Who should bear the consequences of a data breach caused by a cyberattack? Until now, each company has addressed this question individually. However, new international directives have clearly defined who must ensure the implementation of security practices and their enforcement. The new trend of additional financial liability for the board, initiated in the United States, has the potential to spread to other countries.

On average, the CSIRT GOV Incident Response Team, led by the Head of the Internal Security Agency, receives 1,000 reports of cybersecurity threats daily. This highlights the scale of cybercriminal activity.

The main targets of these attacks are employees, including high-level managers who have access to confidential company information. According to the “2024 Data Breach Investigations Report,” about 68% of security breaches involved a human element, such as user error or successful social engineering attacks, indicating that the human factor remains a critical weak point in organizational security.

So far, it has been difficult to determine who should bear the consequences of a cyberattack. An innovative idea was proposed by Brad Smith, Vice President of Microsoft, during a hearing before the House of Representatives committee on corporate security issues. Microsoft will become one of the first companies where cybersecurity directly influences executive bonuses.

We’ve coupled this expansion of resources with important changes in the company’s security governance. In addition to the critical longstanding role of the company’s Chief Information Security Officer, or CISO, we have created the Office of the CISO with senior-level Deputy CISOs to expand oversight of the various engineering teams to assess and ensure that security is “baked into” engineering decision-making and processes.

Ultimately, culture change requires accountability. This is something all our senior leaders understand, starting with Satya as the company’s CEO. Rather than delegate overall security responsibility to someone else, he has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security.

This is also why we announced on May 3 that part of the compensation of the company’s Senior Leadership Team will be based on our progress in meeting our security plans and milestones. Since that time, we’ve worked to refine these compensation and other accountability steps for the next fiscal year, which begins on July 1. [1]– Brad Smith stated before the United States House Committee on Homeland Security.

Actions initiated by Microsoft are seen by analysts as having the potential to become a global trend. How is the situation in the European Union, which typically implements changes more slowly than the United States?

EU cybersecurity regulations introduced in 2016 were updated by the NIS2 directive, which came into force in 2023. The existing legal framework has been modernized to keep pace with increasing digitalization and the evolving cybersecurity threat landscape. EU countries are required to implement the new guidelines into national law by October 17 this year, for example, through legislation.

According to PwC estimates, the new directive will cover over 6,000 entities operating in 18 sectors of the economy in Poland.[2]

In Chapter IV of the directive, Article 20 states:

1.   Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.

The application of this paragraph shall be without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials.

2.   Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity. [3][

As we can see, the European Commission has introduced provisions holding senior management, including board members, accountable for ensuring organizational compliance with cybersecurity risk management requirements and incident reporting. The directive mandates that those in managerial positions ensure appropriate security measures and are responsible for their effectiveness.

The NIS2 directive encompasses a wide range of entities, both public and private, that provide services critical to the functioning of society and the economy.

Entities Covered by the Directive:

Essential Entities:
– Energy Sectors: Electricity, gas, oil
– Transport Sectors: Aviation, rail, water, road
– Banking and Financial Market Infrastructures
– Healthcare Sectors: Hospitals, healthcare providers
– Drinking Water and Wastewater Management
– Digital Infrastructure: DNS service providers, domain registries, cloud computing providers
– Public Administration: Central and regional entities

Important Entities:
– Postal and Courier Services
– Waste Management
– Production, Manufacturing, and Distribution of Chemicals
– Food Production: Entities involved in industrial production and processing
– Manufacturing Entities: Production of medical devices, computers, electronics, vehicles
– Digital Service Providers: Social media platforms, search engine providers
– Research Organizations

Essential and important entities must implement appropriate security policies to ensure a systematic and thorough risk analysis. These policies should include an all-hazard approach, addressing all possible threats, including those related to physical security. The responsibility for implementing these policies lies directly with the boards of these entities.

Do you want to discuss the cybersecurity of your company? Contact us.

[contact-form-7]

[1] https://blogs.microsoft.com/on-the-issues/2024/06/13/microsofts-work-to-strengthen-cybersecurity-protection/

[2] https://www.pwc.pl/pl/uslugi/nis2-nowe-wymogi-dotyczace-cyberbezpieczenstwa.html

[3] https://eur-lex.europa.eu/eli/dir/2022/2555/oj

I believe that the Android OS needs no introduction. It is currently the most popular smartphone operating system. However, the days when Android was only used in consumer electronics are behind us. Today we can meet Android devices at every step. It is increasingly used in industries such as security, automation, logistics, sales, hospitality, etc. Due to its ease of use, flexibility, level of customization and lower cost, Android devices are the choice of many enterprises and organizations. However, for many companies Android systems are not considered safe enough for use in the workplace or like all mobile devices are too distracting. One of the best solutions to the above problems is the Kiosk Mode tool, which allows us to convert your Android device into a dedicated app, while providing additional security and reducing additional distractions. Enjoy your reading!

COSU – corporate-owned single use device

Dedicated devices (formerly called corporate-owned single-use, or COSU) are fully managed devices that serve a specific purpose. Thanks to this, it is possible to maximize the use of the device, while limiting use of personal and non-supervised functions like telephony, messaging etc. We deal with many such devices every day. These include vending machines, automatic ticket printers, parking meters or interactive information boards in shopping malls. COSU allows IT administrators to remotely control all these devices and can lock the device for a specific application. This prevents users from using other applications or performing other activities on these devices.

Kiosk Mode

Kiosk mode allows to turn Android devices into single-use devices by running only one application or a specific set of applications. Starting with Android 5.0 Lollipop, the system offers two ways to lock the device for a specific purpose:

• App pinning – Using the app pinning feature, users can temporarily pin any installed app on the screen. The navigation buttons (Home and Recent apps) are visible but inactive. The user can exit this mode by holding down the Home and Recent apps buttons simultaneously.
• Lock task mode – This is an even more effective way to switch your Android device into a single-purpose kiosk. Only applications whitelisted by the Device Policy Controller (DPC) may be blocked. The navigation buttons (Home and Recent apps) are hidden. Exiting this mode is done by calling the stopLockTask() method. This mode is available to only device owner devices.

Running the application in Kiosk Mode gives us a number of benefits:

• device acts as a single application platform,
• hidden navigation buttons (Lock task mode),
• inactive status bar,
• automatic app startup with system startup,
• disabled notifications,
• blocked incoming calls,
• inactive transition to settings,
• working in full screen mode.

How to enable Android Kiosk Mode?

The first step is to implement the class inheriting from the DeviceAdminReceiver class:

class MyDeviceAdminReceiver : DeviceAdminReceiver() {
    companion object {
        fun getComponentName(context: Context): ComponentName {
            return ComponentName(context.applicationContext, MyDeviceAdminReceiver::class.java)
        }
    }
}

DeviceAdminReceiver is a class which provides a convenience for interpreting the raw intent actions that are sent by the system.

Then we have to inform the system that our application wants to become the device administrator. We can do this by adding a receiver in the AndroidManifest.xml file:

<application>
          ...
      <receiver
            android:name=".MyDeviceAdminReceiver"
            android:description="@string/app_desc"
            android:label="@string/app_name"
            android:permission="android.permission.BIND_DEVICE_ADMIN">
            <meta-data
                android:name="android.app.device_admin" />
            <intent-filter>
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED" />
            </intent-filter>
        </receiver>
    </application>

At this point, we can proceed to the installation of the application. Note that, in order to grant administration rights to the app, you must remove all existing users.  The easiest way is to apply a factory reset your device. It is important not to add a Google account to the device during the first start-up after the reset. List of steps for correct configuration is as follows:

1. factory reset on your mobile device,
2. skip the steps related to adding a Google account,
3. enable the developer mode and USB debugging on the mobile device,
4. install adb (Android Device Bridge) on your computer – it is automatically installed with the Android Studio environment,
5. install the application on a mobile device using Android Studio or by entering the following commands in the console:  

   1. adb install path / to / kiosk / application.apk

6. grant the application device administrator privileges:

   1. adb shell dpm set-device-owner pl.inero.deliverM8 / .MyDeviceAdminReceiver

Use the following code snippet to verify that the granting process was successful:

override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        mDevicePolicyManager = getSystemService(Context.DEVICE_POLICY_SERVICE) as DevicePolicyManager
        val isAdmin = mDevicePolicyManager.isDeviceOwnerApp(packageName)
        if (isAdmin) {
            println("You are an admin")
        } else {
            println("You are not an admin")
        }
    }

Depending on the needs, we can enable the user to disable the Kiosk mode via the interface (e.g. by confirming with a password) or completely block the exit from the application. With the help of the code snippets below, I will try to explain how you can control the device settings to get the solution that best suits your needs.

One of the parameters we can control is whether we keep the device on while the device is plugged in. “0” means  to never stay on while plugged in.

private fun enableStayOnWhilePluggedIn(active: Boolean) = if (active) {
        mDevicePolicyManager.setGlobalSetting(mAdminComponentName,
                Settings.Global.STAY_ON_WHILE_PLUGGED_IN,
                (BatteryManager.BATTERY_PLUGGED_AC
                        or BatteryManager.BATTERY_PLUGGED_USB
                        or BatteryManager.BATTERY_PLUGGED_WIRELESS).toString())
    } else {
        mDevicePolicyManager.setGlobalSetting(mAdminComponentName, Settings.Global.STAY_ON_WHILE_PLUGGED_IN, "0")
    }

If we want to impose restrictions on the user, we can use the method addUserRestriction(ComponentName admin, String key). The device user must have device administrator rights or a security exception will be thrown. This method can be called on an instance of DevicePolicyManager.

mDevicePolicyManager = getSystemService (Context.DEVICE_POLICY_SERVICE) as DevicePolicyManager

In our case, we have blocked the user from factory reset, adding new users, connecting external media, controlling the device volume and turning off the bar status:

private fun setRestrictions(disallow: Boolean) {
        setUserRestriction(UserManager.DISALLOW_FACTORY_RESET, disallow)
        setUserRestriction(UserManager.DISALLOW_ADD_USER, disallow)
        setUserRestriction(UserManager.DISALLOW_MOUNT_PHYSICAL_MEDIA, disallow)
        setUserRestriction(UserManager.DISALLOW_ADJUST_VOLUME, disallow)
        mDevicePolicyManager.setStatusBarDisabled(mAdminComponentName, disallow)
    }
private fun setUserRestriction(restriction: String, disallow: Boolean) = if (disallow) {
        mDevicePolicyManager.addUserRestriction(mAdminComponentName, restriction)
    } else {
        mDevicePolicyManager.clearUserRestriction(mAdminComponentName, restriction)
    }

If we want our application to start with the system startup, then we have to add the appropriate filters:

private fun setAsHomeApp(enable: Boolean) {
        if (enable) {
            val intentFilter = IntentFilter(Intent.ACTION_MAIN).apply {
                addCategory(Intent.CATEGORY_HOME)
                addCategory(Intent.CATEGORY_DEFAULT)
            }
            mDevicePolicyManager.addPersistentPreferredActivity(
                    mAdminComponentName, intentFilter, ComponentName(packageName, MainActivity::class.java.name))
        } else {
            mDevicePolicyManager.clearPackagePersistentPreferredActivities(
                    mAdminComponentName, packageName)
        }
    }

In order to run the application in full screen screen Kiosk Mode , the appropriate flags must be added:

private fun setImmersiveMode(enable: Boolean) {
        if (enable) {
            val flags = (View.SYSTEM_UI_FLAG_LAYOUT_STABLE
                    or View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION
                    or View.SYSTEM_UI_FLAG_LAYOUT_FULLSCREEN
                    or View.SYSTEM_UI_FLAG_HIDE_NAVIGATION
                    or View.SYSTEM_UI_FLAG_FULLSCREEN
                    or View.SYSTEM_UI_FLAG_IMMERSIVE_STICKY
                    )
            window.decorView.systemUiVisibility = flags
            window.decorView.setOnSystemUiVisibilityChangeListener {
                window.decorView.systemUiVisibility = flags;
            }
        } else {
            val flags = (View.SYSTEM_UI_FLAG_LAYOUT_STABLE
                    or View.SYSTEM_UI_FLAG_LAYOUT_HIDE_NAVIGATION
                    or View.SYSTEM_UI_FLAG_LAYOUT_FULLSCREEN)
            window.decorView.systemUiVisibility = flags
        }
    }

Finally, we use the startLockTask () and stopLockTask () methods to turn Lock task mode on / off:

private fun setLockTask(start: Boolean, isAdmin: Boolean) {
        if (isAdmin) {
            mDevicePolicyManager.setLockTaskPackages(
                    mAdminComponentName, if (start) arrayOf(packageName) else arrayOf())
        }
        if (start) {
            startLockTask()
        } else {
            stopLockTask()
        }
    }

Results

The above operations allow to change the Android device into a dedicated device, operating in full screen mode and preventing the user from using other functionalities. For the purpose of exemplification of our case, we used a mobile application, developed in our company for supply chain management. This application is a part of DeliverM8 platform, we developed in order to optimize and plan supply chain management tasks for the last mile delivery. You can read more about it here. Coming back to the topic of the blogpost, the final  effect is as follows:

Summary

In this blog post we showed how to quickly set up a configuration of a mobile application to get a single purpose device that meets our needs as much as possible. The use of the Kiosk Mode brings many benefits, such as increasing security or limiting access to undesirable functionalities, creating a solution tailored both to the needs of employees (inventory management, field service management, transport and logistics) and customers (hospitality check-in, self-service kiosks).

Google Workspace (GW) is a great tool for corporate collaboration that simplifies document flow between employees and allows you to use smart automation tricks to make your teamwork more agile and efficient. It also allows you to combine other Google services such as natural language processing and understanding, chatbots, Google Vision, built-in google databases and many others thus allowing to improve collaboration for corporate teams. In this post, I will show you how one of Google Workspace tricks, Google Apps Script, can be helpful in your corporate document creation and processing. We’re going to have a look behind the scenes of creating Header and Footer which is triggered with a single menu-item click! (not (CTRL+C, CTRL+V) x2 ). And to spice things up we’re going to write code in TypeScript in local IDE and then compile it to Apps Script code.

But before we do that, let’s just quickly explain what Apps Script is.

Basically speaking Apps Script is a Google Platform to develop business applications integrated with Google Workspace applications like Gmail, GDocs, etc. The code itself is a plain Javascript that has access to libraries that allows you to access the Google resources you need. (like a spreadsheet (GSheets) or the document (GDocs))

If you feel like you need to learn more about this then check The official AppScript overview page.

Environment Setup

Online Editor (JavaScript)

As mentioned before, we are going to develop the application in local IDE with Typescript, but if you think that you don’t need it (you really don’t have to). Then you can just open the online editor in your Google application like this:

Once you do that, you can just start writing code that you want, the main AppScript file should already be created. Please note that if you choose this approach you’ll be writing JavaScript code (just skip the types if you want to follow my code from the next chapters)

Local IDE (TypeScript/JavaScript)

To write TypeScript code you’ll need (guess what) a local IDE. I am using IntelliJ, but you can go with VS Code and it also should do the job just fine. Unfortunately, this is not enough to make this work. You’ll also need NodeJs and a package manager (I used npm), which is going to help us install type definitions for TypeScript and clasp.

Install commands:

npm install -g @google/clasp
npm i -S @types/google-apps-script

Clasp (Command Line Apps Script Projects) is what’s going to connect our code with the documents stored on our Google Drive. I won’t go into the details of using this command line. Just the basics that I had to use myself. Of course, if you need more then here’s the Apps Script clasp small guide.

After you install clasp you have to log in to your Google account (so that you can access your GDrive). After typing the command below you’ll be taken to the google login website where you’ll follow the instructions.

clasp login

Now you’re logged in and ready for action! 🙂 And by action, I mean creating a project. For that we’re going to use the following command:

clasp create

Which is going to ask you for the type of application that you want:

In today’s use-case, we’re going to select the docs.

After you do that your project should be ready to work on.

Few things to keep in mind:

• This is going to create a document in your GDrive.
• The document’s name is going to be the same as the name of the folder in which you created the project with clasp create.
• You probably will have to create file Code.ts yourself.

The Goal

Okay, so the actual thing that we want to achieve is the header footer, which can be triggered with a single click, like this:

And the click would result in this:

The Code

Now you’re probably ready to get to the actual coding. You can open the previously created Code.ts file and write some functions using google types definitions we installed before.

Again I am not going to go into details of every single interface and object defined in Apps Script, just the ones that were useful for this use case.

Style

First thing that we’re going to do is to define the text style:

function getTextStyle(): any {
const style = {};
style[DocumentApp.Attribute.BOLD] = false;
style[DocumentApp.Attribute.FONT_FAMILY] = 'Calibri';

return style;
}

This function is going to be used in both header and footer to provide the appropriate font-weight and font-family.

Logo

To display the company logo we’re going to create a separate function, which takes in a document paragraph to which the logo is going to be connected and desired size as arguments.

function addLogo(parentParagraph: GoogleAppsScript.Document.Paragraph, size: number): void {
const logoBlob = DriveApp.getFilesByName('Inero_Software_logo.png').next().getBlob();
parentParagraph.addPositionedImage(logoBlob)
.setLeftOffset(400)
.setHeight(size)
.setWidth(size);
}

As you can see here, we are using DriveApp, which allows us to get any file stored on our Google Drive, in this case, we are getting a logo (I don’t have to mention that it is on my GDrive, right?)

The setLeftOffset function is pushing the logo to it’s righteous place. (like you know, the image is on the right side not left… nevermind)

Header

First step of header and footer functions is checking whether the header already exists. (If somebody already has something in the header, adding more stuff through Apps Script could result in unwanted text/image setting.)

function addHeader(): void {

let header = DocumentApp.getActiveDocument().getHeader();
if (!header) {
header = DocumentApp.getActiveDocument().addHeader();
}
…
}

The logic here is pretty straightforward. We take our GoogleDoc using DocumentApp.getActiveDocument() and get the Header of the document. If it doesn’t exist then create it.

Easy.

But you may be wondering, what’s the DocumentApp . It is a class/service which allows you to open google docs stored on your GDrive (it doesn’t have to be the active one).

Next step is to put the content inside our header:

function addHeader(): void {

...

const style = getTextStyle();
style[DocumentApp.Attribute.FONT_SIZE] = 11;

let firstParagraph = header.appendParagraph('Inero Software sp. z o. o').setAttributes(style);
header.appendParagraph('Ul. Trzy Lipy 3, 80-172 Gdańsk, PL').setAttributes(style);
header.appendParagraph('inero-software.com').setAttributes(style);

addLogo(firstParagraph, 60);

header.appendHorizontalRule();
}

You can see what’s happening here:

• We set font-size
• We create 3 paragraphs, assign them the text and style
• We save the first paragraph to a variable, so we can use it as a reference point for inserting the logo
• At last, but not least, we append the horizontal rule which gives a nice touch to our header

The footer function is almost exactly the same, so I won’t be describing it. But here’s the code since for quick overview:

function addFooter(): void {

let footer = DocumentApp.getActiveDocument().getFooter();
if (!footer) {
footer = DocumentApp.getActiveDocument().addFooter();
}

const style = getTextStyle();
style[DocumentApp.Attribute.FONT_SIZE] = 10;

let firstParagraph = footer.appendParagraph('inero-software.com').setAttributes(style);
footer.appendParagraph('hi@sandbox-www.devel.inero.com.pl').setAttributes(style);
footer.appendParagraph('VAT ID: PL583327270').setAttributes(style);

addLogo(firstParagraph, 40);
}

Is that it!?

No, we still need to create the aforementioned menu, right? Here’s the function:

function onOpen(e): void {
DocumentApp.getUi().createAddonMenu()
.addItem('Add corporate Header & Footer', 'addFooterAndHeader')
.addToUi();
}

Here DocumentApp allows us to access the user interface and add what we want to it. And what we want is the menuItem. addItem() function takes in the text which will be displayed in the UI and the function to trigger when clicked.

Function onOpen is one of the simple triggers , and onOpen is triggered whenever a document is opened (so every time you click F5 the menuItem is being added).

Here’s the function which is executed when you click the menuItem:

function addFooterAndHeader(): void {
addHeader();
addFooter();
}

No explaining needed here…

Is that it!?

Yes, but only when it comes to code. One more thing left to do is to push the code to our Google Drive document. (you can skip it if you’re using the online editor)

It’s an easy thing to do, all you have to do is to go to your project directory, open your CLI, and type…

clasp push

And that’s it! You can go to your google drive account, find your file and start the script through your own menu item. You will have to agree that you trust this add-on a few times, and that is a question only you can answer… Do you trust yourself? (or how google puts it – do you trust this unknown developer)

Summary

I’d say that the whole operation was relatively easy to do. You can see how fast you can create a custom add-on that simplifies (automates) your back-office tasks (especially if you don’t care about type-checking and use the online editor, not the local setup). It’s enough if you check the docs to see how certain classes work and you’re good to go!

But what else could you do besides a simple header & footer?

That may sound kind of corny but – whatever your imagination tells you. You could attach custom footers to your emails depending on who you write to, or maybe integrate google cloud search with your databases so that you could reference your data inside your emails within seconds. Seriously, a lot of possibilities.

Google Workspace, similarly to Microsoft SharePoint, provides great tools for back-office automation. Using GW you can integrate various services that Google offers and combine them including such services as natural language processing, machine learning, App Scripts, Google Vision and many others and adjust them to your corporate requirements.

What’s your next (first?) Apps Script project?
If it’s not a secret then share it with me on twitter @IgorStencel .
(If it is a secret though, we can chat about it privately through LinkedIn, don’t be a stranger!)

In need of some real help with creating your dream Google Workspace Add-on?
Contact us at hi@inero-software.com

Inero Software provides knowledge and expertise on how to successfully use cutting edge technologies and data to shape corporate digital products of the future.

In the blog post section you will find other articles about IT systems and more!