The metaverse has well and truly made it into the cultural zeitgeist, but who is coding it? Who is managing it? In this article, Emmanuel Benzaquen, CEO of Checkmarx sets about answering these questions as well as explaining why you should care.
The next iteration of the internet, also known as web 3.0, is in full swing. The idea is to make the next generation of the internet more immersive, interactive, decentralised and technologically advanced for today’s digitally enabled communities. At the very centre of this web 3.0 transformation, is the metaverse.
It has been hailed as the next frontier for cyber security experts, this new-gen technology has transformed into a multi-billion-dollar industry.
Although the metaverse is full of promise, there are understandable concerns about its security. Most current security solutions and technologies were not developed with decentralised applications in mind. Therefore, standard measures, such as endpoint security, multi-factor authentication, or network firewalls, will not be enough to protect this domain.
Given the unorthodox features of the metaverse, such systems need a deep layer of embedded application security. However, to comprehend the critical need for application security (AppSec) in the metaverse, we must first identify the unique traits and features of this next-generation virtual technology.
How much do we really know about the metaverse?
The metaverse can be defined as an interconnected set of 3D virtual worlds that facilitate interactive media environments. The goal of such platforms is to build digital environments where people can engage naturally, just as they would in the real world. As an extended integration of Virtual Reality (VR) and Augmented Reality (AR), there are endless possibilities whether it’s interacting with one another, buying products, attending social or community events, investing in assets, creating and selling art, or just meeting new friends.
According to recent reports, there are over 400 million active monthly users in different metaverse platforms today, with market size being valued at over $40bn in 2022. And this will only continue to grow, as more brands and artists are heavily promoting this concept.
So, the future of this innovative and engaging technology is full of excitement for sure, but what about its security?
Is our data safe in the metaverse?
As the number of users grows, so too will the number of potential threats. When users join such virtual environments, they reveal not only their identities but also highly sensitive network data such as their IP addresses. Even more so, when these platforms are used to facilitate financial transactions, users are often required to provide sensitive financial information.
The purpose of metaverse platforms is to facilitate frictionless and engaging experiences. Therefore, traditional payment mechanisms requiring centralised entities (like banks) are irrelevant in such environments.
When making a purchase in the metaverse, would you be willing to take off your VR headgear and reach out to your smartphone every time to verify a transaction? This is anything but immersive. This is why many of these virtual marketplaces accept cryptocurrency and other decentralised assets for payment.
This is concerning because such transactions require users to share their private wallet details. Moreover, there’s often no feature to determine or authenticate the true identity of the receiver of the funds. So, it’s evident that financial data plays an integral role in this space and should be a subject of significant consideration during development.
The overwhelming cybersecurity concerns
As the metaverse follows a decentralised model, development initiatives for such projects are not governed by any rules, oversight agencies, or security procedures. It is the exclusive responsibility of the platform’s creators to safeguard users’ personal information.
This implies that top executives and other project managers usually have no obligation to discuss the internal information of the development team. Who is responsible for writing the code for these applications? What entity is in charge of safety measures? Who exactly is making sure that everyone follows the rules? These questions are often left unanswered in this space.
These anonymous aspects create a lack of accountability for such platforms. Who develops the open-source code and the APIs that so many businesses will utilise to create new apps and new areas in the metaverse? Without answering these questions, we can’t ensure compliance.
With so many security concerns, these interactive virtual worlds are the perfect hunting ground for cybercriminals. In fact, metaverse companies reported a 60 per cent increase in cyber-attacks and an 85 per cent increase in online fraud last year.
Can AppSec be the new landscape for metaverse security?
To make these next-gen virtual worlds a secure and safe space for users, developers and project leaders must emphasise security at the core application level. Organisations that are venturing into this space should focus on developing their metaverse platform as a secure application, rather than trying to integrate security measures after development.
This is where AppSec comes in. Executives and project leaders must incorporate solutions that can find, fix and prevent security vulnerabilities in the source-code – and even solutions that can verify the trustworthiness of contributors to coding projects. AppSec solutions can incorporate effective security policies throughout the development life cycle so that any potential vulnerabilities are identified and remedied during the production phase.
Automated AppSec solutions can scan codes in real-time as developers are writing them and remediate potential software vulnerabilities during development, meaning that metaverse platforms come out of the production phase with built-in security measures that reduce the risks of conventional threats such as data exfiltration and identity theft.
It will be years until the metaverse is perfected but in the meantime, project leaders and executives must not forget their security responsibilities. A secure platform builds more credibility in the industry and extends the user base. That’s why application security should be at the heart of every metaverse project going forward.
