More stories

  • in

    The best VPN for the UK 2021

    Why picking a good VPN can make your life better  Consumer Virtual Private Networks (VPN) have become increasingly important for people who want to stay safe online, whether it’s for work, entertainment, or when passing through airports and cafes with free wifi.  There has been a boom in VPN adoption in recent years. While employees have been using VPN to securely tunnel into a corporate network for decades, Edward Snowden’s 2013 NSA leaks made more people jittery about mass surveillance. Russia’s and China’s recent bans on VPNs show how contentious the technology has become for governments. A raft of national security laws, such as the UK’s 2016 Investigatory Powers Bill, also spurred interest in consumer VPNs.

    Anyone with the know-how can set up their own VPN with a remote virtual machine in the cloud for about $10 a month in one location, but many people want a VPN to access content in different regions, which makes price, speed, locations, and server capacity important. Mainstream consumer VPN services let average computer users create a secure point-to-point encrypted tunnel through which data can travel and can shield metadata, such as a home computer’s IP address.   If you’re paying a monthly fee for a VPN, it should work like any utility, humming in the background without noticeably disrupting downloads and uploads.   For me, as a tech news reporter based in Europe, I find a VPN useful when I need to check out Google’s US Chromebook and Pixel pricing to see products and prices that are not immediately available in the UK, Europe or Australia.  So a VPN has many diverse functions. A major drawcard for consumer VPNs is that many people just don’t like content being geo-blocked by Hulu, Amazon, Google, and Apple. You also might be a resident of the UK who travelled abroad and now can’t see premier league football matches, some BBC content or shows only available on Netflix’s UK service.  But picking a VPN provider is tricky because consumers need to trust the VPN provider is protecting data as claimed. 

    That’s where third-party audits come into play and may help identify lemons. Nearly all VPN providers claim not to log user data and suggest their location of operation will prevent law enforcement from Five Eyes nations acquiring data. Not all subject their products to a third-party audit.  All my VPN speed tests were carried out through Ookla’s SpeedTest.net from a home fibre broadband connection just outside of Stockholm. I generally experience non-VPN download speeds of 70 Mbps and slightly faster upload speeds around 80 Mbps. Latency is normally about 3-5ms without a VPN.     

    Reliable with a reputation for solid product

    Locations: 160Countries: 94Simultaneous connections: 5Kill switch: yesLogging: noPrice: £9.42/month (USD $12.95), or 12 months for £72.74 (USD$99.95)Trial: 30-day refund guaranteeSupported platforms: iOS, Android, MacOS, Windows, Linux, game consoles, smart TVs, routersExpressVPN was founded by Peter Burchhardt and Dan Pomerantz in 2009, making it one of the first mainstream consumer VPN services at a time when free public Wi-Fi was rare, the iPhone didn’t exist, and people weren’t as concerned about government snooping, computer security and online privacy. ExpressVPN operates from the British Virgin Islands, which has favorable laws for those who want to keep their data private. ExpressVPN has subjected its performance claims to an audit by PwC in 2018 and an audit of privacy and security claims by German security outfit Cure53. However, that only covered its Chrome extension.It is one of the more expensive consumer VPN providers but it also has a solid reputation for providing a reliable service with plenty of options to configure the service.     It is investing in its alternative to the widely-used OpenVPN VPN protocol called Lightway. It launched this month and promises much faster connection times, faster speeds and more reliable connections.       With the native ExpressVPN app, establishing a connection to a server anywhere takes at most a few seconds. Connections to the US provided reliably fast download/upload speeds but latency was larger due to distance. Many Brits temporarily reside in Australia and may have picked up a few TV shows that are only shown locally. Similarly, connecting to a server in Australia resulted in high latency (ping) with download/upload speeds ranging between 43/46 Mbps to 18/9 Mbps.     These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when connected to:Hong Kong (397, 44/1.61)Melbourne, Australia (508, 19/9)Frankfurt, Germany (64, 44/64)London, UK (60, 66/49)New York, USA (171, 55.7/54) Pros:   Fast connections, decent speeds to major content markets    Simple and non-intrusive user interface    Frequent audits and reports are published   Broad platform support  Cons:   It is relatively expensive    Browser extension only supports Chrome and Firefox

    One of the top consumer VPN providers

    Simultaneous Connections: 6Kill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Android TV, Chrome, Firefox, router, Fire TV/Kindle Fire, Xbox, PlayStation, MediaStreamer Logging: None, except billing dataCountries: 59Servers: 5517Trial/MBG: 30 dayNordVPN is generally considered a winner on speed and the number of servers it has across the globe. Not all VPN services have a monthly payment option even though prices are quoted on a monthly basis. NordVPN actually has a one month option, which costs £10.61, including VAT. NordVPN accepts payment via card schemes, pay platforms from Apple, Google and Amazon, Klarna, and cryptocurrencies. The one-year plan costs £52.39, including VAT, or £4.36/month. There’s also a 2-year plan that’s cheaper, costing £87.91 a year, including VAT, or £3.66/month.  NordVPN is operated by NordSec and its parent company, Tefincom & Co., S.A., is registered in Panama — a jurisdiction that technically doesn’t require it to store user logs and is outside of arrangements with Five Eyes alliance nations. It recently completed a security audit of its VPN apps with VerSprite, the cybersecurity company it’s partnering with for its bug bounty program, which it’s run since 2019, shortly after disclosing a breach at a data center it used in Sweden. NordVPN was co-founded by Lithuanian entrepreneur Tom Okman, who ZDNet covered in a recent in-depth profile.  Notably, NordVPN relies on WireGuard rather than OpenVPN. The former has a much smaller codebase, reducing the likelihood of security vulnerabilities lurking. It’s also developed NordLynx, NordSec’s WireGuard-based next-gen tunneling solution. NordSec tests indicated it would double the performance over OpenVPN and IKEv2 protocols. NordVPN always performs well in speed tests and has been at the forefront of the auditing trend for VPNs. In 2020, it re-engaged PricewaterhouseCoopers (PwC) Switzerland to probe its no-log policy claims for one week. It first engaged PwC in 2018 to assess its no-log policy. These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when connected to a server in:Sweden (15, 48/76)Australia (547, 56/6)Hong Kong (411, 36/9)New York (188, 42/67)Los Angeles (295, 61/12) London: (58, 45/60)Netherlands: (55, 71/75)Germany: (54, 62/79)

    A Swiss-based VPN that tried to make encrypted email simple

    Simultaneous Connections: Up to 10Kill Switch: YesPlatforms: Windows, macOS, iOS, Android, Linux, Android TV, ChromebookLogging: Strict no log policy, except billing data Countries: 55Servers: 1,287Trial/MBG: 30 dayProtonVPN is another service worth considering for privacy-conscious Brits. It’s a Swiss-based VPN that was started by former MIT and CERN scientists who first launched the encrypted email service ProtonMail in 2014 and started ProtonVPN in 2017. It doesn’t appear in most top US-focussed consumer VPN lists, but is worthy of consideration in the UK because of its location and record on privacy. It uses known VPN protocols such as IKEv2/IPSec and OpenVPN. Network traffic is encrypted with AES-256, while key exchange is done with 4096-bit RSA.ProtonVPN has commissioned audits for all its full-release software from SEC Consult, a reputable Austrian security consultancy.Being Swiss-based, Proton claims it can’t be coerced by Five Eye alliance nations to hand over user logs. ProtonVPN applications offer a built-in Kill Switch feature or the Always-on VPN feature.There’s a decent free version with three locations and “medium” speeds, while the “Basic” costs €4 (£3.41) a month charged at €48 per year (£40.93). It includes 350 servers in 49 countries and allows for two VPN connections on a “high speed” connection. There is also support for blocked content, P2P/BitTorrent support, and NetShield-based adblockers. The €8 (£6.82) a month VPN package is likely to be the best option for people willing to spend on a decent VPN. It includes 1,200 servers in 55 countries and offers up to 10 VPN connections with speeds up to 10 Gbps. ProtonVPN delivered respectable performance when connected to a server in New York (92 ms latency, 37/59 Mbps download/upload speeds). On an un-congested LA-based connection, it had a latency of 166 ms, and download/upload speeds of 64/73 Mbps. ProtonVPN is a solid VPN and it just announced a major speed boost with its “VPN Accelerator” technology for paid accounts with the ProtonVPN app. The VPN Accelerator speed boost works with multiple VPN protocols, including OpenVPN TCP, OpenVPN UDP, Wireguard, or IKEv2 VPN protocols. It could be a game-changer for high latency servers.There’s a handy “quick connect” option and connecting to ProtonVPN takes just a few seconds. The UI is helpful too, putting the Kill Switch — if you want to block the internet if your VPN connection drops out — up front, along with the adblocker controls, and its Secure Core option to route data through the privacy-friendly countries. These features are for the paid subscriptions.  The version offers three locations. The instance I tested included servers in Japan, Netherlands and the US. In my SpeedTest broadband tests of ProtonVPN’s free service, download and upload speeds were about 10 Mbps slower when connected to a server in the Netherlands, which is plenty for streaming HD video. Connecting via Proton’s US servers was a much slower experience on the free option, with download/upload speeds of 10/23 Mbps, and latency of 252ms.These were the SpeedTest results (ping in ms, download/upload speeds in Mbps) when using Proton’s €8 (£6.82) a month VPN connected to:Hong Kong (30, 48/51)Australia (30, 35/25)Germany (30, 50/13)London, UK (29, 40/28 Mbps)USA (29, 40/28 Mbps) Note: Proton’s maps indicated that all connections outside of Europe, by default, went through a server in Iceland as a first hop, which is likely why its latency appears lower than other VPNs. Pros:It supports a decent free tier VPN serviceSupports more devices than most on a single subscriptionHas undergone publicly available audits and values transparency Interface offers shortcuts to key security and privacy configurationsCons: It is more expensive It’s a young VPN service It’s server infrastructure is smaller than the well-established brands

    A VPN that values transparency

    Simultaneous Connections: Up to 5Kill Switch: YesPlatforms: Windows, macOS, iOS, Android, Linux, Android TV, Chrome, Firefox, games consolesLogging: Countries: 37Servers: 780Trial/MBG: 45 dayAptly-named Swedish VPN provider Mullvard (‘mole’ in English) is an interesting choice for consumers and offers a single price of €5 (£4.27) a month, making slightly more expensive than larger rivals. However, its simple, flat pricing isn’t designed to encourage annual or three-year subscriptions. It has fairly broad country coverage and is upfront about which VPN servers it rents and owns. Its ‘owned’ servers are located solely in Europe and the UK and support speeds up to 10 Gbps. Generally Mullvard uses 31173 Services AB to host its owned servers. These are faster; however its rented servers are all dedicated. The service supports OpenVPN and Wireguard tunneling protocols. Users can configure it to work either exclusively on one protocol or have the Mullvard app select the protocol automatically.     Mullvard stands out for its transparency about its server infrastructure and any server issues it’s facing. It also has a clearly and thoroughly explained document outlining its no-logging policy and what payment information it collects — basically nothing that could identify the user. It doesn’t require a username, password or email address to establish an account and instead generates a random account number for each new account. The only details for each account it stores are the account number and the time remaining on that account. Mullvad accepts cash, Bitcoin, Bitcoin Cash, bank wire, credit card, PayPal, and Swish (the Swedish peer to peer payment system co-funded by major banks).Mullvad has undergone three major security audits, making it a leader in VPN transparency. In 2018, Mullvad contracted German consultancy Cure53 and Assured to vet it for security vulnerabilities in its app. In mid-2020 Cure53 audited its apps for Windows, Linux and macOS as well as iOS and Android and disclosed all bugs found. In December 2020, Cure53 audited Mullvad’s infrastructure to look for security issues and privacy leaks. Once again, Mullvad disclosed all issues found.   Mullvad VPN AB is owned by Swedish parent company, Amagicom AB. Mullvad VPN AB Amagicom AB are 100% owned by founders Fredrik Strömberg and Daniel Berntsson who are actively involved in the company and are keen on researching cybersecurity issues.Additionally, Mozilla selected Mullvad’s VPN infrastructure to run its own Mozilla-branded VPN. Though Mozilla doesn’t state it uses Mullvad on its website, the link to its “full list of servers” redirects to Mullvad’s. Hopping between countries was simple. The app chooses the optimal location within each country. I experienced no dropouts when switching countries. Speeds were fastest within Europe, but slow on the US west coast and Australia. The desktop app is lightweight and has a simple interface that doesn’t take up too much screen space.Latency and speeds connected to Mullvard servers in different locations (ping in ms, download/upload in Mbps):   London (45, 51.18/60.3)San Jose, USA (324, 25.99/49.49)Switzerland (77, 61.31/61.22) Sydney, Australia (603, 6.06/60)Brazil (458, 18/52) Frankfurt, Germany (52, 50/65) Paris, France (63, 53/72) Hong Kong (412, 11/1.24) Pros:Easy pricing that doesn’t encourage multi-year subscriptionsDecent speeds and great infrastructure across EuropeA focus on privacy and security with investments to prove itProvides extremely clear information about user information it collects Cons:Compared to multi-year subscriptions, it is more expensiveIt is a smaller VPN than it’s larger rivals with fewer serversFocussed more on VPN services across Europe

     Simultaneous Connections: Up to 7Kill Switch: YesPlatforms: Windows, macOS, iOS, Android, Linux, Android TV, Chrome, Firefox, games consolesLogging: Has a no log policy Countries: 90Servers: 6,900Trial/MBG: 45 dayCyberGhost has a few friendly features and offers that make it appealing to general users. The company offers a free one day trial of its VPN service and a longer than usual 45-day money back guarantee, plus it’s relatively cheap. It claims to have 38 million users and says it does not collect or store user IP addresses, DNS queries or browsing history. Its headquarters are in Bucharest, Romania. A few years ago, it didn’t offer a connection to servers in Russia but now it has one in Moscow. The company does produce a transparency report but it hasn’t been audited by a third-party for several years. Compared to rival VPN services, CyberGhost is cheap. Its three year plan costs just £1.99 a month billed £77.61 a year. The two year plan costs £ 2.89 a month and is billed at £69.36 a year, while the one year plan costs £3.45 a month and is billed at £41.40 a year. During tests, the VPN offered decent speeds and fast connection times. ProsAbundance of servers Cheaper than most VPN providersConsNo recent audits 

    How did we determine the best VPNs?

    This roundup of the best VPN providers considers a variety of reasons that UK residents would want to use a VPN and which providers could be the best for them, factoring in price, trustworthiness, security claims, and connection speeds. I tested each VPN’s connection performance in multiple locations over a week during work hours. All of them offered similar speeds and, naturally, these were all slower than without a VPN enabled. As expected, more distant locations resulted in higher latency but some VPN services offered slightly better speeds. I also checked whether the provider had undergone a recent audit as this is an important signal of transparency.  

    How do you choose the right VPN?

    Picking the right VPN depends on multiple factors, from home router and network equipment to the ISP and their interconnections. That means choosing the optimal VPN provider in terms of speed and performance will depend on specifics that are unique to each user. Whether one VPN is better than another also depends on why you want to use a VPN in the first instance. 

    Do I need a VPN when I travel?

    The one case where everyone could benefit from a VPN that supports multiple devices is travel. Right now, travel is less likely due to the pandemic but once it becomes a more realistic possibility, a VPN can provide protection at the airport, hotels, shopping malls, and other places where using a public Wi-Fi connection is convenient but risky. Alternatively, when you’re abroad and need to access content that’s only available to IP addresses in your home country, a VPN can be useful. Other situations include when visiting a doctor’s office and you don’t want to be associated with the location you’re accessing the internet from for obvious privacy reasons. In this respect, it’s worth considering both the price and the terms of the contract. It might, for example, be worth paying a little bit more for a VPN that offers the service on a month-by-month basis rather than comparing the monthly cost that must be paid on an annual basis. That is, you might only need it for a few days or a few times a year.  

    Does everyone need a VPN?

    Many people won’t need a VPN on a daily basis when connecting from a home network, but it can be a handy tool to have on the ready when the occasion arises. In that sense, it can be helpful to have as a utility that can be used from a laptop or a mobile device. 

    ZDNet Recommends More

  • in

    Dallas school district admits SSNs and more of all employees and students since 2010 accessed during security incident

    The Dallas Independent School District — one of the biggest school districts in the United States — has released an advisory saying the personal data of students and employees was accessed and downloaded during a “data security incident.”The school district serves more than 150,000 students and said in a notice that any student, employee, parent or contractor with the school district since 2010 is affected by the incident. When asked by ZDNet whether this was a cyberattack, the school district would not say. The district received notice of the data security incident on August 8 and said federal law enforcement agencies are now involved in the effort to address what happened. Although the investigation is still ongoing, they believe someone accessed the school district’s network, downloaded data and temporarily stored it on an encrypted cloud storage site. The notice claims the data has been “removed from the site” but does not explain how this was done, whether the data was put somewhere else or sent to someone else. Data that the school district is allegedly “required by law to maintain” was exposed during the attack, including the first and last names, addresses, phone numbers, social security numbers and dates of birth for current and former students, employees and parents. Some students even had information about their custody status and/or medical condition exposed during the attack. 

    For employees and contractors, the hackers also gained access to their dates of employment, salary information and reason for ending employment.”Despite our efforts, the district is now one of a growing number of public and private organizations experiencing cyberattacks,” the school district said.”The district’s IT team, assisted by forensic consultants, has addressed specific vulnerabilities that were exploited during this event and will continue efforts to augment security going forward. We regret any inconvenience this incident may have caused and believe it is our responsibility to inform the public that we are taking steps to notify individuals whose records have been impacted.” The district will be updating a website with information about the attack and said anyone who would like to sign up for free credit monitoring should call (855) 651-2605. The hotline is being run by identity protection technology company Kroll, which the Dallas Independent School District hired to manage the aftermath of the attack. The school district said it would be providing more specific information about what data from each person was accessed and would be sending it to Kroll, which could then let people know if they call the hotline. Kroll is offering victims just 12 months of credit monitoring and ID theft recovery services. The school district is creating a website that allows victims to enter their information to access credit monitoring. Victims can also call to activate the monitoring. The credit monitoring website will be available to victims on September 10. “We continue to investigate and remediate this incident. The district is conducting a comprehensive review of its systems and implementing additional security measures. We are confident these changes will decrease the possibility of a future incident,” the district statement explained.  More

  • in

    CISA urges IT teams to address critical vulnerability affecting Cisco Enterprise Network Function Virtualization Infrastructure Software

    CISA released a note this week urging IT teams to update a Cisco system that has a critical vulnerability. The vulnerability affects Cisco Enterprise Network Function Virtualization Infrastructure Software Release (NFVIS) 4.5.1 and Cisco released software updates that address the vulnerability on Wednesday.The vulnerability “could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device as an administrator,” according to Cisco. The vulnerability is in the TACACS+ authentication, authorization and accounting (AAA) feature of NFVIS. “This vulnerability is due to incomplete validation of user-supplied input that is passed to an authentication script. An attacker could exploit this vulnerability by injecting parameters into an authentication request. A successful exploit could allow the attacker to bypass authentication and log in as an administrator to the affected device,” Cisco said.”There are no workarounds that address this vulnerability. To determine if a TACACS external authentication feature is enabled on a device, use the show running-config tacacs-server command.” Cisco urged IT teams to contact the Cisco Technical Assistance Center or their contracted maintenance providers if they face any problems. 

    “The Cisco Product Security Incident Response Team (PSIRT) is aware that proof-of-concept exploit code is available for the vulnerability described in this advisory. The Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory,” Cisco added, thanking Cyrille Chatras of Orange Group for reporting the vulnerability.John Bambenek, threat intelligence advisor at Netenrich, said it is a “pretty major problem for Cisco NFV devices that highlights software engineers still struggle with input validation vulnerabilities that have plagued us for almost three decades.” “Easy acquisition of administrative rights on any device should be concerning and organizations should take immediate steps to patch their devices,” Bambenek added. More

  • in

    US Cybercom says mass exploitation of Atlassian Confluence vulnerability 'ongoing and expected to accelerate'

    US Cybercom has sent out a public notice warning IT teams that CVE-2021-26084 — related to Atlassian Confluence — is actively being exploited.”Mass exploitation of Atlassian Confluence CVE-2021-26084 is ongoing and expected to accelerate. Please patch immediately if you haven’t already— this cannot wait until after the weekend,” US Cybercom sent out in a tweet on Friday ahead of the Labor Day weekend holiday. A number of IT leaders took to social media to confirm that it was indeed being exploited.Atlassian released an advisory about the vulnerability on August 25, explaining that the “critical severity security vulnerability” was found in Confluence Server and Data Center versions before version 6.13.23, from version 6.14.0 before 7.4.11, from version 7.5.0 before 7.11.6, and from version 7.12.0 before 7.12.5.”An OGNL injection vulnerability exists that would allow an authenticated user, and in some instances unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance. All versions of Confluence Server and Data Center prior to the fixed versions listed above are affected by this vulnerability,” the company said in its advisory. They urged IT teams to upgrade to the latest Long Term Support release and said if that is not possible, there is a temporary workaround. “You can mitigate the issue by running the script below for the Operating System that Confluence is hosted on,” the notice said. 

    The vulnerability only affects on-premise servers, not those hosted in the cloud.Multiple researchers have illustrated how the vulnerability can be exploited and released proof-of-concepts showing how it works. Bad Packets said they “detected mass scanning and exploit activity from hosts in Brazil, China, Hong Kong, Nepal, Romania, Russia and the US targeting Atlassian Confluence servers vulnerable to remote code execution.”Censys explained in a blog post that over the last few days, their team has “seen a small shift in the number of vulnerable servers still running on the public internet.” “On August 31st, Censys identified 13,596 vulnerable Confluence instances, while on September 02, that number has decreased to 11,689 vulnerable instances,” Censys said. The company explained that Confluence is a “widely deployed Wiki service used primarily in collaborative corporate environments” and that in recent years it “has become the defacto standard for enterprise documentation over the last decade.” “While the majority of users run the managed service, many companies opt to deploy the software on-prem. On August 25th, a vulnerability in Atlassian’s Confluence software was made public. A security researcher named SnowyOwl (Benny Jacob) found that an unauthenticated user could run arbitrary code by targeting HTML fields interpreted and rendered by the Object-Graph Navigation Language (OGNL),” the blog said. “Yes, that is the same class of vulnerability used in the Equifax breach back in 2017. Just days before this vulnerability was made public, our historical data showed that the internet had over 14,637 exposed and vulnerable Confluence servers. Compare that to the current day, September 1st, where Censys identified 14,701 services that self-identified as a Confluence server, and of those, 13,596 ports and 12,876 individual IPv4 hosts are running an exploitable version of the software.”A Censys chart showing how many servers are still vulnerable. 
    Censys
    “There is no way to put this lightly: this is bad. Initially, Atlassian stated this was only exploitable if a user had a valid account on the system; this was found to be incorrect and the advisory was updated today to reflect the new information. It’s only a matter of time before we start seeing active exploitation in the wild as there have already been working exploits found scattered about,” Censys added. Yaniv Bar-Dayan, CEO of Vulcan Cyber, told ZDNet that security teams need to fight fire with fire as they work to prioritize and remediate this Confluence flaw. Attackers shouldn’t be the first to automate scans for this exploit and hopefully IT security teams are ahead of their adversaries in proactively identifying the presence of this vulnerability and are taking steps to mitigate, Bar-Dayan said. “Given the nature of Atlassian Confluence, there is a very real chance components of the platform are Internet exposed,” Bar-Dayan added. “This means that attackers won’t need internal network access to exploit the RCE vulnerability. A patch is available and administrators should deploy it with extra haste while also considering other mitigating actions such as ensuring no public access is available to the Confluence Server and services.”BleepingComputer confirmed on Thursday that some threat actors are installing cryptominers on both Windows and Linux Confluence servers using the vulnerability.   More

  • in

    Agora touts healthcare, education, workplace and metaverse applications of real time engagement tech

    Agora announced this week that it would be investing $100 million into real time engagement applications and tools, touting the technology as an important step forward in a more digitally connected world.Executives from Agora and dozens of others spoke at the company’s RTE2021 conference this week, touting the ways real time engagement technology has gained prominence, particularly during the COVID-19 pandemic.With millions stuck working and learning from home, Agora said there has been an explosion of interest in using real time engagement for everything from healthcare services to gaming, educating and even working. The technology’s growth in usage has coincided with the emergence of metaverse tools that seek to create digital worlds where people anywhere can congregate, share and collaborate online.Agora CEO Tony Zhao said the disruption of the pandemic prompted people to seek out more natural interactions with one another, and he noted that many people are now tired of simple video connections. With real time engagement, people have been able to create a slate of new tools, applications and solutions. Zhao said internal Agora data has shown that there is an explosion in demand for mental health services as well as more social entertainment, gaming services and even fitness applications that can be accessed any time, anywhere. He noted that demand for telemedicine services grew by more than 4,000% last year and real time engagement helped healthcare officials simulate physical visits to doctors’ offices. New metaverses also allowed people to work and learn together from across the globe. 

    Zhao cited the success of Tribe XR as an example of the value real time engagement can provide. Tribe XR CEO Tom Impallomeni explained that the technology has allowed them to create a virtual world where DJs and music producers can practice, play and perform for digital audiences. They use virtual reality systems to simulate DJ equipment and help people learn how to DJ through VR headsets.In partnership with Agora, the company now offers a way for users to upload music and perform on Twitch, Youtube and through integration with other metaverses.Agora’s real time engagement platform has helped Tribe XR create a video calling system where teachers and performers can connect with audiences from any device without using VR. “Real time engagement technologies take people off their isolated islands and out of their silos, connecting them together in a more natural and meaningful way. From New York to San Francisco, to Bangalore to Dubai, physical distance is no longer an obstacle,” said Reggie Yativ COO of Agora. Through the Agora platform, teachers have created applications that allowed them to reach thousands of students in real time while entrepreneurs and activists have been able to use interactive audio streaming and livecasting to create chatrooms, hold live panel discussions and participate in events. Everything from sing-a-longs to dates, cooking and shopping can be done using the real time engagement platforms. One of the biggest areas real time engagement is seeing interest is in gaming. Barbara Pickering, head of innovation and technology at HP, spoke at length about the HP Omen gaming division which has been hard at work on Omen Oasis, part of Omen’s gaming hub software. Pickering said HP is working with Agora to combine gaming experiences with video streaming. Although platforms like Twitch and others have become popular, many gamers only want to share video streams with a small group of friends as opposed to a wider, one-way audience. With Omen, gamers can communicate through video, watch each other play through games and hang out together. Pickering said it has been difficult to facilitate because streaming and video sharing during games is demanding, requiring high quality rendering and fluid motion. “Our challenge is to bring gaming to a communal space akin to watching someone play an arcade game over their shoulder,” Pickering said, adding that real time shared and interactive experiences have become a huge business. More than 60% of gamers want to share their gameplay with other gamers but most only want to share it with a group of 20 people or less. “Gamers often want to share with their friends and for the experience to be interactive. For that you need a real time solution. Agora wants to make streaming real time, with latency in the milliseconds, and the investments they’ve made in backend infrastructure and proprietary algorithms to optimize network traffic and video streams have helped as Omen Oasis seeks to expand the gaming experience to be even more socially engaging beyond the typical multiplayer dynamics,” Pickering noted.  “With Oasis we’re providing a really simple interface for people to jump into social game sharing with a focus on audio and video sharing.”Agora said real time engagement is also being used by mental health platforms like Talkspace as well as workout platforms. Edward Krakus, senior vice president of product at Agora, touted their software defined real time networking — called SD-RTN — that enables developers to scale quickly and deliver fluid real time media delivery. “The network adaptive streaming architecture combines variable-bitrate streaming technology with proprietary logic that provides the best media experience for every user,” Krakus explained, noting that the tool is designed to build experiences for a wide variety of devices, video processing speeds and WiFi connections. Krakus said Agora wants to make it easier for developers to use the company’s API for an expanded set of use cases. With the API and SD-RTN, developers will have the ability to publish multiple streams from any device, control streams of subscriptions, expand their channel management capabilities and have access to advanced layout controls that support sophisticated video display management as needed for virtual events and education use cases, Krakus said. “The ability to democratize access to RTE technology and to accelerate time to market for developers is another area where Agora continues to invest,” Krakus added, noting that the Agora App Builder has seen a massive amount of interest. People have built video experience platforms and even flexible classroom tools to facilitate online learning applications. Agora’s extension marketplace also features dozens of fun tools that can be added to apps like face filters, voice filters and content moderation tools. Virginia Liu, senior vice president of ecosystems at Agora, said the company plans to invest $100 million dollars in the RTE ecosystem, hoping it will continue to “change how we work, live and play in the future.” More

  • in

    How to stream NFL football in 2021

    Looking ahead to the NFL 2021 season, I fear my Pittsburgh Steelers have a long, hard row to hoe. But, at least, with a lot of luck, we’ll have a full season with minimal Covid-19 interruptions. Still, you’d be wise to stay home and watch your games by streaming them.  We’ll have more regular-season games than ever since the NFL is going to a 17-game season. In total, we’ll have an 18-week, 272-game regular season. It kicks off on Thursday night, September 9, in Tampa Bay and concludes with 16 division games in Week 18 – two games on Saturday, January 8, and 14 games on Sunday, January 9, 2022. It used to be a real pain to stream NFL football games. Now, it’s easier than ever, but there are still some problems to avoid to make sure you’ll get to enjoy your game instead of wanting to throw your TV on the street. These days most of the services will work with any streaming device. That said, before putting your money down for any streaming service, make sure it will work with your device of choice. The prices of streaming services vary wildly depending on how you subscribe to them. Be sure to shop around. If you don’t, you can waste a lot of money. But, if you do, you can find some real deals. First, the easiest way to get most games is by subscribing to a live TV streaming service. Of these, you want services that carry local CBS, NBC, and Fox channels. Not all of them do. For example, Philo doesn’t have any local stations. Others only have local stations for some areas. Before subscribing to any service, check the fine print and make sure you get your local stations.  You’ll also want the NFL Network and ESPN’s national feeds. Again, not all packages include these by default. Make sure the one you buy includes these networks.

    By and large, Sunday NFC games are on Fox, AFC games are on CBS, and Sunday night football is on NBC. Monday night football is only on ESPN. Fox has the most Thursday night games, with some streamed on Amazon Prime Video, but a few games are only available on the NFL Network.  Live TV Streaming Services For your best live streaming services, which include NFL games, check out:

    Four tiers, multiple streams

    By monticello shutterstock

    (Formerly AT&T TV, AT&T TV Now, and DirecTV Now) Despite the confusing name changes, the service and offerings remain largely the same. That means, unfortunately, it tends to be expensive. DIRECTV Stream has four tiers:  Entertainment comes with 65+ channels and 40,000 Video on Demand (VoD) titles for $70 Choice with 90+ channels and 45,000 VoD selections for $85 Ultimate with 130+ channels and 55,000 VoD selections for $95Premier with 140+ channels and 65,000 VoD shows for $140. All offer your local ABC, CBS, Fox, and NBC channels in most, but not all, areas. Except for the bottom-tier Entertainment offering, all packages come with the NFL Network, regional sports networks, and HBO Max.  DIRECTV Stream used to offer a generous 500 hours of cloud DVR storage. Now, it offers a mere 20 hours of video storage. You can get unlimited DVR storage for an additional $10 a month. You can also get limitless storage if you elect to get the Premier package. In either case, if you want to skip or fast-forward through commercials on recorded shows, that will cost you another $15  a month.   On the other hand, you can stream up to 20 — yes 20 — devices simultaneously on your home network. There is one quirk for pro football watchers, you can only stream local Fox NFL games to three devices.  The NFL RedZone Channel, which shows you every touchdown from every game, every Sunday afternoon, is available in the Sports Plus add-on package for $11/month. You cannot, I’m sorry to say, get NFL Sunday Ticket, which shows all live out-of-market Sunday games, but is not available on DIRECTV Stream. To watch those games, you still need a DirecTV satellite TV account, to be able to show you can’t get DirecTV satellite TV, or be a student at an approved college or university.  The two-year contract offers the same services for $10 less a month per package. It’s not a great deal. It also, shades of old-style cable companies, comes with a penalty charge if you decide DirecTV isn’t for you

    For serious sports fans

    By Tada Images shutterstock

    Are you a serious sports fan? And when I say “serious,” I mean besides watching the US holy trilogy of football, basketball, and baseball. Do you want to watch the English Premier League, F1 Racing, and cricket? Yes? Then, you should check out FuboTV. That said, FuboTV does cover, in many areas, CBS, Fox, and NBC. Besides sports, FuboTV is a full-fledged streaming service with all the usual stations. It comes with three English-language plans. The first, Starter, has 108 channels and 250 hours of video DVR storage, and you can stream to up to three screens at once for $65 a month. This comes with a free trial. Pro currently offers 108 channels, 1,000 hours of cloud DVR storage, and up to 10 screens for $80 a month. The top tier, Elite, offers over 170 channels, 1,000 hours of cloud DVR storage, and up to 10 simultaneous screens, for $80 a month. All tiers include ESPN and The NFL Network.  Another nice feature is you can fast-forward or skip commercials on your recorded shows.  If you want NFL Redzone, however, that will cost you $11 for the Sports Plus package. 

    Easy to use

    By AFM Visuals shutterstock

    Hulu with Live TV’s big selling point is it’s the one service, which combines both live TV and a video-on-demand (VoD). It’s a powerful package. Besides great original content, like exclusive titles such as Only Murders in the Building, it also has a large catalog of other on-demand shows and movies. On top of that, you get over 75+ live and on-demand channels. Basic sports are well covered with the ESPN and Fox sports networks. Like most of the other services, it gives you access to local CBS, Fox, and NBC channels in most areas. If you want NFL RedZone, it’s available now with its new Sports Add-on.Hulu with Live TV’s interface and performance has been consistently improving over time. I find it the easiest live TV service to use. Hulu with Live TV’s combination of on-demand video and live TV is nice, but it now costs $65 a month. For that, you can also stream two sessions at once and get 50 hours of cloud DVR storage. If you want more, for $10 a month you get 200 hours of cloud storage. With this Enhanced Cloud DVR, you can also record multiple shows at the same time, and fast-forward through any content in your DVR. For another $10 a month, you can play as many streams at once. But, unlike the other services, you can’t easily stream outside your home. As Hulu puts it, “Our Live TV plans are intended for single-home use.” Now, you can stream away from home on your smartphone, but if you try to stream on say your dad’s Roku, it won’t work. 

    Channels ala carte

    By Ralf Liebhold shutterstock

    Sling TV’s ala carte approach to channels separates it from its competitors. While the others tend to offer only one or two packages, Sling TV offers two basic packages — Blue, with 43-channels, and Orange, with 32-channels. For other channels, you subscribe to a package, which bundles up to a dozen related channels.  This is a mixed blessing. I like it because it lets me get only the channels I want while it’s also a tad confusing. It starts with two $35-per-month channel packages. Some channels are available on both Sling Orange, over 30 channels, and Sling Blue, over 45 channels. Orange is basically an ESPN/Disney package, while Blue offers a Fox/NBC package. Blue also includes The NFL Network. Your best deal, if you want a broad selection of channels, is to combine them for $50.What you won’t get though is your local CBS affiliate. For that, Sling TV urges you to use an over-the-air (OTA) antenna. Sling TV offers its own streaming device, AirTV 2. This lets you watch both Sling TV and your local channels. I’ve used and liked them both. If you need an antenna, Sling TV offers the AIRTV2 as a bundle with an indoor HD antenna. This currently costs $49. Sling TV’s packages, besides such common offerings as Showtime channels, cost from $6 or $10 monthly. For pro ball fans, the $11 Sports Extra comes with 15 channels including Redzone. Sling TV’s recently upgraded its cloud DVR from a very limited 10 hours of recording time to a much more reasonable 50 hours. If you want more, you can up to 200 hours of storage for an additional $5 a month. You can fast-forward through commercials with this service.Your streaming options are… interesting. Sling Orange only lets you stream one channel at a time, while Sling Blue allows for three. If you combine them, you can stream four shows at once. Personally, I’ve liked Sling TV since it pioneered live TV streaming back in 2016. I like the interface, I like its speed, and I like that I can pick and choose my channels so I get just what I want. Its combined Blue and Orange price is still below that of its main competitors. But, without CBS, you won’t be able to stream AFC games. For NFL streamers, Sling TV is a second-choice service.On the other hand, Sling TV also gives you the cheapest way to watch RedZone. You do this by subscribing to Sling TV Blue for $35 per month and adding the $11 per month Sports Extra add-on. For now, Sling is also currently offering a $25 discount on the first month of Sling Blue. That drops the combined price to $36 for the first month of football. 

    Excellent but expensive

    By Funstock shutterstock

    At $65 a month, YouTube TV is starting to close in on cable prices.That said, there’s a lot to love here. With over 85 channels, it offers more of the most popular channels than its competitors. It also enables you to watch not only your local ABC, CBS, Fox, and NBC channels in most areas, but your local PBS stations as well. By CNET’s count, out of the top 100 networks, YouTube TV offers the most of them, 78, of any streaming service. Even so, pro football fans will also need the $11 a month Sports Plus package. This includes NFL RedZone, Fox College Sports, GolTV, and Fox Soccer Plus.YouTube TV unquestionably has the best cloud DVR. It comes with unlimited storage and a generous nine months to watch recordings. You can stream up to three simultaneous shows at once. And, yes, you can zoom by commercials on your recorded shows as well. If it wasn’t for the price, I could easily recommend YouTubeTV for everyone. As it is, if you’re not hurting for money, it’s still an excellent choice.

    Streaming services with limited live NFL action

    All devices and PCs

    sjvn

    This year you can watch 11 Thursday night NFL games on Amazon Prime beginning on October 7. You will not be able to watch the earlier games. Amazon Prime Video is available on essentially all streaming devices and PCs. Its membership will cost $119 per year.

    Formerly CBS All Access

    By viewimage shutterstock

    CBS was the first of the big broadcast networks to decide to go into streaming in a big way with CBS All Access. Its biggest selling point is the insanely large CBS catalog of past and new shows as well as live CBS news and sports content. That hasn’t changed since the service has been rebranded Paramount Plus.For football fans what this means is that it includes CBS’ Sunday AFC games on Paramount Plus’ Premium tier for $10 per month. But, and this is a big but, if Paramount Plus doesn’t offer your local CBS station, you won’t be able to watch those games. 

    Sunday Night Football

    By monticello shutterstock

    Peacock will show all of NBC’s Sunday Night Football games, and the first Thursday night game to kick off the season. But, while you can watch highlights with the free version of the service, you’ll need either the limited ad-supported Premium plan for $5 a month or the ad-free Premium Plus plan at $10 a month to watch the full games or reruns. 

    Thursday Night Football confusion Thursday Night Football is messy. Most games will be available on the NFL Network, Fox, Amazon Prime Video, and Twitch, the popular TV gaming streaming service. But, at least two games, the Week 5 London game between the Jets and Falcons, and the Week 15 Saturday doubleheader will only be shown on The NFL Network. Yes, I know Thursday night football on Saturday. I didn’t make this schedule.  So are you ready for some football? I know I am, although, depending on how my Steelers do, I may be regretting that in a few weeks. But, that’s life as a fan isn’t it?

    How much internet speed do you need for streaming?

    To make use of any of these services, you’ll need broadband internet. If you’re living on your own, you may be able to get by with as little as 10Mbp. However, if you’re sharing your home with others and/or you want to watch 4K videos, I recommend you get at least a 25Mbps internet connection. Not sure how fast your connection is? Try one of these Internet speed tests.

    Will cutting the cable cord save you money?

    Back in 2009, when I first cut the cable cord, I saved over $100 a month and still got to watch all my shows. Now, 12 years later, my internet video streaming bills are closing in on cable TV-level bills. Why? Internet streaming is copying the tired, old cable business models. As a result, almost all the live TV services saw price increases in 2020, and they’ll only go up higher in 2021.So, be picky about what services you get. I subscribe to pretty much all of them, but then I get paid to keep an eye on them. Chances are, you’re not so lucky. You should also check to see if your video needs can be met by one or more of the excellent free video-streaming services. In addition, some services, such as Peacock, offer a free tier with advertising. 

    What gear do you need for streaming?

    You might think, “What do I need a streaming device for? Can’t I get all the streaming services I want from my smart TV? But, actually, no, no, you can’t.I wish you could, but today smart TVs are still a poor choice. That’s because, generally speaking, TV manufacturers do a lousy job of supporting streaming services. For example, in 2019, older smart TVs from Samsung and Vizio stopped supporting Netflix. If they can do that to Netflix, the most popular of all subscription-based video streaming services, you know they’ll neglect other services as well.  Besides, some smart TVs also don’t support newer channels. So, for example, if your kids are demanding Frozen 2 on Disney Plus and you have a non-supported Vizio Smartcast TV, you’ll have to explain to your five-year-old that they can’t watch Anna, Else, and Olaf after all. Good luck with that.There are a lot of streaming devices out there. Personally, I recommend any of the Roku devices. They don’t cost much, they support pretty much all services, and they’re easy to use. If you’re looking for the best possible one, I recommend the Roku Ultra for $69. If you want to save your pennies, get a Roku Express 4K Plus for $30,Finally, to make the most of these services, you need a television that’s up to managing 4K and high dynamic range (HDR) movies and TV shows. If you’re a home theater nerd like me and you’ve been saving up your bucks, get an LG OLEDG1P series. The 65″ model lists for $2,800. If you want OLED goodness without a premium price, check out the LG OLEDCXP series. This line’s 65″ screen TV costs $1,900. For the best pairing of price and quality, check out the TCL 6-Series. Here, the 65″ model costs $1,100. Finally, you don’t have to pay a ton of money to get a great TV. The TCL 4-Series works well, and its 65” version only costs $650. No, it’s not as good as the others, but it’s more than good enough for streaming Sweet Tooth, Leverage: Redemption, or Underground Railroad 

    Related Stories: More

  • in

    AWS researcher merges the power of two quantum computers to help make cryptography keys stronger

    Amazon’s researcher put together Rigetti’s and IonQ’s quantum processors to generate random numbers that are the basis of cryptography keys.    
    Shutterstock / Rawpixel.com
    Combining the capabilities of two quantum computers, a researcher from Amazon’s quantum unit Braket has come up with a new way to create truly random numbers that are necessary to protect sensitive data online, ranging from blockchain ledgers to government secrets. Amazon’s research scientist Mario Berta put together Rigetti’s and IonQ’s quantum processors, which are both available through the company’s cloud-based quantum computing services, to generate random numbers that are the basis of cryptography keys.  These keys can in turn be used to encrypt critical data, by encoding information into an unreadable mush for anyone but those who are equipped with the appropriate key to decode the message. Randomness has a fundamental role to play in cryptography: the more random the key is, the harder it is to crack by a malicious actor trying to get their hands on the data. 

    There are many ways to generate random numbers, with the most straightforward method simply consisting of flipping a coin and assigning values of zero or one to the two possible outcomes. Repeat the procedure many times, and you’ll find yourself with a totally random string of bits, which you can turn into a secure cryptography key. Manually flipping coins, however, isn’t enough to keep up with the scale of demand for data security. This is why modern cryptography relies on new technologies known as random number generators, which create streams of bits that are used to produce strong cryptography keys.  This is what Berta has now achieved thanks to quantum processors. “Quantum random number generators (QRNGs) hold promise to enhance security for certain use cases,” said Berta in a blog post. 

    Of course, security experts have not waited for quantum computers to come along to start working on random number generation for cryptography keys.  For years, classical systems have been used, in which coin flipping is replaced with ring oscillators that create a seed of randomness in the form of a few bits. This seed value is then processed by pseudo-random number generators (PRNGs), which use software algorithms to generate longer sequences of numbers with similar statistical properties than those of the original random numbers. But the method has its shortcomings. Ring oscillators, for example, behave in a way that an attacker equipped with lots of compute power could predict; and PRNGs, which are based on computational assumptions, are also at risk of being second-guessed by hackers. In other words, the randomness generated by classical means is only partial, meaning that it is in principle possible to mathematically solve the cryptography key that is created on top of the numbers. Not so much with quantum-generated numbers. “These potential vulnerabilities of classical technologies for generating randomness can be addressed with quantum technologies that make use of the inherent unpredictability of the physics of microscopically small systems,” said Berta. Berta leveraged a property that is intrinsic to quantum physics by which quantum particles exist in a special quantum state called superposition. In a quantum computer, this means that quantum bits (or qubits) can be a value of zero and one at the same time – but that they collapse to either value as soon as they are measured. Whether qubits collapse to zero or one, however, is random. This means that, even equipped with complete information about the quantum state, it is impossible to know in advance to which value the qubit will collapse when measured.  A given number of qubits, therefore, can provide a string of bits with an equal number of completely random values. “Unique quantum features thereby allow the creation of freshly generated randomness that provably cannot be known by anyone else in advance,” said Berta. The catch is that today’s quantum computers are unreliable and noisy, which can alter the randomness of the quantum effect and defeat the whole point of the experiment. What’s more: information about the noise can leak into the environment, meaning that a potential hacker could find the data they need to figure out the measurement outcomes obtained in the quantum processor. To tackle this issue, Berta used two quantum processors to produce two independent strings of bits which he described as “weakly”. The strings are then processed by a classical algorithm called a randomness extractor (RE), which can combine multiple sources of weakly random bits into one output string that is nearly perfectly random.  Unlike with classical means, the post-processing doesn’t involve any computational assumptions, which could be cracked by hackers. Rather, REs condense physical randomness from the different sources. “So, two independent sources that are only weakly random get condensed by these algorithms to one output that is (nearly) perfectly random,” said Berta. “Importantly, the output becomes truly physically random with no computational assumptions introduced.” Berta predicted that as QRNGs become cheaper and more accessible, they could play an important role in high-security applications, especially as the flaws of classical methods become more apparent.  Earlier this year, for example, researchers from security firm Bishop Fox discovered that up to 35 billion Internet-of-Things devices were at risk due to a classical generator failing to create numbers that were random enough to protect sensitive data. And as compute power increases, random number generator attacks are certain to multiply, rendering existing cryptographic schemes insecure. The prospect of current encryption protocols becoming obsolete, however, is still far off. It would require hackers to gain access to huge amounts of compute power to crack today’s cryptography keys – the kind of power that is expected to be unleashed by quantum computers one day, but not before at least a decade. “State-of-the-art implementations of this classical technology for generating randomness sufficiently address nearly all of today’s needs,” said Berta. It remains that a growing number of companies are thinking further ahead and already starting to strengthen their security protocols by increasing the randomness of their cryptography keys. Verizon, for example, recently trialed a “quantum-safe” VPN between London and Ashburn in Virginia; and quantum software company Cambridge Quantum is working on a method to future-proof critical information stored in blockchains. Berta, for his part, encouraged Braket users to get started themselves, by trying their hand at random number generation directly within AWS’s quantum cloud service. More information can be found in the Braket Github repository. 

    Quantum Computing More

  • in

    Fed up with constant cyberattacks, one country is about to make some big changes

    Italy is reinforcing its critical infrastructure with a new cybersecurity agency and fresh EU funding.
    Image: Getty/Andrea Cherchi
    Italy has faced a barrage of cyberattacks in recent weeks. On August 1, the main datacenter of the Lazio region was hit by a ransomware attack, which made many of its online services, including the COVID-19 vaccination-booking platform, inaccessible. All data was encrypted, and attackers requested a bitcoin ransom to allow authorities to recover them. Luckily, technicians were able to restore the stolen data from a backup copy. Less than three weeks later, on August 18, the healthcare agency of the Tuscany region was also targeted by criminals who were able to penetrate its online defenses and destroy some statistical and epidemiological data.

    Previously, ransomware campaigns had hit big corporations such as the energy company Enel Group, Campari, Geox, Tiscali, Luxottica, and hospitals such as the Spallanzani in Rome and the San Raffaele in Milan – albeit with limited results. SEE: Developers, DevOps, or cybersecurity? Which is the top tech talent employers are looking for now? These, and other episodes, have been a wake-up call for Italian politicians and common citizens alike on the necessity to improve the country’s cyber defenses, despite the Minister of Technological Innovation, Vittorio Colao, having already warned in June that “more than 90% of public administration servers are not secure.” “There’s a legacy issue with local and central public administrations, as they work with very old servers and do not have budgets strong enough to update their network infrastructure,” Luisa Franchina, the president of the Italian Association for Critical Infrastructures, tells ZDNet. Thanks to the EU-funded National Recovery and Resilience Plan (PNRR), this is set to change. Total funding for the plan amounts to €261 billion (including some national funding), of which €11,15bn will be allocated for the “digitalization, innovation and security of the public administration”.

    Buying newer and more up-to-date hardware and software will certainly help make life more difficult for attackers; the recently established Agenzia per la Cybersicurezza Nazionale (ACN), which will operate under the direct control of the Prime Minister, should also play a key role. Across the 2021-2027 timeframe, the ACN will oversee a €529m total budget and hire up to 1,000 cybersecurity professionals, starting with 300 employees and then gradually expanding. This compares with just 50 cybersecurity experts who were previously operating under the Department of Information for Security umbrella.  The agency will centralize competencies that were previously scattered among several government bodies and the intelligence services, and will help define and coordinate the Italian cybersecurity strategy. A key component of this strategy will be raising awareness of the issues at stake, and making sure both public and private actors performing functions critical to the safety of the so-called “national cybersecurity perimeter” take appropriate measures to address them. “The problem is not the tool, but the way it is used,” Corrado Giustozzi, a well-known cybersecurity expert in Italy, tells ZDNet. “A great car is useless, if badly driven. We need to focus on improving the processes and the culture.” Giustozzi knows what he is talking about. From 2015 to 2020, he was part of the Computer Emergency Response Team of the Agency for Digital Italy, one of the bodies whose competencies will now partly be taken over by the ACN. In that role, he helped design the minimum cybersecurity guidelines that all Italian public bodies, big and small, need to follow. Those measures contributed to improving a deeply concerning situation: a 2014 report found that only three central public authorities, out of dozens, took data protection seriously enough. Not following the guidelines Unfortunately, the guidelines are not always implemented. In the Lazio-region attack, for instance, the rule not to keep the backup data on the same network as the source was apparently disregarded. The hackers were thus able to delete the backup, which was later recovered, although they could not encrypt it. “We move fast when there’s an emergency, but we do not focus enough on prevention and maintenance,” Giustozzi says.  “This is typically an issue where politics is involved: cybersecurity improvements are not prioritized because, unlike inaugurating a bridge, they are not immediately visible.”

    A more widespread issue, which concerns both the public and the private sector, is a skills shortage. In the 2021 Healthcare Security study by cybersecurity company Bitdefender, 74% of respondents said that the number of cybersecurity specialists in the Italian healthcare sector was inadequate. SEE: Ransomware: This new free tool lets you test if your cybersecurity is strong enough to stop an attack And it’s not just healthcare. In his 2019 report, The Italian Cyber Security Skills Shortage in the International Context, Oxford researcher Tommaso De Zan surveyed managers from the consulting, banking and finance, manufacturing, telecommunications, energy, and transportation sectors. De Zan found that 60% of them could not find even one candidate for the cybersecurity vacancies that they had opened, or had otherwise hired candidates that were not qualified. The problem might lie in part in the so-called “experience trap”, which occurs when employers offer jobs requiring many years of professional experience, but no entry-level opportunities. “In the last few years, Italian universities have started to offer cybersecurity master’s degrees. However, graduates find it difficult to be hired, since there are very few junior positions on offer,” De Zan says. It also does not help that there is little official data available. “The first thing to do is to produce a snapshot of the current cybersecurity skills shortage in Italy. Once done, an improvement strategy must be put into place, and the achieved results monitored on an ongoing basis,” he adds. This work falls into the domain of the ACN, which is also tasked with promoting public/private partnerships to train professionals and develop know-how and innovations in the cybersecurity sector. This will happen both in the ‘competence centers’ that are being supported by the Ministry of Economic Development and in new ‘cyber parks’, which will be modeled on the famous Israeli CyberSpark center of Beer-Sheva. “The competence centers will combine and promote the pre-existing knowledge of private and public stakeholders; the cyber parks will focus on research and training, developing new expertise in the process,” Franchina says. SEE: Cybersecurity jobs: This is what we’re getting wrong when hiring – and here’s how to fix it The first cyber park could be created in Sicily, in the area of the former CARA of Mineo, once Europe’s biggest camp for migrants and asylum seekers. Although some improvements had already been made in the past few years, the money inflow coming from the EU, combined with the increased awareness of politicians and industry stakeholders, means Italy is finally ready to make a quality leap in terms of cybersecurity skills and defenses. The challenge is now seizing the momentum without delay. Cybercriminals are also stepping up the attacks, and they’ve already shown that they can be devastating. More