[New] CYBERSECURITY FUNDAMENTALS

officers were required for a large virtual event where executives were pressent, to prevent them from being mobbed in the virtual world by attendees complaining, questioning whether they were really speaking to the CEO, or otherwise intruding in personal space in a way that they would hesitate to in reality.

This all takes place in a virtual world more akin to Zoom, with only 2-dimensional avatars wandering around, rather than anything more sophisticated but it's still a serious issue for those high-profile participants if they want to engage with employees or the public without facing harassment. While the threats may not be of the same severity, if their security is only considered in the physical world when they are exposed to others in virtual worlds there are still threats that will apply. Even in some virtual worlds, as odd as it may sound, where dangers of eavesdropping and intruders in private conversations can become an issue once again.

These issues only increase when we consider true virtual reality worlds where instead of representation by an abstract avatar on a screen those taking part feel like they are directly immersed. We are still some way from these being a full substitute for reality, but for those who have never experienced today's virtual reality systems even the most cartoony or unrealistic forms can be surprisingly immersive and engaging - and with that immersiveness and engagement come threats to people's safety. Plenty of research has shown that even in the less immersive, twodimensional forms many people identify very strongly with their avatar to the point of reacting to attacks or interactions with them, and this only strengthens when we are taking part in a three dimensional world from a firstperson point of view.

As yet there have been no incidents in modern virtual reality to compare with the 2006 flying penis hordes, but only because this is still an emerging technology and high profile individuals have only taken limited part in it and only in carefully controlled conditions. Earlier this year, shortly after Facebook's announcement of their Meta VR platform, we had the first reports of harassment and sexual assault against a researcher. This was in a public, open chat room, and while there is an argument that of course the targeted user could have left the environment unlike in reality there are issues which embolden harassers and attackers behind a veneer of anonymity and safety from any physical consequences.

We are still very much at the early days of these technologies and it is possible that we will see providers bringing in controls and tools to protect users (though for those familiar with the history of social media and moderation tools on the internet, extremely unlikely).

Most likely though all we will see is use of these tools increasing over the next few years and more of these issues coming to light, especially if or when this form of virtual reality becomes a place for high profile individuals to enage with others. At this point there is going to be a need for people who understand the technology, the cultures of these virtual worlds, and how to deescalate and deal with situations that arise within them.

James Bore is an independent cybersecurity consultant, speaker, and author with over a decade of experience in the domain. He has worked to secure national mobile networks, financial institutions, start-ups, and one of the largest attractions’ companies in the world, among others. If you would like to get in touch for help with any of the above, please reach out at james@bores.com

By Mark “Six” James CPO, EPS, CAS