Software as a Service (SaaS) is a cloud-based software delivery model where apps are hosted by a service provider and made available to users over the Internet. With this model, apps are easy to adopt and use.
However, a recent report from AppOmni reveals that one-third of companies surveyed reported experiencing a data breach this year, marking a 5% increase from the previous year.
AppOmni's State of SaaS Security 2024 Report is based on a survey conducted with cybersecurity decision-makers from 644 organizations across the United States, the United Kingdom, France, Germany, Japan, and Australia, with nearly half of these organizations employing over 2,500 people.
Why focus on SaaS security?One of the most pressing issues identified is the risk associated with Generative AI, with 38% of respondents expressing worries about data and intellectual property vulnerabilities stemming from this technology.
Confidence in data security within SaaS applications is notably declining as only 32% of organizations feel secure about their data. This is a sharp drop from 42% in the previous year which is particularly concerning given the backdrop of rising breaches, as 58% of organizations reported experiencing a security incident in the past year.
While 90% of organizations claim to have policies restricting unauthorized application use, 34% admit these policies are not enforced—a significant increase from the previous year. This gap between policy and practice exacerbates security risks, as organizations struggle to maintain oversight of their SaaS applications. In fact, 34% of respondents are unaware of how many SaaS applications are deployed within their organizations, complicating management and security efforts. About 50% of respondents believe that Microsoft 365 does not have up to 10 connected apps, however, AppOmni’s research reveals that on average, it has 1,000.
SaaS exploits are expanding, mainly thanks to the tussle for whose responsibility it is to secure the apps. From the survey, 50% of respondents believe that this is the primary duty of business owners or stakeholders, while only 15% attribute this responsibility to cybersecurity teams. This distribution can lead to confusion and inadequate security measures as responsibilities are not clearly defined.
Concerns regarding data loss are also prevalent, with organizations citing the loss of intellectual property (34%), reputational damage (30%), and customer data compromise (27%) as their top fears related to SaaS security. These findings emphasize the urgent need for organizations to enhance their SaaS security strategies, ensuring robust policies, clearer accountability, and improved visibility into their SaaS environments to mitigate risks effectively.
Looking ahead, the report indicates a shift in organizational priorities regarding cybersecurity. Approximately 69% of respondents anticipate increased spending on cybersecurity measures in the next 12 months. Also, 29% expect discussions around return on investment (ROI) on cybersecurity investments to become a focal point, emphasizing the need for quantifiable risk reduction.
Brendan O’Connor, CEO of AppOmni said: “SaaS has come a long way from its early days of use in isolated departments, and now underpins modern businesses across every function. But attackers continue to wreak havoc by stealing data, holding companies ransom, disrupting business operations, and damaging organizations’ reputations. Our survey findings, conversations, SaaS war stories over the last year, and the current regulatory environment make it clear that SaaS security must mature.”
“As attacker TTPs and preventable security issues are becoming more widely-known, there are signs that CISOs and their teams are prioritizing SaaS risks among their cloud security initiatives—even as budget pressures intensify. The days of waiting on SaaS vendors as the primary security providers for your SaaS estate are over. As the operating system of business, your SaaS estate requires a well-structured security program, organizational alignment on responsibility and accountability, and continuous monitoring at scale.” O’Connor concluded.
More from TechRadar ProAn investigation into Chinese chip making companies has determined that eight firms were allegedly in violation of Taiwanese law. This is the latest development in global ambitions to develop crucial technologies used in AI, phones, and cars.
Amongst those accused is Naura Technology Group, one of the suppliers to China’s largest chip maker, Semiconductor Manufacturing International Corp. The organization has denied the allegations, affirming that the Taiwan office was established “in accordance with local laws and regulations.”
The firms have denied poaching talent from Taiwanese companies, despite Taiwan's top intelligence agencies finding evidence of the unlawful hiring of engineers to boost China’s semiconductor manufacturing power.
Investing in techTaiwan accounts for 68% of the semiconductor market, but China is the lead spender in chipmaking technology. The nation spends more than the US, Taiwan, and South Korea combined - and is on track to hit $50 billion in semiconductor equipment spending in the near future. As of yet, Chinese domestic industry can’t develop the most advanced chips, especially those used in military hardware.
The race to develop and manufacture chips is just one part of a wider picture. The strategic influence of tech in the geopolitical sphere has become more and more apparent, with the US and China both looking to be the dominant technological powers.
The US has attempted to rally allies like Japan to impose restrictions on imports to China in attempts to hinder development. Japan is being pressured to align more closely with the US’s foreign policy goals by restricting the sales of top end chips.
As both the US and China grow their powers in the technological world, the expansion of chip manufacturing is set to continue, and the development expertise will remain incredibly valuable.
Via Tom's Hardware
More from TechRadar ProA critical vulnerability has been discovered in Microsoft’s Copilot Studio, posing significant risks to sensitive internal data. This flaw, identified as a server-side request forgery (SSRF), allows unauthorized access to internal infrastructure, potentially impacting multiple tenants.
The flaw identified by Tenable's Research Team is attributed to improper handling of redirect status codes in user-configurable actions, which allows attackers to manipulate HTTP requests.
This vulnerability is tracked as CVE-2024-38206 and has a CVSS score of 8.5, indicating its critical severity level. Microsoft has confirmed that this issue has been tackled as of July 31, 2024, and users do not need to take any further action.
Server-Side Request Forgery (SSRF) could have broader implicationsThe SSRF vulnerability identified in Copilot Studio stems from the manipulation of an application to make server-side HTTP requests to unintended targets or locations. This manipulation can lead to unauthorized access to internal resources that are typically protected. Essentially, an attacker could exploit this flaw to make requests on behalf of the application to sensitive internal resources, revealing potentially sensitive data.
In the case of Copilot Studio, the SSRF vulnerability could have been exploited to access Microsoft’s Instance Metadata Service (IMDS). The IMDS is a common target for SSRF attacks in cloud environments because it can yield information such as managed identity access tokens. These tokens can then be used to gain further access to shared resources within the environment, including databases.
For instance, gaining access to a Cosmos DB, where sensitive data is stored, could compromise data integrity and confidentiality, leading to broader security breaches and potential data leaks affecting multiple customers.
This discovery is not an isolated incident. It follows Tenable's previous findings of vulnerabilities in various Microsoft services, including the Azure Health Bot service, Azure Service Tags, and multiple vulnerabilities within the Azure API Management service. The pattern indicates a concerning trend in the security posture of Microsoft’s cloud offerings, particularly as they expand rapidly in a competitive market.
“In the context of cloud applications, a common target is the Instance Metadata Service (IMDS) which, depending on the cloud platform, can yield useful, potentially sensitive information for an attacker. In this case, we were able to retrieve managed identity access tokens from the IMDS. No information beyond the usage of Copilot Studio was required to exploit this flaw,” explains Jimi Sebree, senior staff research engineer, at Tenable.
“As in some of the previous vulnerabilities found by our research team, this vulnerability demonstrates that mistakes can be made when companies rush to be the first to release products in a new or rapidly expanding space,” Sebree concluded.
More from TechRadar ProIFA 2024 continues to deliver even more tech news, including the reveal of tons of AI PCs from top manufacturers. One such is Samsung’s Galaxy line, which is getting two new AI-based entries.
The first is the Samsung Galaxy Book5 Pro 360, powered by the Intel Core Ultra CPU (Series 2) and an NPU with up to 47 total TOPs. It also features an Intel Arc GPU, a 3K resolution and 120Hz refresh rate screen, a Dynamic AMOLED 2X display with Vision Booster (which reduces glare), and according to the tech giant, reaches up to 25 hours of video playback battery life. Its specs also include 16GB of RAM and up to 1TB of storage.
The second laptop is the Samsung Galaxy Book4 Edge, powered by Qualcomm’s Snapdragon X Plus 8-core CPU and an NPU with up to 45 total TOPs. It features a 15.6-inch FHD display with anti-glare tech and comes in Sapphire Blue. Despite the thin and light design, the port selection is well-rounded, with USB Type-C, USB Type-A, HDMI, a combo jack, and a micro SD slot. Its specs also include 16GB of RAM and up to 512GB of storage.
Like other Windows-based AI PCs, the Book5 Pro 360 and the Book4 Edge utilize Copilot+ AI and its in-house AI tools and programs. The former is already available in the UK for £1,699 and will be available on September 24 in other regions. The latter will launch in the US, UK, and other regions starting October 10.
What’s the future of AI-powered CPUs?Like other AI PCs, Samsung is mixing up which AI-powered CPUs will be featured in different models. This move not only increases the options that buyers can choose from based on personal preference but most likely allows manufacturers to ‘test’ out which CPUs work best for their needs.
Of course, plenty of testing had to have been done before launch to ensure that buyers would have the best products. However, the most reliable way to find out the true performance and limits of these AI CPUs and NPUs is to wait for official benchmarks and thorough testing from professionals.
As AI PCs are a new concept and we haven’t seen the full range of what all the CPUs can accomplish yet, it’ll be fascinating to see which ones actually turn out to be winners. However, we’ve at least seen the first Snapdragon chips, and so far, they’ve been extremely promising, with the Dell XPS 13 (2024) and the Microsoft Surface Laptop 7 being notable examples.
While I do have faith in AMD putting out solid AI CPUs that could potentially rival Snapdragon, my worries lie more with Intel’s output. Lunar Lake should technically be more than sufficient to compete with and surpass its competitors, but considering the ongoing stability issues with Intel’s 13th and 14th-gen processors, there are still some doubts as to what Team Blue can accomplish in reality.
You might also likeA letter signed by no fewer than 17 different groups is urging the Federal Trade Commission (FTC) to consider introducing clearer guidance for software tethering.
Described as “making functions of a device reliant on embedded software that ties the device back to a manufacturer’s servers,” the letter addresses “several consumer harms” associated with the practice.
According to the signatories, locking features behind a subscription paywall and rendering products unusable through software at a later date is harming consumers and creating more e-waste that’s detrimental to the environment.
FTC urged to readdress software tetheringThe letter exemplifies the complaint through the $1,695 Snoo, a smart bassinet made by Happiest Baby, which recently moved features like weaning mode, sleep tracking and car ride mode to a $19.99 subscription model. Though buyers from before the change will be able to continue without the subscription, this is said to harm the secondhand market.
Spotify’s $89.99 Car Thing is also used as an example – the music streaming platform confirmed that it would be unsupported from December 2024, less than two years after it launched.
Although it has been acknowledged that some companies offer advanced notice, refunds and a plan to recycle the non-working hardware, the signatories believe that most unsupported products would still be able to work with the right software.
Moreover, the open letter addresses the complex inter-business relationships that can cause similar technical limitations, such as a recent Chamberlain MyQ API update that prevented it from working with smart home assistants – ”the smart home is littered with examples of this sort of bait and switch for consumers.”
The group believes that the problem will only get worse as more “smart” devices are introduced, and calls for the FTC to require companies to disclose a minimum support time for products; for them to ensure that core functionalities work even without internet connection and software updates; to encourage tools and methods for reuse if software support ends; to allow third parties to pick up where owner companies left off with copyright amendments; and to encourage manufacturers to build longevity into their products.
TechRadar Pro has asked the FTC to comment on the letter, but we did not receive an immediate response.
More from TechRadar ProGoogle is racing to get its Gemini AI assistant embedded across its ecosystem, upgrading as it goes. That means not every new or enhanced feature gets much in the way of fanfare when it rolls out beyond the updated support website. Still, a couple of new Gemini tools are worth highlighting for how they embody Google’s strategy of making Gemini as flexible and easy to use as possible.
Google Chrome’s dominant place among web browsers makes it an obvious hub for Google to encourage Gemini use. That now includes enabling users to start interacting with Gemini right from the address bar. It might not seem like much initially, but the feature removes a barrier to Gemini on Chrome, possibly encouraging some of the millions of Chrome users to at least test out the AI.
If you want to talk to Gemini in the Chrome address bar, you just treat it like a lot of other Chrome extensions. Type “@gemini” in the address bar, followed by your question or prompt. Gemini will process the request and take you to the Gemini homepage using the same browser window. You can see how it looks in the image at the top.
Google Chrome isn’t alone in trying to meld an AI assistant with a browser. Microsft Edge has incorporated the Microsoft Copilot AI assistant in some form for more than a year now. Apropos of the name, Microsoft’s browser does have an edge in at least one major way when compared to Chrome’s new feature. Copilot’s responses are shaped in part by the webpage you are currently viewing.
Gemini lacks this level of contextual awareness and ability to personalize a response to your current browsing. If you’re more concerned with privacy than personalization, you might even see this limit as a positive since it means Gemini isn’t analyzing your history. Still, for more general questions or requests, the Chrome address bar works just fine for contacting Gemini. It also pairs nicely with other recent AI updates to Chrome, such as Gemini-powered visual searches through Google Lens, shopping comparisons between tabs, and a better-organized browsing history.
Gemini Upload MobileThe other notable new Gemini update is on the mobile app. If you subscribe to Gemini Advanced, you can now upload files to the Gemini app on Android and iOS devices. The document upload has only been available on the web until now. You can use the app to send up to 10 files of no more than 100MB at a time to Gemini. Most of the common formats are supported, including plain text, Microsoft Word, PDFs, and spreadsheets.
This mobile enhancement is aimed at encouraging people to use Gemini more, even when not at their computers. It brings Gemini’s document analysis to smartphones. That’s great if you want Gemini to explain or summarize a spreadsheet or report without having to copy and paste it manually. As with the Chrome address bar option, Google’s efforts are all about making Gemin more accessible. And once people get used to Gemini in whatever forms they prefer, it will be that much easier for Google to retain them as customers regardless of what its rivals offer. Whether Gemini will be another Google product people use as reflexively as Gmail or Google Docs is still up in the air, but it’s a strategy with a lot of success behind it.
You might also likeWe were expecting robots, smart home, and AI to be big at the IFA 2024 trade show… and LG has delivered by combining all three into one new product that's going to be released in the first half of 2025 in South Korea.
It's an adorable little two-wheeled bot with a carry handle and big set of eyes, which has been given the inexplicably business-minded name of 'LG Self-Driving AI Home Hub'. Not really the cutesy title you expect for something like this, but given that you summon it by saying the word "Hi LG", I might call mine 'Eljy'.
To be fair, the official name is very descriptive for what it offers. It acts as a kind of AI smart speaker that you can give commands to, and with LG's new AI platform (which does have a cool name: FURON) behind it, it apparently has multiple LLMs to draw understanding from, and uses ChatGPT 4-o to be able to understand and communicate naturally, even to weirder requests.
@techradar ♬ original sound - TechRadarIt also has a fun party trick where you can draw something in a companion app on a tablet, 'send' the picture to the robot, and generative AI will create an original story that follows the elements of the picture.
You can call out to summon the robot over to you, and it'll come to where you are and announce itself charmingly (at least, it was charming in a trade-show demo, maybe you'll want to turn it off in real life). I saw it navigating a very empty environment, so I don't know how good its object avoidance is, but it seems to have a good range of sensors on the front.
And as I mentioned, it's a smart home hub, and can control all kinds of smart home tech. LG recently acquired a smart home control open platform that works with tons of brands, and with Matter support on board, it should be very flexible.
You can ask it to make changes to your smart home controls, but it can also respond contextually – one option LG highlighted is that you can task the robot to stay with your kids as they roam the house, and it will follow them around, and then when the clock hits 'time to get ready for bed' it can dim the lights in the room they're in.
(Image credit: Future)Obviously, its little wheels can't take it up stairs, but it has a carry handle for that. I'll also say that it wasn't the smoothest mover – it seemed a little stuttery, and wasn't too sure which way to face when an LG demo-er asked it to come to him, but that might be just an issue with having a big group of people staring at it too. All of this might be improved by the time it launches, of course.
What's more important is the way it moves when it's talking to you. It wobbles sideways and forwards when it gets more enthusiastic, and can rotate its handle to emphasize 'emotions' too – like a combination of a fun enthusiastic aunt and a cat.
That's while it's talking in a pretty natural voice – though not too natural. I think it strikes a nice balance between friendly and robotic.
I can imagine myself wanting one of these to watch the house while I'm gone. LG had a larger demo of its vision of a smart home powered by generative AI assistants, where something like this robot could roam the house and make changes to your heating or cooling system depending on the temperature and humidity in each room.
It could be great to have it as a kind of video guard dog, as many similar home robots have angled themselves, responding to sounds when it knows I'm out. Maybe it can pretend to be armed with a taser to ward of intruders. Or maybe it'll tell them a cute story and lull them into a false sense of security while it automatically calls the police. We'll see!
Of course, LG hasn't announced a price yet, so who knows whether it'll feel remotely desirable once we know that. But it'll be damn charming either way.
Verizon has revealed that it's expanding its fiber network by preparing to buy Frontier Communications in a cash deal worth $20 billion. The acquisition aims to help Verizon recapture fiber lines that were sold in 2016 as part of a TV and Internet deal in California, Texas, and Florida.
Verizon offered $38.50 per share, a premium of 36.3% to Frontier’s closing price on the 3rd September. The deal is set to close in 18 months, and is expected to help Verizon compete against premium broadband services such as AT&T.
Frontier reported a debt of $11.25 billion as of June 30th 2024, and under the current terms of the deal, Verizon will pay Frontier a fee of $590 million. The company brings 2.2 million subscribers to combine with Verizon's 7.4 million FiOS connections.
Mutually beneficialThe deal is predicted to generate at least $500 million in annual run-rate cost savings by its third year of operation. Frontier’s coverage primarily serves the Midwest, Texas, and California, whilst Verizon focuses on the North East and Mid-Atlantic. Verizon CEO Hans Vestberg comments, “The acquisition of Frontier is a strategic fit. It will build on Verizon's two decades of leadership...and is an opportunity to become more competitive in more markets throughout the U.S.”
Verizon has reaffirmed its commitment to building a best in class network and delivering high-speed broadband. This comes just months after Frontier Communications launched its ‘Good to Go’ campaign, which aimed to deliver fiber technology that will span a customer’s lifetime.
This Verizon deal is set to expand the company’s coverage and offer faster service to a wider range of customers. Broadband companies are each looking for ways to gain an edge over their competitors, with AT&T looking to space to provide supplementary coverage, using satellites to provide service to areas with unreliable connections.
Via CNBC
If you've ever tried to type using a gamepad or gaming device, you know it can be tricky, especially with this new generation of handheld gaming PCs like the Steam Deck and Asus ROG Ally X, so it’s good to see that Microsoft is currently trialling a new and improved gamepad keyboard layout for Xbox controllers in Windows 11.
The Verge reports that the new layout isn’t the only thing PC gamers with Xbox controllers can look forward to - they will also be able to use the X button for backspace, the Y button for spacebar, and the menu button of a connected Xbox controller to hit enter (as you would on a physical keyboard). Microsoft is also adding vertical alignment (consideration for the arrangement of keys in the vertical direction) to make it easier to type with the on-screen keyboard.
The new on-screen keyboard is currently in user testing in the Windows Insider Program’s Beta Channel, which means we expect it to roll out to all eligible users pretty soon (unless Microsoft changes its mind).
(Image credit: Getty Images) The bigger picture of Windows handheld gamingI think it’s smart for Microsoft to continue developing Windows 11 to improve its gaming abilities while also working on other things like its AI-powered Copilot tool. Windows 11 is now the most-used operating system by PC gamers (at least according to a recent Steam survey), and while it performs fine for gaming laptops and desktop PCs, the operating system isn’t quite as well suited to gaming handhelds, which have smaller screens and rely on controller inputs, rather than traditional keyboards and mice, which Windows was originally designed for.
While the new gamepad-friendly on-screen keyboard has been well received by many so far, there’s more work that can be done - and handheld PC gaming is an exciting, and growing, market. As The Verge points out, Microsoft can still improve things like being able to log into Windows with an Xbox controller, as well as ensure that the on-screen keyboard automatically appears when you select text fields to write in them.
I could see Microsoft addressing these in the near future, as we recently wrote about Microsoft’s improved Windows Game Bar with Compact Mode, making it easier to control your device while you’re playing a game - even on a smaller screen. The Xbox app has also gotten controller improvements to make it easier to navigate the app while using an Xbox controller, so it’s good to see that Microsoft isn’t completely distracted by adding AI into all parts of Windows 11.
If Microsoft’s handheld gaming offerings continue to improve, I think it could make Valve, the company behind the Linux-based SteamOS operating system that the Steam Deck uses, sweat a little bit. I’m certainly excited to see what else Microsoft has up its sleeve when it comes to Windows on handheld devices, which is something I haven’t felt in a long time.
YOU MIGHT ALSO LIKE...Cybercriminals have no limits when it comes to the scale, size, and organization they target. As long as there is data to be stolen, they will launch an attack.
Historically, these cybercriminals focused on large brands with valuable data; however, these companies often have the resources to invest in advanced firewalls and robust security measures to protect their information.
Consequently, cybercriminals are now shifting their focus to easier targets, such as educational institutions.
Why are educational institutions are prime targets?According to a recent report by NordLayer, cyberattacks targeting educational institutions have increased by 37% compared to last year.
This alarming statistic shows the growing vulnerability of schools, colleges, and universities in the face of evolving cyber threats. Following best practices for security, such as using unique and strong passwords, should now be a priority for all members of the academic community.
The academic sector is particularly appealing to cybercriminals for several reasons. Schools and universities manage vast amounts of sensitive information, including personal data of students and faculty, financial records, and valuable research data. The rise of online learning has only added to the complexity of managing cybersecurity, introducing more infrastructure, software platforms, and endpoints that can be exploited.
Furthermore, educational institutions often struggle with limited budgets and inadequate cybersecurity measures, making it challenging to protect against sophisticated cyber threats. Both lower and higher education institutions have been frequent targets of ransomware, with 80% of lower education providers and 79% of higher education institutions reportedly falling victim to attacks, causing significant disruptions to academic operations and potentially leading to long-term damage to an institution’s reputation.
Beyond the financial impact, data breaches can lead to identity theft, reputational damage, and legal consequences for educational institutions. Protecting sensitive information is not only about safeguarding financial assets but also about maintaining trust and integrity in the academic community. Unfortunately, cyberattacks in the education sector continue to increase. In fact, it currently surpasses other high-risk sectors such as government, healthcare, and finance this year.
A UK government survey found that 86% of further education colleges reported experiencing a cyber breach or attack in the past year.
To combat the growing threat of cyberattacks, educational institutions must adopt a proactive approach to cybersecurity. Regular updates to software and systems are essential to protect against known vulnerabilities. Training staff and students on recognizing phishing attempts and other social engineering tactics can reduce the risk of human error leading to a breach.
Educational institutions should also invest strategically in cybersecurity infrastructure, such as firewalls, intrusion detection systems, and encryption technologies. Furthermore, conducting regular assessments of current cybersecurity measures can help identify weaknesses and areas for improvement.
“Educational institutions need to prioritize cybersecurity, implementing measures that foster a culture of digital awareness among students and staff,” says Andrius Buinovskis, head of product at NordLayer.
“The stakes are especially high at the start of the new academic year, for educational organizations and they need to be prepared for cyberattacks…Every member of the academic community — from students to teachers, must play an active role in cybersecurity. Simple yet effective practices like using strong, unique passwords and learning to identify phishing attempts, can significantly improve an institution's security posture," Buinovskis concluded.
More from TechRadar Pro