Security and the Metaverse

Metaverse, a term with no set definition at the moment, can generally be considered another mode of communication over the Internet. The Metaverse builds on the Internet and simulates the physical world. For an immersive and interactive experience in the virtual world, companies make use of new-age technologies like Augmented Reality and Virtual Reality. To achieve the ideal Metaverse, a few key characteristics that must be realized are decentralization, boundlessness, interoperability, immersive and social experiences, persistency, and security. Not adhering to any of these is equivalent to building a non-compliant metaverse. 

The Metaverse opens doors for its users to have a virtual identity. This virtual identity can be an embodiment of their real self or something that influences them. Ultimately, it allows illintenders to procure a person’s private information and analyse their preferences and thought processes. As the Metaverse is still nascent, it is highly unregulated. This is alarming as bad actors resort to crimes like phishing, stalking, child and sexual abuse, molestation, exploitation of human rights, trespassing, obscenity, and much more. In addition, Metaverse requires hardware like haptics, wearables, image and motion sensors, VR headsets, etc., that collect large amounts of sensitive data and are susceptible & easily prone to attacks.

Metaverse makes it easier for hackers to track biometrics, user behaviour & physiological responses, which can be used for malicious purposes like vote rigging & targeted advertising campaigns. Tracing the attacker’s identity is also challenging because the attacker’s tracked public address does not reveal their real-life identity. It is essential to educate the users about basic cybercrimes and general precautions. Governments should recognize new technologies as early as possible & form committees to draft data regulatory policies and laws. 

To lessen the challenges in privacy due to universal interoperability, experts suggest that technology companies agree to specific standards for a connected Metaverse to expel the need for a company to license the right to use another company’s underlying technology to build their own Metaverse. Companies should form their privacy policy, data retention policy, licensing agreements & other legal policies, and documents with guidance from specialized law firms and gain an understanding of the regulatory challenges posed by Metaverse. Since cryptocurrency and tokens are the primary media of exchange in the Metaverse, crypto organizations must seek to make developments with all the security measures and regulations in place. Establishing robust security measures in and around the Metaverse is also recommended to protect its integrity. 

Cloud Security Journey for Banks/FI

Financial Institutions/Banks are adopting cloud services and this is becoming the first choice due to its scalability, elasticity, cost-saving, reduced overhead, and Pay as you go model. But financial institutes/Banks have more focus on privacy, security, confidentiality, and integrity of customers & financial data.

Join this session as we discuss:

• Different aspects of Cloud migration throughout its journey while keeping our risk appetite within limits.
• Common threats including data breaches, data loss, DDOS, insider threats, shared responsibility, and risk of insufficient due diligence/care throughout the cloud journey.
• Continuous risk management strategy for the cloud.
• Why financial institutes/banks are slow/reluctant in moving their customer/core data to the cloud.
• Legal & Regulatory aspects while dealing with the cloud and mitigating the associated risks.

Why AI-Based cyber defense systems require a shield

Artificial intelligence (AI) is quickly becoming critical in defending our digital assets against sophisticated cyber attacks. During this security transformation, we paid much attention to how these capabilities help build a defense posture. But we often overlook how hackers might harness AI to evade detection.  

This session is about how adversarial AI works and what it takes to eliminate or reduce the risks.

Red Herrings on the Zero Trust Journey

Today, Zero Trust is a key priority item in everyone’s Cyber Security agenda. It’s success and effectiveness depend on how it is perceived and put into practice. The route to Zero Trust is riddled with false leads and missing elements. This session gives some practitioner perspectives that can be useful in Zero Trust implementation.

Evolution of Attacks Against Services and Countermeasures

Today’s IT industry is changing very quickly. As a white hacker leader of a fintech company, which, unlike traditional financial institutions, moves quickly and delivers innovative services everyday in a race against the clock, I will share the perspective on the latest IT trends in view of security. Essentially, I would like to explain the issues that arise from the increase in the use of open sources and frameworks on a case-by-case basis and suggest countermeasures to be taken by companies from both engineering and managing perspective, and also emphasize the importance of such countermeasures.  

An Engineering Approach to Data Privacy and Protection

The ever-changing paradigm of data generation, storage, and consumption has led to the exponential growth in data incidents. Year 2021 has been the year of highest data breaches exposing Personal information of millions of users. The root cause for these data breaches ranges from vulnerabilities in unprotected databases, misconfigurations in cloud systems, Ransomware, malware or slip from marketing service providers. Most organizations have strong Privacy Organizational functions that are compliance focused however, they lack Privacy Engineering functions focused on embedding privacy into the engineering practices. This lecture makes recommendations about Privacy Engineering best practices that can help prevent, detect, and mitigate Privacy Threats and Vulnerabilities and provides information about appropriate Privacy and Security controls to mitigate the Privacy Risks.