Speaker 1: Welcome to Kobe Time, a podcast series on Markets and
Speaker 1: Economies from DVS Group Research. I'm Pam Rebek, chief economist,
Speaker 1: welcoming you to our 123rd episode. Today's episode is a
Speaker 1: function of popular demand.
Speaker 1: Uh whether at work or at home concerns on cybersecurity
Speaker 1: are on the rise and elevated to say the least.
Speaker 1: Uh Here in Singapore stories on cyber scams, ransomware are
Speaker 1: rife and perhaps they are an underestimate given that many
Speaker 1: of such crimes go under reported.
Speaker 1: Uh and there is cyber threat at the corporate and
Speaker 1: government levels, which is a whole different ball game. So
Speaker 1: let's talk about all this with an expert. I'm really
Speaker 1: pleased to have Nicholas re from control risk with me.
Speaker 1: He's a partner there uh with control risk, digital risks,
Speaker 1: America's and global threat intelligence practices. Nicholas specializes in the
Speaker 1: provision of threat intelligence to public and private sector organizations
Speaker 1: as well as leading and delivering complex threat intelligence and
Speaker 1: security projects.
Speaker 1: Nick regularly advises fortune 100 executives on digital transformation, cybersecurity,
Speaker 1: emerging tech risks and threat intelligence matters. Nick Race. Welcome
Speaker 1: to Kobe Time. Thank
Speaker 2: you very much. It's a pleasure to be here.
Speaker 1: You
Speaker 1: just happen to be in Singapore. That's happen to want
Speaker 1: to do this thing. So, I'm really grateful that you
Speaker 1: could make the time. Yeah. No.
Speaker 2: And I really appreciate the invite. I know the firm
Speaker 2: has been a long listener to the podcast and there's
Speaker 2: been lots of people that have been very excited about this.
Speaker 2: So I'm glad to meet you and glad to be
Speaker 2: in Singapore.
Speaker 1: Fantastic.
Speaker 1: Nick. Maybe we can start by going over the three
Speaker 1: kinds of cyber threats, you know, the state sponsored ransomware
Speaker 1: and the whole idealistic quote unquote activism
Speaker 1: stuff.
Speaker 2: Yes, I think that's a good place to start. And
Speaker 2: for a lot of listeners, I'm sure this is going
Speaker 2: to be something they're relatively familiar with because it's been,
Speaker 2: you know, over the past decade, something that's now made
Speaker 2: the mainstream news media. We're starting to hear about these
Speaker 2: things and we can talk about the
Speaker 2: political aspects, we can talk about the financial aspects. But
Speaker 2: when we think about threat actors, we usually classify them
Speaker 2: in those three categories. So at the very, very top
Speaker 2: of capabilities and sophistication usually linked to states, whether military
Speaker 2: or civilians, we have those intelligence units, those apts as
Speaker 2: they're often called advanced persistent threat groups that are very,
Speaker 2: very highly resourced and that usually will work on the
Speaker 2: back
Speaker 2: or at the behest of a government, they will do
Speaker 2: things like large scale espionage operations, disruptions linked to conflict.
Speaker 2: And that's certainly something that we're looking at more and
Speaker 2: more as we come into this geopolitical arena in 2024
Speaker 2: that's going to be very challenging for businesses. And we
Speaker 2: also see some of these groups leverage these capabilities for
Speaker 2: financial gains. And that's something that in the banking industry,
Speaker 2: we've talked for a long time about no
Speaker 2: Korea very famously has deployed state level capabilities to target
Speaker 2: financial institutions and the financial ecosystem as a whole. But
Speaker 2: that's the broad family of sort of nation state level operations.
Speaker 2: And then we have next to this is organized criminality
Speaker 2: and sometimes heavily disorganized criminality because it's not just very,
Speaker 2: very well resourced and capable groups. It's also at times,
Speaker 2: people who just want to make a quick buck
Speaker 2: and who have discovered that cyber is a great way
Speaker 2: to do this. It's a very low risk operation. You
Speaker 2: rarely get arrested on the streets for doing a cyber crime.
Speaker 2: And certainly that's both a function of law enforcement resources
Speaker 2: and the multi jurisdictional and transnational nature of the risk
Speaker 2: for organizations. But it's also because of the ease of
Speaker 2: anonymisation online. And that's been a big trend over the
Speaker 2: past few years. You know, Cryptocurrency
Speaker 2: have helped a lot in the space. But more broadly,
Speaker 2: we've seen these criminal groups of various degrees of sophistication
Speaker 2: share one thing in common. They're motivated by financial gain.
Speaker 2: So whether we're talking about ransomware extortion, the ability to
Speaker 2: encrypt lock systems and data and extort money or data
Speaker 2: breaches which often are accompanied by extortion. We are looking
Speaker 2: at financially motivated groups and then at the bottom of
Speaker 2: the capability
Speaker 2: spectrum. But increasingly over the years, I've been in this field,
Speaker 2: we've seen that shift quite a bit upwards in terms
Speaker 2: of skills is the activists, the cyber activist groups, those
Speaker 2: have been in popular culture represented a lot by anonymous
Speaker 2: and we've seen a sort of guy fawkes mask for
Speaker 2: those of you that are avid on the TV side.
Speaker 2: Mr Robot had a great depiction of this type of, of,
Speaker 2: of sort of group, but usually they're ideologically motivated.
Speaker 2: Now, one of the interesting trend and you know, for
Speaker 2: some of those our listeners who might have worked on
Speaker 2: Wall Street during the times, the sort of occupy Wall
Speaker 2: Street movement saw a lot of activity. Exactly. And a
Speaker 2: lot of groups targeting big banks, but usually we see
Speaker 2: a lot of environmentally motivated groups. We have a plethora
Speaker 2: of different ideologies. I think the shift in recent years
Speaker 2: has been much more politically ideological motivations that veer on
Speaker 2: state
Speaker 2: level sponsorship or support. And this is what we've seen.
Speaker 2: Certainly in the Middle East, the law we've seen across
Speaker 2: parts of eastern Europe where these groups become difficult to
Speaker 2: discern whether or not they are actually individuals or small
Speaker 2: groups or if they are being asked to run these
Speaker 2: operations by governments.
Speaker 1: Let me go back to the government in a second.
Speaker 1: Which is so, yes, there are capabilities that governments apply
Speaker 1: to espionage and we know most countries do it.
Speaker 1: Um, there's also this whole layer of snooping that governments
Speaker 1: owe to their own people.
Speaker 1: And we've been hearing about certain software packages that certain
Speaker 1: countries commercialize and sell and you hear all sorts of
Speaker 1: unsavory governments picking up those things. So, tell us a
Speaker 1: little bit about that. Yeah,
Speaker 2: it's
Speaker 2: been a maybe a good decade now that we've seen
Speaker 2: crop up these companies that have specialized private sector companies,
Speaker 2: technology companies that have specialized in designing and developing toolkits capabilities,
Speaker 2: malware
Speaker 2: at times to essentially conduct espionage operations and have commercialized
Speaker 2: it to law enforcement agencies across the world and for
Speaker 2: a range of different purposes, sometimes legitimate purposes. And we
Speaker 2: do see counter terrorism operations or particularly in countries with
Speaker 2: the resources to build their own cyber capabilities as limited
Speaker 2: valid use cases for criminal investigations. The challenge though is
Speaker 2: that in some
Speaker 2: jurisdictions and depending on the nature of the government, we've
Speaker 2: also seen abuse of this capability and part of this
Speaker 2: abuse has been used to target journalists, freedom of the press,
Speaker 2: but also freedom of religion and at times even minorities
Speaker 2: within certain countries, I think the real challenge is making
Speaker 2: a distinction and this is what we talk a lot
Speaker 2: in the threat into our world is making a distinction
Speaker 2: between motives and capabilities, having the capability to do so
Speaker 2: like snoop on an iphone, which most governments will have
Speaker 2: a capability to do is only legitimate when it is
Speaker 2: used by a purpose that is lawful. And I think
Speaker 2: that's where a lot of even the regulatory framework has
Speaker 2: been evolving very quickly. Over the years when most of
Speaker 2: our privacy regulations were built back before 2017 18, with
Speaker 2: the Chinese cybersecurity law in the European Union's general data
Speaker 2: protection regulation, data privacy law had been written in 1990.
Speaker 2: You know, we were talking before starting about the iphone
Speaker 2: release in 2007. Look at the pace of evolution and
Speaker 2: how difficult it is to stay on top of these
Speaker 2: capabilities for regulators. And I think that's going to be
Speaker 2: a constant economy in the near future in our societies
Speaker 2: and in our democracies, how do we balance the capabilities
Speaker 2: our governments have with the motives and the intent to
Speaker 2: use these capabilities through legislation and through democratic processes?
Speaker 1: What's your sense of GDPR? Now, whenever I go to
Speaker 1: a website, there's a little
Speaker 1: box that comes up. Do you accept the cookies or not?
Speaker 1: That is it really changing things? So
Speaker 2: I
Speaker 2: think it has and there's been really interesting case law
Speaker 2: in Europe where some of the fundamental principles of GDP
Speaker 2: are notably the right to be forgotten, which really came
Speaker 2: from a single activist based in Spain who sort of
Speaker 2: was really upset about when he entered his name on Google.
Speaker 2: The results that came in were either too old and
Speaker 2: were misrepresentation of who he was or were in
Speaker 2: at times. And I think now within the European Union
Speaker 2: and certainly as European citizens, individuals can request that their
Speaker 2: information be taken down, that has undeniably really improved the
Speaker 2: privacy of European Union citizens. And I think we've seen
Speaker 2: similar bills come across the world and we are seeing
Speaker 2: a real trend towards adoption of this approach. That being said,
Speaker 2: one of the objectives of GDPR was, you know, seriously
Speaker 2: improve the accountability of organizations in protecting consumer and employee data.
Speaker 2: And whilst we've seen improvements as a whole, it's not
Speaker 2: all of one size fits all. It's certainly not a
Speaker 2: silver bullet. And I think the challenge is regulation will
Speaker 2: not be the only answer to the problem that cybersecurity
Speaker 2: poses the privacy of our data
Speaker 2: um uh entails. And importantly, whilst GDPR was a step
Speaker 2: in the right way, it is only a single step
Speaker 2: in what's going to be a very long hike.
Speaker 1: Is it too early to say that the data leak
Speaker 1: issue in Europe is sort of better than elsewhere because
Speaker 1: of all these laws,
Speaker 2: I think, I wish as a European Union citizen that
Speaker 2: it was better. I don't think unfortunately, it is going
Speaker 2: to be better. Thanks to regulation. I think regulation creates
Speaker 2: better accountability. I think you mentioned that the introduction
Speaker 2: to this episode, there's always been this challenge of, we
Speaker 2: only know what we know and as the public or
Speaker 2: as you know, members of the business community, we know
Speaker 2: if somebody's been hacked because they say it publicly, what
Speaker 2: GDPR has helped. And I think what a lot of
Speaker 2: the legislations are coming out and I just saw the,
Speaker 2: the CS A here in Singapore is doing more work
Speaker 2: on mandatory disclosure of breaches is creating a universe of
Speaker 2: accountability
Speaker 2: that is very helpful because at least it creates a
Speaker 2: level playing field in terms of statistically. Do we see
Speaker 2: less data breaches since GDPR? No, we probably see more.
Speaker 2: And that's also a factor of just the sophistication of
Speaker 2: the landscape and just how much more data reliant we are.
Speaker 1: So tell me something about the level of sophistication and
Speaker 1: the scale of cybersecurity threats out in the world. How often,
Speaker 1: how big are we
Speaker 1: talking about?
Speaker 2: I mean, we'd be talking about every millisecond. If we
Speaker 2: looked at the technical materialization of attacks, I think there
Speaker 2: has been attempts at quantifying the damages.
Speaker 2: We are talking if cyber crime was an economy in
Speaker 2: 2025 it's scheduled to be the third largest economy in
Speaker 2: the world after the US and China. So we are
Speaker 2: talking trillions of dollars of damages. Dabbing said I always
Speaker 2: take this quantification with a pinch of salt. There is
Speaker 2: no and this is one of the big challenges in
Speaker 2: our space is there is no way to
Speaker 2: actually understand the scale of the problem because it is
Speaker 2: reliance on reporting, it is reliance on transparency internationally. And
Speaker 2: the reality is we don't have much of this. What
Speaker 2: we can see is both in terms of spend budgetary
Speaker 2: wise by governments and private sector and in terms of
Speaker 2: cost of remediation, the problem is significant. And in my
Speaker 2: 10 years working in the private sector and advising organizations
Speaker 2: around the world,
Speaker 2: I now very rarely do not see an organization that
Speaker 2: has cyber on top of its risk register as both
Speaker 2: high likelihood and high impact.
Speaker 2: I think where we see the trend moving is because
Speaker 2: our societies and our organizations are connecting more and more.
Speaker 2: We are seeing massive investments in digital transformations. The reality
Speaker 2: is the problem is only going to get bigger and
Speaker 2: because we are connecting, not just ourselves to the internet,
Speaker 2: but we're also connecting machines, we're connecting factories, we still
Speaker 2: have roughly 50% of the world that's not connected to
Speaker 2: the internet.
Speaker 2: There is still a huge amount of vulnerabilities that are
Speaker 2: only yet to come.
Speaker 1: If we are
Speaker 1: fixated on the vulnerabilities, sometimes we sacrifice efficiency or productivity.
Speaker 1: I used to work at a public sector organization where
Speaker 1: the fear of cyberattack was so big that we used
Speaker 1: to use two different laptops, one for external access, one
Speaker 1: for internal use. And then there was a virtual dropbox.
Speaker 1: If you downloaded some data from outside, you'd go through,
Speaker 1: but it'll go through like filter after filter before you
Speaker 1: could bring it to the, but that was in my view, inefficient,
Speaker 1: it slowed us down.
Speaker 1: Um, are you seeing that sort of paranoia which is
Speaker 1: causing that sort of cost?
Speaker 2: Yeah. I think it's a really good point and I
Speaker 2: think it's one that we often in the security industry
Speaker 2: don't talk about enough security for a long time, was
Speaker 2: seen as this huge blocker and an impediment to doing business.
Speaker 2: I mean, we've had scenarios where we tell executives if
Speaker 2: you travel to a certain country, you can't take your
Speaker 2: cell phone and they look at us and they say
Speaker 2: we're going to take our cell phones. So not only
Speaker 2: does it encourage,
Speaker 2: you know, bypassing the controls, it also the controls become
Speaker 2: too difficult, then we lose our purpose of being a
Speaker 2: business or operating properly what we are seeing. And I
Speaker 2: think this is, this is the biggest thing that everyone
Speaker 2: out there, both organizations and individually, we need to think
Speaker 2: about
Speaker 2: paranoia is unhealthy. We need to be proportionate and to
Speaker 2: be proportionate, we need to understand our environment. And if
Speaker 2: I am a bank or if I'm a government institution
Speaker 2: or if I am a health care company or law firm,
Speaker 2: my threat environment is going to be different. Not everybody
Speaker 2: needs to be for Alamo,
Speaker 2: not everybody needs to have military grade defenses. Some do
Speaker 2: maybe parts of our organizations do
Speaker 2: and those parts they need to be proportionate to the
Speaker 2: risks that we face, if we apply a blanket rule,
Speaker 2: we are going to waste money, we're gonna piss off
Speaker 2: our users and ultimately we're going to be counterproductive. Right.
Speaker 1: Right. I mean, I've noticed this even in certain apps
Speaker 1: where the security concern is so big that the app
Speaker 1: shuts down at every single hint of vulnerability.
Speaker 1: And as a result, it's not a user friendly app
Speaker 1: anymore.
Speaker 2: I think banking has really led the way in balancing
Speaker 2: this because it's fundamentally A B two C business. So
Speaker 2: and it's a business that has been heavily targeted historically
Speaker 2: by cyber attacks. It's also a business where consumers are
Speaker 2: very concerned about the safety and the security of their data.
Speaker 2: And at the same time, they need that seamless connectivity.
Speaker 2: And so if you look at some of the innovations
Speaker 2: of the technical layer multi factor authentication, the use of
Speaker 2: biometric on our phones for fingerprinting, the banks are still
Speaker 2: leading the charge. And I think there's a real lesson
Speaker 2: here for the community that security can be done whilst
Speaker 2: being user friendly. It doesn't have to be everybody log
Speaker 2: out every 10 minutes and I need to re input
Speaker 2: 15 passwords. And luckily the tech is moving into such
Speaker 2: a space where
Speaker 2: the solutions designers, the technology companies are really thinking about
Speaker 2: the user
Speaker 1: nick coming from DB si fully relate to what you're
Speaker 1: talking about. Um As we speak, we have two full
Speaker 1: blown military conflicts in the world. Russia, Ukraine Israel Gaza
Speaker 1: and we have this simmering tussle between the US and China,
Speaker 1: which probably will last our lifetime.
Speaker 1: So talk about cyber security and dimensions of actual conflict,
Speaker 1: both full blown one as well as a simmering
Speaker 2: one. Yes, I think this is, this could be a
Speaker 2: topic for the next 20 hours. It is by far
Speaker 2: the pieces that I find the most fascinating in this
Speaker 2: space because
Speaker 2: it's where we see the real convergence of this risk
Speaker 2: environment and the convergence between real life and that digital component. Look,
Speaker 2: I think for a long time, we had forecasted and
Speaker 2: not just we are control risk, but organizations across the
Speaker 2: world had forecasted that Cyber was going to become a
Speaker 2: normal part of conflict and particularly of hybrid conflicts like
Speaker 2: what we're seeing
Speaker 2: and certainly both in the Middle East and in eastern Europe,
Speaker 2: it has manifested this way. I think Ukraine was a
Speaker 2: surprise to a lot of commentators because I remember at
Speaker 2: the beginning of the war, there were lots of questions about,
Speaker 2: are we going to see a very large scale cyber attack,
Speaker 2: crippling the entire electric grid
Speaker 2: or even into Europe? And for our listeners that may
Speaker 2: have an interest in the field, you know, the scenario
Speaker 2: was colonial pipeline, the shutdown of a pipeline in on
Speaker 2: the eastern seaboard in the US. The reality is we
Speaker 2: didn't see this. And I think there were two reasons
Speaker 2: for this. One is Cyber is part of military operations
Speaker 2: is one
Speaker 2: the many tools at the disposal of states. But it
Speaker 2: is also not a replacement for traditional kinetic war and
Speaker 2: traditional conflict. That being said it does feature prominently as
Speaker 2: part of both of these conflicts. And I think they
Speaker 2: give us a taste of what there is to come. Actually, Ukraine,
Speaker 2: you know, after the invasion of Crimea in 2014, we
Speaker 2: saw the development of disruptive or destructive cyber attacks against
Speaker 2: Eastern European energy infrastructure by Russian Linked units. And what
Speaker 2: that was a good forecasting sign of is war is
Speaker 2: a capability development moment in cyber. It is through military
Speaker 2: means that we see novel tactics and techniques. It is
Speaker 2: what we've seen in the targeting of satellite systems during
Speaker 2: the war in Ukraine. It's also what we've seen in
Speaker 2: the targeting of data centers and large scale telecommunication infrastructure.
Speaker 2: It is not
Speaker 2: the sort of big nuclear apocalypse that people may have forecasted,
Speaker 2: but it is evident that it has become a critical
Speaker 2: part of before during and after conflicts. And I think
Speaker 2: the concern when we look at some of the tensions
Speaker 2: around the world today is there are more and more
Speaker 2: states developing these capabilities. What keeps me up awake at
Speaker 2: night is the private sector is going to be caught
Speaker 2: in the middle of all of this.
Speaker 2: We private sector companies, not only oftentimes run the infrastructure
Speaker 2: that sits in those countries, it is also our business
Speaker 2: imperative to work across jurisdictions and what we're seeing and
Speaker 2: particularly the sanctions that came
Speaker 2: by both the US and the Eu after the invasion
Speaker 2: of Ukraine on Russian businesses was a good indicator when
Speaker 2: all of a sudden you couldn't update Microsoft in Russia
Speaker 2: because the sanctions prohibited Microsoft from sending updates to laptops
Speaker 2: and assets in Russia.
Speaker 2: It is reshaping the world of technology these conflicts. And
Speaker 2: I think very interestingly for us, for instance, we are
Speaker 2: increasingly looking at technology as a resilience concern and just
Speaker 2: strictly a cyber security concern. And I know that's a
Speaker 2: big part of the discussion in Singapore about the resilience
Speaker 2: of the infrastructure cyber resilience in Singapore. I think that
Speaker 2: is absolutely the right discussion
Speaker 2: to touch on the US and China. Look we are
Speaker 2: entering a US electoral period, we don't yet know what
Speaker 2: will happen. But it is very clear that the tensions
Speaker 2: around the control of technology
Speaker 2: and the development of generative A I, we've got the
Speaker 2: beginnings of quantum discussions happening a little bit everywhere is
Speaker 2: going to be a real arms race between the two superpowers.
Speaker 2: And it's going to put businesses in the middle of this,
Speaker 2: of having to pick where do I choose my technology
Speaker 2: supply chain from? How do I build resilience in light
Speaker 2: of different regulatory framework?
Speaker 2: And importantly, what is the direction of travel from an
Speaker 2: access to technology and the security of our technology in
Speaker 2: light of my own business strategy
Speaker 1: Right.
Speaker 1: I want to go back to the issue of resiliency
Speaker 1: for a second in the context of Russia, Ukraine. So, yes,
Speaker 1: at the beginning, the fear was that there will be
Speaker 1: cyber attacks from Russia and there will be widespread blackouts
Speaker 1: both in Ukraine and elsewhere.
Speaker 1: Now, what about the fact that almost three years after
Speaker 1: the conflict started? And despite all sorts of sanctions, Russia's
Speaker 1: capabilities seem pretty good. How are they being so resilient?
Speaker 2: It's
Speaker 2: a great question. And I think there's been lots of
Speaker 2: analysis recently around the sort of move of Russia towards
Speaker 2: a war economy regime and something close to 70% of
Speaker 2: GDP now being dedicated to the war effort. And I
Speaker 2: think that
Speaker 2: most governments now in their strategic military planning take cyber
Speaker 2: as one of the aspects of we need to maintain resources,
Speaker 2: we need to maintain capabilities throughout the continuation of a
Speaker 2: war effort. And so that pivot has been very significant
Speaker 2: in Russia,
Speaker 2: I think equally I mentioned earlier on when we were
Speaker 2: talking about the different types of threat groups. What we
Speaker 2: saw at the beginning of the conflict is a lot
Speaker 2: of the ransomware groups that were very active targeting financial
Speaker 2: institutions and other businesses in the US or in Europe
Speaker 2: or in a all of a sudden stopped their activity
Speaker 2: and focused on Ukraine.
Speaker 2: And this is where the resourceful and the asymmetric nature
Speaker 2: of cyber capabilities where it actually doesn't cost that much
Speaker 2: to do and it becomes very sustainable over time because
Speaker 2: unless you lose the infrastructure within Russia, it's still a
Speaker 2: computer with internet access and you can do a lot
Speaker 2: of damage
Speaker 2: with that. And so I think those resources and the
Speaker 2: asymmetric nature of the spend has been one of the
Speaker 2: reasons why we have seen the continuation of the cyber
Speaker 2: operation surrounding the conflict in Ukraine. But also certainly that
Speaker 2: pivot towards a war footing economy, a wartime economy has
Speaker 2: allowed Russia to sustain a lot of its efforts.
Speaker 1: Fascinating. I, I really didn't see, you know, this coming
Speaker 1: from Russia. I'm pretty amazed that, you know, uh to
Speaker 1: your point that if indeed the Apple I Os or
Speaker 1: Microsoft 365 upgrades are not happening. How on earth are
Speaker 1: they not falling into technological obsolescence unless they have
Speaker 1: friendly countries which are helping them? The text Act?
Speaker 2: Absolutely. There is a lot of, we're seeing a lot
Speaker 2: of Interstate Cooper operation aligned particularly to kind of more
Speaker 2: traditional geopolitical alliances. We're also seeing a lot of home
Speaker 2: grown talent coming out of a lot of places. One
Speaker 2: of the, one of the paradoxes of cyber and I
Speaker 2: often
Speaker 2: draw a parallel with the sort of nuclear arms race.
Speaker 2: If a group gets a hold of a nuclear warhead,
Speaker 2: they can use it once and that's it. Once it's
Speaker 2: been used, it's been spent unless you know how to
Speaker 2: manufacture it, it's gonna be very difficult. If you get
Speaker 2: access to computer code, you can reuse it
Speaker 2: ad nauseam. It is constantly standing on foundations that cannot
Speaker 2: be shaken. We are not tomorrow going to redesign if
Speaker 2: tomorrow Microsoft can't update Windows in Russia. Windows doesn't stop working.
Speaker 2: It's still going to work
Speaker 2: and you can customize things on top of it. And
Speaker 2: that's one of the reasons why technology feels like such
Speaker 2: an exponential pace of development. It's because we never really
Speaker 2: have to start over. We're always building on top of
Speaker 2: things that are being built on top of things. And
Speaker 2: so that's why
Speaker 2: it's very, very hard to build things, but to maintain
Speaker 2: and improve things is actually a lot easier and a
Speaker 2: lot less costly.
Speaker 1: I can imagine that the cybercrime unit at Interpol is
Speaker 1: having sleepless nights because the possessive of this issue. So
Speaker 1: I brought up Interpol for a reason. So on the
Speaker 1: ransomware attacks these days, everybody wants or everybody, most uh
Speaker 1: hackers want crypto as a settlement for ransom.
Speaker 1: My view on crypto was it should be the most
Speaker 1: transparent system in the world. It's a Blockchain and we
Speaker 1: know what the transactions are happening. Why is it so
Speaker 1: hard to not be able to track down people who
Speaker 1: are receiving crypto
Speaker 1: payments?
Speaker 2: Yeah, I think it's, it's the same frustration that a
Speaker 2: lot of innovators have had with platforms like social media,
Speaker 2: you know, the
Speaker 2: the impetus and the design was very much towards transparency,
Speaker 2: freedom of access, freedom of of, of sort of control
Speaker 2: of or from control of, of, of centralized institutions. And
Speaker 2: that's still very much if you look at the sort
Speaker 2: of the maths and the science behind the Blockchain, that
Speaker 2: is the philosophy, it is a transparent ledger.
Speaker 2: But then clever people who had bad intentions realized that
Speaker 2: much like any human attention span, much like banking transaction.
Speaker 2: If you run transactions through hundreds of different layers becomes
Speaker 2: very difficult to reverse engineer. And I think that's where
Speaker 2: we've seen this real frustration. And at times what I
Speaker 2: think has slowed
Speaker 2: down the likelihood of adoption of crypto as part of
Speaker 2: traditional banking or as part of traditional national economies is
Speaker 2: because there's been a weaponization of the capability. So we
Speaker 2: did see very early on when ransomware became a thing,
Speaker 2: the birth of what's called Tumblr, which are services that
Speaker 2: you can purchase on the dark web where you will
Speaker 2: say I have an illegal transaction. I want to hide it.
Speaker 2: It's money laundering, it's, it's and it's automatic systems that
Speaker 2: will run the Cryptocurrency through hundreds and hundreds and hundreds
Speaker 2: of different wallets that have just been created. And all
Speaker 2: of a sudden, it becomes very difficult to trace. The
Speaker 2: last thing I'd say on this point. And I think
Speaker 2: this is the tension with both the regulatory and the
Speaker 2: sort of governance of these technologies,
Speaker 2: part of the principles of cryptocurrencies and the Blockchain was
Speaker 2: freedom from central oversight and governance. But it is also
Speaker 2: because of that freedom from central oversight and governance that
Speaker 2: we see these abuse materializing because there is no authority
Speaker 2: to say the technology shouldn't be used that way. The
Speaker 2: way banks dealt with anti money laundering in Kyc over
Speaker 2: the past 2030 4050 years has been through cooper operation
Speaker 2: between institutions.
Speaker 2: Well, if there is no institution, co-operation becomes very difficult.
Speaker 2: And so that's a very inherent tension in the philosophy
Speaker 2: of these technologies that will eventually need to be reconciled
Speaker 2: one way or the other
Speaker 1: is anything happening in that regard,
Speaker 1: global efforts.
Speaker 2: There are lots of discussions, there are lots of working groups.
Speaker 2: I think lots of governments and financial institutions are looking
Speaker 2: into it. The open source community has built amazing and
Speaker 2: there are tremendous people who are spending a lot of
Speaker 2: their personal time working to the betterment of the technology.
Speaker 2: I think we are
Speaker 2: seeing a more optimistic term. I mean, we've obviously had
Speaker 2: the situations like ftxs and it's it's been rife for
Speaker 2: scams and various other, but it is very much the
Speaker 2: infancy of the technology. And to some extent, you know,
Speaker 2: Ponzi schemes never stopped us from banking. So I don't,
Speaker 2: I'm not a very bad pessimist in this space. I
Speaker 2: think it will take multilateral efforts. And I think
Speaker 2: the concern going back to the geo politics of it
Speaker 2: all is states seem less and less inclined to be multilateral.
Speaker 2: So for technology like this I think we really need
Speaker 2: to think about what the community and the private sector
Speaker 2: can do to help to improve the transparency of it.
Speaker 2: You know,
Speaker 1: Nick,
Speaker 1: when you were saying that I was basically thinking of
Speaker 1: the parallel between climate change and cybersecurity.
Speaker 1: The exter analogies are so substantial that you trying to
Speaker 1: take your foot within your own borders doesn't work. You've
Speaker 1: got to work the whole global community. Yes.
Speaker 2: And I think the parallels with climate change are, you know,
Speaker 2: the magnitude and the scale of the problems are so
Speaker 2: significant that they can feel so daunting that individually, we
Speaker 2: rescind and we retract from trying to be a part
Speaker 2: of the solution.
Speaker 2: I think this is something we've seen a lot in
Speaker 2: the world of business and the SEC published directors recently
Speaker 2: to make sure that boards that were uh regulated by
Speaker 2: the SEC had accountability of Cyber. I think that's a
Speaker 2: great first step towards ensuring that everyone realized we are
Speaker 2: part of the solution. All of us use cell phones,
Speaker 2: all of us have smart watches. Now we have smart homes,
Speaker 2: we are connected,
Speaker 2: we are responsible as well for not just our security
Speaker 2: but ensuring that we are pushing technology and innovation direction
Speaker 2: that's going to be a net positive for the
Speaker 2: world.
Speaker 1: We do connectedness. I was at a board meeting in
Speaker 1: Singapore last week and during the my presentation, somebody's doorbell
Speaker 1: back in Oslo rang and he was like, who's you know,
Speaker 1: knocking on my door and he was taking it out.
Speaker 1: Um, Nick, you live in the US, you face a
Speaker 1: lot of American companies, but you're visiting Singapore. I'm assuming
Speaker 1: during your stay here, you'll be talking to a lot
Speaker 1: of Singaporean companies. What's your sense of Singapore? Is Singaporean
Speaker 1: population susceptible to more
Speaker 1: scams and cyber scams than other countries. Our Singapore institutions
Speaker 1: facing it better than others. Just give us a sense
Speaker 1: from an international perspective.
Speaker 2: I'm always fascinated when I come by Singapore because you're
Speaker 2: very much one of the most connected economies, connected societies
Speaker 2: in the world.
Speaker 2: And I think that's both a blessing and a curse
Speaker 2: when we think about cyber because I think the level
Speaker 2: of awareness and education around the problem, the government has
Speaker 2: done a lot of work at discussing the issue with
Speaker 2: the private sector. There's been regulations that have been sectoral
Speaker 2: and national around the issue. Um And at the same
Speaker 2: time because it is such a connected economy, we do
Speaker 2: see a lot of attacks in Singapore proportionally speaking,
Speaker 2: not any different than many other places in the world.
Speaker 2: But I think you are by virtue of the concentration
Speaker 2: of high tech businesses between finance, health care, tech, all
Speaker 2: of these businesses that have a larger attack surface than
Speaker 2: most and also one of the largest shipping ports in
Speaker 2: the world. And we are seeing a huge amount of
Speaker 2: businesses investing in Singapore.
Speaker 2: That is a perfect recipe for cyber threat, actors of
Speaker 2: all ilks to target the country. I think when we
Speaker 2: look at major data breaches that have occurred in the
Speaker 2: past few years, you know, whether these be in the
Speaker 2: healthcare sector, we've had breaches in the telecommunications space very
Speaker 2: recently in the law firms, uh sector of professional service industry.
Speaker 2: Those trends mirror very much
Speaker 2: what we are seeing elsewhere. I think the real challenge
Speaker 2: for Singapore in the years ahead is how to continue
Speaker 2: maximizing the opportunities that come from this incredibly connected population.
Speaker 2: I'm fascinated every time when you look at the infrastructure,
Speaker 2: the roads, the public transport, the applications that exist for
Speaker 2: hailing a cab are remarkably ahead of many other places
Speaker 2: around the world. But that creates a layer of vulnerability.
Speaker 2: And I think when I look at the landscape here,
Speaker 2: there's been probably a less less lesser concern around the
Speaker 2: top level geopolitical risk, although that may very well change
Speaker 2: in the near future,
Speaker 2: but more concern around criminality and that's absolutely where we
Speaker 2: see it scams are rife. I think the advent of
Speaker 2: generative A I is going to trigger even more. You know,
Speaker 2: we are in a city in a country where there's
Speaker 2: 3 to 4 primary languages spoken for business and for
Speaker 2: sort of transactions that opens a lot of doors for
Speaker 2: spear phishing, for scams for all of these sort of things.
Speaker 2: And I think it is balancing that opportunity with the
Speaker 2: risks that is a challenge moving forward. But I'd certainly
Speaker 2: say on par
Speaker 2: the exposure is greater, but actually, there's been also great
Speaker 2: works and companies here are very aware of the issue
Speaker 2: and are certainly getting more and more aware and investing
Speaker 2: more and more in security.
Speaker 1: Yeah. No, no doubt about the investment aspect. And I
Speaker 1: think that firms and the government are, you know, very
Speaker 1: enthusiastic investors and procure of, you know, technologies to sort
Speaker 1: of prevent or, or reduce the fallout from cybercrime. Uh
Speaker 1: You mentioned generative A I. So let's talk about A
Speaker 1: I a little bit.
Speaker 1: Uh So even before large language models came in, you know,
Speaker 1: just the application of A I itself meant that, you know,
Speaker 1: one can again run complex algorithms and iterative calculations to
Speaker 1: break codes or uh learn people's behavior and then apply
Speaker 1: it against them, that sort of stuff. Now, this 18 months,
Speaker 1: 16 months of LM MS uh are the hackers of
Speaker 1: the world
Speaker 2: picking it up and the world's still here, as far
Speaker 2: as I'm aware, we're not in a simulation yet. Um
Speaker 2: So, yeah, I think there's, there's been a bit of
Speaker 2: um there's been a bit of a, a balancing of
Speaker 2: public consciousness around the development of the technology. So to
Speaker 2: answer your direct question, yes, we're seeing hackers beginning to
Speaker 2: use it. And I think particularly in social engineering attempts,
Speaker 2: there was a very notable case of an engineering firm
Speaker 2: in Hong Kong that was breached for about $20 million
Speaker 2: and it was a deep fake voicemail that allowed the
Speaker 2: breach to occur. So somebody's voice had been mimicked. And
Speaker 2: I think in a sort of spectrum of risks that
Speaker 2: we're anticipating from generative A I, we're really in phase one,
Speaker 2: which is that disinformation, deep fake social engineering.
Speaker 2: How do hackers use it? They will use it to
Speaker 2: very rapidly create tailored emails to target their targets based
Speaker 2: on their linkedin profile. It's not something they haven't done before.
Speaker 2: They just go quicker or maybe to translate into Mandarin
Speaker 2: when they normally only speak Portuguese. And there we go.
Speaker 2: The spear phishing email looks much more credible and much
Speaker 2: more likable,
Speaker 2: but it hasn't been a total collapse that some were predicting.
Speaker 2: And I think in part, it's largely because of how
Speaker 2: challenging the education about what it is that we talk
Speaker 2: about when we talk about general A I and I'm
Speaker 2: sure it's been the same in your firms and in
Speaker 2: the conversations you've had in the communities, there is a
Speaker 2: very varied level of understanding of what the tech can
Speaker 2: do today. Its possibilities in the future are tremendous, but
Speaker 2: we are still seeing just the very beginnings of the application.
Speaker 2: So what we thought was going to revolutionize the world
Speaker 2: in two months, you know, 18 months, we're still here
Speaker 2: and there's still a lot of great things that have happened.
Speaker 2: But by no means what the public may have expected,
Speaker 2: I think when we look to the future, there are
Speaker 2: indeed considerations from a cyber perspective where it's a barbaric term,
Speaker 2: but it's existed for a while, but it's called Polymorphic malware.
Speaker 2: So it's the ability of computer code to adapt to
Speaker 2: its environment to know if it's sitting on a Windows
Speaker 2: system or a MAC system or an I OS system.
Speaker 2: And we do expect small language models to be included
Speaker 2: in malware development so that
Speaker 2: there's less and less need for human operators, much like
Speaker 2: we are using LMS to reduce the need for traders
Speaker 2: to kind of look at every single bit of the
Speaker 2: trades that they're doing to gain speed in the research
Speaker 2: that they do. And so it's always a sort of
Speaker 2: arms race between the good guys and the bad guys.
Speaker 2: It's whatever we develop to either defend or to do
Speaker 2: our day to day work, they develop to exploit or attack.
Speaker 2: And so we will see more, it's still very much
Speaker 2: in its infancy.
Speaker 1: OK. Um On that, uh there's a lot of foundation
Speaker 1: of cybersecurity built around cryptography and the whole Blockchain is
Speaker 1: built on the foundation of cryptography. Uh putting aside L
Speaker 1: MS but just the other exciting science fiction area which
Speaker 1: is quantum are these cryptographic foundation of modern technology at threat.
Speaker 2: So you can, yeah, I think they, I think they
Speaker 2: are um the question is more difficult to answer if
Speaker 2: you ask me when. Uh but certainly
Speaker 2: in the concept stages. And we have seen, you know
Speaker 2: now that the public is getting in a lot of
Speaker 2: boards of fine, we understand A I the next question
Speaker 2: is quantum computing and quantum telecommunication, which do theoretically pose
Speaker 2: a systemic risk to encryption everywhere around the world. And
Speaker 2: I think encryption will only be the beginning quantum computing
Speaker 2: in its commercial applications. And as far as we can
Speaker 2: tell because again, it is very much not out there yet.
Speaker 2: There are proof of concepts, there are some small scale
Speaker 2: applications but we still have massive physics challenge to resolve
Speaker 2: to deploy commercially
Speaker 2: will absolutely jeopardize the very foundation of encryption as we
Speaker 2: designed it because it will allow for cracking. What would
Speaker 2: take today billions of years to crack a password using
Speaker 2: RS A encryption theoretically could take less than a few
Speaker 2: hours with a quantum computer. Now, I think quantum for
Speaker 2: me is emblematic of again, that exponential curve in technology.
Speaker 2: Um we are living in an era where I think
Speaker 2: it took, you know,
Speaker 2: 60 years for a million people to gain access to
Speaker 2: the radio. Then 40 years for people to get access
Speaker 2: to the TV. Then 20 years for 1 million people
Speaker 2: to have access to the internet, it took four hours
Speaker 2: for 1 million people to use chat GP T. And
Speaker 2: that curve is very much a again, a symptom of
Speaker 2: the foundations that we are building upon. Those building blocks
Speaker 2: are still here.
Speaker 2: So quantum is really about computational capabilities we are going
Speaker 2: to live in an era where a lot of the
Speaker 2: current security and defensive measures we've put in place that
Speaker 2: are reliant on the limitations in our current computing capabilities
Speaker 2: will have to be rethought.
Speaker 2: And that's going to be a very significant effort by
Speaker 2: everyone and costly.
Speaker 1: Right now, I'm assuming scientists are fully cognizant of the
Speaker 1: theoretical threat posed by quantum. And the really smart ones
Speaker 1: are trying to already figure out some countermeasure to that.
Speaker 1: Uh I mean, so like the day somebody says we
Speaker 1: have a fully operational quantum computer, the world doesn't completely
Speaker 1: panic and sell everything they have hopefully, is there some
Speaker 1: hope like that? There,
Speaker 2: there
Speaker 2: is some hope. And I think, you know, the scientific
Speaker 2: community does what the scientific community should do. They're innovating
Speaker 2: and much
Speaker 2: like what we've seen in other major societal and economic evolutions,
Speaker 2: they are not necessarily thinking about this from a purely
Speaker 2: risk based perspective and you wouldn't want them to. This
Speaker 2: is also one of the benefits. I think of all
Speaker 2: the noise around gen A I, we had certain suddenly
Speaker 2: a lot of people around the world became technology, ethical specialists.
Speaker 2: And you know, everybody has an opinion of what's good,
Speaker 2: what's bad in this space. That is part of where
Speaker 2: I think the checks and balances that are happening across
Speaker 2: a lot of places in the world, in government, in academia,
Speaker 2: in the R and D community is around having a
Speaker 2: multidisciplinary group of people around the table. And this is
Speaker 2: what we say a lot to boards and executives when
Speaker 2: we meet them. And we talk about these emerging technology issues.
Speaker 2: You have to look at this across the spectrum of
Speaker 2: your business, your risks, your duty of care, your social responsibility,
Speaker 2: your esg obligations, all of these are deeply interlinked and
Speaker 2: without doing so, we run the risk of really generating
Speaker 2: technology or employing technology that ultimately will harm our businesses
Speaker 2: or societies or our people.
Speaker 1: Fascinating though, Nick, you're not a large language model. So
Speaker 1: I'm not gonna ask you to summarize in 20 words,
Speaker 1: the two hour presentations you make to companies. But um
Speaker 1: give us a sense of some of the best practices
Speaker 1: that you're urging companies and boards to adopt in dealing
Speaker 1: with cybersecurity.
Speaker 2: Yeah, I
Speaker 2: think the the three things I would let companies sort
Speaker 2: of really focus on is first get the basics, right?
Speaker 2: And I think still today we talk about ja I
Speaker 2: we talk about quantum, the vast majority of businesses get
Speaker 2: compromised by a simple phishing email and that will never
Speaker 2: go away. We need to be realistic no matter how
Speaker 2: much technical spend we make. This is a human problem.
Speaker 2: And so continue with the basics and education in your
Speaker 2: business
Speaker 2: as you do this. The second layer is think strategically
Speaker 2: about technology, not just in terms of security, but in
Speaker 2: terms of your resilience over the entire span of your business.
Speaker 2: One of the things I'm always surprised by is boards
Speaker 2: and executives are
Speaker 2: comfortable doing market entry analysis. We should be doing technology
Speaker 2: entry analysis. Why are we picking this? Lm why this
Speaker 2: cloud provider? Why are we venturing into this space? Those
Speaker 2: questions need to be asked at the most senior level
Speaker 2: in business to get a holistic view of the risk.
Speaker 2: And then the last thing I would do is don't
Speaker 2: be afraid to look at both risk and opportunities over
Speaker 2: a long term horizon.
Speaker 2: Again, the parallel with climate change, I think are really
Speaker 2: important here. We can be worried about today, but our
Speaker 2: executives and boards have a responsibility towards tomorrow and today,
Speaker 2: we need to make sure we do the basics, right?
Speaker 2: We need to prepare for what is going to be
Speaker 2: a very different world in 5, 1015 years. And when
Speaker 2: we think about cyber, it is talking about what does
Speaker 2: our business want to be?
Speaker 2: Do we want to have access to the latest technology
Speaker 2: and manage the risks? Do we want to be maybe
Speaker 2: second line adopters? And first see how the technology evolves.
Speaker 2: And importantly, how do we look at implementation as a
Speaker 2: cultural phenomenon within our enterprises, how are users going to
Speaker 2: think about it? And this requires that long term vision
Speaker 2: much like we do long term business strategy,
Speaker 2: we should do long term technology risk assessments?
Speaker 1: Fantastic final question. Um you mentioned earlier that, you know,
Speaker 1: financial sector has always been sort of the forefront of
Speaker 1: balancing user experience with infrastructural security and so on beyond
Speaker 1: financial sector, when you look around the healthcare defense uh
Speaker 1: other education schools, which sectors look to you
Speaker 1: fairly resilient and smartly managed and which sectors do you
Speaker 1: look to you the most vulnerable?
Speaker 2: Yeah, II, I think we've seen a real leaps and
Speaker 2: bounds in the tech sector and, and particularly sort of
Speaker 2: um I'd say technology as a service that's been a
Speaker 2: massive because they've become so critical to the actual businesses
Speaker 2: of others. And if you're Amazon Ali or if you're
Speaker 2: Microsoft your business is security, security of your consumer data.
Speaker 2: And I think much like the banks, they've had to
Speaker 2: rapidly adapt their business models.
Speaker 2: I think where I have deep concerns and um you know,
Speaker 2: health care has been a real area of concern because
Speaker 2: health care is incredibly complex as a sector from hospitals
Speaker 2: to insurance to sort of now we have, you know,
Speaker 2: health tech providers, farmers,
Speaker 2: but the real concern is the value of personal health
Speaker 2: information is incredibly significant to a hacker. It gives us
Speaker 2: insights into people, it gives us insights into some of
Speaker 2: their challenges, but also how to reach into them and
Speaker 2: how to social engineer them that makes it very attractive
Speaker 2: for threat actor.
Speaker 2: The other sector that I have a long term worry
Speaker 2: of is my sector, professional services. And I think because
Speaker 2: we sometimes forget we are part of so many supply chains.
Speaker 2: We work with businesses across all verticals, whether you're a
Speaker 2: law firm or consulting organizations, we have access to a
Speaker 2: lot of data, a lot of sensitive data
Speaker 2: and we sometimes make for the worst patients. It's like
Speaker 2: doctors make for the worst patients, consultants and professional service
Speaker 2: industries sometimes make for the worst patients because we think
Speaker 2: we know better. And I think I will always stress
Speaker 2: on my clients and certainly everyone out there ask those
Speaker 2: questions in the discussions with your providers because again,
Speaker 2: it is a supply chain issue. It is very much
Speaker 2: the weakest link in the chain and all of our
Speaker 2: business are connected now and it will be very difficult
Speaker 2: to disconnect them. So that's probably where I'd see the
Speaker 2: sort of good and the bad.
Speaker 1: Absolutely fascinating. Nick Race. Thank you so much for your
Speaker 1: time and insights.
Speaker 2: Thank
Speaker 2: you very much for having me. It's been a pleasure.
Speaker 1: It's
Speaker 1: been great and thanks also to our listeners. Copy Time
Speaker 1: was produced by Ken Delbridge Violet, Lee and Daisy Sharma
Speaker 1: provided additional assistance. All 123 episodes of the podcast are
Speaker 1: available on Apple Google and Spotify, as well as on
Speaker 1: youtube as for our research publications, webinars and all other
Speaker 1: material that we put out. You can find them by
Speaker 1: Googling D BS research library. Have a great day.