{"id":2680,"date":"2024-02-22T17:40:09","date_gmt":"2024-02-22T17:40:09","guid":{"rendered":"https:\/\/horizon.peachpuff-wolverine-566518.hostingersite.com\/?p=2680"},"modified":"2024-02-22T17:40:09","modified_gmt":"2024-02-22T17:40:09","slug":"researchers-and-small-businesses-join-forces-against-hackers","status":"publish","type":"post","link":"https:\/\/scienceblog.com\/horizon\/2680\/researchers-and-small-businesses-join-forces-against-hackers\/","title":{"rendered":"Researchers and small businesses join forces against hackers"},"content":{"rendered":"

Improved cybersecurity defences for electronic commerce have emerged from EU-funded projects.<\/p>\n

By<\/em><\/strong> \u00a0Tom Cassauwers<\/p>\n

What do a Greek pharmacy, a Spanish multinational bank, a German foundation specialised in the digital economy and a UK university have in common?<\/p>\n

They all helped develop software tools with EU funding to counter cyber and physical threats to e-commerce in the European single market, the world\u2019s most lucrative.<\/p>\n

Prime targets<\/strong><\/p>\n

Called\u00a0ENSURESEC<\/a>, the project sought to ensure that small and medium-sized enterprises, or SMEs, in particular have adequate technological knowledge and defences against hackers and fraudsters.<\/p>\n

\u2018SMEs have fewer resources,\u2019 said Luis Carrascal, a cybersecurity expert at French software company Inetum. \u2018They can\u2019t just hire large teams of cybersecurity experts. The majority of SME employees also lack a basic understanding of cybersecurity.\u2019<\/p>\n

SMEs are defined as businesses that employ fewer than 250 people and have annual turnover of no more than \u20ac50 million. They account for almost all companies in Europe, making them regular targets of cyber-attacks.<\/p>\n

Nearly a third of European SMEs faced at least one cybercrime in 2021, according to a\u00a0Eurobarometer<\/a> survey.<\/p>\n

A typical example involves a \u201cransomware\u201d attack in which hackers enter a company\u2019s computer systems, encrypt their data and demand a ransom. A European\u00a0network of small businesses<\/a> reported a 57% increase in ransomware attacks on SMEs in 2023 compared with the previous year.<\/p>\n

\u2018Attack surface\u2019<\/strong><\/p>\n

Theodoros Sakopoulos, who owns an online pharmacy called ToFarmakeioMou in the Greek capital Athens, simulated a hybrid physical and digital attack during ENSURESEC.<\/p>\n

In the mock theft, hackers tried to jam the GPS tracker of a drug delivery by the business so they could intercept the truck and steal its contents. Sensor devices were developed to track the shipment and notify the pharmacy when any order got tampered with.<\/p>\n

Sakopoulos was among 22 participants in ENSURESEC, which ran for two years until mid-2022. Other participants included Spain-based CaixaBank, the IOTA Stiftung \u2013 a German foundation advancing research into the digital economy \u2013 and the University of Greenwich in the UK.<\/p>\n

\u2018The attack surface is huge in e-commerce,\u2019 said Augustin Lemesle, a research engineer at the French Alternative Energies and Atomic Energy Commission, or CEA, which also took part in the project. \u2018You can be attacked from everywhere.\u2019<\/p>\n

Lemesle was the technical coordinator of ENSURESEC, whose participants came from 14 European countries. Other participants included the Spanish office of French software company Atos and Belgian university KU Leuven.<\/p>\n

AI vigilance<\/strong><\/p>\n

One of the project\u2019s software tools uses artificial intelligence (AI) to monitor a company\u2019s internal networks, which are shielded from the outside internet. They\u2019re the grand prize for hackers, who seek entry to gain access to sensitive data.<\/p>\n

That\u2019s why monitoring such internal networks for suspicious activity is key for keeping a company safe.<\/p>\n

Doing that manually is hard because of the high number of people using these networks and because of their complexity. By contrast, an AI system can do this automatically 24 hours a day and report anything out of the ordinary.<\/p>\n

\u2018We need to ensure that a company reacts well when a threat appears,\u2019 said Lemesle.<\/p>\n

Online buying has boomed since the Covid-19 pandemic erupted in 2020.<\/p>\n

The turnover of\u00a0European e-commerce<\/a> increased by 6% to \u20ac899 billion in 2023 compared with the previous year. Growing numbers of SMEs are serving their customers through the internet, which makes them a bigger target for attacks.<\/p>\n

\u2018E-commerce is very closely linked to consumers,\u2019 said Lemesle. \u2018If something goes wrong there, it has a very big impact on society. Everyone is using e-commerce, which puts our personal data and security at risk.\u2019<\/p>\n

Easy-to-use kit<\/strong><\/p>\n

Inetum\u2019s Carrascal led a separate EU-funded research project to develop cybersecurity defences that are easier for smaller European businesses to use.<\/p>\n

Called\u00a0CyberKit4SME<\/a>, the project ended in November 2023 after three and a half years.<\/p>\n

Carrascal said the difficulty for smaller businesses isn\u2019t an insufficient number of software options to address cybersecurity but rather their complexity.<\/p>\n

\u2018There are already a lot of software tools on the market,\u2019 he said. \u2018The issue is that they\u2019re complicated to operate. That\u2019s a problem for SMEs, which don\u2019t have big IT teams.\u2019<\/p>\n

One of the software options from the project helps SMEs store and access their data more securely.<\/p>\n

A second looks at how people behave on the company\u2019s networks and where dangers may lie.<\/p>\n

The human dimension is the weakest link in a company\u2019s cybersecurity setup. People might, for example, click on an infected link, giving hackers access to the company\u2019s internal networks.<\/p>\n

Yet another piece of software from the project seeks to spot security vulnerabilities through the modelling of IT systems.<\/p>\n

\u2018It allows companies to create a virtual model of their information system, which helps them analyse possible threats,\u2019 said Carrascal.<\/p>\n

At present, this kind of software requires an information-technology expert to go through a company\u2019s software system and list all the places where it can be accessed from the public internet. This creates a list of possible hacking entry points that in turn need to be protected.<\/p>\n

By automating more of this process, CyberKit4SME has made it easier for smaller companies to improve the security of their computer systems.<\/p>\n

Market tests<\/strong><\/p>\n

Both CyberKit4SME and ENSURESEC are keen for their technologies to enter the marketplace.<\/p>\n

ENSURESEC has grounds for optimism.<\/p>\n

Some companies are already selling tools developed during the project, while other tools have been made open-source, according to Lemesle.<\/p>\n

\u2018There\u2019s real demand for our technology,\u2019 he said.<\/p>\n

Other technologies that emerged in ENSURESEC need further development, some of which is being done in new EU-funded research projects, according to Lemesle.<\/p>\n

CyberKit4SME too has been disseminating some its software for free.<\/p>\n

Of six technologies developed in the project, four have been made fully open-source and one partly, according to Carrascal.<\/p>\n

\u2018Anyone can use them,\u2019 he said.<\/p>\n

Furthermore, some project partners are considering creating a startup business to commercialise the whole toolkit, according to Carrascal.<\/p>\n

\u2018Attackers will keep exploiting less prepared organisations,\u2019 he said. \u2018That\u2019s why we need to invest in better protecting them.\u2019<\/p>\n

Research in this article was funded by the EU\u2019s Horizon Programme. The views of the interviewees don\u2019t necessarily reflect those of the European Commission. <\/em><\/p>\n

More info<\/p>\n