THE METAVERSE is still in its infancy, but experts say it is fast becoming a new target for cyberattacks. David Stinner, president and founder of USitek, an IT solutions provider in Tonawanda, N.Y., is concerned companies are not paying enough attention to metaverse security risks as they explore use cases.
“I am worried that users will somehow think that security is a non-issue or built into the technology,” he says. While the virtual reality (VR) headset is a new interface, the network infrastructure is the same as what a company uses for its day-to-day operations and could be ripe for attack, Stinner notes.
Caroline Wong
That VR interface itself may become an issue, adds Caroline Wong, chief strategy officer at Cobalt, provider of penetration testing as a service. For example, cybercriminals could guide a user wearing a VR headset into an area laden with malware. She adds that for organizations, security risks are related to data privacy, such as when an avatar impersonates trusted colleagues and asks for confidential data.
Hackers have already stolen assets from a game on a network built using the same technology as the metaverse, says Wong. “Where the money goes, cybercriminals will follow.”
Cybersecurity awareness is the first step toward protecting personal data in the metaverse, according to Wong. “Install two-factor authentication when possible,” because identity fraud by creating false avatars could lead customers to share private and financial data with the imposters,” she points out. Tools to safeguard the customer data collected during visits must be implemented.
MSPs should plan for data security and privacy at the start of new projects, says Stinner. When working with clients on metaverse initiatives, include a code of conduct to address engagements; interaction rules to protect privacy, guard against bullying, and protect your client’s business reputation; and a policy for how to deal with advertisements. IT providers, he says, “need to understand the business impacts and business concepts they are bringing into the digital world.”
David Stinner
Some guidance for users will be necessary, says Wong. “Remind clients that anything they say, post, or do in the metaverse can be recorded, so they should proceed with caution.” Their digital footprints are also permanent. Even oversharing personal information about themselves or their organizations “could make clients a target for cybercriminals,” she stresses.
Lead your customers into the metaverse by relying on their existing security tools for authentication, identification, and data protection. If the metaverse develops as Meta and others hope, it is important to educate your clients so they are aware that emotional connections will happen faster, a perfect breeding ground for phishing scams and other manipulations.
Concludes Stinner, “I want the IT channel to enter the metaverse with eyes wide open and be one step ahead” of hackers.
Image: iStock
