Virtual and augmented reality present new and compelling opportunities for innovation across numerous industries. However, key questions remain regarding the associated security risks and how to mitigate them.
Recently, augmented reality (AR) and virtual reality (VR) were largely considered science fiction. Yet, they have rapidly evolved from experimental technologies into mainstream applications, particularly within the interactive media consumer market. This extends beyond gaming; there are increasingly promising commercial applications leveraging immersive technologies. Experts estimate that these technologies will become indispensable in the business world by 2025.
Business Applications of Virtual and Augmented Reality
Let's examine some examples of where the application of virtual and augmented reality is already a reality:
Product Prototyping
One of the most promising applications currently is product prototyping, which involves creating a complete digital model (or a ‘digital twin’) and integrating it with a virtual reality experience. This enables thorough testing and ideation without the high costs associated with developing multiple physical prototypes.
Employee Training
Another increasingly popular immersive use case is employee training, particularly in the area of workplace safety. By applying virtual or augmented reality to training programs, it’s possible to create a safe and highly interactive simulated environment, alongside the ability to provide real-time feedback. Similarly, AR and VR can enhance safety in hazardous environments, such as factory floors or nuclear reactors.
These are just a few glimpses into the applications of virtual and augmented reality. And while they may still sound like science fiction to the uninitiated, they are, in fact, becoming reality. Companies like Ford, Airbus, and Sotheby’s are already utilizing them.
The Camera Challenge
Augmented reality glasses require a camera to understand the surrounding environment, making it a critical and, consequently, a security risk component. Following the initial Google Glass prototype launch in 2013 (which was subsequently discontinued in 2015), growing concerns emerged regarding privacy and security. The Google Glass launch even popularized the term ‘glasshole,’ referring to individuals who misused the device (such as spying on others and taking photos without consent).
A New Frontier for Social Engineering
Augmented Reality (AR) and Virtual Reality (VR) devices, similar to computers and smartphones, are increasingly connected to networks, forming part of a rapidly expanding global network often referred to as the Internet of Things (IoT). As connected devices, they handle data transmission and storage, making them prime targets for cybercriminals seeking to illicitly acquire information. Specifically concerning immersive experiences, there's a heightened concern regarding corporate espionage and sophisticated social engineering tactics. When technology can convincingly simulate a location, the potential for exploiting human vulnerabilities is significant.
Like any technology, users represent the weakest link, making extended reality a particularly attractive target for exploitation. For example, attackers could inject malicious functionality into VR platforms designed to deceive users and extract personal information. Furthermore, there are emerging ransomware threats where attackers could disrupt platforms and interrupt critical meetings before demanding a ransom.
The trend indicates that Virtual Reality (VR) and Augmented Reality (AR) experiences will continue to become more immersive and realistic. While this will drive greater adoption and attractiveness, it simultaneously increases their inherent risks. Techniques like deepfakes – synthetic media generated by machine learning – enable manipulation of voices and videos to appear authentic. If a cybercriminal gained access to motion tracking data from VR headsets, they could potentially create a digital replica and overlay it onto another person's VR experience, such as an immersive business conference, to conduct an attack, representing a novel dimension in cybercrime.
Data Breach Risks
Beyond providing new methods for attackers to manipulate victims, VR and AR also present the classic cybersecurity risks associated with data transmission and storage. As systems that handle this data, they are highly attractive targets for those seeking to obtain valuable personal information. Denial-of-Service (DoS) attacks are also a potential concern, with potentially severe implications for those reliant on AR in critical situations such as surgical procedures or operating hazardous machinery.
Risk mitigation is often more achievable than anticipated
To mitigate risks associated with virtual and augmented reality (VR/AR), it's best to begin with fundamental information security principles, which should govern the broader IT infrastructure across the organization. While attacks on VR/AR systems manifest differently, the technological and administrative measures used to safeguard them are similar to those employed for other connected technologies. They utilize the same protocols as any other connected device, necessitating the application of standard best practices: maintaining firmware updates and encrypting sensitive data. Critically, security vigilance should never be overlooked. Many immersive devices do not encrypt data by default and can integrate with third-party applications with questionable security. This requires ongoing monitoring.
In addition to standard security measures, extended reality (XR) presents unique challenges, particularly concerning physical security and user protection. A significant concern with virtual reality is its complete blockage of the user's visual and auditory connection to the external world. It's crucial to initially assess the physical security and user environment. This principle also applies to augmented reality, where users must maintain a high level of situational awareness.
Identity and access management is fundamental to any information security strategy and impacts all devices. However, this area is often overlooked when adopting these systems. For example, you may be able to identify colleagues through their avatars, but there's also the potential risk of an avatar being copied and used by unauthorized parties. Fortunately, when implemented correctly, solutions like multi-factor authentication (MFA), such as utilizing eye-tracking sensors to verify identity before granting system access, can potentially enhance identity and access management.
Despite these challenges, the potential for adopting VR/AR in the workplace remains significant; we must proceed with caution, as with any other technology.
Sources: Kaspersky