More than a third of global organisations store data in shared or public cloud environments. And around the same proportion store data in a private cloud. As organisations move to multi-cloud architectures, malicious actors are looking to capitalise on any new attack vectors that this opens up, such as data and application sprawl and possible misconfiguration of cloud infrastructure. A holistic cyber security strategy will help to mitigate the risks inherent in a multi-cloud environment, while enabling the organisation to reap the business and technology rewards associated with it, explains Rory Duncan of NTT UK. We are increasingly living in a multi-cloud world. According to the ‘2019 Risk:Value Report’, over a third of respondents in global organisations say their company currently stores its data in a shared or public cloud environment, such as Amazon Web Services (AWS), Microsoft Azure or Google. Around the same proportion stores data in a private cloud. These numbers are set to go up as more and more businesses transition their processes and applications to the cloud.

Linux is considered to be less prone to malware compared to other operating systems, and as a result Linux users rarely run anti-malware. However, many popular software applications released on other platforms cannot run natively on Linux. Wine is a popular compatibility layer for running Windows programs on Linux. The level of security risk that Wine poses to Linux users is largely undocumented. This project was conducted to assess the security implications of using Wine, and to determine if any specific types of malware or malware behavior have a significant effect on the malware being successful in Wine. Dynamic analysis (both automated and manual) was applied to 30 malware samples both in a Windows environment and Linux environment running Wine. Behavior analyzed included file system, registry, and network access, and the spawning of processes, and services. The behavior was compared to determine malware success in Wine. The study results provide evidence that Wine can pose serious security implications when used to run Windows software in a Linux environment. Five samples of Windows malware were run successfully through Wine on a Linux system. No significant relationships were discovered between the success of the malware and its high-level behavior or malware type. However, certain API calls could not be recreated in a Linux environment, and led to failure of malware to execute via Wine. This suggests that particular malware samples that utilize these API calls will never run completely successfully in a Linux environment. As a consequence, the success of some samples can be determined from observing the API calls when run within a Windows environment.

Security investments are finally starting to bear fruit. Research shows outsourced incident response engagements against financial institutions – the most targeted sector for cyber attacks in 2016 – have dropped off significantly. Companies are seemingly waking up to the realisation that their core business processes need serious bolstering to keep the bad guys out.

‘Secure by design’ is not a new concept. Much discussed as part of General Data Protection Regulation (GDPR) compliance, it has recently re-emerged as a discipline that's integral to strategic security planning. But what does secure by design really mean? A quick search will bring up plenty of options to choose from, covering everything from IoT security to software development. It's so much more than a tagline, however.