InCyber Keynote - Critical Infrastructure Under Attack & the Role of Government

Good morning, Montreal. Matthew Rosenquist, and we, we just heard a great panel talk about critical infrastructure. Well, we're gonna talk about it a little bit more, and we're gonna talk about it at a higher level, right? Cybersecurity is about protecting our way of life, our technology, And when we talk about critical infrastructure, it just so happens it is the ultimate target for the most sophisticated and well-funded threats. And that's something we have to deal with because those threats are getting stronger and they're getting more aggressive. And we have to deal with that. Unfortunately, The bodies, the companies, the organizations that oversee critical infrastructure in our world, they can't defend them against this level of attack. The attacks that are coming, not the ones of yesterday. We have to look forward. So when we talk about critical infrastructure, let's just take a moment and think about that. Critical infrastructure makes sure that there's food on the shelves of the grocery store, that you have clean water and sanitation, that you have the ability to get your money from banks. It is the underpinning of modern society, and governments have an obligation to make sure that that foundation remains secure, remains accessible. But there were adversaries out there who were not interested in that. And that's what we're gonna talk about today. Because the private sector, in many cases, owns, oversees, and manages these critical infrastructures. And if we lose one, it's an emergency. We see that with natural disasters, hurricanes, fires. But these are all interrelated, right? And local events where one of these goes down, again, it's an emergency. But they are tied together. And the adversaries know that. So when multiple ones go down, you get a cascade effect. And it's no longer just an emergency. It's a catastrophe. And that concept is not lost on those very high-level aggressors that we're gonna talk about today. I've been in cybersecurity for 34, coming on 35 years now. I advise governments, I advise academia, and businesses all over the globe, not about yesterday's attacks, but what's coming. Because that's where we need to look. And in cybersecurity, it's, it's kind of simple. We either have leadership to be able to look forward, to be able to address those threats, to be able to manage those risks, or we are stuck in crisis. And we've all seen that, we've all felt that. Anybody in the cybersecurity industry has dealt with crisis and pain and angst and long, long nights into the morning. So it is up to us to make sure that it works. But government plays a very key role here, and we're gonna talk about that, and it needs to actually get bigger. And there's friction there, especially with the private organizations. But we need to get past that. And if we don't do that sooner, we will feel the pain, and ultimately later we will realize we should have done that. So let's meet the most aggressive nation-states on the planet. And when I say aggressive, I'm talking about organizations that are willing to spend billions of dollars that they are training, just as they train their army in how to use rifles and tanks and artillery, they are building a sustainable capability to conduct warfare on the digital landscape. So if we look at the flags up there, we've got, probably to no surprise, we've got Russia, we've got China, we've got Iran. We've got North Korea. These are those top tier elements that we need to worry about. And we have seen an evolution in their play against critical infrastructure. Because again, it is such a good target. Sadly, it's even an easy target if you're willing to dedicate the resources and the time and you have the focus. And they do. If we look back many years ago, cyber criminals, right? Ah, gotta love them. They were willing to spend thousands and sometimes even tens of thousands for a zero-day, a vulnerability. But then we saw nation states come on the scene. And it went from thousands to ten thousands to a million dollars. Financial incentive. Today, we have vulnerability and exploit asks by nations like these for over $20 million for a single vulnerability. And they're not done. This continues to go up. They're willing to invest, they're willing to build that capability. And their number one target is critical infrastructure. Now each one of these particular countries, they have their own motivations and flavors in what they want to accomplish, but it changes over time. And one of the common themes is to push political agendas foreign policy. We see these countries also building up militaries because they see combined arms between the digital and the kinetic world as making sense. And we know many of their plans and we've seen some of their early attacks. Russia against Ukraine, we saw a lot of cyber attacks come in. We're gonna see more. Again, it's not about what happened yesterday. It's about what they're looking to do tomorrow. We've got countries here that are heavily sanctioned. So they use digital technology to get around those. Money laundering, for example. They like doing that, and again, it can bring down a target nation, and it can increase their capability and their functionality in the world, their goals. We see countries, and I'll pick on one here, North Korea. They need hard currency, and again, they use the digital world to do that, and they victimize financial networks, they victimize individual companies and businesses, right? And they're big players. They went from thousands of dollars of ransom to hundreds of thousands, to millions, to tens of millions now per attack. This makes sense for them. Economic espionage? China, by far, last 30 years, number one player in that space, bar none. They wanna steal the intellectual property of companies and critical infrastructure. And what we've seen over the past several years is disturbing. We've actually watched these nations come in and compromise various aspects of critical infrastructure. They come in and then they go quiet. Now we know why that is. These countries are strategic, they're smart, they know at a future point in time they will want that access. So a lot of what my colleagues are doing is trying to find where they've come in and where they're quiet and stealthy and hiding and evict them. But again, they're able to bring in tremendous amount of resources. They're able to tie their intelligence organizations. They can use human Humans, human intelligence. This is not just digital world passing packets back and forth. These countries have intelligence network, human networks that they use and leverage. And they leverage them very well. And they can do that. So I'm, I'm quoting Frank Herbert here. Uh, any Dune fans? Oh, a couple, okay. It's a quote that I like, because if you can destroy a thing, you have power over it. And come on, we all love our digital world. Our lives have changed. We have embraced the goodness of our digital ecosystem around the world. But with that, it is accompanied by equitable risks that we have to deal with. And these aggressors, they want to be able to destroy something, control something, tamper with something, and the something that they're going after is that critical infrastructure. And this is where government comes in. It's no longer a nice to have. And the last panel talked about regulations. Yes, that's important. But there's more things than that. Government comes in as a major potential player, partner, and leader. Number one, it's got huge resources, more so than any individual company that runs critical infrastructure, more than any individual sector. And because they are overarching, they can tie all that together, they can add those resources in. Human, financial, you name it. The other aspect that governments come in to play is that adversarial perspective on things. Now I talk with a lot of CISOs, and most of the cybersecurity community has come up through the ranks with a technical background. A technical background means you find a problem and you fix it, and your day is good and you go have coffee. Adversaries are different. You go find a problem, you fix it, and the adversary shifts, changes, adapts, moves somewhere else. You don't get to have coffee, you have to keep pursuing that. It is a different game. That's why ex-military, ex-law enforcement are actually great. That mentality that they're dealing with an intelligent adversary. Governments, same thing. Now governments can do things that normal companies can't. They can create reg— regulations, right? They can hack back, something that no company should ever try. It's bad news. But governments can. Governments can tie in their intelligence organizations to understand those threats, where they're going, and the tools that they're using. Again, the normal businesses that run and protect critical infrastructure can't do that. Governments can pull together those companies in sectors so that they can share information. So they know when somebody else is being attacked and how they're being attacked so they can take a proactive stance. Very important. And they can define minimum, minimum regulations for operation. Now compliance to regulation is not true security. It's, it's the starting point. But at least they can raise all boats, as they say, to get rid of some of those easy targets. Because again, we have to worry about those cascading effects. So governments can do things that companies that protect our critical infrastructure that we really rely on, right? Governments can do things that the companies simply cannot do or achieve. The other aspect is there's longevity there. CEOs come and go, right? But the governments tend to be more stable. So their leadership and their requirements provide an advantage. It helps with the consistency and the focus moving forward. Okay, so top areas that governments need to apply. Leadership, we talked about that. We have to show leadership. Governments can come in and bring people together. Defining those goals. Sometimes it's in regulations, but in reality, the goals have to be much higher. Regulations are down here. Many of the sectors we looked at have horrible goals, and they're not consistent. Government can help change that. Third, regulations. You do need to put a, a floor that everybody has to come up to, and it has to continually be raised. The top governments out there right now are also working on that sustainability. Security isn't you do once and you're done. You have to continually adapt. And that's where government can come in as well. Sector collaboration, yes. Leveraging law enforcement. If you don't have the laws, they can't do it. If they're not trained how to investigate, doesn't work. Alright, and if you can't work together, law enforcement across the world, so that you can apprehend, prosecute, and incarcerate, again, regular companies can't do that. And then money, funding, innovation. The first axiom of cybersecurity is it's not relevant until it fails. So bad things happen, and then you see the private industry start funding funding tools and processes. That's after the fact. Governments are in a unique position where they can invest ahead of time, predictively. And that is huge. Overall, if we work together, public and private sector, we can be strong. If we fail to do it, if governments don't take that role, We get torn apart. And we're already starting to see this. So last slide here. Right, we know critical infrastructure, we all rely on it, and it's being attacked. It was being attacked yesterday and it's definitely gonna be attacked tomorrow. Governments can and must play a key role here. They have to help. And the governments that aren't are not servicing their population. They're not servicing their citizens because this is a known threat. They can add those resources we need to the fight and they can contribute those unique services like intelligence and law enforcement and hacking back. And so it is imperative the government take that next step, proactively work to bind public and private, to show that leadership, and to move us to that next stage where we are continuing to adapt with the rise of those apex predators out there. Thank you.