Marco Ramilli (Yoroy Security) illustrates the current needs and emergencies of the gaming world in terms of information security.
"Game manufacturers are increasingly using digital technologies to allow for faster, more controlled and pervasive gaming."
Marco Ramilli, founder and Ceo of Yoroy Security and cybersecurity expert, highlights it in illustrating the current needs and emergencies concerning gaming world, in terms of information security.
“Initially, it was possible to play only in special centers, while now thanks to technology you can do it from the comfort of your home or from your mobile device. These games often use digital communications (over the Internet), in order to be controlled or to favor simultaneous tournaments or, again, to enable communication between players. In this context, online games become complex systems that often require the introduction of personal data and/or payment methods such as (but not exclusively) credit cards or special coupons previously purchased. Like any digital system, these too need protection and appropriate defense, in order to avoid information theft and fraud. The presence of any vulnerabilities within such systems could allow an attacker to create difference between competitors or modify the results of victories.
It is important to ensure, for the digital security of players, that these systems are periodically (at each release) verified through specific penetration testing services and that they undergo regular audits in order to reduce the probability of an attack".
Has Covid-19 changed people's access to online, both for work and for pleasure, and has this also changed the activity of companies and consultants dealing with cybersecurity?
“Covid-19 has literally shifted work from offices to homes, thus defocusing defense systems. While working within the corporate digital perimeter meant taking advantage of all the investments and infrastructures adopted by your organization,
today many corporate systems operate in environments for which they were not conceived or designed: the home network. It rarely contains protection systems such as perimeter proxies, next generation firewalls, intrusion identification systems, sandboxes for automatic malware detonation, Dns defense and advanced Edr tools, but on the contrary there are home routers, probably not patched and applications that through a Vpn bypass the company perimeter systems, allowing on the one hand the worker to use internal systems of his own organization (Crm, Erp, Team Leading Platform, etc etc) without effort but on the other hand enabling new attack scenarios.
At the same time, the IT security consultants have seen a significant increase in double extortion attacks, and have experienced a much wider perimeter to defend than the previous one, having to operate in hybrid (domestic and corporate) and poorly structured environments".
What are the future challenges for cybersecurity?
“For the attacker it is much easier than for the defender. In fact, while those who defend the digital perimeters must limit, close, monitor every single flaw, for the attacker is enough to find one of them to penetrate inside the target system. For this reason, the challenges on digital defense are very complex, arise from new technologies and can reach the users education, a very broad spectrum involving the human psyche as well as the technology produced or used by individuals or large organizations. Personally, I believe that
the greatest challenge for the near future are the attacks on the supply chain (such as SolarWinds), or attacks on suppliers, typically medium and small organizations that, due to the history of investments, are less digitally protected, and then get through them (through their trust towards the real target) to the real goal".
What can and must be done, at a legislative and regulatory level, to ensure the security of online operations?
"At the legislative level, much has been done, making some certifications mandatory, launching recommendations on specific tests, applying security standards on digital payment systems (I am referring to Pci/Dss) and activating bodies to report and manage IT incidents (I am thinking of italian Csirt, to the Cert of the related ministry as first and simple examples). 100 percent security doesn't exist and therefore cannot be assured. However, game producers can be advised to equip themselves with teams of specialists outside their organization, by starting a proactive and continuous monitoring process in order to identify and manage attacks in the bud. In this way, the chance of such attacks impacting players and gaming software can be significantly reduced. In this phase we are experiencing, where digital has become our close life partner,
the best way to stay safe (excluding obvious severe and behavioral solutions) is to constantly monitor the digital perimeter and ask the right questions, in order to to identify digital anomalies. The experience of industry experts, together with continuous user training, will reduce the impact of upcoming attacks, by making digital a safer place than today!”.