Category: It & Technology

There’s no denying that the technology industry is rapidly evolving. And as a result, the companies that operate within this lucrative sector are also growing. From Apple to Samsung, the tech elite have billions of dollars at their disposal and are becoming ever more powerful.
With all this power, they’re capable of exerting their dominance and influencing countries around the world. But while high-growth technology companies are contributing massive amounts of money to global economies, some people fear that these firms pose a security risk to critical infrastructure systems.
The United States is an example of a country that has slammed foreign technology companies in recent times. Recently, American lawmakers ordered telco AT&T to sever its ties with Huawei over fears that the Chinese mobile phone maker is simply becoming too powerful. They believe that the firm poses a grave threat to national security.

Creating security backdoors
The worry for government officials – especially in the United States – is that foreign technology companies could use backdoors to compromise state information security. Scott Crawford, a director at 451 Research, believes that this issue plays out on “multiple” levels. But it is “often more visible when it comes to security risks, rather than foreign dominance”.
He tells us: “In many of these cases, the concern is that foreign interests could introduce technology or capabilities into the US that could introduce a risk to US information security – a risk that could be difficult to ferret out, if such a threat could be obscured within the technology.”
American security researchers have been looking into these threats for years, as the 2012 case with Huawei and ZTE certainly proves. However, Crawford makes it clear that these incidents aren’t just exclusive to Beijing – they come from countries globally. “These concerns arise in part from evidence gathered by security researchers in recent years alleging either direct or indirect involvement of foreign interests in breaches of sensitive information security. China has repeatedly been alleged to be behind many of these incidents – but it isn’t the only nation seen as posing a threat to foreign interests,” he says.

US as the culprit
The United States isn’t exactly innocent when it comes to surveillance and other espionage activities. Former CIA employee Edward Snowden has offered a great deal of insight into the country’s cyber spying over the years. “The US itself is often seen in this light, particularly following Edward Snowden’s allegations about US surveillance activities. It is therefore not surprising, perhaps, that in 2012, investigations by the US House of Representatives flared around accusations that Huawei and ZTE were doing exactly what the NSA was revealed to be doing two years later with their Tailored Access Operations teams,” explains Crawford.
Responding to these allegations, the Chinese have also been hesitant to accept American technologies into their market. Companies such as Apple and Google have struggled to reach out to the masses in the country. “China itself has reportedly opposed the incursion of US tech leaders into its markets, though many strategic tech companies have sought to reach rapprochement with China to ease concerns,” he says.

Companies that rely solely on foreign technology providers could be putting themselves at risk, admits Crawford. “There is concern at a more strategic level. Should any nation become dependent on a foreign technology provider for capabilities critical to society, it could be placing its strategic interests at risk. At the personal level, this concern could arise regarding technology critical to individual health or safety. At the societal level, it could involve technologies seen as part of critical infrastructure,” he explains.
He expects governments to become tougher on technology companies with the rise of IoT, concluding: “We would expect these concerns to color government response to the continued rise of the Internet of Things, as smart computing capability becomes increasingly integrated with the technologies of everyday life, from large-scale utilities to the smart home.”

A growing security risk
James Wickes, CEO and co-founder of cloud-based visual surveillance company Cloudview, says governments are right to be concerned about foreign companies that become too powerful. He tells us that the threats are “particularly felt in the domain of CCTV equipment, where the security services have not only raised concerns but identified specific threats”. Wickes points out to a situation in the 2016 case when MI6 became worried about Chinese company Hikvision being Britain’s largest supplier of CCTV equipment. He says UK security specialists “expressed grave concerns about the potential security risk, particularly for internet connected cameras”.

In May 2017, the US Department of Homeland Security highlighted similar vulnerabilities. It found a range of problems in connected cameras and issued a security advisory notice. Wickes explains that security researchers have also reported “backdoors in a range of cameras from other manufacturers that allow remote unauthorized administrative access via the web”, giving cyber crooks the ability to target government systems. He says: “Such backdoors are rarely an oversight, and are built in by people who know what they’re doing. They provide a means for hackers to come and go undetected, bypassing all usual security measures.”
In extreme circumstances, cyber criminals could use these backdoors to launch devastating terrorist attacks on countries. “They could even allow the hacker to configure the device to allow front door entry by unwanted persons to appear legitimate. This could easily result in a security breach that affects national security or competitiveness. With an inbuilt back door, poor IoT security might be a little too tempting for a nosey nation, while for terrorists, why bother with suicide bombs if you can shut down power stations, open dams and look at CCTV footage of major cities and public places at will,” he concludes.

While the news that the US Government wants to stop AT&T from forging an ever-closer business relationship with Huawei may seem slightly extreme, it appears that some of these worries are just. There are instances where governments rely too much on foreign technologies, leaving them exposed to attack from state actors. Clearly, security organizations need to keep a closer eye on government IT infrastructure to ensure it’s robust enough to fend off cyber crooks.

If 2017 taught us anything, it’s that you can’t be complacent about your cybersecurity strategy. And as the driving force behind McAfee’s security research and development, you’d expect Chief Technology Officer, Steve Grobman, to have more to worry about than most.
“You could spend all day being concerned about almost anything,” he laughs, when I ask him what threats people should be looking out for.
But there is one big issue facing all companies today. How do you deal with the fast-changing threat landscape whilst continuing to protect yourself against the threats you were worried about yesterday?

“That’s creating a lot of new challenges for an IT defender to comprehend in order to protect their environment,” Grobman says.

Artificial Intelligence has become the latest buzzword in cybersecurity spaces and McAfee is now integrating these capabilities into its latest product offerings.
And it’s easy to see why. When technology has been trained properly, it can be very good at processing massive quantities of data and seeing patterns. Unfortunately, what technology is not so good at is using intuition to spot a new attack pattern or recognize an evasion tactic.

“One of our observations is that there are certain types of things machines are good at and there are things that humans are good at, that machines aren’t,” Grobman explains. “Where a defense strategy can be most effective is when you have a strategy that has the best elements of both working together.”

To those versed in cybersecurity, it’s a well-known fact that the attacker has an inherent advantage over the defender and part of that reason is the attacker’s ability to move faster than the defender.

“When we want to deploy it [a new product] to our customers we have to develop it, put it through our internal quality assurance cycle, have our customers acquire it. They have to put it through their quality assurance cycle then they have to go through a deployment cycle,” Grobman tells me. “All of this can take weeks, possibly months. If you’re an adversary, you can build yesterday and deploy today. Time is very much on the side of the attacker.”
This scenario doesn’t change when AI becomes involved. In fact, it brings with it its own unique set of challenges. However, Grobman’s concerns aren’t from the Elon Musk school of thought.

“I am more worried about overly trusting the outcomes from AI as opposed to it going rouge per-say,” he explains. “There can sometimes be an overconfidence in the ability for AI to do things that they’re not really doing. With AI or machine learning, you can actually have a model that looks very good but is actually worthless.”

To demonstrate this problem, Grobman built his own machine learning model that he claimed could predict the winner of the Super Bowl. On the surface the model worked, correctly predicting the outcome nine out of 10 years. However, Grobman intentionally over trained the model, having it learn the noise of the games he knew he would be testing it on, rather than developing it to understand anything about American football.

“The point is, when you apply it to cybersecurity there’s a lot of companies that are saying ‘here’s how amazing our machine learning model is. Look how effective it is!’ and you really just have to understand some of the nuance of how it’s being positioned. Is it being trained? Is it being tested on things that are very similar to what it was trained on? Those are the things you need to worry about.

“Most of these models don’t really know what an attack is. It’s not like a person who’s saying, ‘there’s bad things happening – this is an attack’. It’s based off the attack looking similar enough to things that it’s been conditioned or trained on so it’s able to classify it correctly. Which is a real risk.”
This very real problem only reinforces Grobman’s belief that man and machine need to work together in order to tackle these emerging security issues. Unfortunately, an increasing cybersecurity skills gap is threatening to undermine that working model and seriously impact on how companies deal with security.

“All organizations will need a combination of technology and people and different types of organizations have different levels of ability to pay for individuals of varying talent. So, you’re going to see cyber security issues impacting organizations that haven’t traditionally had major issues.”

And in some ways, this is set to be the biggest security challenge facing companies in the coming years. How do companies develop and deploy technology that is not only successful from a cybersecurity point of view, but can also improve the efficiency of people, to help mitigate the labor shortage.
So, what can we expect to see more of in the future? Grobman believes we’re going to see cloud breaches that will have catastrophic impacts on organizations or people.

“I think we saw the beginnings of that with the Yahoo breach. You know, one single breach impacted three billion accounts. That’s a scale unlike anything we’ve previously seen. I think we’ll see more breaches related to non-traditional devices.”
Grobman ends our conversation on a relatively somber note, keen to acknowledge that while companies like McAfee are continuing to fight the good fight against these emerging threats, the battle is nowhere near won.

“I think the sophistication of attacks will grow,” he concludes. “All the great technology that defenders are using today is going to be used to make attacks more effective and we need to get ready for it.”

This is a contributed piece from Emil Eifrem, CEO of Neo Technology, the company behind graph database, Neo4j.

Amazon has taught us the value of being able to predict what else customers might want to buy, by analysing online sales data. It’s a lesson that any retailer wishing to survive needs to start learning – and applying.
But to do so, retailers need not only to know about my past purchases, but be able to instantly combine this knowledge with any new interest shown during the customer’s current visit to offer recommendations.

How? Simple: they need to understand the customer intent by analysing a host of clues offered by the customer, interrogate this data at lightning speed to serve up uncannily relevant recommendations and so generate great, tailored offers – offers that become increasingly more accurate, as the recommendation engine gathers more data and learns more about the customer in the process.

To accomplish this requires a combination of NL (Natural Language) processing, ML (Machine Learning), accurate predictive analytics, a distributed, real-time storage and processing engine and, I contend, a graph database to make all the real-time data connections required.

Why do I say that? Let’s look at a real-world example of just such a combination – eBay’s AI-based ShopBot is built on top of a graph database. That graph layer directly enables the system to answer sophisticated questions like, ‘I am looking for a brown, leather Coach messenger bag costing less than $100, please find me those’.

ShopBot asks qualifying questions and will quickly serve up relevant product examples to choose from. The functionality is impressive – you can send the bot a photo with a direction such as, ’I like these sunglasses, can you find similar models?’ and it will employ visual image recognition and machine learning to figure out similar products for you, in milliseconds.

All this is done by using NL processing techniques to figure out your intent (text, picture and speech, but also spelling and grammar intention are parsed for meaning and context), while the graph database (using Neo4j) helps to refine the search against inventory with context – a way of representing connections based on shopper intent that’s shaping up to be key to the bot making sense of the world in order to help you.

That context is stored, so that the ShopBot can remember it for future interactions. So when a shopper searches for ‘brown bags’ for example, it knows what details to ask next like type, style, brand, budget or size. And as it accumulates this information by traversing the graph database, the application is able to quickly zero in on specific product recommendations.

Why relational isn’t your best friend here
Tapping into human intent like this and delivering highly responsive, accurate help is the Holy Grail of what applied AI can offer. In this discussion on conversational commerce the example is well made: in response to a statement, My wife and I are going camping in Lake Tahoe next week, we need a tent, most search engines would react to the word ‘tent’ and the additional context regarding location, temperature, tent size, scenery, etc. is typically lost.

This matters, as it’s this specific information that actually informs many buying decisions – and which graphs help empower computers to learn. Context drives sophisticated shopping behaviour, and graph technology is the way to open it up for a retailer.

But you can’t get there the way you’re going now. The traditional way of storing data is ‘store and retrieve’, but that doesn’t give you much in terms of context and connections – and for your searches and recommendations to be useful, context needs to come in.

To help improve meaning and precision, you need richer search, which is what AI-enriched applications such as chatbots give us.

Graph databases are now one of the central pillars of the future of applied AI, and graph is shaping up as the most practical way of getting there.