Home Sections Archive by category Cybersecurity

Cybersecurity

How to Protect Your Business from Cybercrime in a Digital World

By Contributor
Cybersecurity

Strong Defenses

By Terra Carnrike-Granata and Andrew Frisbie

 

The ever-evolving digital world we operate in each day offers infinite opportunities for business growth and development, but it also presents many risks.

On the positive side, the artificial intelligence (AI) boom provides businesses of all sizes ways to streamline processes and operations, reduce costs, and generate revenue. On the other hand, the explosion of AI technology has created new pathways for sophisticated cybercriminal enterprises to attack.

According to a recent study from Massachusetts IT Sloan Cybersecurity and Safe Security, 80% of ransomware attacks are powered by AI-generated malware, phishing campaigns, and deepfake-driven social engineering. The study asserts that “AI has made ransomware attacks faster, more efficient, and harder to detect.”

In today’s threat landscape, hacking is a business. Sophisticated organizations operate like legitimate businesses, and their primary goal is usually financial gain through theft, extortion, and exploitation. These fraudsters have legitimate businesses of all sizes in their crosshairs.

According to a survey from Mastercard of more than 5,000 small and medium-sized business owners, 46% have experienced a cyberattack on their current business, and nearly one in five that suffered an attack later filed for bankruptcy or closed their business. Smaller businesses often do not budget for adequate cybersecurity protection and have fewer internal resources dedicated to cybersecurity, and criminals know it.

Terra Carnrike-Granata

Terra Carnrike-Granata

Andrew Frisbie

Andrew Frisbie

“Educate your employees. A robust security program, combined with awareness of warning signs, safe practices, and responses to takeover, are crucial for protecting your company and customers.”

But even small or medium-sized businesses with limited cybersecurity budgets and resources can use these strategies to protect their assets from cyberattacks:

• Require multi-factor authentication (MFA). If your business does not require MFA, you are taking an unnecessary risk by leaving accounts and personal information unprotected and vulnerable to attack.

• Ensure all employees use strong, unique passwords, or consider passwordless options for improved security. The most important characteristic of a strong password is length, with between 12 and 21 characters recommended. Good passwords also avoid predictable patterns (such as 123456 and qwerty), and should not include personal information like birthdays, addresses, or phone numbers. Passwords should also be unique for every login. Passwordless options use passkeys or biometric identifiers in place of passwords and can be very strong if implemented properly.

• Install antivirus software on all company devices. Antivirus software protects devices from known and even suspected malware, which can steal your data, encrypt it so you cannot access it, or even erase it completely.

• Keep all device software patched and up to date. Patching is fundamental to security because fraudsters exploit known vulnerabilities. By keeping software up to date, devices receive regular security patches, which makes it much harder for hackers to exploit.

• Educate your employees. A robust security program, combined with awareness of warning signs, safe practices, and responses to takeover, are crucial for protecting your company and customers.

• Invest in third-party cybersecurity expertise. Getting outside eyes on your company’s security environment is critical to a well-rounded security posture. In most cases, the cost of an outside security consultant is reasonable when compared with the cost of a breach, including business downtime, reputational damage, a potential ransom payment, and data loss.

• Invest in adequate cyber insurance, which helps mitigate the financial impact of cyberattacks and data breaches by covering costs related to incident response, data recovery, legal fees, business interruption, and other potential liabilities.

The rise in AI usage has also spurred an increase in high-quality email impersonation attacks and business email compromise. With higher quality phishing and social engineering tactics, scam emails look more realistic, so it is important to remind employees to pause and evaluate before responding, clicking on links, or downloading attachments. Encourage employees to report suspicious emails to the network administrator to be checked for signs of trouble.

Financial institutions will never ask for personal information or account credentials in an email or text message, so it is good practice to call your bank directly if a suspicious email, phone call, or text raises concerns about your business bank accounts.

It is important to note that, even with processes and protections in place, businesses can experience cybersecurity incidents and should be prepared to respond immediately. In the event of a cyber incident, businesses should cease all activity on the network or system, contact their bank(s), and change online banking passwords. Depending on the level and seriousness of the incident, businesses may also need to file reports with local police and the FBI’s Internet Crime Complaint Center.

It is also critical to keep meticulous records of events around the incident to aid in the recovery process. NBT Bank’s Business Fraud Information Center provides a full range of resources and information as well as up-to-date fraud information and alerts to help protect your business from becoming one of the thousands victimized by scammers each year.

 

Terra Carnrike-Granata is senior director of Information Security at NBT Bank, where she designs and implements sophisticated controls to prevent loss and mitigate risk, while also developing innovative ways to educate consumers and businesses on cyberthreats. Andrew Frisbie is vice president and director of Information Security at NBT Bank, where he provides strategic leadership to and operational oversight of the Information Security, Cyber Operations, Third-party Risk Management, and Insider Risk Management programs.

Cybersecurity Offers Promising Career Paths

By
Sean O’Brien says cybersecurity used to be seen as a niche issue
Cybersecurity Special Coverage

Evolving Threats

Sean O’Brien says cybersecurity used to be seen as a niche issue

Sean O’Brien says cybersecurity used to be seen as a niche issue in many business sectors, but has become a central concern.

As high-tech businesses grapple with the implications of artificial intelligence (AI) — and workers worry what that might mean for their job security — those who work in cybersecurity may have reason for optimism, Sean O’Brien said.

“Even though we’ve seen a shift, certainly, in IT careers around AI — folks getting laid off and so on — cybersecurity is still humming along. It’s one of the hot industries, essentially,” O’Brien, director of Cybersecurity at Bay Path University, recently told BusinessWest.

A few days earlier, O’Brien had led Bay Path’s 13th annual Cybersecurity Summit, where he and other experts discussed how artificial intelligence is reshaping cybersecurity, education, and workforce development, and what all that means for career paths in this quickly evolving field.

Some young people might be scared off by what they perceive as the highly technical nature of cybersecurity, but he emphasized that the field, and the work being done within it, is strikingly diverse.

“One of the reasons I keep emphasizing the non-technical nature of cybersecurity is because I think that tech can scare people,” he said. “First off, we’re talking about things that are actually scary — things that keep me up at night. But also, people don’t want to feel like they’re going to be a code monkey, so to speak, sitting at a keyboard all day. So I try to emphasize the more exciting cases, the sort of weird and interesting stuff that we can do in cybersecurity.

“Cybersecurity is wide-ranging. There are people who analyze malware — they look at what’s in our software and how it spies on people and breaks their stuff and steals their info, or even drains their Bitcoin wallet, those kinds of things. There are folks who do digital forensics work — they may be looking at evidence and preparing it for a court case or even just an investigation or an audit of an organization.”

Then there are people who work at security operations centers like the one now located at the Richard E. Neal Cybersecurity Center of Excellence in Springfield, which help organizations detect, prevent, and respond to threats.

“When people talk about AI being a threat, what they really mean is generative AI being a threat, large language models being a threat. And just like AI had been used for defensive good purposes before, we can still take generative AI and use it for good purposes as well.”

“That’s a burgeoning field, being the individual who looks at a dashboard, sees all the information coming in, and makes conclusions and reports and even post-mortem analysis,” O’Brien explained. “Even after something has gone wrong, you need the individual who’s going to say, ‘well, here’s how it went wrong,’ and provide that report to the C-suite in an organization.”

Then there are individuals moving to cybersecurity from other fields — or vice versa — and incorporating it into other disciplines.

“I want to have folks who are managers, essentially, who are able to take all of this information, come up with security plans and risk management scenarios, and talk about security architecture and those kinds of things, because those don’t change no matter what goes on with the technology,” O’Brien told BusinessWest. “In my time — and I’ve been doing this since I was a kid, essentially — I have seen technology shift so much, but the fundamentals don’t change.”

In short, it’s a field broad enough to welcome people from any discipline or interest, and that, combined with the fact that it’s certain to remain important, makes cybersecurity an attractive career option.

“You’ve got to have the hunger for it, certainly,” he added. “That’s why it’s always fun to be around other cyber folks, because they’re always energetic.”

 

Future Shock

The keynote address at the Cybersecurity Summit was delivered by Scott Shapiro, a professor at Yale Law School. O’Brien met him years ago when he worked there, and the two of them co-founded a cybersecurity lab for Yale law students.

“We took folks who are non-technical, primarily — great legal minds, certainly, but not technical people — and we got them to use the command line. We got them to do hacks on their own,” O’Brien said. “We would say, ‘here’s why strong passwords are important. By the way, here’s how to crack a weak password.’”

Now in charge of Bay Path’s cybersecurity program, O’Brien is passionate about sparking that interest in young people.

Sean O’Brien (right) conducts a ‘fireside chat’ with Yale Law School Professor Scott Shapiro about advances in cybersecurity and AI during the recent Cybersecurity Summit.

Sean O’Brien (right) conducts a ‘fireside chat’ with Yale Law School Professor Scott Shapiro about advances in cybersecurity and AI during the recent Cybersecurity Summit.

“Bay Path, an amazing program, really has an innovative approach, which is one of the reasons they recruited me,” he told BusinessWest. “They said, ‘hey, you’re doing some cool and interesting things with cybersecurity, we’re doing cool and interesting things with cybersecurity, so let’s hang out.’”

Shapiro’s address — and ‘fireside chat’ discussion with O’Brien — touched numerous times on the role of AI in cybersecurity, and why it’s not all bad news.

“The first thing is to recognize that every tool can be used for good or for bad. A gun can be used either to defend yourself and your family in your home or to hold up a convenience store. And encryption — we love encryption when it protects our private communication; we hate it when it’s called ransomware,” said Shapiro, who is also the author of Fancy Bear Goes Phishing: The Dark History of the Information Age in Five Extraordinary Hacks.

He applied the same message to AI, after a quick history lesson explaining the difference between classical AI and generative AI, which is a much more recent phenomenon.

“AI has been part of cybersecurity for such a long time. You had very basic symbolic systems that helped detect for intrusions and exploitations. In the 2010s, you could not walk through a trade show without people telling you about their AI that protects everyone, and that was machine learning that tried to correlate usage with time, with location, and try to figure out the markers of a threat.

“Now, when people talk about AI being a threat, what they really mean is generative AI being a threat, large language models being a threat. And just like AI had been used for defensive good purposes before, we can still take generative AI and use it for good purposes as well.”

The bad purposes are plenty, Shapiro said, from deepfakes to malware. But in many ways, AI is simply sharpening the sort of threats that already existed.

On the traditional internet, O’Brien told BusinessWest, “we had things called botnets. These are automated computers that are being controlled by a command and control computer somewhere. So your grandmother’s TV set or set-top box or router can be controlled by some adversary somewhere on the other side of the world. You get enough of these machines talking together, they can attack websites; they can break stuff down. Those kinds of threats have been going on for a very long time.

“I would say what’s going on right now is AI is an accelerating force,” he went on. “We still have these threats; everything old is new again. But because AI is able to sort of think on its feet, it’s able to probabilistically change direction and try certain things very easily.”

During the Cybersecurity Summit, O’Brien talked about a botnet called Aisuru that was the most highly trafficked domain in the world during November — more than Google, Yahoo, Facebook, you name it — because of the ease with which it insinuated itself into everything from routers to cameras to gaming platforms. Its goal? Distributed denial of service attacks trying to take down websites.

That sort of threat takes cybersecurity out of the business realm and makes it everyone’s concern.

“Now that everybody’s online constantly, we have devices in our pockets which are basically supercomputers. We’re surrounded by devices, cameras, thermostats, all the stuff that’s connected to the internet. Cybersecurity is now a central topic. It’s encompassed so many aspects of our life,” he explained. “Chat GPT was released to the public a few years ago, and there is a real revolution in computing, and people are starting to see how these algorithms can do incredibly useful stuff, but also incredibly dangerous stuff.”

But AI can also be a strong weapon against those dangers.

“I remember old-style viruses. We had some Macs in our elementary school that got a virus, and everything went down. But then we started having virus detection engines — they look for signatures, and they react. AI is very good at this sort of signature detection and being very agile, being able to look at some things and say, ‘this looks like activity that shouldn’t be happening in the network.’

“So those detection tools, this ability to read through long logs of text, which is what people use ChatGPT and these types of technologies for anyway, are security tools that are speeding up the pace of action and analysis and giving cybersecurity analysts a lot more detailed information a lot more quickly.”

 

Always Watching

One reason O’Brien likes being an educator is seeing what students are actually interested in, and the way they think of new threats and new applications.

“The students are coming to us with scenarios that are interesting, their own ideas about unique hacks that could be happening. I had a student, for example, demonstrate for me a hack of a Roomba. I hadn’t thought much about a Roomba, but you think about a Roomba, it moves around, and it actually has a lot of data about the physical space,” he said.

“Having that surprise at this point in my life, after I’ve thought I’ve seen everything, is a really big part of this. I’m excited to see where things go.”

And that constant learning is yet another reason why cybersecurity careers will remain attractive — and why shepherding a new generation into that work is so important.

“I think it’s going to be hard to eliminate the need for cybersecurity folks, no matter what comes around the corner technologically,” O’Brien told BusinessWest. “We’ve got to stay on our feet. We’ve got to lock our things up.”

Strengthening the Human Element in Cyber Defense

By
Cybersecurity Special Coverage

Sophisticated Game

 

 

There’s no doubt, information security experts say, that people have become more savvy about detecting phishing attacks and other cyber threats.

Unfortunately, the hackers have become more savvy as well — exponentially so, in the era of artificial intelligence — and that’s a problem.

“The risk is getting worse, not better,” Bean said. “The sophistication of the attacks is getting infinitely better, and the variety or complexity of the attacks is getting significantly higher. And a lot of that is driven by AI.”

Elaborating, he explained that there are essentially two types of phishing attacks. One is the bread-and-butter, scattershot attacks that hope to ensnare as many random recipients as possible. And these hackers — many of them operating from foreign countries where English isn’t their first language — are now using AI to craft emails that sound more plausible, and don’t set off the same alarm bells as their cruder predecessors.

“But then there are high-value attacks, which are much more sophisticated and much more intelligent. They’re not just mass attacks sent out to hundreds or thousands or millions of people. They’re targeted attacks,” Bean said — and these employ AI to a troubling degree.

He related a real-life example of a CFO getting an email from a hacker posing as a vendor, urgently asking for a payment, at a time when the CEO was traveling and unavailable (which the hacker knew). To verify the transaction, the hacker set up a Zoom call with what turned out to be a deepfake version of an actual attorney.

“The lawyer says, ‘this is what the money is for; go ahead and wire it.’ And the CFO, at that point, is very comfortable and sends the money, no hesitation,” Bean said. “That kind of deepfake would have been impossible even three years ago; only Hollywood could provide that level of sophistication. But in the last couple of years, it’s so easy. You can get content online, combine it with certain tools, and do some really impressive stuff that’s beyond phishing — it’s straight-up cybercrime.”

Tim Miller, chief Information Security Officer at Community Bank, agreed that malicious AI tools are helping to create perfectly crafted phishing emails that are specific to a company or individual user, which is why the bank’s employees are not only trained on a regular basis to detect these threats, but tested as well.

“You don’t want to create a simulated fishing program without some level of training tied to failures,” he explained. “And you’ve got to make it believable; you’ve got to make it good. Sometimes that upsets people; we’ve done tests in the past that people have gotten really upset about, but that’s what these threat actors are doing. They don’t care what your feelings are. The point is to get an emotion out of you, a sense of urgency, of fear, and that’s how they get you to click.”

Exploiting the human element in cybercrime — known in IT circles as social engineering — is an ongoing concern for companies of all sizes.

Delcie Bean

Delcie Bean

“The risk is getting worse, not better. The sophistication of the attacks is getting infinitely better, and the variety or complexity of the attacks is getting significantly higher. And a lot of that is driven by AI.”

Hoxhunt, an organization that helps companies with IT risk management, notes that the human element is a factor in 68% of data breaches, according to a Verizon report. Of those, the Comcast Business Cybersecurity Threat Report says 80% to 95% are initiated by a phishing attack, and the total volume of phishing attacks has skyrocketed since the advent of ChatGPT in 2022.

“I think the risks from AI are going to continue to develop, and we’ve already seen significant changes from what the risks were before,” Miller said. “What was theoretical risk a year ago is actual risk now, and what that’s going to look like a year from now, I think, is somewhat unknown.”

 

Damage Done

For companies that do fall prey to cyberattacks and data breaches, the damage can be significant, Miller said, especially for companies (like banks and hospitals) in highly regulated industries, publicly traded companies, and businesses that operate in multiple states.

“Even if you deem it a small-scale event, it can mushroom very quickly,” he noted. “Now, let’s take the example of ransomware, where they’re able to get in and actually encrypt your data. In almost every ransomware event over the last couple of years, they’ve combined that with data exfiltration. So not only are they preventing you from accessing your files, they have a copy of it themselves. So it’s a combination of them wanting money from you, and they have the data already.”

Another big risk in these events is reputation risk, he went on.

“If a customer knows that you’ve had a security incident or a breach, especially a significant one, how do they know their data is going to be protected going forward? How do they know that the company is ultimately going to be able to protect them in the future? And are they more likely to find somebody else to do their business with? That’s the thing with cybersecurity incidents — it starts to degrade trust a little bit, which makes it challenging for companies to overcome.”

That’s why cybercrime is actually much more prevalent than public reports would suggest, Bean said. “You’re not going hear about 95% of them. The CEO or CFO doesn’t want to let that story get outside their little circle of trust.

“Ransomware has always been much more prevalent than we knew about because companies were keeping it secret, unless it caused a significant outage, like a hospital or an entire town being taken down,” he added. “For every one of those, another 100 businesses were hit quietly, and they dealt with it, and they weren’t telling anyone because they didn’t want it reaching the world because of loss of credibility and fear of lawsuits — and a lot of cybercrime stayed under the radar.”

Bean emphasized that the classic, non-AI attacks that have been around for years are still prevalent — essentially, “they’re trying to get you to log in and do something.” But these have become more sophisticated and targeted as well.

“They’ll know that you placed an Amazon order — ‘there’s a problem with the delivery of your dog food; click here if you still want to receive this order.’ They use very sophisticated tools to scrape your cookies when you’re on websites, and they see that you’re browsing for dog food, they assume you placed the order, and they send a very targeted attack. That stuff is growing.”

Miller said Community Bank communicates regularly with customers on how they can avoid becoming victims, while also making sure employees know what to look for.

Tim Miller

Tim Miller

“If a customer knows that you’ve had a security incident or a breach, especially a significant one, how do they know their data is going to be protected going forward? How do they know that the company is ultimately going to be able to protect them in the future? And are they more likely to find somebody else to do their business with?”

“It’s important, from our perspective, to make sure everyone inside the company understands that cybersecurity risks are everyone’s responsibility. It’s not just my role,” he explained. “And it’s important for the folks in our branches to understand what these threats are because they are the frontline to customer interactions. And if they can relay some of the information to them, that’s obviously beneficial for all.”

That’s especially true at a time when threats are increasing. “I mean, the concept of deepfakes is very much here, and it’s not going anywhere. And that’s a concept that’s really challenging for people to grasp,” Miller went on, going back again to what he emphasizes internally, which is the importance of following established processes — for instance, when a possibly deepfaked company executive is asking for a wire transfer.

“It goes back to adhering to your processes and not necessarily going off of your emotion — because your emotion in that instance would be, ‘I want to satisfy the CFO by making this wire.’ But the reality is, you might have a verification step where you call the CFO back. These attacks have gotten so good that the whole ‘smell test’ piece may not work anymore. So you have to go back to certain things that you know will identify those risks.”

 

Strong Defense

Bean emphasized the importance of both training and testing employees, saying one without the other isn’t enough.

At the same time, however, “we’ve had to shift to almost accepting that there’s going to be a certain amount of successful phishing attacks. It’s like a war — you have to cede one line in the battle and retreat to a different position that you feel is more defensible.”

And that second position, in many cases, has been recognizing what a successful breach looks like — often using AI systems to monitor that — and locking it down before damage is done.

“Most commonly, they’re stealing Microsoft 365 or Google Workspace credentials. But the second they log into the system, there are certain hallmarks about how that’s going to look. The login is different in subtle ways; a login by a bad actor sends up suspicious flags. An AI system can evaluate that login, and if there’s anything remotely suspicious, a human can lock the account, send a report to us, and we take over the case from there.

“That’s definitely been a godsend. We’re seeing hackers getting through MFA [multi-factor authentication] or getting a password through phishing, but we’re catching them the instant they log in,” Bean went on, comparing it to having both external home security and motion sensors inside the house. “The police arrive before there’s any damage.”

He added that this is a war being fought on multiple fronts, and companies need to take it seriously, through training, testing, and perhaps an outside partner.

“If someone can get in, it can be anywhere from a couple hundred thousand dollars to a couple million, and most businesses don’t have that floating around. Some go out of business or face financial hardships that might not be covered by cyber insurance. It’s not something you can afford to underinvest in.”

Miller added that “a lot of companies, especially smaller companies, don’t have budgets to invest in the latest and greatest, and that’s fine. It’s more about, are you patching your systems? Are employees aware of newer threats? There’s a lot that companies can do.

“These are the basics of cybersecurity — which, honestly, is what protects you 99% of the time,” he added. “It’s doing the basics of being skeptical. That’s one of the keys with phishing and all these other types of fraudulent attempts — being skeptical about it.”

Lessons from the CrowdStrike Fiasco

By Contributor
Cybersecurity

In Times of Turmoil, Patience and Communication Are Key

By Sean Hogan

 

The day began long before the sun rose. At 3 a.m. that summer morning, I found myself groggily pulling myself out of bed to prepare for a 5:30 flight to a business conference in Montana. The early-morning hours are never the easiest, but the promise of a productive trip and the excitement of the conference kept me going.

Arriving at Bradley International Airport at 4:30 a.m., I was met with the usual hustle and bustle of travelers, all with their own destinations and stories. After clearing security, I found a quiet spot to sit and wait for boarding. As I sipped on a hastily bought coffee, I read a brief article on my phone about flights being canceled in Australia. Little did I know that this was a harbinger of the chaos that lay ahead.

Shortly thereafter, the first signs of trouble began to emerge. Flights and monitors at Bradley International started shutting down one by one. It was an eerie sight, and a sense of unease settled over the terminal. The day, which had started so early, was about to get much longer.

As the minutes turned into hours, it became clear that this was no ordinary delay. Delta, the airline I was flying with, was one of the hardest-hit by what was later revealed to be a widespread issue with their cybersecurity software, provided by CrowdStrike. The software update had inadvertently disabled Delta’s primary communication method — its app.

Sean Hogan

Sean Hogan

“In Delta’s defense, it did have a solid commitment to CrowdStrike and leveraged its cybersecurity software to protect its systems. However, the unintended consequences of the software update highlighted a crucial lesson: the importance of effective communication, especially in times of crisis.”

Throughout the day, as the delays dragged on, one of the most frustrating aspects was the lack of communication from Delta. In our interconnected world, where information is always at our fingertips, the silence was deafening. The uncertainty and lack of updates left us all in a state of limbo, not knowing when or if we would be able to reach our destination.

In Delta’s defense, it did have a solid commitment to CrowdStrike and leveraged its cybersecurity software to protect its systems. However, the unintended consequences of the software update highlighted a crucial lesson: the importance of effective communication, especially in times of crisis.

The entire experience was a true test of patience. As the hours passed, I tried to remain calm and focused, but the stress and frustration of the situation were palpable. It was a stark contrast to the level of communication we have at my company, Hogan Technology, where transparency and timely updates are prioritized.

Eventually, after a grueling 12 hours of delay, we did manage to get to Montana. The relief of finally boarding the plane and taking off was immense, but the day had left a lasting impression on me.

This ordeal taught me several valuable lessons about the customer experience. In moments of uncertainty and disruption, clear and consistent communication is paramount. Customers need to feel informed and reassured, even if the news isn’t always positive. The silence from Delta only amplified the stress and frustration of the situation.

Furthermore, the experience underscored the importance of patience. In our fast-paced world, delays and disruptions can be incredibly frustrating, but maintaining a calm and composed demeanor can make a challenging situation more bearable.

Again, in the end, we made it to Montana, and the business conference proved to be productive and insightful. But the journey there was a stark reminder of the importance of effective communication and the value of staying patient in the face of adversity.

 

Sean Hogan is president of Hogan Technology Inc.

 

What Is the Outlook on Artificial Intelligence in 2025?

By Contributor
Cybersecurity Special Coverage

Bracing for Change

By Delcie Bean

In 2024, artificial intelligence (AI) achieved significant milestones that have set the stage for transformative developments in 2025.

 

Key AI Milestones of 2024

Regulatory Frameworks: The European Union finalized its comprehensive AI Act, establishing a framework that balances innovation with ethical considerations. This legislative milestone is expected to influence global AI policies and governance.

Technological Advancements: Breakthroughs in AI-powered scientific discoveries, particularly in biomedicine, were highlighted by DeepMind’s AlphaFold, which demonstrated remarkable progress in protein folding. This advancement opened new avenues for drug development and biological research, showcasing AI’s potential to revolutionize science and healthcare industries.

Consumer Technology: The launch of the first AI-native smartphone, equipped with a dedicated AI chip, marked a shift toward more intelligent and personalized mobile devices. This innovation pushes the boundaries of user experience and sets the stage for future advancements in consumer electronics.

 

The Outlook on AI in 2025

Artificial intelligence continues to be one of the most transformative forces of our time, and 2025 is shaping up to be a pivotal year. As the pace of innovation accelerates, industries, businesses, and individuals are grappling with the opportunities and challenges AI presents. Among the current trends are:

Advancements in Generative AI: Generative AI is expanding beyond text, venturing into video production and other media forms. Tools like HeyGen, Sora, and Runway ML enable the creation of realistic and personalized video content, democratizing video production for businesses and individual creators.

AI Integration Across Sectors: Industries are adopting AI at scale in fields like:

• Healthcare: AI-powered diagnostics, personalized treatment plans, and drug discovery are becoming mainstream, enhancing patient care and operational efficiency.

• Finance: Predictive analytics and fraud-detection systems are improving efficiency and security in financial operations.

• Manufacturing: AI-driven automation and predictive maintenance are optimizing production lines, reducing downtime, and increasing productivity.

 

Predictions for AI in 2025

2025 promises exciting developments and disruptions:

Technology Breakthroughs: AI models will become more powerful, efficient, and accessible. Recent advances in energy-efficient AI, such as Google’s Pathways model, suggest that future systems will require less computational power while delivering superior performance. Moreover, multimodal AI — capable of processing text, images, and videos simultaneously — will enhance virtual assistants, enabling them to understand and respond in richer contexts.

For example, consider a smart-home system that can analyze both audio commands and video input to adjust lighting, recommend entertainment, or detect potential hazards.

Consumer-centric AI: Apple’s rumored ventures into AI are likely to materialize in 2025, potentially redefining personal technology. Imagine an AI-driven iOS system that not only anticipates user needs but also offers proactive suggestions, such as ordering groceries or suggesting health routines based on daily activity patterns.

Industry Disruptions: AI will reshape several sectors, with standout changes in:

• Education: Adaptive learning platforms like Squirrel AI are expected to evolve, offering highly personalized curriculums that cater to individual student needs. AI tutors could become commonplace, providing real-time feedback and assistance across subjects.

• Logistics: Companies like Amazon and FedEx are already testing AI-driven autonomous delivery systems. By 2025, we might see widespread use of drone deliveries and autonomous vehicles in urban centers.

• Urban Planning: Smart cities will leverage AI for everything from traffic management to waste reduction. Projects like Sidewalk Labs in Toronto are early examples of how AI can transform urban living.

Challenges and Considerations: Despite its promise, AI’s growth is not without hurdles:

• Data Privacy and Security: As AI systems handle sensitive information, ensuring robust data protection will be crucial to maintaining trust.

• Bias and Inclusivity: Addressing biases in AI algorithms remains a pressing issue. Inclusive development practices are essential to prevent perpetuating inequalities.

• Economic and Social Impact: The balance between innovation and job displacement will be a critical conversation. Preparing for AI’s impact on the workforce is imperative for a smooth transition.

Opportunities for Businesses and Individuals: AI in 2025 isn’t just about challenges; it’s also about immense opportunities:

• Leveraging AI for Growth: Businesses of all sizes can use AI to gain a competitive edge. From automating routine tasks to enabling new product innovations, the potential is vast.

• Upskilling the Workforce: Training and reskilling will be key. Organizations investing in their employees’ AI literacy will thrive in the evolving landscape.

• AI as a Partner, Not a Threat: Collaborative human-AI workflows can enhance productivity and creativity, showing that AI complements human capabilities rather than replacing them.

 

Conclusion

As we look to 2025, AI’s trajectory is clear: it will become more integrated, powerful, and impactful across all facets of life. However, with great power comes great responsibility. It’s up to businesses, governments, and individuals to steer AI’s development toward ethical, inclusive, and beneficial outcomes.

The future of AI is not set in stone — it’s a story we’re all writing together. By staying informed, adapting to change, and embracing innovation, we can ensure that 2025 marks another milestone in AI’s journey toward improving lives and transforming industries.

 

Delcie Bean is CEO of Paragus Strategic I.T.

 

The Importance of Multi-factor Authentication in Cybersecurity

By Contributor
Cybersecurity

Layers of Protection

By Charlie Christianson

 

Today’s cyberthreats are constantly evolving, threat actors are increasingly sophisticated, and the risks of having accounts compromised through stolen or hacked passwords are very high.

One of the most effective ways to protect against having an account compromised is by using multi-factor authentication (MFA). MFA is a security process that requires users to provide two or more verification factors to gain access to a resource such as an application, online account, or VPN. By combining multiple forms of verification, MFA significantly reduces the likelihood of unauthorized access. In fact, many cyber insurance providers now require it.

 

Enhancing Security with Multiple Layers

The key advantage of MFA is that it provides multiple layers of security. Traditional authentication methods, such as passwords, are increasingly vulnerable to attacks. Many people continue to use weak passwords or the same password across many accounts.

Commonly used attack vectors include phishing, brute-force attacks (guessing weak passwords), and credential stuffing (using compromised passwords from one breach to access unrelated accounts) to compromise passwords. MFA addresses these vulnerabilities by requiring additional verification factors that are much harder to steal or replicate. These factors typically include:

• Something You Know. This could be a password, PIN, or an answer to a security question.

• Something You Have. This includes physical devices like a smartphone, security token, or smart card.

• Something You Are. Biometric verification may include fingerprints, facial recognition, or voice recognition.

By combining these factors, MFA ensures that, even if one factor is compromised (like a password), unauthorized access is still unlikely unless the attacker can breach multiple layers or the user is not paying attention and actually allows the access.

Charlie Christianson

Charlie Christianson

“The key advantage of MFA is that it provides multiple layers of security. Traditional authentication methods, such as passwords, are increasingly vulnerable to attacks.”

Mitigating the Risk of Data Breaches

Businesses can be devastated by a data breach through financial losses, reputational damage, and legal implications. Implementing MFA can significantly mitigate the risk of such an event. According to a report by Verizon, compromised credentials are one of the leading causes of data breaches. MFA makes it exponentially more difficult for attackers to use stolen credentials, as they would also need to defeat a second or third layer of authentication.

For instance, if a user’s password is compromised through a phishing attack, the scammer would still need access to the user’s mobile device or biometric data to complete the authentication process. This additional barrier is often enough to deter attackers or prompt them to move on to easier targets.

 

Compliance with Regulatory Standards

Most industries are subject to regulations that mandate the implementation of MFA. These include General Data Protection Regulation, the Health Insurance Portability and Accountability Act, and the Payment Card Industry Data Security Standard. All emphasize the importance of robust authentication mechanisms. Failure to comply with these standards can result in severe penalties and legal repercussions.

By implementing MFA, organizations will satisfy a major requirement of these regulations and enhance their overall security posture. Strong security practices also enhance customer trust and confidence.

 

Protecting Remote Workforces

A remote workforce presents several cybersecurity challenges. Employees accessing company resources from multiple locations with various devices increase the attack surface for cybercriminals. MFA is essential to ensure that only authorized individuals can access sensitive information and systems.

Remote access solutions, such as virtual private networks and cloud services, should be protected with MFA to prevent unauthorized access. This is an essential tool in preventing man-in-the-middle attacks and session hijacking, which are more prevalent in remote work environments.

 

Improving Incident Response and Risk Management

MFA also plays a critical role in improving incident response and risk management. By implementing MFA, organizations can better track and monitor access attempts, allowing them to identify and respond to suspicious activities more quickly. Better visibility aids in earlier detection of failed attempts and helps to mitigate threats before they become major incidents.

MFA helps to reduce the overall risk profile of an organization by minimizing the chances of unauthorized access. This is one of the reasons why cybersecurity insurers are requiring MFA on external accounts, internal administrator accounts, and even domain user log-ins.

If you are renewing your cyber coverages, be sure to read the cyber questionnaires carefully and make sure you are doing what you say you are doing. Cyber insurers will deny claims or even deny coverage altogether if they determine these critical controls are not in place.

 

Conclusion

In an era where cyberthreats are increasingly sophisticated and pervasive, MFA stands out as a crucial component of any cybersecurity strategy. By requiring multiple forms of verification, MFA significantly enhances security, mitigates the risk of data breaches, ensures compliance with regulatory standards, protects remote workforces, and improves incident response and risk management.

Organizations that prioritize the implementation of MFA can better safeguard their digital assets and maintain the trust of their customers and stakeholders. As cyberthreats continue to evolve, the importance of including an MFA solution as part of your cybersecurity strategy is becoming essential in the fight to secure your digital assets.

 

Charlie Christianson is president of CMD Technology Group Inc. in East Longmeadow.

Cybersecurity Center at Springfield Union Station Nears Opening

By
The main entry of the new Richard E. Neal Cybersecurity Center of Excellence.
Cybersecurity Special Coverage

Training Ground

The main entry of the new Richard E. Neal Cybersecurity Center of Excellence.

The main entry of the new Richard E. Neal Cybersecurity Center of Excellence.

 

There are plenty of ways to learn about cybersecurity, Gene Kingsley said, but none better than actually doing it.

“It’s a huge advantage to be immersed in an environment where you’re undergoing what you’re learning about. You’re not just learning coding; you’re actually applying coding. You’re not just reading a book; you’re applying knowledge that you can replicate on your next job, having had this experience.”

Kingsley, cyber range manager for the Richard E. Neal Cybersecurity Center of Excellence, was describing the value of the center, which will open later this summer, to students studying cybersecurity — but also to an industry that desperately needs an influx of talent.

The project, housed at Springfield Union Station, is just one component of a multi-million-dollar series of investments, announced in 2022, to bolster cybersecurity resilience — and the related workforce — across the state.

These awards included a $1,086,476 grant to support the launch of CyberTrust Massachusetts, a nonprofit that works with business and academia statewide to grow the cybersecurity talent pipeline by increasing career pathways for underrepresented groups, while promoting security operations to address the day-to-day needs of resource-constrained municipalities, nonprofits, and small businesses.

“It’s a huge advantage to be immersed in an environment where you’re undergoing what you’re learning about. You’re not just learning coding; you’re actually applying coding. You’re not just reading a book; you’re applying knowledge that you can replicate on your next job.”

The state also awarded $1,462,995 award to Springfield Technical Community College (STCC) and $1,200,000 to Bridgewater State University to establish a security operations center (SOC) and cyber range in each city. The Neal Center at Union Station, managed by STCC, also benefited from $500,000 in ARPA funding from the city of Springfield.

Springfield’s 6,000-square-foot center — a collaboration between STCC, the Springfield Redevelopment Authority, and CyberTrust Massachusetts — aims to be a hub for advancing cybersecurity awareness, education, and innovation while battling global security threats. Its cyber range is a simulated, hands-on training environment, and its SOC is envisioned as a support service for Massachusetts municipalities, as well as regional businesses, to detect cybersecurity events in real time and respond quickly.

“Springfield Union Station has re-established the city of Springfield as the crossroads of New England, and it will soon serve as home to a state-of-the-art cybersecurity training center that will greatly benefit our region,” U.S. Rep. Richard Neal said during a walk-through earlier this year.

Now that it’s set to open, Mary Kaselouskas, vice president and chief information officer at STCC, is excited to see its applications for students; three STCC classes will conduct work there this fall.

“Any of the students involved in the cybersecurity courses will have the cyber-range experience embedded in that,” she told BusinessWest, “and other classes will use the range as well.”

The facility’s security operations center

The facility’s security operations center will be a support service for municipalities and businesses to detect cybersecurity events in real time and respond quickly.

And not just STCC students; other institutions partnering on the project include Bay Path University, UMass Amherst, Western New England University, Elms College, and Springfield College, each of which offer a range of certificate and degree programs in cybersecurity, computer science and programming, digital forensics, criminal justice, and more.

“This is a very important initiative,” said Doug Keevers, program director of the School of Management and Technology at Bay Path. “It definitely benefits all students in the region by providing them with a facility where they can gain practice and hands-on experience. They’re going to be exposed to mentors, professionals in the field, real-life situations, different types of things — even competitions.

“We are very focused on knowledge, and taking the intangible and making it more tangible — giving students more hands-on, real-life experience. That’s what we’re all about,” he went on. “This will not be just for Bay Path and the partners involved, but any schools who want to use this facility as a resource. That’s very important in a field that can change dramatically on a daily basis.”

 

Essential Components

Essentially, the Neal Center will provide threat monitoring and other cybersecurity services for Commonwealth municipalities and small-business and nonprofit customers. The SOC will be able to monitor, detect, and respond to cyberthreats 24/7/365, protecting organizations’ assets.

Meanwhile, the cyber range is a testing lab that mirrors real-world IT environments to provide hands-on training opportunities to local companies, universities, and other cyber-focused organizations. It will allow both students and employees of companies and municipalities to experience simulated threats in a virtual environment, including hands-on training in live-fire attacks, blue-team/red-team events (in which one team attacks a system and the other defends it), and other training models, potentially leading to certification in security fields for students.

“We are very focused on knowledge, and taking the intangible and making it more tangible — giving students more hands-on, real-life experience. That’s what we’re all about.”

CyberTrust Massachusetts CEO Pete Sherlock called the center a critical piece of the Commonwealth’s overall effort to grow and diversify the cyber workforce and address the security needs of municipalities, nonprofits, and businesses. “With its state-of-the-art cyber range, educational facilities, and security operations center, this cyber center of excellence is a world-class resource to serve the region’s people and institutions.”

For its part, CyberTrust was launched to address four key imperatives for the state:

• Boosting security, as organizations across Massachusetts are challenged to find affordable resources to defend themselves against growing cybersecurity threats and maintain resiliency in the digital world;

• Underemployment in cybersecurity, with almost 800,000 cybersecurity job openings in the U.S. — a number expected to grow — and more than 20,000 in Massachusetts alone. The center also puts a particular focus on women and communities of color, which are underrepresented in the cybersecurity workforce and frequently overlooked for employment due to a lack of opportunity to obtain hands-on experience;

• Employee training, as businesses across the Commonwealth typically do not have a location to send their employees to receive such training at an affordable rate; and

• Business and economic development, specifically a need to convene regional hubs for business development where cybersecurity entrepreneurs can establish and grow startups, or where specific industry segments, such as defense contractors, can receive specialized support.

Gene Kingsley

Gene Kingsley says the new center could be an economic boost for downtown Springfield as well as benefiting the cybersecurity workforce.

Students who train at the center will have access internships and industry partnerships that help them build experience and career networks, research opportunities that establish best practices combined with emerging technologies, and community outreach and education forums to raise awareness about cybersecurity risks and solutions.

Kingsley said it could also be an economic booster for downtown Springfield. “Obviously, more traffic downtown is ideal. The idea is bringing people from the community to upskill them. And this is a growth field; we’re looking to get people into the field right now.”

Kaselouskas agreed, noting that the new center could be a way to boost the security workforce by creating training opportunities in an easy-to-access location.

“What’s nice about the center is that it’s a centralized location available by train and bus and it’s very easily accessible,” she said, adding that the city is interested in using the center for training its own employees. “It offers them an economy of scale. It’s cost-prohibitive to buy the platform or services on your own.”

Businesses can also use the center to upskill employees, Keevers said.

“Cybersecurity permeates every industry, every field, every department. I’ve heard advisory-board members say, ‘we have an employee who has an affinity for cybersecurity; they just need some upskilling.’ So it’s an opportunity to do that.”

 

Creating a Hub

Kaselouskas said the state’s recent focus on cybersecurity investments is intended not just to buy tools and give them to businesses to fight cyberthreats, but to train the future workforce.

“Bridgewater’s center is on campus, and ours is at a different location, but the vision and goal are the same: to train students to allow them to get jobs.”

Combined with MassReconnect, the program that now makes community college free for Massachusetts residents age 25 and up — and which has boosted enrollment at STCC and other colleges — the Neal Center promises to draw more talent into a field that needs it.

“My personal passion is for Massachusetts to become a cyberhub. And I think this is an opportunity to do that,” Keevers added, noting that, while some young people are hesitant to enter what they feel is an overly technical field, cybersecurity jobs span a wide range of skills and expertise.

“It’s not one size fits all. The biggest threat in cybersecurity is people, and the best way to stay safe is to educate and train people.”

Cybersecurity Summit to Focus on Workforce, Ecosystem

By
Cybersecurity

Strengthening the Lines of Defense

Peter Sherlock says the numbers certainly help tell the story.

There are roughly 26,000 employed in Massachusetts today in what would be called the cybersecurity sector. And there were, at the precise moment we talked with him, exactly 18,263 openings in that realm, a number that goes up seemingly every day.

That means this sector has about two-thirds the number of qualified individuals it needs, said Sherlock, adding that the dire need to close that gap was one of the motivations behind the creation of CyberTrust Massachusetts, which he now serves as CEO.

Another motivation was to make the state’s businesses, institutions, and municipalities more cyber-secure at a time when the number of victims of cyber and ransomware attacks — like the number of job openings in this sector — keeps going up.

Peter Sherlock

Peter Sherlock

“As we put these students into these SOCs, they’re going to be working under the supervision of cyber professionals. We’re going to put them to work making cities and towns more cybersecure.”

How CyberTrust is going about these assignments, which overlap in many different ways, as we’ll see, will be among the focal points of Sherlock’s presentation at the 11th annual Cybersecurity Summit at Bay Path University, set for Friday, Oct. 13 at the Mills Theatre in Carr Hall on the school’s Longmeadow campus.

Registration for the event, which has been drawing steadily larger audiences because of the importance of the subject matter, is required. Individuals can register at baypath.edu/summit, and attend either in-person or remotely.

The working title for the program is “Who’s Next? How a Stronger Cyber Ecosystem is the First Line of Defense.” And Sherlock told BusinessWest that there are many elements that comprise this ecosystem, including the business sector, government, and education (the state’s colleges and universities, and even its high schools and middle schools). Together, they work on those twin assignments of building the workforce and making entities more cyber-secure.

At the forefront of these efforts is CyberTrust Massachusetts, a nonprofit committed to building both opportunity and security through a consortium of statewide businesses and colleges.

“CyberTrust arose out of a long-running dialogue among business and academic leaders, with some folks in government; these were discussions centered around workforce,” he said, adding that he understands first-hand the challenges of hiring — and retaining — within this sector.

Indeed, he previously served as chief operating officer of MITRE, as well as senior vice president responsible for MITRE’s defense and intelligence business.

“In my roles there, I had to worry about our annual hiring programs; trying to hire 1,000 STEM professionals every year was quite a challenge, as was retaining them,” he explained. “I would talk a lot with other executives in the Massachusetts area about the challenges of growing the pipelines in some of these technologies to keep up with the demand.

“And as the pandemic disrupted the workforce a bit more, those problems have become even more urgent,” he went on, adding that this urgency helped bring business and education together in the CyberTrust Massachusetts consortium to “move the needle,” as Sherlock put it, on not only these workforce issues, but the growing threat — in the form of cyber and ransomware attacks — to businesses of all sizes, nonprofits, institutions, and municipalities.

In his presentation at the Cybersecurity Summit, which will followed by what is expected to be a robust question-and-answer period, Sherlock said he will address a number of issues and initiatives, including the workforce challenges, efforts to activate new pathways for the talent pipeline in order to both grow and diversify and workforce, and cybersecurity approaches for municipalities across the Commonwealth.

While doing so, he will discuss how these problems intersect, and also about efforts to address them jointly, such as the security operation center, or SOC (pronounced ‘sock’ by those within this sector) that is taking shape at Springfield’s Union Station. This SOC, to be established by Springfield Technical Community College, will provide threat monitoring and other cybersecurity services for the state’s municipalities, small businesses, and nonprofits, while also creating learning opportunities for those in or seeking to join this sector at a ‘cyber range,’ a new testing lab that will mirror real-world IT environments to provide hands-on training opportunities to local companies, universities, and other cyber-focused organizations.

“We need to introduce new people to the cyber career field, whether it’s recruiting them from high school or getting adult career changers, and making non-cyber majors credentialed in cyber.”

“While focusing on workforce, we decided we could be serving another purpose at the same time,” he explained. “As we’re training our cyber learners with hands-on experiences, we could actually put them to work securing cities and towns, nonprofits, and small businesses. We put together this rather ambitious plan to set up security operations centers at a number of universities across the Commonwealth and to infuse new cyber-range technology into these colleges and universities and enlist cyber employers from across the state into this activity.

“As we put these students into these SOCs, they’re going to be working under the supervision of cyber professionals,” he went on. “We’re going to put them to work making cities and towns more cybersecure.”

Overall, Sherlock said the workforce issue requires creative, outside-the-box thinking and efforts to encourage individuals to consider this field while they are still in high school or even middle school.

“We need to introduce new people to the cyber career field, whether it’s recruiting them from high school or getting adult career changers, and making non-cyber majors credentialed in cyber,” he said. “There are a lot of different ways to get people into the field that we weren’t working at too much.”

Sherlock said he would go into much more detail at the summit, which grew out of the growing importance of cybersecurity in today’s society, the emergence of that sector, and the need to keep businesses and the community at large informed when it comes to new trends, new initiatives — and new threats, said Tom Loper, associate provost and dean in the School of Management and Technology at Bay Path.

Loper said he hopes, and expects, this year’s summit to be well-attended because of its focus on businesses and municipalities, the efforts to keep them safe from cyberattacks, and the role that they play within the emerging cyber ecosystem.

 

Cyber Criminals Exploit Preventable Human Failures

By
Cybersecurity Special Coverage

Easy Targets

 

While the technology used to prevent cybercrime has certainly become more sophisticated over the years, Paul Savas has two simple words when it comes to the human side of cybersecurity.

“Be smart.”

Unfortunately, too many people simply choose not to.

“If it looks like something’s suspect, don’t open it. Don’t click on the links. So many times, these attacks happen to people who are letting their guard down,” said Savas, vice president of Comcast Business’ Western New England Region.

“How many of us get that Amazon text — ‘there’s a question about the order in your account.’ It’s a bogus text, and you should delete it right away,” he continued. “But so many people don’t. They’re curious. ‘There’s a link … I’ll click it.’ But you have to be smarter than that.”

Then there’s the problem of password laziness.

“They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

“The biggest problem is common passwords,” said Sean Hogan, president of Hogan Technology in Easthampton. “So many people reuse passwords; they have a password that they’ve used forever, and they’ll do variations of that password. The problem is, once all the bots out there have that password or something close, they will figure out all your passwords within seconds.”

And he’s run into stubbornness when it comes to changing password habits.

“When I go out to see clients, it’s a constant struggle. One of our hardest adaptations is getting them to start going with password management or password vaulting. They keep creating their own passwords. They’ll even keep a file on their desktop that says ‘passwords,’ kind of a spreadsheet. If I’m a hacker, I love that.”

Allen Reed, assistant vice president and Information Security officer at Freedom Credit Union, has run into similar frustrations.

Allen Reed

Allen Reed says ‘trust, but verify first’ is a good rule of thumb for clicking email links.

“At the credit union, I’m always hammering employees: ‘don’t click that link, don’t open that attachment, don’t ever click until you have verified. Trust, but verify first.’ Yes, it’s inconvenient to make a phone call to someone: ‘did I receive an email from you?’ But that’s the world we live in.”

When he talks about cybersecurity with Freedom employees, Reed says he tries to “put a little fear in them” with examples of mistakes other businesses have made, and the financial consequences. “It gets them to think a little more clearly.”

But the topic isn’t just an occasional one at the credit union. “We institute cybersecurity-awareness training on day one of their employment. In fact, we’re audited from the federal financial sector every year to make sure every employee has had security-awareness training — at least annually, but most importantly, on day one.”

Even then, Reed regularly uses his metaphorical hammer.

“We all receive email all day, every day. And the staff has to be trained over and over,” he said. “It’s like when we were young children at the stove, and we were told, ‘don’t touch the stove.’ We had to be told a thousand times before it sunk in.”

And hopefully, the message took root before a serious burn. That’s what companies of all sizes and from all sectors are dealing with today: the possibility of being badly burned by a breach.

For this issue’s emphasis on cybersecurity, BusinessWest examines why even the best-equipped networks can be compromised because of simple human error — and what employers are doing to drive that message home.

 

Growing Threats

One problem, Reed said, is that cyberthreats have changed over the years.

“In 2005, you were worried about your average teenager sitting in the bedroom after school thinking about how hack into the CIA mainframe; they did it more for the joy of it, to be proud of it.

“Today, we’re talking about nation-states attacking. We’re talking about a government providing monetary resources, building out multi-story buildings, hiring their own citizens and providing them with pay, to attack other nations. That’s what we’re dealing with today. They attack 24/7/365.”

And their efforts have become savvier, Savas said.

“Don’t underestimate the bad actors, because they are so far ahead when it comes to social engineering and how to employ technology. They do research on social media, and they know things about you, like your dog’s name. That’s a pretty easy password to figure out. So don’t make it easy to guess.”

Sean Hogan

Sean Hogan

“You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

Some companies have unknowingly voided their cybersecurity insurance policies because they lacked a certain level of protection — not just hardware and software, but training and compliance. “Every level of protection has a cost,” Savas added, “and some companies are gambling and not being fully protected.”

Indeed, Hogan said many advances in cybersecurity are being driven by insurance companies, which are not happy about paying out for preventable mistakes.

“They don’t want the exposure,” he went on. “And they’re going make it harder to pay off cybersecurity insurance — because that is paying out constantly. They are losing money on that; they’re realizing they sold a lot of policies where people are not doing what they should be doing. And the hackers have caught up.”

Reed noted that, going forward, most businesses will not be able to get cyber insurance coverage until they move to minimum 15-character passwords. “We moved to that four years ago because I knew it was coming.”

And not just longer passwords — or, preferably, pass phrases that are easy for the user to remember but impossible to guess — but two-factor authentication, like a code sent via text or email to the user’s phone. “You have to do that,” Hogan added. “When we install a new environment for a client, they have to do multi-factor no matter what.”

In addition, “there are paid software programs that manage passwords for you and give you different passwords you can copy and paste into the program you’re trying to log into,” Reed said.

For those who choose their own passwords, replacing letters with symbols in a recognizable word — $ for S, ! for I, etc. — makes the password exponentially safer, Savas said, adding that length is still a better safeguard than complexity.

Hogan encourages password vaulting in password generation. “I never generate my own passwords. The client shouldn’t either. So when I go to create that password, I’m going to generate a password that’s going to be random; it’s going to be extremely complex. It’s not the name of my dog. It’s not the name of my car. It’s got nothing to do with me. And it’s going to be a password just for that one website, for that one portal. And then it gets saved to a secure vault.”

 

Common Sense

While all these procedures are smart, Hogan went on, they only work as long as a company’s employees follow them.

“Can I ensure that everybody’s doing this? No. Can it be a procedure that you mandate? Yes, you can mandate it. But tracking it is a little different. So we add a couple more things on top of all this. Besides password management, vaulting, and multi-factor authentication, then we do the dark-web monitoring and security-awareness training.”

But a lot of cyber protection still comes down to common sense. That includes what people choose to share online, Reed said.

“If you have your entire dossier of who you are on Facebook, Twitter, Snapchat, whatever, once that dossier is out there, that’s what criminals leverage,” he told BusinessWest. “That’s what’s going to convince your grandmother that you need help, because it really sounds like you.”

Or, convince you that your CEO wants you to click a dangerous email link.

“The hackers look at people that can approve wire transfers, ACH batches, you name it,” Hogan said. “They’re looking at owners, they’re looking at CFOs, they’re looking at controllers. We call that ‘whaling’ or ‘spear phishing,’ where they actually target a certain individual. And they’re very sophisticated. They come up with real information.”

Reed agreed. “If they’re going to impersonate the president or the CEO, the only way they’re able to leverage that person, with that crafty email, is if they spend months on social media learning about that person, gathering information to formulate the email. That’s what gets employees to click — because we all want to do what the CEO wants us to do.”

Much of this behavior, from smart password creation to avoiding phishing attacks, comes down to training, Hogan noted. And sometimes, even that’s not enough.

“We can talk until we’re blue in the face, but that doesn’t mean that somebody working at that company is going to follow those procedures properly,” he said, recalling a recent incident when a remote worker for a client used his own laptop to log into the company portal from a remote site, got a suspicious pop-up, and clicked on it, allowing a cyber attacker to navigate the company’s system.

“That’s a big issue. You know the environment that the client has is pretty darn secure, but when you’re having people from the outside log in from their own equipment that is not secure, you’re really running the risk of a breach.”

And many times, Savas said, companies don’t even know they’ve been breached. “The bad actors go in, look around, see if there’s anything worthwhile, then map out a strategy. And that, to me, is scary.”

On the plus side, he believes the message is getting across, and companies are buttoning up with proper training.

“More education is happening within organizations. Attempts are being made, but it all comes down to that individual user being educated, heeding those warnings, and being smart about the things they can control,” Savas explained.

“Confidentiality of the password, not opening attachments, not clicking those links. Those are the three elements that open up an intrusion,” he added. “A lot of it is preventable. The majority is preventable.”

Massachusetts Awards $14 Million to Address Digital Equity

By Contributor
Cybersecurity

Bridging the Divide

Leaders from the Commonwealth’s Executive Office of Economic Development and the Massachusetts Broadband Institute (MBI) at MassTech recently announced $14 million in new grants from the state’s Digital Equity Partnership Program to address statewide digital-equity gaps during an event at Tech Foundry in Springfield.

The three grants were announced by Economic Development Secretary Yvonne Hao, who highlighted selected projects from Tech Goes Home, which will receive $4.5 million; Vinfen, on behalf of the Human Services Alliance for Digital Equity, which will receive $4.3 million; and Baystate Health, on behalf of the Western Massachusetts Alliance for Digital Equity, which will receive $5.1 million.

“Massachusetts has a real opportunity to close the digital divide and ensure all people in our state can participate in the digital economy,” Hao said. “These grants will help residents build their digital skills and get online affordably, thereby expanding their connections to job and training opportunities, healthcare resources, social connections, and so much more. We are grateful to the Massachusetts Broadband Institute for its work to make affordable high-speed internet available to residents across the state.”

The secretary was joined at the event by business and nonprofit leaders from across the state, highlighting the critical need for increased digital connectivity for residents statewide, an issue that grew in importance during the COVID-19 public-health crisis. Following the secretary’s remarks, MassMutual Chairman, President, and CEO Roger Crandall spoke about the issue, appearing in his role as a board member of the Massachusetts Competitive Partnership, which published a report last year titled “Connecting Communities through Digital Equity,” highlighting the importance of addressing digital equity statewide.

“Internet access is a crucial driver of economic and social advancement, from fostering innovation and creating new jobs to utilizing government and community services,” Crandall said. “Yet, far too many households in Massachusetts lack broadband service, creating a significant barrier to many career and educational opportunities. The business community has a collective responsibility to help address this inequity by continuing to invest in and expand access to digital infrastructure, literacy programs, and affordable digital tools for all residents throughout the Commonwealth.”

The event included a roundtable discussion with executives from the three grant-recipient organizations, which pointed to the digital-equity challenges Massachusetts citizens face each day and how the awarded projects aim to increase connectivity and access. The grants will support two years of critical digital-equity project development and implementation across the state.

“The genesis of the Alliance for Digital Equity in June 2020 was a direct response to digital disparity — not new — and our societal dependence on the internet to address to meeting basic material needs as the COVID-19 pandemic surfaced,” said Dr. Frank Robinson, vice president of Public Health at Baystate Health. “It was embarrassingly obvious that digital marginalization for already-marginalized people would exacerbate negative health outcomes, economic oppression, and racial injustice. Digital equity and inclusion is truly a super-social determinant of health, critical to our meaningful progress toward health equity and satisfying basic human rights in this connected society, linking people to vital resources, such as jobs, education, healthcare, food, and information.”

The Digital Equity Partnerships Program was launched in September 2022 with the goal of designating qualified organizations to implement projects that meet the goals outlined in the Commonwealth’s ARPA COVID recovery legislation, which created a $50 million fund to bridge the digital divide in the state.

“I am thrilled to see that Baystate Health, in partnership with the Western Massachusetts Alliance for Digital Equity, have been recognized by the Commonwealth’s Digital Equity Partnership Program and received a grant of $5.1 million to continue addressing the digital divide,” state Sen. Jo Comerford said.

State Sen. Adam Gomez added that “the funds created by the ARPA COVID recovery legislation of 2021 represented a momentous step toward bridging the digital-equity divide for Western Massachusetts. There are far too many unserved communities in this region of the Commonwealth who do not have simple access to WiFi. Communities in this region will now have substantially increased access to not only WiFi, but also support for key programming areas such as digital literacy, public-space internet modernization, and connectivity initiatives for economic hardship. Eliminating the digital-equity divide in Western Mass. is absolutely crucial to supporting a thriving economy.”

While the state has made trides to improve broadband and WiFi access, state Rep. Lindsay Sabadosa noted, many communities have been left behind, much public housing remains unwired, and towns that don’t know how to fund projects that would level the playing field for all residents. “The Digital Equity Partnership Program will assist these communities, providing important funding and assistance in learning how to incorporate this technology into their daily lives.”

Springfield Mayor Domenic Sarno said the Digital Equity Partnership Program will help eliminate or mitigate the barriers faced in accessing digital equity and help close the digital divide. “Access to affordable and reliable internet is essential for our residents, and achieving this goal will not only enhance the quality of life for many, but will also help advance vital economic-development projects and educational initiatives, not only here in Springfield, but across the Commonwealth.”

The state’s digital-equity programs build on initiatives launched in response to the COVID-19 public-health crisis, which included public WiFi hotspots in unserved towns in Western and Central Mass., as well as the Mass Internet Connect program, which worked with MassHire to provide financial support and digital-literacy tools to help get unemployed residents back to work.

The MBI has also launched a Municipal Digital Equity Planning Program to support Massachusetts communities with planning activities that will help build a broad understanding of how a lack of internet access is impacting residents in their community, as well as a Broadband and Digital Equity Working Group comprised of stakeholders from across the state that will inform the makeup and focus of state programs, providing key technical expertise and representation of target populations.

“Our partner organizations are leaders in the digital-equity field and have cultivated an incredible network of local stakeholders who will ensure these funds have maximum benefit to the communities they are designed to serve,” said Michael Baldino, MBI director. “Today’s grants, coupled with our municipal planning program and the engagement of our dedicated working-group members, will ensure that the dollars invested lead to the desired impact — more residents will not only gain access to devices, digital skills, and more affordable internet, they will have access to a wider range of social, educational, and healthcare resources.”

AI Promises to Impact the Workforce in Unexpected Ways

By
Cover Story Cybersecurity

Rise of the Machines

 

Twice a year, Tom Loper participates in a Cybersecurity Advisory Council meeting. The last one was … different.

“I would say there was a sense of concern that I hadn’t seen before at that council because of ChatGPT and the phishing potential,” said Loper, dean of the School of Arts, Sciences and Management at Bay Path University.

He explained that people can use ChatGPT, the AI chatbot that has drawn major worldwide attention since its unveiling last fall, to input information from any website, or emails from an organization, to generate a phishing episode much more realistic, and much more likely to draw a response, than its target had ever received.

“These are people — from Facebook, from Fidelity, from the Hartford, from every major organization you can think of in our area and beyond — who were taken aback by the capabilities of ChatGPT,” Loper said.

“It really scares the hell out of all of us, because we know the biggest problem that we have in cybersecurity, the biggest challenge, comes between the brain and the keyboard. Human beings allow people in.”

“It really scares the hell out of all of us, because we know the biggest problem that we have in cybersecurity, the biggest challenge, comes between the brain and the keyboard,” he explained. “Human beings allow people in. The systems are very good at stopping people from breaching — flags go off, bells and whistles go off. But the biggest problem we have is the human intervention that has to take place. And human beings make mistakes. Especially when we’re connected to the outside world, we make mistakes that allow phishing to take place.”

Tom Loper says ChatGPT is already making work easier

Tom Loper says ChatGPT is already making work easier for students and professionals, but that raises issues ranging from plagiarism to how jobs might change.

And ChatGPT just made that challenge even more daunting.

But the impact of this and other AI tools extend far beyond cyberthreats.

“AI has the ability to be as impactful as the internet — possibly even as impactful as electricity — on the way business is conducted,” said Delcie Bean, president and CEO of Paragus Strategic IT in Hadley. “We all knew this day was coming for a long time, but now it’s here, and by the end of this decade, the only businesses that will still be in business are the ones that embrace the change.”

Bean explained that these tools allow enormous amounts of work previously done by humans to be completely automated, often in a fraction of the time and with much greater accuracy — and not just basic administrative work.

“We are also talking about highly complex work like computer coding, law, and even practicing medicine,” Bean related. “In a recent demonstration, AI correctly diagnosed 225 cancer cases within 18 minutes and at 85% accuracy, while human doctors took 50 minutes and only achieved a 64% accuracy rate with the same cases. Between now and the end of the decade, we are going to see dozens of new companies and technologies emerging, displacing a lot of legacy processes and technologies at a rapid pace.”

What does that mean for employers, the workforce, and job opportunities in the future? No one has all the answers to that question — although ChatGPT itself took a stab at it for us  — but there is broad agreement that change is coming.

“AI has the ability to be as impactful as the internet — possibly even as impactful as electricity — on the way business is conducted. We all knew this day was coming for a long time, but now it’s here, and by the end of this decade, the only businesses that will still be in business are the ones that embrace the change.”

“This really challenges all forms of expertise because it’s drawing on this incredible domain of knowledge,” said James Wilson, professor of Business at Bay Path. “Now, the accuracy of it, the citing of it, all that is not there yet. But it will come.”

Wilson recently started teaching courses in a certificate program on digital transformation, which includes discussion of the impact of AI on the workplace.

“It started as a therapy session because the students were like, ‘what’s the future going to be? What skills do I need to have? What’s going to happen?’ It’s very uncertain. We have these things called human skills … which are presumably going to differentiate us from this artificial intelligence — that is, creative thinking, inquiry, critical thinking, collaboration. You’re not going to run your business on ChatGPT.”

Delcie Bean says AI promises to disrupt

Delcie Bean says AI promises to disrupt not only administrative and computer careers, but law, medicine, and a wide range of other fields.

But that’s not the only viewpoint. “The most pessimistic view of this is that AI will do for humans what the automobile did for horses,” Wilson said. “There are some dire projections.”

 

Future … Tense

Loper and Wilson have delved into the capabilities and possibilities of ChatGPT and other AI tools on the higher-education level, and they’ve been impressed.

“ChatGPT is the hot topic because it’s a breakthrough in the way it uses large language processing,” Loper said. “It’s never been made available to the public like this before. The exciting part is how it processes data at a phenomenal speed — it’s absolutely amazing.”

And it’s not just regurgitating knowledge, he stressed. Xiaoxia Liu, assistant professor and director of Applied Data Science at Bay Path, has been using ChatGPT in her classes, helping students finish programming projects.

A Brief ‘Interview’ with ChatGPT

We went right to the source and asked ChatGPT for its take on this article’s topic. These are the answers it provided within seconds.

How will ChatGPT and other AI tools threaten the job market in the coming years?

AI tools and automation have already impacted the job market in many ways, and it is likely that this trend will continue in the coming years. ChatGPT and other AI tools can automate repetitive or low-level tasks, leading to job displacement for those whose work can be automated.

However, it’s essential to note that AI tools and automation can also create new job opportunities, particularly in areas that require specialized skills or expertise in implementing and managing AI technology. Additionally, the use of AI tools can increase productivity and reduce costs, which can result in businesses expanding and creating new job positions.

Overall, the impact of AI on the job market is complex and multi-faceted. While some jobs may be replaced by automation, new opportunities may arise, and existing roles may evolve and require different skill sets. It is essential for individuals and businesses to adapt to these changes by acquiring new skills and embracing the opportunities presented by AI.

What are some jobs that ChatGPT and other AI tools will impact the most?

ChatGPT and other AI tools are likely to impact a range of jobs, particularly those that involve repetitive or low-level tasks that can be automated. Some examples of jobs that may be impacted the most include:

• Customer-service representatives: ChatGPT can automate many customer service tasks, such as answering common questions or directing customers to the appropriate department.

• Data-entry clerks: AI tools can be used to scan and input data, reducing the need for manual data-entry clerks.

• Factory workers: AI-powered robots can perform tasks such as assembly-line work, reducing the need for human workers.

• Drivers: The use of self-driving cars and trucks may impact the job market for drivers in the coming years.

• Financial analysts: AI tools can analyze financial data and identify patterns, potentially reducing the need for human financial analysts.

• Retail salespeople: The rise of e-commerce and automated checkout systems may reduce the need for human retail salespeople.

• Administrative assistants: AI tools can be used to automate tasks such as scheduling appointments, managing email, and organizing files, reducing the need for human administrative assistants.

It’s important to note that the impact of AI on these jobs may vary depending on the industry, location, and other factors. While AI may automate some tasks, it may also create new job opportunities in areas such as data analysis, AI development and maintenance, and other specialized roles.

Write a haiku about how AI might change the way people work.

Machines learn and grow.
Work becomes more efficient.
Humans thrive with ease.

“She gives them a start, and then they have to finish it; they use Python or whatever to finish it,” Loper explained. “Now, she’s letting them use ChatGPT, and they’re finishing it in seconds. And it’s very accurate, very fast. She’s excited about that. That’s an example where ChatGPT uses large language learning to help it finish something that you started without you giving it much guidance at all, other than the start of the program.”

Loper noted that ChatGPT also gives different answers to questions based on who’s asking and in what way.

“The algorithm, for whatever reason, is drawing on what it thinks is ideal, but your past references influence the way that it searches. The type of question you ask generates a certain type of format and answer. So if you’re asking a business question, you get an answer in a business format. If you’re asking a question for a literary magazine, you get a different format.”

And that raises issues with academic plagiarism, Loper noted, because professors can no longer throw a chunk of a student’s work into Google to get a definite take on whether something was lifted, verbatim, from another source.

He has experimented with generating presentations from ChatGPT based on a series of prompts, and recognizes the ramifications for students. “It was logically laid out and put in a format that, if a student gave it to me, I would say, ‘damn, that’s good. You really learned this material.’”

When it comes to cracking down on plagiarism, Wilson added, “we might have to abandon ship on that in a way, because it’s not so much about being original anymore as being creative in your inquiry and critical in your understanding of it.”

Wilson called up other AI tools as well during his talk with BusinessWest, from Butternut AI, which can build a website in 20 seconds, to Pictory AI, which generates videos, to Wondercraft AI, which asks for discussion prompts and will generate a full podcast, featuring multiple voices.

“I teach a business-analytics class, where it was all research, research, research. I don’t think it’s about research anymore,” he said of the way AI will affect academia. “I think it’s about asking the right questions. It’s about the right inquiry. It may not be about writing anymore. It may be about editing and getting a draft from the AI expert and then adjusting it. The amount of content that can be created is staggering.”

Even classroom lectures can benefit, he added. “I can put in a few prompts, and it generates an entire lecture. I can go in and change the text, which will then be re-narrated through AI. Suddenly, all my content is better organized.”

Amid all these implications is the compelling idea that AI will only get sharper.

James Wilson

James Wilson

“We’ve all gotten used to Siri, and we’ve all gotten used to Google, but now you’re going to have this super-intelligent, conversational assistant with you,” Wilson said.

Loper added that these discussions are no longer theoretical. He noted that speakers at the Davos World Economic Forum, among others, have been thinking seriously about what types of work are going to be replaced by artificial intelligence and what careers will continue to be dominated by human beings, with their unique sensing and critical skills.

“Human beings aren’t going away any time soon, but we’re going to have a level of augmentation that we’ve never experienced, and we don’t know how to work with it yet. It’s so new,” he added. “James and I are playing with ChatGPT, and we’re kind of in awe of it, but we’re just skimming the surface compared to some of the ways people are using it. It’s just amazing.”

Added Wilson, “if you try to imagine this in a much smaller sense, it’s like when the smartphone came out — how did that change business? Texting and emailing and video chat reconfigured the way things are done, but in a smaller sense.”

Loper agreed. “This is much bigger than anything like that.”

 

Risk and Reward

Przemyslaw Grabowicz, a computer scientist in the College of Information and Computer Science at UMass Amherst, is heading up a research initiative called EQUATE (which stands for equity, accountability, trust, and explainability), which is currently developing a coordinated response to the Biden administration’s request for public comment on its AI Accountability Policy.

“As a computer scientist, I believe technology can make our lives better, maybe in some senses easier,” he told BusinessWest. “But I think there’s a risk that, if we step into new technologies too quickly, then society may develop a distrust for new technology that may, in the end, slow down developments.”

The National Telecommunications and Information Administration (NTIA), a Commerce Department agency that advises the White House on telecommunications and information policy, is studying whether there are measures that could be implemented assure that AI systems are “legal, effective, ethical, safe, and otherwise trustworthy.”

“Responsible AI systems could bring enormous benefits, but only if we address their potential consequences and harms,” NTIA Administrator Alan Davidson told Reuters. “For these systems to reach their full potential, companies and consumers need to be able to trust them.”

In crafting accountability policies, Grabowicz said, leaders in all areas of life need to think carefully about the consequences of technology development and ways in which profits from this development will be converted into long-term societal gain rather than short-term profits. If not, such technology may contribute to the growth of misinformation and polarization.

“As a society, nobody wants these kinds of consequences, but if corporations focus on short-term financial gain, they may not consider the potential harmful consequences of technology being used in a way that it wasn’t meant to when it was developed.”

Such questions, Bean noted, will be further accelerated by advances in other technologies, especially robotics. “We are rapidly approaching the day when there will be free-standing robots in our lives who are able to think, make decisions, and interact with the world around them.”

In terms of security, he went on, it is hard to quantify the threat. “With Microsoft’s new tool VALL-E, which can mimic a human voice with a sample size as small as three seconds; deepfakes being able to be produced in minutes by anyone with basic computer skills; and more and more data being available to be mined, we are going to need to rethink security.

“While it is possible to imagine how technology will respond to meet these threats, the risk to businesses is the gap that exists in between the threats coming online and the response being available and adopted,” he added. “A lot of businesses are likely to face real threats in that gap — not to mention physical security, things like hacking a moving vehicle or sending a robot to conduct a robbery.”

In short, Bean said, “while there is much to look forward to, there are certainly many threats that will need to be understood and addressed.”

Meanwhile, artificial intelligence continues to evolve — in ways we may not even see coming.

Don’t Make Yourself a Target with Easily Cracked Passwords

By
Cybersecurity

Guessing Game

 

NordPass, a password manager that provides users with an encrypted password vault, recently released its annual report on the most commonly used — and, therefore, most easily cracked — passwords.

The most common password globally? That would be ‘password.’ The rest of the top five: ‘123456,’ ‘123456789,’ ‘guest,’ and ‘qwerty.’

In the U.S., ‘guest’ takes the top spot, followed by ‘123456,’ ‘password,’ ‘12345,’ and ‘a1b2c3.’

Clearly, not a lot of effort is going into creating such passwords, and it doesn’t take a hacker much time — mere seconds, actually — to defeat them.

Popular films and TV shows also rank among the past year’s most popular passwords, including ‘batman,’ ‘euphoria,’ and ‘encanto.’

“While the worst passwords might change every year, human beings are creatures of habit,” NordPass notes. “Every year, researchers notice the same pattern — sports teams, movie characters, and food items dominate every password list.”

Here are a few tips from the Federal Trade Commission (FTC) to create strong, secure passwords.

 

Make Your Password Long and Strong

That means at least 12 characters. Making a password longer is generally the easiest way to make it stronger. Consider using a passphrase of random words so that your password is more memorable, but avoid using common words or phrases. If the service you are using does not allow long passwords, you can make your password stronger by mixing uppercase and lowercase letters, numbers, and symbols.

 

Don’t Reuse Passwords

Use different passwords for different accounts. That way, if a hacker gets your password for one account, they can’t use it to get into your other accounts.

 

“While the worst passwords might change every year, human beings are creatures of habit. Every year, researchers notice the same pattern — sports teams, movie characters, and food items dominate every password list.”

 

Use Multi-factor Authentication When Possible

Some accounts offer extra security by requiring something in addition to a password to log in to your account. This is called multi-factor authentication. The something extra you need to log into your account fall into two categories: something you have, like a passcode you get via an authentication app or a security key; or something you are, like a scan of your fingerprint, your retina, or your face.

 

Consider a Password Manager

Most people have trouble keeping track of all of their passwords. The longer and more complicated a password is, the stronger it is, but a longer password can also be more difficult to remember. Consider storing your passwords and security questions in a reputable password manager. To find a reputable password manager, search independent review sites, and talk to friends and family for ones they use. Make sure to use a strong password to secure the information in your password manager.

 

Pick Security Questions No One Else Can Guess

If a site asks you to answer security questions, avoid providing answers that are available in public records or easily found online, like your zip code, birthplace, or mother’s maiden name. And don’t use questions with a limited number of responses that attackers can easily guess, like the color of your first car. You can even use nonsense answers to make guessing more difficult — but if you do, make sure you can remember what they are.

 

Change Passwords Quickly If There’s a Breach

If a company tells you there was a data breach where a hacker could have gotten your password, change the password you use with that company right away, and on any account that uses a similar password. And if someone is using your information to open new accounts or make purchases, report it and get help at identitytheft.gov.

 

Bottom Line

“Passwords are the locks on your account doors,” the FTC notes. “You keep lots of personal information in your online accounts, including your email, bank account, and your tax returns, so you want good protections in place.”

What Does the Cybersecurity Landscape Look Like in 2023?

By
Cybersecurity Special Coverage

Defense Mechanism

 

The numbers are staggering. According to Cybersecurity Ventures’ 2022 cybercrime report, the cost of cybercrime is predicted to hit $8 trillion in 2023 and will grow to $10.5 trillion by 2025.

The impacts on businesses are already well-established. According to security.org, one in every six businesses that fell victim to cyberattacks faces ransomware, and about half of them pay the ransom. And according to a report last year by Security Intelligence, the share of data breaches caused by ransomware grew 41% in the previous year and took 49 days longer than the average breach to identify and contain.

A study conducted last year by Positive Technologies among financial organizations, fuel and energy organizations, government bodies, industrial businesses, IT companies, and other sectors found that cybercriminals are able to penetrate 93% of company networks and gain access to local network resources.

Such breaches, obviously, affect personal data. In 2020 alone, data breaches exposed more than 37 billion personal records, 82% of which came from only five breaches, security.org notes. Data breaches affect not only companies and organizations, but also the people whose information is in the exposed records. And identity-fraud losses in 2020 cost its 49 million victims $56 billion in total, or roughly $1,100 per victim.

“Cyber insurance premiums are climbing, and it’s becoming increasingly difficult for companies to afford or obtain coverage.”

Clearly, the threat is real, and growing. Here are a few trends to consider when looking at the cybersecurity landscape, and what tech media and organizations are saying about them.

 

Rising Threats, Rising Liability

With the rise in cybercrime has come increased risk for businesses, and that means a much larger cybersecurity sector. According to security.org, the global cyber insurance market was worth $7.8 billion in 2020 and is likely to grow into a $20 billion industry by 2025. About 75% of all cyber insurance premiums are for businesses, and the rest for individuals. But that could be shifting as well.

So, too, is the responsibility companies bear for their own data security, Forbes projects. “Cyber insurance premiums are climbing, and it’s becoming increasingly difficult for companies to afford or obtain coverage,” the publication notes. “To negotiate insurance premiums and better risk coverage, businesses will be required to present evidence across a broad spectrum of security areas in order to prove compliance with leading cybersecurity standards and best practices.”

Organizations will begin to conduct enterprise risk assessments that highlight the maturity level of their cybersecurity program and proactively address any underwriting concerns, it continues, noting that risk assessments can help determine decisions around insurance gaps, limits, and coverage.

“With the distinct possibility of a global recession on the horizon, we expect to see ransomware attacks spike in 2023. However, larger organizations in regions heavily impacted during the ransomware boom are the most prepared for this wave after investing time and money in fighting back.”

As for those internal efforts, Forbes also notes that cybersecurity has become too complex for many organizations to manage on their own, and most companies don’t have the skills or resources to manage a full-fledged security operations center (SOC). For these reasons, many businesses will be forced to think creatively and could decide to outsource their day-to-day security operations.

Locally, one such SOC is being developed at Springfield Union Station, part of a state- and federally funded project announced in November to establish a Cybersecurity Center of Excellence at the site, which will also include a ‘cyber range’ for training.

Mary Kaselouskas, vice president and chief information officer at Springfield Technical Community College (STCC), which will manage the center, noted recently that “a lot of companies don’t have the resources for a fully operational SOC, or can even afford to have managed SOC operations,” so the need for a local SOC is clear.

 

Zero Trust on the Rise

One way businesses are increasingly curtailing cyber threats is through a concept called ‘zero trust.’

According to IBM, the idea, developed by John Kindervag in 2010 while a principal analyst at Forrester Research, is a broad framework that promises effective protection of an organization’s most valuable assets. It works by assuming every connection and endpoint is considered a threat.

Essentially, a zero-trust network logs and inspects all corporate network traffic, limits and controls access to the network, and verifies and secures network resources. A zero-trust security model ensures data and resources are inaccessible by default, and users can only access them on a limited basis under the right circumstances, known as least-privilege access. The strategy also authenticates and authorizes every device, network flow, and connection.

“As hybrid work became a way of life, more organizations have started adopting zero-trust frameworks, meaning all users, apps, and devices that request access are assumed to be unauthorized until proven otherwise,” Security Intelligence notes. “Organizations with a zero-trust approach deployed saved nearly $1 million in average breach costs compared to organizations without zero trust deployed.”

 

Connecting the Globe

Perhaps no cybersecurity trend has been bigger in the last several years than the scourge of attacks related to the supply chain. Analyst firm Gartner predicted that, by 2025, 45% of global organizations will be impacted in some way by a supply-chain attack.

“Cyber criminals look for organizations or industries teetering at the edge and then make their move to tip them over,” said Charles Henderson, an IBM global managing partner and head of IBM Security X-Force. “Last year, we saw that with manufacturing — a strained industry viewed as the backbone of supply chains. With the distinct possibility of a global recession on the horizon, we expect to see ransomware attacks spike in 2023. However, larger organizations in regions heavily impacted during the ransomware boom are the most prepared for this wave after investing time and money in fighting back.”

Global threats often require a global response, which is why, last year, the U.S. State Department announced the launch of the Global Emerging Leaders in International Cyberspace Security (GEL-ICS) Fellowship, in partnership with the Meridian International Center.

The fellowship will support the development of a diverse global network of future cyber policy leaders who share the U.S. and other partners’ vision for cyberspace, and is designed to equip emerging leaders from the governments of these foreign partners with the knowledge and global connections to be advocates of the framework of responsible state behavior in cyberspace, as affirmed by the United Nations General Assembly.

The first cohort of 20 to 25 government officials will engage in a year-long program on international cyberspace policy in 2023. Fellows will visit Washington, D.C., New York City, and San Francisco to engage with U.S. and international leaders from government, industry, and civil society. They will also participate in a series of thematic webinars to support continuing education and foster networking among the fellows and stakeholders.

Additionally, fellows will reconvene on the margins of the 2023 Internet Governance Forum hosted in Japan to mark the end of the program. With each year, fellowship alumni will form a growing, global network of proponents for a stable and secure cyberspace for future generations.

 

Good Time for a Job Search

If there’s a plus to the increasing cyber threat landscape, it’s an explosion in job opportunities. Even at a time when the IT industry is seeing massive layoffs, cybersecurity appears to be a safer harbor than other tech careers.

The global cybersecurity workforce grew to encompass 4.7 million people last year, reaching its highest-ever levels, according to a workforce study by ISC2. However, the same study found there is still a need for more than 3.4 million security professionals, an increase of more than 26% from 2021’s numbers.

The U.S. Bureau of Labor Statistics projects similarly robust need, estimating that the number of cybersecurity jobs will grow by 35% between 2021 and 2031. According to Cyberseek, of those 3.4 million professionals needed globally, about 770,000 opportunities are in the U.S. alone.

Opportunities Abound for Graduates of Cybersecurity Programs

By
Brian Levine says the UMass Cybersecurity Institute
Cybersecurity Special Coverage

Threat Level: Constant

Brian Levine says the UMass Cybersecurity Institute

Brian Levine says the UMass Cybersecurity Institute’s work is “security for the common good.”

 

Make no mistake, we live in an increasingly interconnected world, and the technology that makes that possible is always under threat from those who would mine, expose, and exploit data — often in life-altering ways. So while it’s no surprise that the cybersecurity field is rife with job opportunity, exactly how much opportunity (a half-million open jobs nationally, according to one study) may still raise eyebrows. Area universities with cybersecurity degree programs hope those statistics also raise interest in a challenging field that offers good pay and the chance to do some truly meaningful work.

It’s impossible to envision a world that doesn’t need cybersecurity, Brian Levine said, and that’s not exactly good news.

“I don’t think there’s any way this will go away, unfortunately,” he said, after listing common threats ranging from malware and ransomware attacks to massive breaches of consumer data. “It’s an ever-present problem. So what we do here is really important.”

He was referring to the UMass Cybersecurity Institute on the Amherst campus, which launched in 2015 with the mission of advancing what it calls “security for the common good,” said Levine, the institute’s director. For example, he has worked over the past decade to build tools used by law enforcement around the country — and the world — on cases of internet-based child sexual abuse (for example, the sharing of exploitative photographs).

“That’s a privacy issue, and a forensics issue,” he said, stressing that the institute’s researchers never lose focus on the human benefits of their work — in other words, it’s never just a technical exercise.

“The courses we offer are influenced by research that we do,” he went on. “We have a lot of pride in moving the research we’re doing into the classroom.”

That high-impact work is appealing to many who enter this profession, but one of the most obvious draws is the career opportunity. Matt Smith, director of Cybersecurity programs at Bay Path University, noted that a half-million jobs in cybersecurity are open across the U.S. — more than 20,000 of them in New England, and roughly two-thirds of those (13,389, according to the national CyberSeek research project) in Massachusetts — the 12th-highest total among all U.S. states.

“The industry is changing so rapidly.Turn on the news — one day they’re talking about ransomware, another day it’s the Colonial Pipeline attack … it’s all about security. So, workforce in this industry is in demand.”

“The industry is changing so rapidly,” Smith said. “Turn on the news — one day they’re talking about ransomware, another day it’s the Colonial Pipeline attack … it’s all about security. So, workforce in this industry is in demand.”

That’s the other side of the ‘bad news’ coin — at least for people who want to make a career of defending against threats that will only continue. “It’s real job security, with high starting salaries. You’re going to retain employment and have opportunities to upscale.”

Reflecting the many different niches in cybersecurity, Bay Path offers three undergraduate degrees in the field — digital forensics and incident response, information assurance, and risk management — as well as a master’s degree in cybersecurity management.

“We renew the courses every time we go live, sometimes two times a year,” Smith said. “Every time it’s being presented to another cohort, we look at the information being presented and decide if it’s still applicable, or how it can be improved upon.”

Matt Smith says the constantly evolving nature of threats means job security

Matt Smith says the constantly evolving nature of threats means job security and advancement opportunities for today’s cybersecurity professionals.

For example, “the Colonial Pipeline incident hadn’t happened two years ago — so, let’s talk about that this year and remove something else from the course. We’re always going through the courses, tweaking them, fine-tuning them, and I think that sets us apart from other universities. We handpick the material we incorporate, and we update it, and we use the best forensic software we can.”

And that’s a challenge, said Beverly Benson, Cybersecurity program director for the American Women’s College, Bay Path’s all-online arm, which offers intensive, accelerated versions of the undergraduate cybersecurity programs taught at the main campus.

“I am constantly doing research on threats, making sure my curriculum and content is fresh, because the reality is, those individuals who are trying to attack systems, they don’t take vacations,” she told BusinessWest. “We need to stay abreast of everything to make sure students are getting as up-to-date a curriculum as possible.”

The industry’s constantly evolving nature makes it attractive to many career seekers, she added.

“It’s not a repetitive type of field. There may be a framework to adhere to, but as technology advances, so does the work that needs to be done. Our world is becoming more connected and interconnected, and data is everything. Think about the gadgets in our homes — even washing machines, dryers, and stoves are connected to the internet. We need people to understand how to keep that data safe.”

For that reason, Benson went on, “cybersecurity touches everyone, whether it’s healthcare, financial services, food service, the travel industry, the Department of Defense, you name it. We’re a very interconnected world, and we’re able to do things faster because of data — so we need to protect that data, whether it’s at rest, in transit, or in use.”

 

Defending Data

Levine listed a number of ways the cybersecurity research — and classwork — at UMass affects real people.

“One professor looks at ensuring that people have censorship-free access to information on the internet, which can be very important if you’re a dissident in a country that has censored or filtered it,” he said. “Another professor works with differential privacy, and his technology is being used by the U.S. Census.”

That term refers to technology that allows the government, corporations, or anyone else to release statistical information while not exposing people’s individual data.

Beverly Benson

Beverly Benson

“It’s not a repetitive type of field. There may be a framework to adhere to, but as technology advances, so does the work that needs to be done. Our world is becoming more connected and interconnected, and data is everything.”

“One problem with studies that collect information about you and release it later is the possibility that someone’s personal details can be inferred by looking at the data set,” Levine said, noting that differential-privacy measures ‘fuzz’ the information so the statistics are accurate, but don’t reveal information about any one person.

“We have courses on what some people call ‘ethical hacking’ — how to analyze a computer for its vulnerabilities and learn to defend those vulnerabilities. It’s teaching students to be white hats,” he explained, adding that other classes delve into reverse-engineering security, digital forensics, ethics and law, and securing distributed systems — which, these days, means cryptocurrency.

“Cryptocurrencies are one of the hardest challenges — no one is in charge, and people are exchanging things of value,” Levine said, adding that, whatever the topic, UMass brings in experts with practical experience in the field to teach students. “We don’t want everything taught from an ivory-tower point of view. And we want to teach techniques that will survive past graduation in a quickly evolving field. It’s not just computer science.”

At the American Women’s College, Benson said the average age of a cybersecurity student is 35, many no doubt drawn by the expansive opportunities in the field. “We have career changers, we have people in IT fields who are looking to specialize, and some are new to it, looking to learn more about cybersecurity and join the workforce.”

She’s also gratified that the program is making a small dent in what is currently a male-dominated workforce, to the tune of 80%. Part of the pitch, she said, is the reality that work in this field is wildly varied.

“We have the opportunity to demystify cybersecurity,” she said. “I explain to our women that cybersecurity is more than someone being in a basement coding. Part of cybersecurity is things like risk management, which can be a more consultative approach, helping someone understand assets, risks, and how to protect against vulnerabilities. Those are not technical skills; those are essential business skills.”

Smith agreed. “This hits on financial services, healthcare, government, you name it. Every industry has been affected in one way or another by cybersecurity.”

He should know, having worked in a number of sectors, ranging from the Pentagon to the financial-services world, and he often calls on professionals who actually work in those fields to bring their real-world expertise to Bay Path students. “A lot of programs are computer-science-driven; they’re experts in coding and programming. When you jump into cybersecurity, it’s a different animal.”

Introducing more women into the field, and all the sectors it influences, would be a healthy development, he said.

“I’m the program director, but also their cheerleader,” Benson agreed. “They know my motto is ‘dare to dream,’ and having a diverse workforce will bring about diversity of thought, diversity of problem solving, diversity in the ways people will collaborate. And I think that’s so needed.”

 

Making Connections

Another needed element is networking and making connections in the field early, Smith said. Many Bay Path students take advantage of a Mass Cyber Center mentorship program, working with large companies like Baystate Health, Travelers Insurance, and MassMutual.

“Networking doesn’t happen only when you go to conferences,” he said in explaining the value of such programs. “And most employers, after an internship, offer something on the spot — they’ll say, ‘please, when can you start?’”

That’s huge for new graduates, who typically enter the work world in significant debt. “We’re one of the industries that actually tackles that cohesively. We’re actually getting them employed at a very high-level-paying job, thus cutting down on student debt,” Smith noted, adding that a graduate’s employer will often pay for further education as well.

Speaking of connecting students with careers, the UMass Cybersecurity Institute recently secured a renewal of its CyberCorps Scholarship for Service program, sponsored by the National Science Foundation, which began in 2015.

The latest grant will support approximately 31 scholars at the undergraduate and graduate levels in the university’s computer science and electrical and computer engineering degree programs by offering them full tuition and fees, a stipend ranging from $25,000 per year for undergraduates to $34,000 per year for graduate students, and a professional-development fund for one to three years of their degree program. In addition, students complete an internship at a federal agency during the summers and, upon graduation, work full-time at a federal agency in a cybersecurity role for one to three years at full pay and benefits. Then they’re free to move on, but many don’t.

“We’ve done this for 34 students already, and the vast majority have stayed in the government after their service period is up,” Levine said, noting that federal opportunities range from working at the Pentagon to protecting land and wildlife with the Environmental Protection Agency; from tracking down cybercriminals with the FBI to joining the Cybersecurity and Infrastructure Security Agency, which swoops in to manage ransomware attacks.

“This program will help create a new generation of cybersecurity professionals and researchers to address novel and challenging problems facing society,” said Sanjay Raman, dean of the College of Engineering at UMass Amherst. “These students will help to modernize the executive-branch workforce, advance science and technology at government laboratories, and secure our national defense.”

It’s that kind of real-world impact that inspires those who teach the next generation of cybersecurity pros.

“This is why I get up in the morning,” said Bay Path’s Smith, who worked in counterintelligence around the time of 9/11 and remembers how the world changed. “We did a lot of things to protect our country, and I’m proud of that. Now, I want to give back to the students and help them pick up some of the stuff I’ve learned, so they can excel in a workforce that’s begging for anybody with interest in their field.”

His job, and that of his department, is to stay at the forefront of developments in the field — and, again, they are constant — and continue to hone and evolve the program so it remains relevant and on the cutting edge.

“We want our students to stand out in the industry and get hired,” he said. “And we’ve been very fortunate — our students are landing some amazing jobs.”

 

Joseph Bednar can be reached at [email protected]

Older Adults Are Increasingly Targeted by Online and E-mail Scams

By
Cybersecurity

Vulnerable Population

 

When people think about cybersecurity threats, Stephanie Helm said, they often think only about the technical side — the ways in which electronic devices can be compromised and data stolen.

They sometimes forget about the human side of the equation — but that’s where older adults are often especially at risk.

“There’s a technical vulnerability that can be exploited, whether it’s somebody’s password, exploiting a vulnerability because they failed to update the device to include a patch, or maybe they’re using an unsecured WiFi when they’re in a public location,” said Helm, director of the MassCyberCenter. “So there’s a technical component that everyone using the internet is facing today.”

Just as critical, however, is what she calls the “social engineering of the individual,” where a victim willingly divulges information based on the fact that somebody’s engaging them in a personal way.

Stephanie Helm

Stephanie Helm

“These are professional people who know how to hit those emotional buttons and continue that relationship with the hope that somebody is going to divulge information.”

“Older folks might not have the comfort level with the technology to secure their information,” she said, “and they may be more vulnerable to the social engineering.”

Helm shared these thoughts and others during a webinar presented last week by LeadingAge Massachusetts, titled “Cybersecurity: Helping Older Adults Stay Safer on the Internet.” She joined Rubesh Jacobs, managing director of 24/7 Techies USA, and Judy Miller, director of Technology and Accounting for Kendal at Oberlin in Ohio, to discuss the reasons seniors are increasingly falling prey to online and e-mail scams, and what can be done about it.

“The number of scams leading to financial loss has been dramatically increasing since 2019,” Jacobs said, citing a Federal Trade Commission (FTC) report that the number of online scams tripled between 2019 and 2020, outpacing phone-call scams — which actually declined slightly — for the first time. Meanwhile, e-mail scams more than doubled.

“The acuteness of that spike is shocking,” he added. “We’ve also noticed this trend in our own call centers; 28% of calls we get for help are somehow related to fraudulent activities online.”

According to the FTC, Americans age 60 and up are falling prey to tech-support scams — in which someone poses as a computer technician to gain remote access to the victim’s computer — about 475% more often than those ages 20 to 59. (By contrast, the younger group falls victim to online-shopping scams 60% more often than seniors.)

“Senior citizens are really in that nexus where a criminal can get at them through technical means, or they can get at them through social engineering” — and often a combination of both, Helm said. “The protections you put in place have to look at both of those aspects because you’re not quite sure which of those things a person might be most vulnerable for. I think that’s really troublesome.”

Judy Miller

Judy Miller

“Seniors lose an average of $500 or more when they’re scammed, sometimes due to the fact that they are often trusting and polite, they own their own home, and they have good credit, so they make a good target.”

Effective cybersecurity, she explained, considers people, processes, and technology working together to make someone more resilient and likely to recognize scams.

“The components of social engineering are worth thinking about,” she added, noting that a scam might begin with a realistic bot, either on the phone or online, that shifts over to a live scammer if the victim responds.

Those victims, Helm said, are often lonely and want to talk to someone, or they’re trusting and grateful that someone wants to help them solve a problem, which is why scammers try to establish trust.

One reason for the recent spike in cases is that many older adults were much more isolated starting early in 2020, with family members avoiding most visits until after COVID-19 vaccinations arrived, she noted. But families do need to engage with these topics. “Having an ability to ask questions or to talk about things they’ve been presented with in a safe manner is really important.”

But seniors are far from the only victims, Helm said. “If they continue the engagement, these are professional people who know how to hit those emotional buttons and continue that relationship with the hope that somebody is going to divulge information.”

 

It Takes a Village

Miller has worked for Kendal Corp. for 28 years, so she’s seen these threats evolve at her own facility, which offers units for independent and assisted living, memory care, and skilled nursing.

“Seniors lose an average of $500 or more when they’re scammed, sometimes due to the fact that they are often trusting and polite, they own their own home, and they have good credit, so they make a good target,” she explained. “They have also been falling prey to cyber incidents because of their increased use of the internet.”

Scams that have targeted her residents have taken many forms, from imposters posing as legitimate government agencies or companies requesting payments to fake but attractive offers for gift cards, and much more. Most originate from e-mail, she noted.

When Jacobs asked Miller how often she hears such things, she responded, “it’s almost more important how much we don’t hear about them.”

To make sure people stay educated, if she hears of a scam targeting a resident, all residents are alerted, and some tech-savvy residents will even spread the word themselves if they encounter a scam attempt. “It’s really engaging the entire community to help each other in preventing some of those things from happening.”

Once a scammer gains someone’s trust, Helm said, they often introduce an element of urgency — the idea that the victim has to act now to get a deal or avoid a penalty or legal trouble.

“We should talk about how these scams exist and give senior citizens the confidence that they can recognize when this doesn’t make sense and avoid that sense of urgency to act, because that’s where you make a mistake,” she explained. “It’s perfectly acceptable to say, ‘I do all my business by mail — put a letter in the mail to me, and I’ll respond to you.”

But it’s easier said than done, she admitted, especially at a time when many seniors — and younger people, for that matter — have been more isolated than usual.

“I think it’s difficult for anybody in society to be fully armed and resilient. I feel if people become isolated in their old age and are not as familiar with some of the technology, they can get intimidated. So this is an area where we’re trying to see if we can be more helpful to them.”

Family members can help educate their older loved ones by asking gentle but probing questions about what may be going on, the webinar participants noted, and encourage residents of senior-living communities to call an administrator if they encounter a suspicious e-mail or think their information may have been compromised. And, of course, they should emphasize the importance of protecting passwords and other sensitive information, not clicking suspicious links, and shopping only at reputable, well-known websites.

“If it sounds like it’s too good to be true, it probably isn’t true,” Helm said. “I like to talk with senior citizens about having confidence in the skeptical skills they had throughout life. These are scams that happen to be on a computer, but they’re scams we grew up with since we were kids — bait and switch, or acting like an imposter.”

She takes a broad view of threats, having served in the U.S. Navy for 29 years. After her retirement as a captain, she taught military operations, specifically on integrating cyberspace operations into wargames.

“That was an opportunity to talk about how cybersecurity or cyber operations can affect operations that you traditionally would not think they would impact,” she explained. Now, in her role with the Mass Cyber Center, she knows there are few areas cybersecurity doesn’t impact — and that older Americans are often especially at risk.

“Today,” she said, “we all know this has great consequences to our daily lives.”

 

Joseph Bednar can be reached at [email protected]

Why Working from Home Can Increase Cybersecurity Threats

By
Cybersecurity Special Coverage

Risk and Reward

If the COVID-19 pandemic has taught businesses anything, it’s that employees, in many cases, can do their jobs from home — which can, in theory, lead to cost savings. But also expenses — the type of expense that, if ignored, can lead to much bigger losses.

We’re talking about data security. And what remote workers need depends, in many cases, on how long they plan on staying home, said Sean Hogan, president and CEO of Hogan Communications in Easthampton.

“We have some clients investing in the home office and planning on shrinking their bricks and mortar, so they’re going to save money on bricks and mortar or the lease,” he told BusinessWest. “But then they have to invest in bandwidth and security for the remote office. It’s a huge issue.”

And a sometimes messy one. In a shared workplace, Hogan noted, “you might have great security, firewalls, routers, you have security installed, you make sure all the security is updated, you constantly have the latest patches and revisions.”

But working from home poses all kinds of issues with the unknown, the most pressing being, what programs are running on home devices, whether those devices are loaded with viruses, and whether they can infect the company’s servers when they connect remotely.

“We’re trying to control security at someone’s own bandwidth at the house, where three, four, or five people may be trying to jump on at the same time,” he added. “It’s not shaped at all; it doesn’t prioritize any applications or traffic. Now, there are ways to do that — we can install SD-WAN software that allows us to monitor the connection and prioritize traffic like Zoom, Microsoft Teams, or GoToMeeting. That way, you don’t have everyone breaking up and having issues.”

Sean Hogan

Sean Hogan

“We have some clients investing in the home office and planning on shrinking their bricks and mortar, so they’re going to save money on bricks and mortar or the lease. But then they have to invest in bandwidth and security for the remote office. It’s a huge issue.”

But that doesn’t solve the issues of security holes in the home wi-fi — which have weaker protocols, allowing hackers easier access to the network’s traffic — as well as the human element that makes workers vulnerable to phishing scams, which are the top cause of data breaches, and insecure passwords, which allow hackers easy access to multiple accounts in a short period of time.

“The Internet has become the Wild West over the last 10 years,” said Jeremiah Beaudry, president of Bloo Solutions in Chicopee, starting with scam e-mails — from phishing attacks to realistic-looking but nefarious sites that try to wrench passwords and data from users and install malware on their computers.

“I get e-mails from clients three or four times a day — it used to be once or twice a week — saying things like, ‘I got this e-mail asking me to wire money to a client,’” he noted. “You can’t stop people from pretending to be someone else, and the language is getting more and more clever.”

That combination of possibly flawed technology and human errors make the home office a particular concern in the world of cybersecurity.

“Nobody has the exact answers right now for how to make the most secure connection at a remote office,” Hogan said, adding that going to the cloud has been an effective measure for many businesses, while others have taken the more drastic step of setting up physical firewalls at remote sites for key employees — say, for the CEO or CFO. “We’ll lock them down if they’re actually connecting to files and servers that are really confidential.”

Possible solutions are plenty, he said — but it all begins with knowing exactly what equipment remote employees are dealing with, and what threats they pose.

Viral Spread

COVID-19 isn’t the only fast-spreading infection going around, Hogan said. In fact, “45% of home computers are infected with malware. That’s an eye opener for many people. It’s a huge issue, and removing it is a huge challenge.”

One problem is the human element — specifically, how users invite threats in by not recognizing them when they pop up. Take the broad realm of phishing — the setting in which people receive such pitches can actually make a difference in how they respond, Beaudry said.

“It’s harder to sift through it when working from home; it’s not natural. You’re out of your element when you’re sitting at our desk in your pajamas, as opposed to being in your office at work. You may not be reading your e-mail as carefully as you normally would. You may not be on alert.”

A big piece of the puzzle is end-user awareness, he said. “You want to have your employees educated about what’s out there, so they know how to spot forgeries.”

Alex Willis, BlackBerry’s vice president of Sales Engineering and ISV Partners, recently told Forbes that companies trust their employees to do the right thing, and workers are generally honest, but trust can be a dangerous thing.

“The problem with just trusting people is that employees don’t always do this on purpose,” Willis said. “Sometimes, it’s just purely unintentional. They are working on a home machine that’s riddled with malware. They need access to corporate data. For instance, if the company issues a slow laptop to an employee and the employee has to get their job done, they are going to use their home computer that is faster to do the job. In that scenario, the home computer might not be as secure.”

Jeremiah Beaudry

Jeremiah Beaudry says home networks aren’t typically built to run as efficiently — or safely — as those in a workplace.

Again, it’s that issue of the unknown, Beaudry told BusinessWest. “You don’t know what they have going on with their home networks. We didn’t set up the home connection, we don’t know what they have, and everyone has different people on it. Some are borrowing it from their apartment complex or sharing it with the neighbors, and they expect the internet to work perfectly. It’s not going to.”

In an office, on the other hand, everyone is using the same network, running at the same speed, with the same level of security and firewall protection. “Then, when they go home, there are so many variables.”

The best-case scenario is to give employer-owned devices to employees so they can remotely manage information.

“You can put antivirus on an employer-owned device; when they’re using their own devices, you don’t know what they’re doing to protect it,” Beaudry added. “And if the employee is laid off or fired, you would have the ability to control any employer-owned data.”

At the very least, he said, companies should encrypt the traffic between their network and individual users’ home computers.

“We put monitoring agents on remote clients that monitor for any viruses or malware and will update their antivirus and malware protection in some cases,” Hogan added.

Vigilant Approach

None of this completely addresses the speed and efficiency issues of home devices. “Usually, in a home office, they pay for their own bandwidth, and the business can’t say, ‘we don’t want your kid playing Fortnite,’” Hogan said. “That’s the challenge.”

“I get e-mails from clients three or four times a day — it used to be once or twice a week — saying things like, ‘I got this e-mail asking me to wire money to a client.’ You can’t stop people from pretending to be someone else, and the language is getting more and more clever.”

“Some clients will pay for a second, business-only connection for remote workers, he added. “But that’s pretty extreme; not many are doing that.”

More popular — and effective — is the move to a virtual environment. Working in the cloud, he noted, means not worrying about the hub-and-spoke relationship between physical servers and computers that’s the biggest weak point for security. “Most of my clients have eliminated that weakness.”

For some clients, the cybersecurity issue is especially critical — take medical businesses, for whom privacy is paramount in the HIPAA era. “That changes the game completely,” Hogan said, noting that one resource for companies handling sensitive data is a SOC, or security operations center.

“Clients who really value security can sign up with a SOC team that responds in case of a breach,” he explained. “It’s a lot of monitoring, detecting, and responding.”

Delcie Bean, CEO of Paragus IT, said any investment in platform migration and remote work has to be accompanied by investment in strong security tools — and education.

“The legacy tools and technologies used to secure networks for the past 10 years need not apply for this next wave of mobile workers,” he told BusinessWest. “Security of the future will be a lot more about multi-factor authentication, deep encryption, and will involve a lot more end-user training as well as testing than the command-and-control style approach of the past.”

Hogan agreed. “Password management is so massive,” he said, noting that people resist simple protections like multi-factor authentication, or even just using complicated passwords, or different passwords for different sites.

“We are also dark-web monitoring pretty consistently,” he added. “The dark web has been on fire lately — a lot of breaches.” Once data fall into those hands, the damage is done, he added, “but the important thing is to know what got breached, and if you can tell what credentials are out there, so you can change them.”

The bottom line, Beaudry said, is to make sure employees use unique passwords and encrypt connections remotely, and not using tools that are potentially vulnerable.

“And there’s a long list of tools known to be exploited by hackers, so it’s good to check with an IT professional before using any remote desktop method,” he added. “Some methods require you to open firewall ports that can leave you vulnerable to ransomware and all sorts of awful data breaches. The main thing is to make sure your firewall is locked down and no unnecessary ports are open, and you have backups of all data.”

That’s a lot to consider when moving into an era of expanded remote work — some of which comes at a cost. But the cost of ignoring it is much higher.

Joseph Bednar can be reached at [email protected]