Businesses are under attack from all corners of the globe and while many organisations may think that nation-state threat actors would never target or be interested in them, the reality is that no-one is exempt from security threats.

Security leaders need to ensure they are staying up to speed on the latest threat intelligence, this can either be through an in-house capability or via third-party threat intel providers. Once they understand the tactics, techniques and procedures (TTPs) deployed by these threat actors, organisations can then ensure they have robust mechanisms in place to digest and act on this information to implement appropriate controls.

Organisational culture plays a key role in ensuring everyone is aware of the threats and risks posed to the business. It is vital that leaders educate users on what the most prevalent threats may look like and how to respond, this is a primary defence to protecting their business.

Social engineering remains one of the most widely used methods of attack and so implementing processes that are resistant to individual compromise is key. Using phishing resistant authentication methods, ensuring strict identity governance and control, and having a well-tested incident response capability are all crucial steps to preventing and mitigating these types of attacks.

Unfortunately, securing your own organisation is not enough and historically nation-state threat actors have taken advantage of weak third-party suppliers and supply chain governance. Having strong supply chain governance and assurance is now one of the top trends across industries and it’s critical businesses understand the dependencies and access that suppliers have.

If prevention fails, lateral movement post-compromise is one of the first actions threat actors will attempt and so endpoint detection and response, and zero-trust solutions that can prevent and detect unauthorised access are also vital.

In 2023, 1.9 billion session cookies were stolen from Fortune 1000 employees. With the session token, attackers are bypassing MFA and so it is much harder to detect and respond. Having solutions  in place as part of a zero-trust architecture to detect session token replay attempts can stop these attacks and alert to possible credential or endpoint compromise.

Ultimately, collaboration and partnership across organisations and industry will help organisations understand these threats, the risks posed by nation-state actors and more importantly allow them to work together to prevent them.

Stephen McDermid is EMEA CSO at Okta  

UK based legal professor Or Brook has filed a class action against Google worth approximately £5bn in the UK Competition Appeal Tribunal (CAT). The class action, brought on behalf of hundreds of thousands of UK-based organisations that used Google’s search advertising services, accuses Google of abusing its near-total dominance in the general search market to drive up prices.

This latest class action follows on from one filed by Nikki Stopford, co-founder of Consumer Voice, and legal firm Hausfeld & Co LLP, and appears to focus on the Google’s anti-competitiveness.

Stopford’s case looks at the cost to consumers due to increased advertising costs businesses that use Google Search pay as a result of anti-competitive practices. In November last year, Google’s attempt to throw out Stopford’s case was dismissed, paving the way for the case to be heard at the CAT.

Along with Stopford’s case, in January,  the Competition and Markets Authority (CMA) began an investigation seeking to determine if Google has strategic market status in search and search advertising activities, and whether these services are delivering good outcomes for people and businesses in the UK.

The Brook case appears to be looking specifically at the cost to business arising from Google business practices that stipulate its Chrome browser and search engine are configured as the default options on Android devices and Google’s payments to Apple to ensure Google search is default on the Safari browser.

The class action also covers Google’s Search Engine Management Platform (SA360). Brook alleges that this offers better functionality and more features regarding Google’s own advertising offering than that of its competitors.

Damien Geradin, founding partner of Geradin Partners, the legal firm representing Brook, said: “This is the first claim of its kind in the UK that seeks redress for the harm caused specifically to businesses who have been forced to pay inflated prices for advertising space on Google pages.”

In the claim, Brook argues that Google has been shutting out competition in the general search and search advertising markets.

The claim argues that Google’s conduct has prevented competitors in the general search market from distributing their own search engines, which has enabled Google to maintain its dominance, leading to restricted competition in general search. Brook contests that Google has ensured that its own search platform is the only viable means of advertising to the vast majority of consumers, and ensured its dominance in search advertising.

She said: “Today, UK businesses and organisations, big or small, have almost no choice but to use Google ads to advertise their products and services. Regulators around the world have described Google as a monopoly and securing a spot on Google’s top pages is essential for visibility.

“Google has been leveraging its dominance in the general search and search advertising market to overcharge advertisers. This class action is about holding Google accountable for its unlawful practices and seeking compensation on behalf of UK advertisers who have been overcharged.”

On top of the class actions, Google is also being investigated by the CMA, which is looking at whether its Play Store requires app developers to sign up to unfair terms and conditions as a condition of distributing their apps.

Football players are issuing “stop processing” requests to gaming, betting and data-processing firms over the use of their performance, health and injury data, citing ethical concerns with how the information being distributed about them can affect their career prospects.

Under Article 21 of the UK’s General Data Protection Regulation (GDPR), individuals have the right to object to the processing of their personal data.

Submitted on behalf of players by the Global Sports Data and Technology Group (GSDT) – an enterprise co-founded by former Cardiff City and Leyton Orient manager Russell Slade, and technologist Jason Dunlop – the “stop processing” requests are asking the companies involved to cease their processing of all tracking and performance data, as well as other personal information such as health or injury information.

The “stop processing” requests sent by GSDT – as part of its Project Red Card initiative to give footballers and other sportspeople more control over the collection and use of their performance data – follow its extensive engagement with companies in the gaming, betting and sports data industries over the past five years.

While GSDT are unable to disclose which companies the requests have been sent to, they are some of the largest betting, gaming and sports data consultancy companies in the world.  

Speaking with Computer Weekly, Dunlop and Slade said that they must now take action via Article 21 of the UK GDPR because the ethical concerns GSDT has raised about the use of football players’ data have been ignored by firms throughout the sports data ecosystem.

“We’re still in correspondence with them, but I just don’t think we’re moving forward,” said Dunlop. “It is disappointing that, despite ongoing engagement with these companies for the past five years, we have reached a point where we must take action to protect our players’ and the processing of their data.

“This issue could easily be resolved if players were recognised as stakeholders in the sports data ecosystem. While we have seen some attempts by others to address this, three critical questions remain: Do players have the right to object to industries outside sport using their data? Who should decide who uses a player’s data? And what is the true value of this data to the athlete?”

Slade added the concerns about player data extend to every level of the game: “Many people still don’t understand how this industry works and don’t realise how important accurate data is to a player’s value and career. It is crucial that we get this right for all players.”