The National Information Technology Development Agency (NITDA) is statutorily mandated by the NITDA Act of 2007 issued the Nigeria Data Protection Regulation to safeguard, regulate and protect the critical information infrastructure and data of individual and corporate bodies from breaches. This is an except from the regulation detailing the rights of a data subject.   PART THREE: 3.1 RIGHTS OF DATA SUBJECT (1) The Controller shall take appropriate measures to provide any information relating to processing to the Data Subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, and for any information relating to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the Data Subject, the information may be provided orally, provided that the identity of the Data Subject is proven by other means.   (2) If the Controller does not act on the request of the Data Subject, the Controller shall inform the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority.   (3) Except as otherwise provided by any public policy or Regulation, information provided to the Data Subject and any communication and any actions taken shall be provided free of charge. Where requests from a Data Subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: a) Charge a reasonable fee considering the administrative costs of providing the information or communication or taking the action requested; or,   b) Write a letter to the Data Subject stating refusal act on the request and copy The Agency on every such occasion through a dedicated channel which shall be provided for such purpose.   (4) The Controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.   (5) Where the Controller has reasonable doubts concerning the identity of the natural person making the request for information, the Controller may request the provision of additional information necessary to confirm the identity of the Data Subject.   (6) The information to be provided to Data Subject may be provided in combination with standardized icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing. Where the icons are presented electronically, they shall be machine-readable.   (7) Prior to collecting Personal Data from a Data Subject, the Controller shall provide the Data Subject with all the following information: a) the identity and the contact details of the Controller; b) the contact details of the Data Protection Officer; c) the purpose(s) of the processing for which the Personal Data are intended as well as the legal basis for the processing; d) the legitimate interests pursued by the Controller or by a third party; e) the recipients or categories of recipients of the Personal Data, if any; f) where applicable, the fact that the Controller intends to transfer Personal Data to a third country or international organization and the existence or absence of an adequacy decision by The Agency; g) the period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period; h) the existence of the right to request from the Controller access to and rectification or erasure of Personal Data or restriction of processing concerning the Data Subject or to object to processing as well as the right to Data Portability; i) the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; j) the right to lodge a complaint with a relevant authority; k) whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the Data Subject is obliged to provide the Personal Data and of the possible consequences of failure to provide such data; l) the existence of automated decision-making, including profiling and, at least, in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject; m) Where the Controller intends to further process the Personal Data for a purpose other than that for which the Personal Data were collected, the controller shall provide the Data Subject prior to that further processing with information on that other purpose, and with any relevant further information; and n) Where applicable, that the Controller intends to transfer Personal Data to a recipient in a foreign country or international organization and the existence or absence of an adequacy decision by The Agency.   (8) Where Personal Data are transferred to a foreign country or to an international organization, the Data Subject shall have the right to be informed of the appropriate safeguards for data protection in the foreign country. The Data Subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning him or her. Considering the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.   (9) The Data Subject shall have the right to request the Controller to delete Personal Data without delay, and the Controller shall delete Personal Data where one of the following grounds applies: a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or processed; b) the Data Subject withdraws consent on which the processing is based; c) the Data Subject objects to the processing and there are no overriding legitimate grounds for the processing; d) the Personal Data have been unlawfully processed; and e) the Personal Data must be erased for compliance with a legal obligation in Nigeria.   (10) The Controller

Even accounts belonging to banks and educational institutions were found on lists plastered across various hacker forums Amer Owaida 16 Apr 2020 – 09:34AM More than 500,000 Zoom accounts are now up for grabs on hacker forums hosted on the dark web. Some are going for less than a US cent apiece while others are given away for free. In a statement provided to BleepingComputer, cyber-intelligence company Cybel said that it noticed free Zoom accounts being offered on hacker forums around April 1st as a way for hackers to increase their notoriety. The accounts were posted on text sharing sites where ne’er-do-wells offer lists of email address and password combinations. Cybel reached out to one of the forums and was able to purchase a large number of accounts so it could warn its clients of potential breaches. The company was able to obtain about 530,000 accounts for about US$0.002 each, with accounts containing victims’ email addresses, passwords, personal meeting URLs and their HostKeys. Accounts belonging to financial institutions, banks, colleges and others were also found in the list. Since the COVID-19 pandemic has forced many companies to switch to remote working, Zoom and other videoconferencing services have enjoyed a surge in popularity, with its users becoming a favorite target for ne’er-do-wells. The accounts that are currently either on sale or being given away on hacker forums don’t seem to have been obtained from a cybersecurity attack or any kind of breach of Zoom’s infrastructure. Instead, the credentials are believed to come from credential-stuffing attacks. During these attacks, bad actors usually use bots to hammer sites with automated login attempts, leveraging credentials from past data breaches. Once the bot hits the right combination, its operators have access to the account. They can use this either to wreak havoc in the form of Zoom-bombing pranks or compile them into a list with other stolen credentials and sell them off on forums. Bleeping Computer went on to verify the veracity of the stolen data by selecting random email addresses and contacting their owners. One of the contacted people said that the posted password was an old one, which provides some credibility to the theory that some of the login details were obtained from old security incidents. How to stay safe One way to lower the chances of becoming a victim of a credential-stuffing attack is to refrain from recycling passwords across different services. “Hackers use very simple tools to re-use passwords that are stolen in separate data breaches – an attack known as ‘password stuffing’. They are then able to quickly attempt to access all accounts with the same email address as the user name,” says ESET security specialist Jake Moore. Zoom has been thrust into the limelight recently due to the privacy and security challenges as it had difficulties coping with the influx of new users. If you are a Zoom user you might also want to check out our article on how to secure your Zoom account so you are protected from any malicious activities or pranks in the future. Amer Owaida 16 Apr 2020 – 09:34AM Source: www.welivesecurity.com

Document Management. Redefined. M-Files and Mitiget bring to you the only intelligent information management platform that organizes content based on what it is, not where it’s stored. You can even connect to existing network folders and systems to make them more intelligent with built-in AI to automatically categorize and protect information. In this piece, you will be enlightened on setting up the ultimate work from home environment. 2/3 of managers report that employees who work from home increase their overall productivity. 86% of employees say they’re most productive when they work alone – devoid of distractions like inefficient meetings, office gossip, or loud office spaces. Employers who offered a work from home option had employee turnover rates fall by over 50%. 68% of millennial job seekers said a work from home option would greatly influence their interest in working for a company. What is Your Ultimate Workspace? Software Tools Document Management – M-Files Video Conferencing – Zoom, Teams, Goto Meeting Endpoint Protection & Security Real-Time Communication Tool – Slack, Teams Collaboration & Project Management Equipment Webcam Monitor(S) Computer High-Speed Internet Desk Comfortable Chair 13 Tips For Staying Productive Working From Home Get Your Home Office All Set Up. Monitor, keyboard, mouse, chair, printer… get everything you need set up the way you like it. Maintain A Dedicated Office Space. You need an office space that is for business only. Your work setup should be separate from your personal setup. Use Quality Technology To Stay Connected. You need basic technology to stay connected — project management, collaboration, communication and document management. Sustain Regular Hours. Make a schedule and stick to it. Know when to work and when to call it a day. Have A Morning Routine. Routines help us get in the groove. Establish a routine to get into the right headspace. Get Dressed. Taking a shower and getting properly dressed goes a long way towards feeling energized and ready for the day. Have A Sit-Down With The Family And Lay Out A Few Rules. Have a family meeting and lay some ground rules about the space you need to be productive working from home. Take Breaks. Allow yourself to take a lunch hour and a couple fifteen-minute breaks to clear your head. Exercise And Stretch Periodically. Exercise gives your body a jolt of endorphins. Take one of those breaks and stretch or go for a walk. You’ll feel so much better afterwards. Leave Home If You Can. Try to step away from your workspace regularly. The fresh air and natural light are a welcome sight. Discover Your High Productivity Peaks. Find out what your most productive times of day are and build your work schedule around those periods. Update Your To-Do List Every Day. It can be challenging to keep track of your priority items, tasks and deadlines. Make it a habit to use a to-do list and update it daily. Check In With Coworkers Frequently. Set aside the time to meet with your team and catch up. It’s healthy for you and healthy for them… and everyone feels more connected.

The COVID-19 pandemic has resulted in many people working from home for the first time. Working from home has specific cybersecurity risks, including targeted cyber-crime. When compromised, unauthorized access to your stored information can have a devastating effect on your emotional, financial, working life and the organization you work in. To ensure your business, personal data, and work data is safe from hackers, Mitiget has enumerated some cybersecurity tips to help you. Guide to Employers As an organization, you have duty of care to protect your information asset and your stakeholders. Hence, ensure that the corporate Virtual Private Network (VPN) solution scales and is able to sustain a large number of simultaneous connections. Provide secure video conferencing for corporate clients (both audio/video capabilities). If you are using the subscription based platforms like zoom meeting, goto meeting and so on, configure the security settings and ensure proper authorization is established for any attendee to each meeting. All the corporate business applications must be accessible only via encrypted communication channels such as SSL VPN, IPSec VPN. You may need to find out from the IT or security team what is in place and ensure it give some assurance of encryption for all data transmissions or communication. Access to application portals should be safeguarded using multi-factor authentication mechanisms. Prevent the direct Internet exposure of remote system access interfaces (e.g. RDP). Mutual authentication should be preferred when accessing corporate systems (e.g. client to server and server to client). Provide where possible corporate computers/devices to staff while on teleworking; ensure that these computers/devices have up-to-date security software and security patch levels and that users are regularly reminded to check patch levels. It is advisable that a replacement scheme for failing devices is also in place. BYOD (Bring your own device) such as personal laptops or mobile devices must be vetted from the security standpoint using NAC, NAP platforms. For example, there should be periodic patch checks, configuration checks, AV checks, etc. Ensure that adequate IT resources are in place to support staff in case of technical issues while teleworking; provide relevant information, such as on contact points, to staff. Ensure policies for responding to security incidents and personal data breaches are in place and that staff is appropriately informed of them. Guide to Employees Use corporate (rather than personal) computers where possible – unless BYOD has been vetted confirming you don’t have vulnerabilities. As far as possible, do not mix work and leisure activities on the same device and be particularly careful with any mails referencing the corona virus. Secure your home office – Physical security shouldn’t go out the window when you’re working from home. Just as you lock them up the office when you leave for the day, do the same when working from home.  Laptops can be stolen from your backyard, living room or home office. Take your laptop inside when you go and make lunch and lock the door to your home office. Keep your home workspace as secure as you keep your normal office. Connect to the internet via secure networks; avoid open/free WiFi or hotspot. Most WiFi systems at home these days are correctly secured, but some older installations might not be. With an insecure connection, people in the near vicinity can snoop your traffic (more technical people might be able to hijack the connection). Cyber-criminals look to exploit default passwords on home routers because of not many people bother to change it, leaving their home network vulnerable. Changing your router’s password from the default to something unique is a simple step you can take to protect your home network from malicious actors who want access to your devices. The solution is to activate the encryption if it hasn’t been done already and/or to adopt a recent implementation. Avoid the exchange of sensitive corporate information (e.g. via email) through possibly insecure connections. Avoid oversharing your screen – During online meetings, be cautious when sharing your screen. If possible, don’t leave any windows open that you don’t want to share. Accidents do happen, and sometimes you might share something that you didn’t mean to. While it can be awkward, it’s also a privacy issue. You might be oversharing content that is not meant to be viewed by others. As far as possible use corporate Intranet resources to share working files. On the one hand, this ensures that working files are up-to-date and at the same time, sharing of sensitive information across local devices is avoided. Be particularly careful with any emails referencing the corona virus, as these may be phishing attempts or scams (see below). In case of doubt regarding the legitimacy of an email, contact the institution’s security officer. Data at rest, e.g. local drives, should be encrypted (this will protect against theft / loss of the device). Antivirus / Anti-malware must be installed and be fully updated daily. The system (operating system and applications used, as well as anti-virus system) needs to be up to date. Lock your screen if you work in a shared space you should really avoid co-working or shared spaces at this moment. Do not share the virtual meeting URLs on social media or other public channels. (Unauthorized 3rd parties could access private meetings in this way. Mitiget recommends cybersecurity tips for teleworking.

Internet-facing systems and applications pose security risks. These security risks are the results of vulnerabilities present within the systems and applications which can be exploited for malicious purposes. A vulnerability is any mistake or weakness within the security procedures, design, implementation, or any control that will lead to the violation of the system’s security policy. Vulnerability Assessment and Penetration Testing (VAPT) employs a holistic approach to defending the cyber assets of an organization. Combining both Vulnerability Assessment (VA) and Penetration Testing (PT), VAPT addresses the questions “What are the issues within the network?” and “What can be determined attacker do to comprise the network?” Vulnerability Assessment focuses on internal organizational security while Penetration Testing looks to mitigate external risks. Hence, VAPT provides enterprises with a more comprehensive evaluation of the threats facing their applications, systems and networks. This enables enterprises to better protect their systems and data from malicious attacks. Vulnerability assessment employs assorted automated tools and manual testing techniques to determine the security posture of the target system. It is aimed at network devices, servers, and systems to spot key vulnerabilities and configuration issues that an attacker can benefit from. It is generally conducted within the network that consists of internal devices and since of its low footprint, it is can be performed frequently. This process identifies all the breach points and loopholes that can be leveraged by an attacker to perform fraudulent intrusion activities. Penetration testing focuses on identifying the assorted possible routes that an attacker can use to gain access to the network. It also identifies the potential damages and further compromise to the network that an attacker can do once the attacker has gained access to the network. Penetration testing utilizes the identified set of vulnerabilities in vulnerability assessment is employed as an input vector. This process of VAPT helps in assessing the effectiveness of the security measures that are present on the organization network. A good VAPT process should incorporate the subsequent steps: Determining the objectives and scope of the process: the primary step is about the goal and scope of the assessment. It involves clearing stating the target of the assessment, determining which systems and networks are going to be assessed, identifying where any sensitive data resides, and which data and systems are most crucial. Vulnerability scanning: The identified key systems and networks are scanned, either manually or via automated tools, employing threat intelligence and vulnerability databases to spot security flaws and weaknesses, and separate false positives. The goal is to find vulnerabilities that may be exploited. Information gathering: The identified vulnerabilities are analyzed existing exploits or new exploits for the vulnerabilities detected are looked for or created. This helps in formulating an idea for penetrating the network and systems. Exploitation phase: this is often an important step because the exploits chosen are wont to launch targeted attacks on the systems and network. Vulnerability analysis and report preparation: The results of the exploitation phase are then analyzed. Each vulnerability is ranked supported the information in danger, the severity of the flaw, and therefore the damage that would be caused by a breach of the affected system. The goal is to quantify each threat and to see the amount of risk behind each flaw and its potential impact. Detailed reports are prepared which can provide a transparent sense of the causes of the vulnerabilities, their potential impact, and therefore the suggested methods of remediation for taking corrective actions. Remediation: Finally, the recommendations actions must be taken to eliminate the vulnerabilities discovered. It can be done simply via a product update or through something more involved, from the installation of recent security tools to an enhancement of security procedures. The ranking provided within the report helps to prioritize this process, ensuring that the foremost urgent flaws are handled first. It’s also worth noting that some flaws may have so little impact that they will not be well worth the cost and downtime required for remediation. VAPT Best Practices Scan every device within the network: Failing to scan every device and access point leaves the network and systems receptive weaknesses. Scanning all assets within the ecosystem helps wake up light the assorted vulnerabilities within the infrastructure and allows the formulation of a remediation plan or acceptance of risk. Additionally, create a list including all devices within the network irrespective of their function, and choose which targets to incorporate within the vulnerability scanning list from your inventory. Perform VAPT frequently: The quantity between consecutive VAPT processes may be a risk factor because this gap between scans leaves your systems receptive new vulnerabilities. The spec, device impact on the network, and other factors are the deterministic factors to determine the frequency vulnerability scanning and remediation. Prioritize the patching process: as an example, patching internet-facing devices for all discovered vulnerabilities is more important than patching similar devices that have already been blocked by settings or firewalls. Prioritizing doesn’t mean neglecting; it’s a time-management practice that’s required because of resource limitations. it’s essential to target assets that provide the best risk levels to the organization. Document all scans and their results: Every vulnerability scan should be scheduled employing a management-approved timetable, with an audit process mandated to produce detailed reports covering each scan and its results. By documenting the scan run in keeping with its approved timetable, the organization can track vulnerability trends and issue recurrence, uncovering susceptible systems, and establishing accountability. Reports should be readable to technically savvy business teams to a certain extent, but should also be accessible to non-technical management and high-level personnel, without requiring interpretation. Establish a remediation process: With documented scans results in place and a priority assigned to each device, the remediation process should dictate specific levels of severity and the urgency to remediate each discovered vulnerability, including the required time-frame. Mitiget recommends that VAPT be carried out twice annually and after each major change in the production environment.

This report provides an overview of the most common threats and vulnerabilities in Q1 2020. There has been a significant rise in phishing emails, ransomware attacks, zero-day exploits of technology vulnerabilities and activities of targeted threat groups. These are some of the top common threats: Phishing Emails With the global spread of COVID-19, there has been a large increase in phishing attacks. The pandemic has become the preferred lure in phishing campaigns targeting individuals and organizations. Threat actors have capitalized on the expanding situation to both targets and impersonate different organizations. The phishing campaigns have used the common tactics of attaching malicious documents or including a link to a malicious site while preying on the recipient’s desire for additional information on the evolving scenario. Another tactic used by actors in successful phishing campaigns is the use of domains resembling that of the legitimate one for their attack. This can easily be overlooked by the target of the phishing email and lead them to believe the link is safe. The phishing campaign has seen the increasing use of emails with attached documents disguised as relief payment information from the government. The recipients are asked to fill out the attached form in order to receive their relief payments. However, the document contains malware that infects the host. To mitigate this risk, there should be security awareness training to educate teams on ways to recognize a phishing scam and other common social engineering tactics. Teams must avoid suspicious attachments and not enable of macros on untrusted documents. It is good practice to double-check any links by hovering over them to ensure you will not be redirected to a fraudulent website. URL domain names should be reviewed carefully for typos or missing characters. Also, IT departments must provide simple methods for employees to report suspicious messages. Ransomware There has been a resurgence of ransomware attacks, with recent attacks focused on international healthcare, local government, and education sectors, in particular. A ransomware cyber-attack occurs when malicious software is used to deny a user or business access to a computer system or data. The malware is typically spread through phishing emails or visits to malicious websites and asks for payment for the files to be unlocked. The ongoing use of ransomware as an income stream for threat actors and cyber-criminals continues to increase. As with most malware, ransomware operators have started to add features that place victims under more pressure to pay up. Started by the hacker group Maze, and now being widely adopted by others, attackers can now steal files before starting the encryption process for a system. The operators then leverage the access to these files, along with the threat of public release, to demand that payments be received in a timely manner. To further increase the severity of the situation, the stolen data often contains personal employee information or sensitive business information. The latest ransomware also uses the wake-on-LAN feature to turn on devices that are turned off on a compromised network in order to encrypt offline devices and use spam and malicious attachments to infect victims. A variant of ransomware reboots infected Windows systems into safe mode to bypass the antivirus first and then encrypts victims’ files. A certain type of ransomware targets industrial control systems and encrypts all Windows devices connected to it. Technology Vulnerabilities The first quarter of 2020 saw the active exploitation of several zero-day vulnerabilities with many technology companies affected by these exploits. Prominent examples for such vulnerabilities include a flaw in Citrix NetScaler ADC and Citrix NetScaler Gateway exposing 80,000 companies around the globe, various critical Microsoft vulnerabilities, and Zoom, a popular video conferencing platform, been targeted to execute conference hijacking attacks during meetings. Zoom has released a patch for a vulnerability that made it possible for attackers to find and join unprotected meetings. Also, vulnerabilities in Pulse Secure VPN environments are being exploited to install ransomware. To mitigate this risk, patches should be applied as soon as possible to limit exposure time. If a patch is not available at the time of disclosure, but mitigation steps are available, consider implementing the mitigation until the patch is published with critical systems. Threat Groups The first quarter of 2020 has also seen an increase in the activities of advanced persistent threat groups (APT). APT groups that typically receive direction and support from established nation-states. Like other attackers, APT groups try to steal data, disrupt operations or destroy infrastructure.  However, APT attackers pursue their objectives for relatively long periods. They adapt to cyber defenses and frequently retarget the same victim. In February 2020, the Cybersecurity and Infrastructure Security Agency (CISA) released details on seven malware tools that they identified as being used by cyber group Hidden Cobra (Lazarus Group/APT38). The malware files have been named as follows: Hoplight, Buffetline, Artfulpie, Hotcroissant, Crowdedflounder, Slickshoes, and Bistromath. There has also been a rise in activity from the APT36 threat group, which used spear phishing and watering hole attacks to gain access with the goal of delivering the Crimson RAT malware. The FIN7 group has been connected to an attack campaign targeting organizations with malicious USB drives, often known as USB Rubber Ducky. The USB drives are usually mailed to Human Resources, Information Technology, or Executive Management employees and the package often contained an additional gift item such as a teddy bear or gift card. Mitiget reviewed quarter 1 2020 security landscape globally and designed this report to inform our client and associates the top areas to continue oversight on through the year. We also explored some interesting stats and outline how companies and individuals can protect asset that supports collaboration, enhances productivity, and simplifies information governance and security.

As we all try to assess the impact of coronavirus, inevitably some of those thoughts center around how this is impacting our work life, and some of the longer-term impacts for businesses. While the world is dealing with the worst health crisis of the last 100 years, I’m trying to avoid the constant deluge of bad news as much as possible. But it’s hard not to reflect on the potential ramifications for businesses and the knowledge workforce. I believe this is arguably the most significant disruption of our lives, and hopefully we won’t see anything of this magnitude again for another 100 years. So, what could be the implications for business professionals like us? First, let’s look backwards and try to put this into context. Historians say that there have been four industrial revolutions. The first two moved us from an agrarian to a manufacturing society. The third modernized society in the 1950s and the fourth, of course, is the technology revolution of the last twenty years. What about our experience today as a result of the coronavirus? How far-ranging will the business and societal effects be? I believe that the nature of work has been changed forever. Some industries will fail, and some will thrive. We are already seeing examples of this all around us. The concept of working remotely has been around for a long time and the current situation is simply accelerating the need for businesses to fully utilize available technologies to resolve it. Companies must now enable a more flexible workplace and ensure their knowledge workforce is fully productive while working remotely; there is no turning back and this is no longer a nice to have. This is now business critical. That is not to say that we will all be remote from now on, but we won’t go back to the way it was either. Some companies were better prepared than others to have a productive, engaged remote workforce when this pandemic hit. I happen to work for a company that provides seamless access to documentation and workflows, while ensuring data security and compliance. M-Files is truly an example of how companies that are well prepared with useful technologies can ensure the same worker productivity in a remote environment. However, companies that weren’t proactive and prepared for a quick shift to remote work are really struggling. In the near term, their workforce may be propped up and running, but not as efficiently. Employees may find themselves trying to access or recreate documents, managing document chaos, unable to ensure data security, and finding it difficult to provide adequate service and support to their customers. The long-term implications of this are relatively easy to imagine. The other day I was listening to an economist at one of the top financial firms and she said that “the cat is out of the bag as far as remote working goes.” This is a trend that has been making slow progress for years, but the immediacy of the current environment has forced our collective hand. It’s hard to believe that we’ll go back to the way it was. Millennials have been pushing for this flexible work environment for some time. Many companies will rethink how they structure their workforce and office environments. Why pay for expensive office space for every employee when more flexible office spaces could prove very workable? I can think of a few other big shifts in the way we might work after the pandemic is under control. Business travel will change going forward. It is becoming obvious that more can be done virtually than we ever thought. More sophisticated technologies will emerge that continue to blur the lines of what can be done virtually and what requires an in-person meeting. Also, right now, companies are forced to look for savings because of the serious economic impact of COVID-19, and one area of significant potential savings is non-essential business travel. Companies are beginning to realize that travel isn’t as necessary as they once thought, and they can generate substantial savings from reduced travel. Yes, this is an extreme situation, and obviously traveling will resume, but I don’t believe it will be with as much abandon as before. I believe travel budgets will be appreciably smaller than they have historically been. Virtual events will replace many physical events. I can attest to the fact that there is a substantial shift going on right now in the events space. All physical events — trade shows, partner events, customer events, conferences — have been cancelled and we are all making a hard pivot towards 100% digital events. We are spending money that perhaps we wouldn’t have spent previously on sophisticated virtual event platforms that can provide an immersive, interactive experience remotely. I view events as a double-edged sword. They are a necessary component of the marketing mix, but they come at a great cost. Marketing teams spend a large portion of their budgets on physical events, because we have always felt that they were necessary. Generally, they can be a great way to build brand recognition but typically have low measurable ROI. Are we going to do physical events in the future? Absolutely… but certainly not as much as we used to. I, for one, welcome the opportunity to host engaging digital events. A virtual event has the potential to be a much more tailored, individualized and relevant experience. I hope that we can reach more people and deliver virtual experiences that are truly meaningful to our audience. Above all, transforming events from low ROI physical gatherings to digital experiences that drive new opportunities with better ROI is extremely compelling. Isn’t that what we always wanted them to be? There is an entire events industry that will need to find ways to adapt to this new reality. Personal connections are and always will be an important part of life and business, but I believe the shift to digital events is here to stay. And lastly, there is a question