Rick's Musings in Overtime: Thoughts on Privacy, Security and Trust by Rick Fawcett

Rick's Musings in Overtime: Privacy, Security, and Trust

Key Concepts:

• Decision Maker Challenge: The difficulty executives face in balancing cybersecurity investments with other business needs.
• Cybersecurity as a Business/Social Issue: The shift from viewing cybersecurity solely as a technical problem to recognizing its broader business and societal implications.
• Financial, Reputational, and Legal Risk: The key risk categories that resonate with non-technical decision-makers.
• Low Earth Orbiting (LEO) Systems: Satellite communication systems with inherent security vulnerabilities due to power limitations and encryption constraints.
• Canadian Cyber Security Certification Program: A new program modeled after the US program, impacting businesses contracting with the Canadian government.
• The Never-Ending Cycle: The constant evolution of threats, people, processes, technology, and social factors that challenge cybersecurity efforts.
• People as the Weakest Link: The critical shortage of qualified cybersecurity professionals and the challenges in attracting and retaining talent.

The Decision Maker's Perspective

The speaker revisits the "decision maker challenge," emphasizing that cybersecurity, from an executive perspective, is a business decision, not just a technology issue. It's increasingly becoming a social issue. Decision-makers, often non-technical, must balance cybersecurity investments against other business priorities. They understand financial, reputational, and legal risks, but are increasingly "terrified" by cloud, SaaS, and the evolving threat landscape.

The Changing World: A Year in Review

The past year has seen a remarkable increase in cyber threats and their impact. Key events include:

• Media Domination: Constant coverage of data breaches and cyber threats.
• Ukraine-Russia War: Continued cyber warfare impacting society.
• Israel-Hamas Conflict: Cyberattacks preceding and during the conflict, including manipulating public information (e.g., changing billboard content).
• US Election: Cyber activities aimed at disrupting and influencing the opposition.
• Foreign Interference in Canada: Cyber used to enable foreign interference.
• Environmental Impacts: Environmental incidents impacting networks and information.
• AI and Everything: AI's dual role as a tool for both attack and defense.

Headlines and Real-World Examples

Data leaks are a daily occurrence. The speaker uses the example of Taylor Swift deepfakes to illustrate the impact of AI-generated misinformation on public opinion and elections. The speaker highlights the Calgary Public Library being hit as an example of widespread cyber incidents in Canada. Small and medium-sized businesses are constantly under attack, with Russia and Iran being major sources.

The Never-Ending Cycle

The speaker updates the "never-ending cycle" model, adding "social" as a key factor. The cycle includes:

• Threat: Constantly evolving.
• People: Changing roles and skills.
• Processes: Undergoing continuous re-engineering and simplification.
• Technology: Rapidly changing (Moore's Law).
• Social: The impact of fake news and misinformation.

This cycle creates a paralysis for decision-makers trying to allocate resources effectively.

Canadian Cyber Security Certification Program

A new Canadian program for cybersecurity certification is being implemented for businesses contracting with the government. It's modeled on the US program, which is beneficial for companies already compliant with US standards. However, it adds another layer of cost and complexity. The speaker notes the potential business opportunity in becoming a third-party assessor for the program.

Low Earth Orbiting (LEO) Systems

LEO satellite systems, like Starlink, have inherent security risks due to power limitations. Lower power means less encryption, making them vulnerable to attacks. The speaker mentions ongoing research into encrypting these systems while maintaining their small size.

Achieving Privacy, Security, and Trust

Achieving privacy, security, and trust requires:

• Protecting Data: Ensuring data integrity and confidentiality.
• Protecting Networks: Securing network infrastructure.
• Trusting Data: Verifying the accuracy and reliability of information.
• Trusting Processes: Maintaining robust and reliable processes.
• Trusting People: Investing in and empowering skilled personnel.

The People Problem

The speaker emphasizes that people are the "weakest link" due to a severe shortage of qualified cybersecurity professionals. Universities are not producing enough graduates to meet the demand. Small companies struggle to compete with large corporations like Google and Amazon for AI and cybersecurity talent. Diversifying cyber teams is crucial for better outcomes. Training is essential but expensive.

Conclusion

The demand for cybersecurity professionals will continue to grow. The field is dynamic and offers job security. The speaker encourages students to continue their studies in cybersecurity, emphasizing the critical need for their skills.