Red Team could call an employee and, for example, pretend to be with another department in the organisation. Either way, access to the user’s account and to the corporate network may be granted. • Physical Social Engineering: A Red Team member may search for a relatively high-ranking company member who, perhaps according

to social media, is on a trip or on vacation. The Red Team member would then go to a regional office pretending to be this individual, possibly bringing along a fake business card or ID badge. Then, they would simply let the office know that they are there to get some work done for a few hours. In many cases, the Red Team member is invited in directly and has easy access to a computer connected to the corporate network. • Web Compromise: Externally facing web applications provide an initial foothold into the target network. For example, if the Red Team gets backend code execution on the web server hosted in a DMZ, the Red Team may be able to move laterally from that web server into other areas of the network. In addition, if the Red Team can get SQL injection on a web application, they could potentially acquire credentials into other applications and services. In most cases, targeting people as the weakest link in the security chain proves to be an effective strategy. However, for attacks that go beyond phishing, we recommend that employees do their due diligence when unfamiliar faces are in the office, but they should also be cautious of any physical confrontation. In the second part of this series, we will discuss the tools and tactics that Red Teams use and what it takes to be a Red Team member. 08.2018

INTERVIEW

STRENGTH IN UNITY Ashraf Sheet, regional director, Middle East and Africa, Infoblox, discusses why threat intelligence sharing is key to staying cyber-resilient in the connected era. ybersecurity is a team sport. Today, the bad guys share information, expertise, and code as they help one another inﬁltrate organisations. However, the good guys are lagging behind. As the security landscape becomes more complex and interconnected, cooperation between individuals and organisations is proving to be increasingly crucial. For enterprises, threat intelligence is a key cybersecurity element and sharing this information is instrumental to the success of a security strategy. “Companies today are always on the look-out for the latest security solutions,” said Ashraf Sheet, regional director, MEA, Infoblox. “They seek to protect multiple IT layers from mission-critical assets to the network to the endpoint and so on. However, often, organisations onboard multiple technologies from different vendors.” Security teams often need to buy a separate solution to address varying threats or vulnerabilities. However, due to this, they tend to struggle with the

08.2018

abundance of cybersecurity point solutions and the lack of integration among them. “Even in a connected environment, solutions from varying vendors don’t communicate with one another,” Sheet explained. “This leaves organisations with clusters of information that are too complex and incohesive.” Sheet further explained that the threat data gets too diverse that identifying potential, prioritising them, and allocating security resources become cumbersome. “Having a cohesive set of threat data shared by all devices is the best way

to eliminate this challenge,” he said. “The goal is ensuring that when one device detects a bad compromise that information will be disseminated across the entire network to ensure that this information can be optimised by all other relevant IT layers.” Sadly, sharing is still not a norm. Security companies look at data as a competitive advantage to sell their products and services. They tend to keep it to themselves in hopes they can uncover a nugget that will enable them to win against competing security vendors. But the cost of this approach is losing

We are in an era where global threats are rapidly evolving and intelligence should be shared. Every information and ability should be leveraged to cope with growing threats.

www.tahawultech.com

INTERVIEW

the bigger picture for security. “Security players should aim to lower the risks for customers,” Sheet explained. “The goal is to protect organisations from what will make them vulnerable.” According to Sheet, the mindset is slowly changing, however, there is still a lot of work that needs to be done and Infoblox can play a big role in expanding awareness on the importance of threat intelligence sharing. “We don’t compete with different security solutions, in fact, we complement them and because of this we are able to create a threat intelligence ecosystem that communicates to all kinds of security vendors,” said Sheet. “Organisations prefer sharing with a neutral party or a trusted intermediary rather than sharing with companies directly, indicating the need for a trusted, neutral exchange platform.” Infoblox, according to Sheet, also provides a central threat intelligence platform, which allows speedy distribution information to customers. “More than being able to deliver a timely and actionable threat intelligence, having a core threat data source enable organisations to reduce costs and streamline resources. “We are in an era where global threats are rapidly evolving and intelligence should be shared. Every information and ability should be leveraged to cope with growing threats,” said Sheet. The battle in the digital age landscape should not be between security players, but rather between the threat actors and security innovators. No organisation can detect all the threats or understand what they mean on their own. Therefore, collaboration is key to create stronger defences.

INTERVIEW

EAGLE EYE During the Dubai leg of Hikvision’s Global AI Tour, the video surveillance ﬁrm’s regional president for the Middle East Binson Xu sat down with Security Advisor Middle East to discuss how artiﬁcial intelligence is transforming surveillance technologies.

rtiﬁcial intelligence (AI) is impacting just about every aspect of life and business. The security industry is not exception as a lot of attention go to how AI and surveillance can make cities smarter and safer. “The security landscape is becoming more complex,” said Binson Xu, regional president, Middle East, Hikvision. “Organisations from both public and private sectors are requiring more sophisticated security solutions to help them cope. We can only expect this demand to increase, in fact, a recent report by HIS Markit highlighted that the global security market is predicted to grow by 10 percent annually.” For decades, surveillance systems such as CCTVs have been watching over us or watching out for us. However, surveillance cameras are often only used as a deterrence or as a source of an evidence after an incident.

08.2018

But this is changing — and fast. With the power of AI, organisations are looking at a future where surveillance systems can make predictions pertinent to security. “AI can improve the efﬁciency and accuracy of analytics solutions for a number of key surveillance functions such as facial recognition, number plate recognition and so on,” Xu explained. “It will also reduce the number of false alarms security teams need to deal with.” According to Xu, technologies such as machine and deep learning also enable video surveillance systems to gather data that can help private organisations and law enforcement agencies perceive potential threats or crimes. More than security, Xu highlighted that AI-powered surveillance technologies can also accelerate the capabilities of various operational solutions for industries such as retail, education, energy and so on.

“A good example of this is combining facial recognition with a retail VIP system – by doing this you can tailor offerings to different guests,” he explained. “Supermarkets can optimise features such as the heat maps to gain better insight as which areas of the stores are getting more interest than others. Armed with this information these stores or brands will be able to improve customer experience and roll-out more targeted campaigns.” Hikvision’s Global AI Tour placed the spotlight on Hikvision AI+ technology, which the company says is a threelayered architecture that incorporates cloud and edge computing to provide multi-dimensional perception and front-end processing at Edge Nodes, and then process data in real-time and converged to Edge Domains for intelligent applications and create new data, and further converge ondemand data to the Centre for Big Data analysis. www.tahawultech.com

14th annual

16 - 19 September 2018 The Ritz-Carlton DIFC, Dubai Co-located with

AN INCREDIBLE SPEAKER LINEUP ALREADY CONFIRMED Ihab Hinnawi

Paul Doany

CEO Batelco Group

CEO Turk Telekom

Karim Khoja

Nikolai Beckers

Daniel Ritz

Milan Jovancic

CEO Roshan

CEO Bakcell

CEO PTCL

Acting CEO & Group CTO Telecom Oman (TeO)

Raffaele Annecchino

Dr. Salah Zerguerras

Babak Fouladi

Ali Amiri

Group Chief Technology & Information Officer MTN Group

Group Chief Carrier & Wholesale Officer Etisalat International

Ameen Amaendran Abdullah

Raed Haddadin

President & Managing Director, Southern & Western Europe, Middle East & Africa Viacom Inc.

CEO Etisalat Afghanistan & Sri Lanka

Michael Foley

Henri Kassab

CEO Grameenphone

Managing Director, International, Wholesale & Roaming Zain Group

Karim Tabbouche

Saleem Alblooshi

Chief Commercial Officer VIVA Bahrain

Chief Infrastructure Officer du

Ahmad Al Hanandeh CEO Zain Jordan

Martin Stewart CEO OSN

CEO Renna Mobile

CEO TuneTalk

Maaz Sheikh

Mikkel Vinter

CEO STARZPLAY

Founder & Director Virgin Mobile Middle East & Africa

BOOK YOUR CONFERENCE PASS NOW

Go online at www.terrapinn.com/twme/book or call +971 4 440 2535

1000 ATTENDEES

SPONSORS

200 SPEAKERS

600

TELECOM OPERATORS

INSIGHT

FIVE TIPS FOR PENTESTERS IN IOS By Denise Giusto Bilić, security researcher, ESET

s our phones play an increasingly essential role in our lives, releasing secure applications has become a necessity for protecting end users. As a result, the role of pentesters has gained importance in identifying unwanted behaviours, such as allowing data leaks, producing errors in other apps installed on the device, generating unexpected costs, or denying a certain service to the phone user. Here is a guideline for pentesters looking for security ﬂaws in iOS applications made by developers:

1 Put yourself in the shoes of the programmer To the furthest extent possible, try to understand the people behind the development of the code you are auditing. Figure out which programming language they work with most of the time or what was their ﬁrst (main) coding language. The experience of programmers is usually evident in the architecture of their code and, consequently, the nature of their errors. Knowing these things can point you in the right direction when it comes to investigating. For example, programmers with a Java background often tirelessly replicate design patterns, abstracting functionality 26

08.2018

over and over again. In contrast, mobile developments made by web programmers will have as much functionality as possible deposited into web applications, and rely heavily on the use of WebKit. Both types of developers will be familiar with using high-level APIs, but they are susceptible to errors when manipulating low-level APIs. 2

Get the source code Although it is not the place where an attacker is usually found, obtaining the source code will help you to detect the most errors in the shortest possible time. Penetration tests usually involve limited resources in terms of time and money, so it is a good idea to get the most out of them. Your goal should not be to replicate a real attack scenario, but to ﬁnd as many vulnerabilities as possible to make the ﬁnal application more secure. Objective-C works great with reverse engineering and makes it possible to get a fairly transparent look at the internal mechanisms of an application, even without starting from the source code. 3 Keep in mind the weak points of the language While Objective-C and Cocoa prevent some frequent security errors in C and C++, the use of dangerous APIs, such as strcpy and strcat, or poorly

implemented mechanisms, such as categories or method swizzling , can cause unexpected behaviours that lead to serious security errors. For that reason, be sure to investigate how these techniques impact the application. 4 Identify the possible reuse of vulnerable code Many programmers have developed the bad habit of consulting online programming forums and copying code without really testing how it works, especially when it comes to low-level auxiliary functions, network connectivity, and encryption. Others integrate thirdparty libraries and developments into the base code without checking whether they have any security flaws. This can result in the same vulnerable code being found across multiple applications. 5 Use two testing teams: one with jailbreak and the other with factory Having a device with the factory OS will help you to assess how the application behaves in a real end-user environment, with all the security mechanisms enabled and no problems registering push notifications. In contrast, you can use the device with jailbreak to analyse the file system in more detail and how the operating system works. www.tahawultech.com

14th October 2018 Emirates Towers Dubai #futureenterpriseawards facebook.com/ tahawultech

twitter.com/ tahawultech

linkedin.com/in/ tahawultech

instagram.com/ tahawultech

www.tahawultech.com/futureenterprise/2018/ For sponsorship enquiries Kausar Syed Group Sales Director kausar.syed@cpimediagroup.com +971 4 440 9130 / +971 50 758 6672

Youssef Hariz Business Development Manager youssef.Hariz@cpimediagroup.com +971 4 440 9111 / +971 56 665 8683

IT SOLUTIONS PARTNER

Sabita Miranda Senior Sales Manager sabita.miranda@cpimediagroup.com +971 4 440 9128 / +971 50 778 2771

TECHNOLOGY PARTNER

ENTERPRISE SOLUTIONS PARTNER

Nasir Bazaz Sales Manager nasir.bazaz@cpimediagroup.com +971 4 440 9147 / +971 50 101 2027

TRANSFORMATION AND TECHNOLOGY SPECIALIST PARTNER

CLOUD AND MANAGED SERVICES PARTNER

EVENT PARTNERS

HOSTED BY

OFFICIAL PUBLICATION

ORGANISER

INSIGHT

SECURITY ROLES TO PLAN FOR IN THE DIGITAL ERA Sam Olyaei, principal research analyst, Gartner, explains why CISOs must evolve the talent strategy to reﬂect the changing roles, competencies and skill sets to address digital risk.

hat do you plan to do after graduation? University students are repeatedly asked this question. Those who choose to focus on cybersecurity can rest easy knowing that they have selected a ﬁeld with a near-zero unemployment rate. It’s a reality that chief information security ofﬁcers (CISOs) face every day as only a limited number of people have

28 08.2018

the skills and experience required to ﬁll needed IT security positions. Stafﬁng challenges are compounded by rapidly changing digital business initiatives which are changing how organisations evaluate and confront risk. There’s no proverbial jack-of-alltrades in cybersecurity. Digital business initiatives require that we have the right people in the right roles with the right skills and competencies.

The importance of digital competencies CISOs must think beyond in terms of roles when planning for digital business initiatives. They must now carefully consider which competencies and skills are required to address digital risks. Digitalisation requires a wider range of security roles that entail new skills and knowledge. CISOs need to fundamentally rethink their talent requirements. Roles are just job titles and skills are www.tahawultech.com

17th September 2018, Habtoor Grand Resort, Dubai Speakers

Adam Lalani Group Head of IT Tristar

Ajay Rathi Senior Director of IT Meraas Holding

Alia Al Hammadi Director of IT, Emirates Nuclear Energy Corporation

David Ashford Chief Information Officer The Entertainer

Faisal Ali Senior IT Manager Deyaar

Herbert Fuchs Chief Information Officer ASGC

Jon Richards CEO Yallacompare.com

HE Dr. Rashid Alleem Chairman, Sharjah Electricty & Water Authority and UAE Knowledge Ambassador

TO REGISTER PLEASE VISIT

www.tahawultech.com/powerof4/

#Power4Tech THE POWER OF 4 FOURTH INDUSTRIAL REVOLUTION FORUM The Power of 4 Fourth Industrial Revolution Forum will put the spotlight on the most pressing business issues of our time. Th As hu humans learn to work with smart machines in the digital age, Power of 4 will explore the challenges and opportunities that at organisations will face in the new digital era. Join the conversation with over 300 technology experts and find out how the world is being reshaped by a new dawn of technology. Registration is complimentary for the C-Suite please visit www.tahawultech.com/powerof4/2018/register. Hurry seats are limited. For speaking, agenda or sponsorship enquiries please contact: Publishing Director: Natasha.Pendleton@cpimediagroup.com or Mobile: +971 56 787 4778

STRATEGIC VAD PARTNER

ENTERPRISE NETWORKING PARTNER

HOSTED BY

OFFICIAL PUBLICATION

CLOUD AND MANAGED SERVICES PARTNER

ORGANISER

INSIGHT

a matter of fact. But competencies are the how, the aptitude and traits of employees. The competencies integral to digital business execution are: • Adaptability. Demonstrates ﬂexibility, agility and the ability to respond effectively to changing environments. • Business acumen. Demonstrates awareness of internal and external dynamics with an acute perception of business issues. • Digital dexterity. Showcases the ability to leverage and manipulate media, information and technology in unique and innovative ways. • Outcome driven. Focuses on desired results and business outcomes. Sets and achieves challenging goals. • Collaboration/synergy. Exempliﬁes collaboration with other members of formal and informal teams

CISOs must think beyond in terms of roles when planning for digital business initiatives. They must now carefully consider which competencies and skills are required to address digital risks.

in pursuit of common mission, vision, value and goals. Each of these competencies is critical to one or more of the five new cybersecurity roles that today’s CISOs must plan for tomorrow. Plan for five roles Digital risk officer. The traditional CISO role today will eventually transform into the digital risk officer. Instead of managing information and protecting infrastructure, the digital risk officer will manage cybersecurity risk. Less technical skill is need for this role and success depends on a strong business acumen and the ability to collaborate and communicate effectively. Chief of staff for security. The chief of staff for security, sometimes referred to as the deputy CISO, removes the administrative burden from the CISO, freeing up time to focus on higher value activities. The deputy CISO must influence and

08.2018

communicate effectively to optimise security workflows and processes. Data security scientist. The data security scientist incorporates data science and analytics into security functions and applications specifically, how machine learning, artificial intelligence and analytics can be deployed to automate tasks and orchestrate security functions using algorithms and mathematical models to reduce risk. This role requires advanced mathematical skills and statistical and data analysis. Security “ombudsman.” This role acts as the liaison between lines of business and the security program. Depending on the organisation, this role can report into a business function and requires adaptability and political savviness. Digital ecosystem manager. This role coordinates security and privacy assessments and helps the digital risk officer communicate across the organisation’s ecosystem, including vendors, supply-chain, regulators and other external players that could impact digital risk. It is one of the fastest growing cybersecurity roles. To get started, CISOs should build a list of new competencies required to support their digital business initiatives and then define the skills required to execute on those initiatives. www.tahawultech.com

14 - 18 OCTOBER 2018 DUBAI WORLD TRADE CENTRE

Experience Future Urbanism

WELCOME TO THE LARGEST TECHNOLOGY EVENT IN THE MIDDLE EAST, AFRICA & SOUTH ASIA

Big on numbers. Bigger on opportunities. At the centre of the global tech revolution and the region’s digital transformation, GITEX Technology Week brings together ěJG MOSě POVGRHTĚ KNNOUCěKONS KNĝTGNEKNI the future – right from AI to Smart Cities to Blockchain.

4.700+

100.000+

6.238

EXHIBITORS

VISITORS

MEETINGS SET

80%

16.000+

EXHIBITORS SECURED OVER 2 BUSINESS DEALS

GOVT & CORP BUYERS

VERTICAL CONFERENCES WITH 100+ HOURS OF CONTENT

*2017 onsite sur vey conduc ted t hrough a t hird par t y company

#GITEX2018

CONTACT THE TEAM ON +971 4 308 6566/6022/4090/6282/6077 gitexsales@dwtc.com www.gitex.com

Organised by

Co-located with

INSIGHT

hishing is one of the most common attack vectors for hackers who exploit end-user behaviour as the weakest link in an organisations cyber-defense. For years, criminals have disguised attacks in emails and today we see phishing emails as a primary delivery method for ransomware payloads. Phishing emails have led to massive data exposures, which caused major reputational and ﬁnancial damage in the private and public sector over the last few years. As cybercriminals continue to prey on employees through their technology, they are always taking measures to be one step ahead. In an organisation all it takes is one employee to take the bait. Today’s phishing attacks are so prevalent and so convincing across organisations. What started off as simply “phishing” has now developed into three branches of attacks: the classics, mass phishing and spear phishing, and the recently emerging trend of Business Email Compromise tactic acting as a subset of spear phishing. Business Email Compromise is associated with employee email accounts being compromised rather than the sender address being spoofed. This makes difﬁcult for end-users to spot attacks. It has been stated that 91% of cyberattacks and their resulting data breaches now begin with a spear phishing email message. Phishing has evolved in lockstep with the ‘Malware-as-a-Service’ phenomenon. Phishing emails come in all shapes and sizes, and unfortunately, no single product will fully protect your business from phishing attacks. Phishing is now run as a business and cybercriminals have been using different attack strategies to retrieve information from their target. Some of strategies include phishing services, off-the-shelf phishing kits and Business Email Compromise.

SOMETHING PHISHY: HOW TO IDENTIFY AND AVOID PHISHING SCAMS By Harish Chib, vice president, Sophos Middle East and Africa 32

08.2018

www.tahawultech.com

INSIGHT

Free phishing kits An interesting facet of the phishing ecosystem is that there are a large number of actors committing attacks, but only a small number of phishers that are sophisticated enough to write a phishing kit from scratch. Because of this, phishing kits are now widely available for download from dark web forums and marketplaces, and give attackers all the tools they need to create proﬁtable phishing attacks: emails, web page code, images, and more. Attacks-as-a-service In fact, attackers don’t even need to know how to create malware or send emails anymore. As-a-service and pay-as-you go solutions permeate most online service technologies, and phishing is no different – with a range of services increasingly available to attackers: Ransomware-as-a-service allows a user to create an online account and ﬁll out a quick web form, including the starting ransom price and a late payment price for victims. The provider of the service then takes a cut of each ransom paid, with discounts offered if the user is able to translate the malware code into new languages or if the volume of the attack exceeds a certain level Phishing-as-a-service allows users to pay for phishing attacks to be sent for them, using global botnets to avoid known dodgy IP ranges. Guarantees are even made to only bill users for delivered email messages, much like any legitimate email marketing service. These services have led to the explosion of phishing attacks highlighted earlier, as any attacker can launch an attack regardless of technical skill. Phishing attack prevention: How organisations must protect itself from getting hooked Stop threats at the door The best defense against phishing emails is your email gateway. Email www.tahawultech.com

protection is your watch guard, blocking 99 percent of unwanted email at the gateway, including malicious attachments, content, and URLs – long before an end user ever sees them. Web filtering is another musthave as a front-line defense, filtering and blocking infected URLs should your users click an email link. And file sandboxing ensures those nasty malware laden downloads get removed from the threat chain early on. Protect your weakest link: users Even with the best upfront filters, ds such as BEC – with attacker methods no executables or links to detect – may still get through. ough. Appropriate training and education ucation is critical for ensuring that alll your employees know how to spot and deal with these types of email messages. ges.

from other employees and senior managers, and perhaps most important of all, ensure you have a two-stage approval process for all signiﬁcant fund transfer requests. All the defenses in the world aren’t going to stop an employee from unknowingly sending large payments to a thief without some proper checks and balances in place. Phishing is a problem that will not go away. But you can be more cautious and train yourself to look for giveaways that will tell you if you have visited a phishing website. Cybercriminals will continue to take advantage of opportunities as long as they are getting their money. The ﬁght is challenging but it’s something we can win.

Secure your last line of defense If your click-happy py end users inadvertently unleash leash potent, powerful malware re onto your systems, there’s still ample opportunity to stop op the damage – and even reverse se its effects. Next-generation exploit prevention solutions will identify, entify, analyse, and neutralise the effects fects of even the most advanced, unseen malware out there, and automatically matically clean up all trace of infection so you can get on with your day. Know your business ness Make sure your company processes are understood, that you encourage employees to question requests that seem out of character 08.2018

OPINION

WHY GLOBAL ENTERPRISES NEED TRANSPARENT MOBILITY By Tim Sherwood, vice president, Business Development, Mobility and IoT Solutions, Tata Communications he digital platform economy is constantly transforming the way we work and interact. The Internet of Things (IoT) promises more freedom and functionality than ever before, with devices being used on the go and in conjunction with each other. From logistics to wearable technology, IoT could transform the way any business operates. While IoT has undoubted transformational potential, there continues to be a concern over lack of visibility of device usage which can lead to unpredictable cellular-expenses for the customer. For example, an employee is travelling to different countries for customer meetings. Since she will be busy with work commitments, she might not be able to check if speciﬁc usage rates of her mobile connection have been met or exceeded. As the device is being used in trans-border mode, it can soon clock up very high roaming charges. Enterprises need to be able to control devices and actively manage how they’re used so that the employees don’t come back with huge mobile phone bills.

Mobility needs visibility While the above example is related to human-to-machine connectivity, the need for better visibility and control is equally pressing for machine-to-machine communications – especially in sectors 34

08.2018

www.tahawultech.com

OPINION where devices are crossing national borders on a regular basis. This includes supply chain, transportation, logistics or commercial vehicle fleet management. Beyond operational information of the IoT device, it is imperative for the IoT connectivity provider to provide visibility about what devices are being used and where. This will ensure complete visibility and transparency for enterprises and end-users, allowing them to guard against any overspend. IoT connectivity providers also need to offer flexibility when it comes to national and international services. Mobile services are typically provided by nationally licensed mobile network operators (MNOs) and their partner mobile virtual network operators (MVNOs). Such mobile services allow customers to enjoy mobility anywhere – provided they stay within one particular national jurisdiction. However, this approach is insufficient for businesses with global footprint and aspirations – that already have operations in different countries or are looking to expand geographically. IoT requires more choice and flexibility, as mobility becomes truly global. Many devices will be in permanent roaming mode, while others will switch between domestic connectivity and an international roaming connection. For example, a connected car may have all its connectivity set up for one particular country, but when it crosses an international border, the whole system switches to a roaming setup. Cost-effective connectivity In a roaming world, enterprises are looking at MNOs to offer data plan flexibility, including low data usage plans and shared data plans. While low data usage plans are ideally suited for devices where usage is highly predictable, shared plans offer a usage allowance that can be shared across multiple devices. To keep tabs on usage both nationally and internationally, enterprises also need failsafe monitoring. Visibility through alerts or online portals lets companies set and amend usage www.tahawultech.com

thresholds. If a device is just about to reach its usage threshold, those head office managers will know they’re ahead of the game and can take immediate action. Alerts help to keep usage down and also prevent potential fraud. Beyond monitoring usage, companies may also want to set up user policies, including who can use a device and how they can use it, as well as when and where they use it. Tata Communications MOVE can help enterprises manage these needs of visibility and control, while enabling them to switch between roaming and domestic connectivity seamlessly. Tata Communications MOVE works on the principles of virtualised and programmable MNaaS (mobile network as a service), which ensures network independent global connectivity. Its API based integration supports enterprise applications and portals to give complete visibility and control. This results in a flexible way of operating, and a means of enforcing usage policies. Technologies such as eSIM and network function virtualisation (NFV) can enable enterprises with more control on borderless device connectivity as enterprises and original equipment manufacturers (OEMs) gain the ability to dynamically select the network operators they wish to get connected to. While eSIM offers a virtual control mechanism, a hub is required to be created to normalise the differences in its specifications. This gradual shift in the power dynamics between enterprises on the global communications demand side and MNOs on the global communications supply side can evolve further, with enterprises seeking to establish themselves as MVNOs, thus gaining even more control over their own communications tariffs policies and costs. The web is worldwide – mobility should be too It is important to think truly globally. When we use the worldwide web, it’s exactly as the name suggests – worldwide. The

same concept now needs to apply to mobility and IoT as they work towards offering end-to-end connection between multiple devices or humans and devices. A conﬂuence of technological developments is contributing towards this vision. NFV and virtual SIM, along with cloud-based technologies are paving the way for a virtualised, platform-based approach to connectivity and control. These technologies will help establish the consistency, giving more control to enterprises on their own connected devices. More visibility and control of the usage will encourage enterprises to adopt IoT solutions, enabling the global mobile economy to thrive. 08.2018

INSIGHT

FIVE WI-FI MISTAKES IN THE CONNECTED CLASSROOM By Vivek Mistry, manager, Aruba, a Hewlett Packard Enterprise company

08.2018

igher education has paved the way for many of the technologies we use today. With a unique set of demands and workloads comes a unique set of problems. Laptops and mobile devices have inﬁltrated the classrooms causing distraction to the teaching process. The future classroom is wellconnected with professors utilising Wi-Fi to their advantage to create an interactive learning experience. As we prepare for this shift, we look at some mistakes that must be avoided.

1 Not getting buy-in When it comes to Wi-Fi in the classroom, you must get buy-in from the right people. Meet with building management about installing a WiFi solution to help professors use technology in their teaching. It’s difﬁcult for building management to visualise new Wi-Fi hardware. Bring APs and mounts that would be used in the classroom. Remind them it’s to new teaching and learning methods. One of the easiest supporters will be the professors. Professors are www.tahawultech.com

INSIGHT

your best resource in acquiring funds for new Wi-Fi deployments. Once the service is requested by more teachers, the campus budget committee begins allocating more funds to the project. Everyone must have the common background to reach the end goal with minimal pushback. Start here, with buyin for any classroom Wi-Fi project. 2 Disregarding aesthetics It’s almost a cardinal sin to install an AP that clashes with architectural design. Installing new Wi-Fi in historic buildings can be extremely complicated and frustrating. The campus wants to maintain the original look and feel but you’re tasked with ensuring the campus is moving forward with new technology. Ignoring the aesthetics of a building is the quickest way to get left out of future project planning. You will want to work with the architects and their team members to prevent less-than-ideal cabling locations. Help educate them on why you need APs placed according to a des Giving the architects options shows them you’re a resource willing to help lend to their architectural designs without compromising the quality of Wi-Fi. 3 No planning and design The Achilles heel of Wi-Fi is one no plan and design. Classrooms and lecture halls are dense with devices. Start by speaking with the professors. Understand how they want to use Wi-Fi. The challenges are increased with students bringing in their own devices, creating a BYOD environment. Wi-Fi is being used to create an interactive learning experience. The approach we must take is to design and architect a Wi-Fi network to meet the requirements of classroom activities using capacity planning, predictive and validation surveys, and the selection of proper antennas and mounting solutions. You wouldn’t build a house without planning it and making a blueprint ﬁrst. www.tahawultech.com

4 Misconfiguration The most common mistake in configuration is to allow a WLAN system to automatically make configuration decisions without tuning. Many engineers leave auto-RF settings to their defaults. Configuration must be based upon the design for the classroom. And knowing what exactly those knobs do is just as critical as the design. Understand what results there may be for specific settings, such as using higher minimum data rates, disabling low data rates, transmit power selections, wider channel widths, etc. Poor configuration and optimisation leads to a poor user experience. Upon completing configuration, perform a validation survey to ensure the deployment matches the design and meets the requirements. rements.

is susceptible to a variety of issues. We must treat it as a lifecycle – from planning to design, configuration, monitoring, optimisation, and back again to planning. Buy-in from stakeholders help Wi-Fi objectives get closer to completion. Let everyone know how APs affect the aesthetics of the environment. It’s important to respect the look and feel of a room. Once we get past those hurdles, don’t forget to plan and design to requirements. Identify the everyone’s needs. Audit configurations of your WLAN infrastructure. Understand what each setting does and what the ramifications are. Then validate the implementation with a survey. Continue to monitor closely and make changes to improve the experience.

5 No monitoring ng licensed spectrum will Working with unlicensed et of issues. In order gather its own set ing and learning in to support teaching the classrooms we must be proactive. oring in place is a Having no monitoring big mistake for a large environment supporting professors ssors and students. ain metrics and There are certain onitor which will thresholds to monitor indicate the overall all health of the Wi-Fi dvanced tools can drill network. More advanced ciﬁc APs and groups of in further to speciﬁc APs for accurate results down to near real-time. Monitoring willl reveal issues which rent to the end may not be apparent users. Issues such ch as retry rates, nd average poor roaming, and e a system throughput. Have or end user which can monitor experience so IT can respond quickly. Conclusion Wi-Fi is not a set and forget it technology. The unlicensed spectrum 08.2018

BLOG

THE SECURITY FACTOR By Olivier Thirion de Briel, Global Solution Marketing Director, IAM Solutions , HID Global

t has been clear for years that passwords alone are not enough to protect your company’s assets, networks, applications and data. With the number of breaches increasing every year, and the cost and consequences of those breaches also on the rise, the time to act is now. Multi-factor authentication is essential in today’s environment. It increases security by combining one or more “factors” to verify that the person who is asking for access is who they say they are. These factors

08.2018

include something you have (a smart card or a mobile credential carried on a smartphone or other mobile device); something you know (such as a PIN), and something you are (biometrics). More and more companies are subject to compliance regulations, and strong authentication with the corresponding audit trails are popular requirements. The European Union’s PSD2 regulations for ﬁnancial institutions and GDPR privacy requirements for citizens are two examples. But other parts of the world are not immune. Most companies will be affected by GDPR, and their own government initiatives.

One steadfast method of deploying multi-factor authentication for employees is the hardware token. For the employee, this is often a small, handheld hardware device that calculates a time-bound string of numbers that can be used as a one-time password (OTP). The user then enters this passcode (something they have) plus a PIN (something they know) to prove their identity to the asset they want to access. Behind the scenes, this value is compared to the value calculated on a back-end authentication platform using the same techniques and inputs, including clock and event counters, authentication keys, and algorithms. If the OTPs match, the user gains access, and that event is logged in the platform’s audit trail. Hardware tokens have been around for over a decade, and they are still a popular choice for many organisations. It’s a familiar user experience for the workforce, and the tokens themselves last a long time. Tokens have also evolved beyond the standard keyfob form factor. There are also options that can ﬁt in a wallet, are robust enough for ﬁeld operations, and can accommodate and assist the visually impaired. But there is more to it than that. www.tahawultech.com

AGC'S DIGITAL TRANSFORMATION SOLUTIONS AND APPLICATIONS Harnessing emerging tech to enable true ƚƌĂŶƐĨŽƌŵĂƟŽŶ͗

ACCELERATING YOUR

DIGITAL JOURNEY

#AGCDigital

ƵƐƚŽŵĞƌ ǆƉĞƌŝĞŶĐĞ Contact Centers, Omni Channels, Self-Service, Voice Biometrics

AGC Networks understands the digital wave and ĐĂŶ ŚĞůƉ ƉůĂŶ ǇŽƵƌ ĚŝŐŝƚĂů ƚƌĂŶƐĨŽƌŵĂƟŽŶ ƐƚƌĂƚĞŐǇ

ƵƐƚŽŵĞƌ :ŽƵƌŶĞǇ /ŶƚĞƌĂĐƟŽŶ ŶĂůǇƟĐƐ

ƵƐƚŽŵĞƌ ŶŐĂŐĞŵĞŶƚ Θ >ŽǇĂůƚǇ y DĞĂƐƵƌĞŵĞŶƚ ͕ EW^ ŶĂůǇƟĐƐ͕ ƵƐƚŽŵĞƌ īŽƌƚ ^ĐŽƌĞ

ƵƚŽŵĂƟŽŶ ZW ͕ ĞƐŬƚŽƉ ƵƚŽŵĂƟŽŶ͕ Chat and Speech Bots

'ĂŵŝĮĐĂƟŽŶ E- learning, Contact Centers

/AGC.Networks.Limited /AGCNetworksLTD /company/agc-networks

About AGC Networks ' EĞƚǁŽƌŬƐ ; ' Ϳ ŝƐ Ă 'ůŽďĂů ^ŽůƵƟŽŶ WƌŽǀŝĚĞƌ ƌĞƉƌĞƐĞŶƟŶŐ ƚŚĞ ǁŽƌůĚ͛Ɛ ďĞƐƚ ďƌĂŶĚƐ ŝŶ hŶŝĮĞĚ ŽŵŵƵŶŝĐĂƟŽŶƐ͕ ĂƚĂ ĞŶƚĞƌ ĂŶĚ ĚŐĞ /d͕ ǇďĞƌ ^ĞĐƵƌŝƚǇ ; z ZͲŝͿ ĂŶĚ ŝŐŝƚĂů dƌĂŶƐĨŽƌŵĂƟŽŶ Θ ƉƉůŝĐĂƟŽŶƐ ƚŽ ĞǀŽůǀĞ ƚŚĞ ĐƵƐƚŽŵĞƌ͛Ɛ ĚŝŐŝƚĂů ůĂŶĚƐĐĂƉĞ͘ ' ͛Ɛ ĂďŝůŝƚǇ ƚŽ ƚĂŝůŽƌ ƐŽůƵƟŽŶƐ ŝƐ ƐƚƌĞŶŐƚŚĞŶĞĚ ďǇ ƐĞĂŵůĞƐƐ ƐĞƌǀŝĐĞƐ͘ &Žƌ ŵŽƌĞ ĚĞƚĂŝůƐ ǀŝƐŝƚ ǁǁǁ͘ĂŐĐŶĞƚǁŽƌŬƐ͘ĐŽŵ

info@agcnetworks.com | www.agcnetworks.com

Special discount for readers! Save $300 on standard registration with code CPI

Gartner Security & Risk Management Summit 2018 October 22 - 23 / Dubai, UAE gartner.com/me/security

Securing Digital Business: Adapt. Transform. Scale. Discover the latest research and recommendations to transform your security strategy and build resilience across the enterprise. Special discount for readers! Save $300 on standard registration with code CPI

ÂŠ 2018 Gartner, Inc. and/or its afďŹ liates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its afďŹ liates. For more information, email info@gartner.com or visit gartner.com.