With the metaverse dominating today’s tech news cycle, businesses must now contend with a potentially seismic shift in how we use the internet. There is certainly much excitement about the new possibilities to engage audiences. Yet, as security comms specialists, we’re also conscious of the cyber minefield that we’ll all have to navigate.
Once Upon a Time
Originating from the 1992 science fiction novel Snow Crash as a portmanteau of “meta” and “universe”, the term “metaverse” now applies to a vision of the internet as a single, universal, and immersive 3D virtual space, enabling new forms of entertainment, collaboration, and social interaction between users.
The first example of a shared virtual world was launched in 2003 by Linden Labs and called Second Life; an online multimedia platform that allowed users to create and customise their online avatars and participate in an entirely user-generated virtual environment. However, what differentiates the present-day metaverse is its accessibility, scope and business potential. The advancement of technologies such as VR and AR allow for more immersive and interactive experiences, thus moving beyond the realm of gaming and entertainment to create new opportunities for businesses to engage their audiences in unique and innovative ways.
The Business Potential of the Metaverse
The broad appeal of the Metaverse is backed up by research from Gartner, which indicates that by 2026, 25% of us are predicted to spend at least one hour a day in the metaverse for work, shopping, education, social media and/or entertainment. As a possible next iteration of the internet, the proliferation of the metaverse presents new ways companies can interact on a B2B and B2C level, enabling the creation of virtual storefronts, hosting virtual events, and offering virtual experiences that are not possible in the physical world.
Furthermore, the metaverse has the potential to be positioned as “tech for good”. Tech companies for instance will be able to create simulations and to innovate R&D processes, allowing businesses to experiment with new technologies and break down physical barriers. However, on the flip side of “tech for good”, just as the internet paved the way for cyber warfare, the rise of the metaverse will undoubtedly open new avenues for cybercrime. Businesses looking to capitalise on the metaverse must be strategic and cautious, ensuring they protect their assets and those of their customers.
The Dark Risks
Companies stepping into the metaverse risk revealing new attack surfaces for cybercriminals and bad actors. The possibility of financial data, trade secrets, and intellectual property being exposed is certainly feasible. In the physical world, organisations protect their data by implementing firewalls and take numerous other robust security measures, but the lines between the virtual and physical worlds are blurred in the metaverse. Technologies, processes and behaviours will have to evolve in line with these new realities.
Relying on blockchain technology to verify virtual purchases, the metaverse remains vulnerable to the same criminal activity as traditional blockchain networks. Virtual assets, NFTs and cryptocurrencies, like any digital good, are vulnerable to hacking and theft, with the added complexity of the metaverse environment increasing the risk of these crimes. Furthermore, the use of NFTs and cryptocurrencies in the metaverse may increase the likelihood of money laundering and other illegal activities, so, as with any financial transaction, it will necessitate regulation to prevent criminal activity.
As we know phishing emails and messaging scams are common social engineering techniques used by cybercriminals to steal passwords, personal information, and money. Such impersonations are likely to increase in the metaverse, with fraudsters creating an avatar that looks like you, and using this to conduct attacks against your friends or colleagues – or, as with any other online account, they could simply hack into the real one.
The Digital Wild West
Until the development of an appropriate regulatory framework the metaverse risks becoming a digital wild west. Better legal protections of user data privacy and intellectual property rights will inevitably follow. Yet, they currently sit in the lap of the gods. By its virtual nature, without any controls in place it’s simple to copy, manipulate, and steal digital assets. What recourse can individuals take if personal information is leaked within the virtual world? How can companies protect their branding and assets from being illegitimately appropriated as avatars for bad actors looking to troll and vandalise?
That said, the EU Commission has committed to put forward an “initiative on virtual worlds, such as [the] metaverse.” This could take two primary forms – an update on the existing Digital Markets Act (DMA) and Digital Services Act (DSA) or an entirely new piece of legislation explicitly focused on the metaverse. Additionally, industry collaboration will be crucial to ensure open standards. Already, technology companies have jointly launched the?Metaverse Standards Forum?to develop industry guidelines that ensure immersive VR worlds are compatible. But for now, anyone participating in the metaverse needs to do so with caution.
Metaverse Success: A Game of Two Halves
In summary, while full adoption of the metaverse lies in the future, current investments to the tune of $10 billion+ from venture capital and private investors stand testament to its full potential.
And just as social media platforms like Facebook and YouTube have previously revolutionised business, early adopters are likely to reap the greatest rewards in establishing an early virtual brand presence. A cautious approach to protecting the data of users will be vital in ensuring protecting the brands of those early adopters, ensuring they don’t become famous for the wrong reasons.
