The second edition of the Security Barcamp organized by Trend Micro proves to be a very interesting meeting about IT related topics, both on a worldwide and on a more Italian-focused scale.

Rik Ferguson, Trend Micro Vice-President, was the special guest of the event and, in an extended speech, he spoke about the three main threats in the IT field of the moment and which will be in the future.
The most important threat is ransomware for sure. The phenomenon boomed in 2015 and experienced a 400% growth in terms of attack typologies and available families during the following year. The new trend is to refine and improve the attacking techniques with a particular focus on selected business targets (whose data have an important value and can justify the payment of the ransom) and social engineering, which is at the basis of these attacks.

The second macro-area is about data breaches of company email accounts (in particularly managers and C-level executives), whose aim is to take control of internal communications, learn about confidential mechanisms and so on, and use such information for attacks and financial frauds.

Lastly, the third area with a significant growth rate is about so-called Exploit Kits, which are software tools used to craft Web attacks of different typologies. Similarly to ransomware, a themed dark market exists and is composed by developers -who develop malware- and clients -who pay for ready-to-use malware. Furthermore, Gastone Nencini (Italy Country Manager) added that there are even ‘companies’ specialized in offering malware and ransomware in a SaaS (Software as a Service) format.

Rik Ferguson then gave us an interesting cue about the relation between IT security and the new VR and ER (Virtual Reality and Enhanced Reality) and machine learning related technologies: a potential attacker can place himself between the user and his vision of the world -both real and virtual- and even influence the learning modalities of machines, so that he can lead to the choice of controversial decision.

The speeches by Gastone Nencini and Paolo Lezzi (InTheCyber CEO) dealt with the Italian situation with a focus on threats and how companies in our country would react in such cases.
With the help of real examples, Paolo Lezzi stated once more how so often the IT security budget is seen as a simple operational cost and not as an investment, which is quite unfortunate. He then highlighted the importance of being aware of the use of company tools, where training, maintenance and simulation/analysis of IT-related risks (ie penetration testing) are an important part of the game.

Both Rik Ferguson (international context) and Gastone Nencini and Paolo Lezzi (Italian context) agree in identifying the weakest and critical point of a IT security chain in the human factor, for it is the object of social engineering. Despite IT tools being more efficient and improved, the user is the underlying element of systems vulnerability, which can only be stemmed by means of a proper culture in terms of digital security and (own) identity in a company, home and scholar environment. Similarly, the approach to IT security problems mustn’t be limited to the consequential management of an emergence: it must become a structured routine.