Episode: #5: Security - Here is Why it is Important

Computers now have primary control of critical vehicle functions. Welcome to the IBM Keep It Simple Technology Podcast, where each episode we discuss technology but in a simple way. We keep the explanations simple, but what we spend our time on is emphasizing what this technology means to you and how you can best utilize this technology for you and your business. Your host, as always, Thomas Anglero.

Welcome to the IBM Keep It Simple Technology Podcast. We have a very special guest who I must tell you, just prior to going live on the air, I said, are you ready for this? And she says, I trust you, I trust you, I trust you. First person, first woman I've ever heard say that to me. Ladies and gentlemen, we have IBM's, IBM Norway's head of security. She is IBM's expert in security. She knows it all. Ladies and gentlemen, we are pleased to have Marie Grini. Marie, say hello to everybody, please.

Hello, guys. Hope everyone is good and well in these times of this pandemic. That we are facing. So I'm really looking forward to talking to you today and participating in this podcast. That will be amazing.

Yes, it's going to be amazing, Marie, because I'm going to put you on the spot. So this is Thomas Anglero, your Director of Innovation for IBM. And we are going to focus on security. Marie is our expert. She is IBM's expert on security. And when it comes to security, That is a global issue, especially when it comes to your network. Any one of you, I don't care whether you are a new employee all the way up to the CEO of a company, security is a huge concern for the company. From the employee level to emails that, that employees get that they shouldn't be clicking on, all the way to securing your your company's infrastructure. So, Marie, let's start in a very simple, simple question and we'll take it from there because people, I don't think today really spend enough time thinking about security or investing in security. Why is security so damn important? And I say damn because it is important, but I don't think people like get it enough. So please, Elaborate, remember, keep it simple, why is security so important?

Yeah, I think that it's all back to trust, you know, and to safety and to feeling secure in the world. And actually, that's a very fundamental need for us people. And I guess that we can see it now in the times of pandemics as well, that Some things that you kind of all the time take for granted, that your everyday life will be secure, that your business will be secure, that everything will go fine. There are so many things that you kind of, as a human, we are used to kind of, of habit. We are making rules from what we are used to experience, and that's often happening with us also in business. We are used to that every day is fine, that nothing bad happens, etc. But in the end, it's a little bit about being prepared for that we won't let anything bad happen to us and that we are prepared to handle it in case something bad happens to us. And that's really the counterintuitive practice of doing the security of your business. Every day. That's kind of working with your brain, so to say, to make it accustomed to the fact that your security and your safety and all these things that you take for granted sometimes as a human, they are not coming for free. They are something that we actually have to systematically build into the fabrics of our business, and it's something that we need to build into the culture of our business. And it's something that needs to be the responsibility of everyone working in your business and part of what you present also out to your customers as reasons of why they should trust you as the business. So I think it should be a very, very natural part of how we are doing our job, all of us.

I'm in awe. My jaw is on the desk right now of your answer. Wow. I mean, I think you, you, you, what a wonderful answer because you connected security so wonderfully to what's going on in life today.

Right?

We've, we've, we lost a bit of our security with everything that's going on, all the chaos, all the crisis and everything. And you're absolutely right. We've taken it for granted, but now security is something that we must think about all the time. Excellent. Let's look at security.

Yeah, when you're talking about that, I also wanted to mention one thing I thought about lately, and that is, you know, the World Economic Forum, they, for some years ago, they had a report on a hyper-connected world, which I think is really hitting us now when we see this pandemic situation. And they wrote that report regarding also how the hyper-connected world is impacting us when it comes to cybersecurity. But I really think that we see how the world is so connected. Everything that was maybe before small little things that happened in a corner of the world, with all these connections that we have both physically and digital connections, so the way that the internet, the way that it has woven us all together, making us also more vulnerable for events that could hit us. So I think that it makes me reflect also on cybersecurity, the situation we are today.

You know, Marie, you explain things so well, I think you should host this podcast. Really, you're so good. I don't even have to remind you to keep it simple. That means beautiful what you're saying. You talked about the hyper-connected world, and I think some people may be going, what does that mean? Would you mind just elaborating a little bit? What is the hyper-connected world, and what world did we come from, and why is the now hyper-connected world important? Can you talk about that?

Yeah, I think that it is a little bit about the realities of the internet. Of design. Because if you think about it, when we are talking now only on a webcast, connections and our voices are kind of going in all kinds of weird places over all kinds of weird connections. And when we are doing, for example, internet banking or we are doing connecting with our friends, through social media today. The internet is taking us into a world that is kind of connecting us together through a lot of different nations and a lot of different electronic data systems. So you also see that businesses today— before, maybe they had data centers that were isolated, from each other, and that maybe had simple internet connections only, out of the internet. But if you look at it today, how also business applications are talking to a lot of different parts and bits and pieces, and they are maybe connected to systems that are standing in totally different countries, in totally different data centers.— And yeah, so it's about how everything is connected in quite complex ways that they're not always, all of us even know, you know.

So, so, this again, well said. So, in this hyper-connected world, where we're connected in so many ways, and as you said a moment ago, we don't even know how we're connected. The question is, how do we secure ourselves? How do we secure our company? Where would you like to start? What I mean, because you're the expert. How do we implement security in our lives? How do we implement security in our business? Please.

I think that it all starts with the business culture and it all starts with the leadership. So it all starts with that somebody in your company says that Yes, actually, security matters to us. It is important that we take this matter seriously. It's important to our customers. It's important to our reputation. It's important to all of our employees that we have this in order. So, it all starts at that point. And I think that unless it starts with the leaders, that, um, um, that has a difficulty to actually get into some, um, systematic approach to such, uh, domain, which is, it's actually needed to succeed in security. You need to have a systematic approach that starts from the top.

So let's, let's, let's break that down cuz that's really important. And how many, in your experience, how many leaders out there are taking security serious enough, percentage-wise? 80% of all leaders take security serious enough, or is it more like 30%? Where are you at in your experience?

I think that the businesses today are struggling to keep up because the changes are happening very fast. And we see that, for example, now that we are also moving increasingly to the cloud. That businesses are very aware that they have a gap when it comes to their security, that it is a lag that they need to fix. And I think that currently there is— the majority of businesses will need to increase their security practices going forward. Yeah, I think that this is both for small-medium businesses and for the larger ones. The small-medium businesses might start to see that also they need to look more into how they are securing their business. And the larger enterprises see that their business is changing massively, and because of that, they are lagging with also their security practices. Which need to keep up.

Perfect. You gave me a lot to work on. So let me, let me emphasize one thing and then we move to the next subject. So to emphasize the last point, and the reason why I brought it up was this. There are a lot of leaders out there listening to this podcast right now, and I want them to understand that they're not alone in having fallen behind in properly securing, securing their company. All right. So I think it's really important that a lot of people now understand that you're not alone and it's not too late. Am I right, Marie?

Yeah, absolutely. I think that many businesses out there are seeing that there is a shortage in security skills and expertise and that they need to modernize their approach to security. And they need to look into how they can be prepared for the ever-increasing cyberattacks that are on us. I can mention that only IBM's threat report that was published in January, we saw a massive increase in Internet of Things attacks or industrial systems attacks. And that this is, I think, something that is our big concern because we see that industrial systems like oil and gas and power systems and a lot of these type of systems that maybe before was kind of a little bit isolated from the internet and the kind of commodity IT, they're increasingly getting connected to the same infrastructure. And we see that Uh, it is not always they are ready for that world, that hyper-connected world that we were talking about. And then, um, we see that there is a, a need to strengthen the security in those sectors to prepare for that reality.

I think you just touched on one of the hottest topics going forward into the future. And, uh, we need to spend a couple of minutes on that and break down what you talked about. And that is, you mentioned the Internet of Things, all these devices, right? So let's make it really simple when we talk about Internet of Things, cuz, uh, that requires a podcast onto itself. But the Internet of Things is all these, uh, devices being very specific. Um, uh, home security cameras. Right now you could go on eBay or Amazon and buy, uh, for $40 US, You can buy a cheap web camera that connects to your wireless network and you're 24 hours a day, 24/7, you have a live stream of your inside your house, outside your house, whatever. But these cameras, because they're so cheap, they're part of the Internet of Things, right? They're a device connected now to the internet, but they don't have the best security built into them. Am I right?

Exactly, because many times those things were part of an ecosystem where it was not so important to protect against threats on the internet, right? They were not connected before, so they don't necessarily have the practices to regularly update against security patches. They are not— the software security, or even the software that is on those things, they are not developed in the same way to be robust against IP attacks, and they don't have these security practices. And of course, I won't say that the security practices in all parts of development, software development, are perfect as well. But, you know, in these type of environments that were not used to being connected to the internet, I think that it is a fact that Software is not always prepared for that type of connection. And also the hardware, yes, the firmware and all of that. You know, that's why we have seen attacks that have been quite massive by the use of exploiting vulnerabilities in such devices connected to the internet.

So I think, let me reemphasize what you're saying and break it down even one step further. The devices and equipment you've had in your factory, in your office, in your networks, wherever in the world, some of it that's already been there for quite some time, you're seeing, you see an opportunity to connect it to the internet so you can start gathering data from it. What a wonderful thing to gather more data from your existing expenditures that you already spent, all your infrastructures out there. That's fantastic. But as Marie just said, it's not secure. It wasn't built with security in mind. So that is your, well, your point right now, you're probably gonna save a lot of companies from a lot of losses and a lot of heartache down the road for people to understand that in this world where more, more data you gather, the more data you generate, the more data you, take into your analysis to make better decisions for tomorrow, the higher you run a risk of putting something into your network that could be insecure. With that, let's, let's give people specific advice. Okay. That was fantastic. I think that was the best, longest warmup in the history of podcasting. Let's go straight to advice and let's break it down to two different groups. First group, Actually, we could do consumers as well, but maybe if we have time, we'll get to there. First group is small and medium businesses. What specific advice do you have for them? And realize small and medium businesses don't have the big budgets to go hire IT specialists and hire big companies. So what advice do you have to the small and medium business leaders out there who are listening, who want to implement the best security possible, but they're not security experts?, and they would love your advice. What advice do you have for them?

Yeah, so I think that, um, some of this advice is that, um, security starts with the basics. So, um, it starts with making sure that your systems are patched and that you have your, uh, uh, maintenance of, of your IT systems, uh, ready. And it also starts with recognizing that, uh, You as people are maybe the first starting point. You know, all of your employees need to be aware that security is important. And you need to know what is the most important security threats that could face your business and what are the most important data that you have. So for SMB businesses, it might be that you should, for example, let's Let's say you're a very small company and you have very critical information stored in some of your data systems, or you have some very important— maybe all of your client records, for example, are stored somewhere. And you should be aware that that is a very crucial asset for you and that it might require protection. You should make sure that you have maybe an agreement with the company that is operating the system for you, that they are actually taking security seriously. You can make sure that you have some mobile security software on your laptops and your mobiles. And you can have some awareness about how attacks are operating today. For example, through this COVID-19 situation that is going on now, we see that cybercriminals are exploiting the fear that people are having now about their, the insecurity they have. And they are using that situation to send people mails, or they are asking them to do actions on phone calls. For example, send money from the company, out of the company. They are defrauding people. They are asking people to click on attachments or links and infecting them with viruses that way. And I think that it's good to be aware of those type of scenarios so that you can have a certain skepticism against such attack vectors. So some things, some of these things, and of course, in case you have an attack, don't be afraid to call the experts, right? Don't be afraid to call somebody who can help you.

And again, you're giving great answers because you cover, you gave advice not only for the small and medium business, You also gave great, great advice to everybody listening who's now maybe at home and what is the new habits they should be doing at home or not doing, right? And passing that advice on to their family, kids, you know, wives, husband, or whatever, friends. You know, be very careful in this new world we're in and these opportunistic— and let's call them just evil people who are trying to take advantage of this horrible situation. Um, let's look now. I would love you to give advice to those people listening who are in bigger corporations? And the people I want you to maybe talk to, let's say, let's think of this person, the head of the IT department, and then also the CEO of the company itself. What advice would you give to them?

Yeah, I think that some of the most important advice is that you have, you are signaling and have communication that is clear and consistent to all of the people in your business that there is an importance on this topic of security, that that is important to your business, so that everyone is aware that that is a priority. And after that, I think that it needs to be a systematic approach. And you should make sure that you have somebody to hold that role to secure that there is a systematic approach to the security work in your business. And that that person is reporting sufficiently high up in your organization. That's something that I would really recommend, uh, so that you can have a certain good dialogue with the person. What, what is important to your business? What, what are the— what is the information that is important for you to secure? What are the data systems? What are the assets? What is important for your business to succeed. And it's very important that the security work is starting from there. Because we have seen some examples in the past where you have security officers that— who are working from a theory of securing according to rules and what they think are good rules for security, but therefore maybe forgetting to connect to the leadership or the management of the— or the business management. And then you are kind of getting a very big disconnect between what the business tries to achieve and the business strategy and what the security guys are trying to do. And that is not a good situation. So you really need to make sure that you have a good alignment and that you— You have a good communication between business and security so that the security enables you to actually reach your strategic goals. That's a very, very fundamental basis for a good security practice. And then you need to have good discussions because sometimes there is a give and take. Sometimes there are risks that need to be— drop up on the table. Sometimes there are very easy ways to mitigate those risks. You can, you can do that, and you can very, very well reach your strategy in, even in a better way than before, because you have a much better robustness. And then you have also situations where there are things you need to discuss, right? You need, for example, if the— you are really focused on reaching a business goal and you need to do it fast. And then the security guy said that, well, actually these and these and these risks exist, and we would like to implement this and this and this. And then you say that, okay, but this is taking too much time, then I won't reach my goal quickly enough. Then you need to have the discussions on, would there be alternative ways to do it? What could be other approaches? So I think that this type of dialogue is, is very fundamental.

Mary, I— you've been fantastic with the information you provided. And to wrap it all up, I want to just summarize and, and highlight one very specific thing because it was found in every one of the answers you gave me when I asked you about different aspects of security. And that was that it all starts with communication, or you use the word dialogue as well. That's where security starts. And I think that is a very powerful message for everybody to take away from this podcast, because I think a lot of people from an IT perspective, when they think about security, it gets overwhelming. Oh my God, how do I secure my network? How much is this going to cost? Oh, how complex is this going to be? They don't understand that the biggest, most helpful thing you could do is start having a conversation about community security and then giving people knowledge about just habits, better habits. Just that conversation is the biggest part in terms of security, whether you're a small business, you're a gigantic multinational, communicating and making people more knowledgeable and smarter in what to do to keep your company more secure. Marie, is there any last words you would like to share with everybody listening?

I think I just fully support your, your conclusion on this dialogue, communication, talking together. Absolutely. It couldn't, couldn't be put in a better way. I think that's where one needs to start. And connect also outside of the business. Connect with other experts. Get information about what others are doing. What also us vendors can contribute. So don't be alone. Connect, communicate, and work it together. I think that's kind of the perfect way to deal with the security.

I think those are the perfect words to send us out on this wonderful podcast. Marie Grenier, IBM's security expert in Norway, I thank you, we thank you so much for your time and sharing your knowledge. This is Thomas Anglero, Director of Innovation for IBM. Once again, I really thank you for all of you spending your time and stay tuned for more amazing podcasts with more amazing people like Marie, who actually made my day by saying, "I trust you. I trust you. I trust you." That was great. Thank you, everybody. Until the next time.