“WE’RE LIVING IN A WORLD WHERE CYBERATTACK IS EASIER THAN CYBERDEFENCE”

Cybersecurity guru Bruce Schneier to reveal lessons learned from the Sony hack scandal at the Gulf Information Security Expo and Conference (GISEC)

Mobilk - Cybercriminal attacks around the world will continue to rise as long as personal data provides the ability to commit fraud, and intellectual property is worth stealing, leaving both individuals and organisations vulnerable to harmful computer and network intrusions.

According to cybersecurity guru Bruce Schneier, one of the keynote speakers at Gulf Information Security Expo and Conference (GISEC), a cyberattack is much easier to implement than it is to install impenetrable cyberdefences. The 3rd edition of GISEC, the region’s leading I.T. security platform, will take place from 26-28 April 2015 at Dubai World Trade Centre. The event will address key issues surrounding cybersecurity management, identity management and disaster recovery across different sectors. 

One of the world’s most recognisable voices on cybersecurity, Schneier is also the Chief Technology Officer of Resilient Systems and a Fellow at the Berkman Center for Internet and Society at Harvard Law School in the U.S.A. Schneier is the author of the popular security blog Schneier on Security, and has recently released his book Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World. 

“Everyone must think about cybersecurity in terms of protection, detection and response. We protect against easy attacks and detect and respond to the more sophisticated ones. The goal is resilience. If we do things right well get there,” said Schneier.

Schneier believes many organisations are taking the threat from cybercriminals too lightly. “We tend to be risk-seeking when it comes to losses, which means that we are likely to take chances that we won’t be attacked rather than spend to prevent the attack in the first place,” he explained.

Lessons learned from the Sony hack scandal

During the second day of GISEC on 28 April, Schneier will discuss the reactions and lessons learned from last year’s devastating Sony hack scandal, where a group of hackers called the ‘Guardians of Peace’ infiltrated and stole a number of confidential documents from the computer network of Sony Pictures Entertainment. During his presentation, Schneier will also highlight how companies in the Middle East can secure their networks against this sort of attack. 

“We live in the world where a cyberattack can be the work of a foreign government or a couple of guys on a computer at home,” Schneier said. “The lessons from the Sony hack are the same as those in the attack against Saudi Aramco in 2012 when 30,000 of its workstations were infected with a malicious virus. As the Middle East catches up to the rest of the world in Internet infrastructure, companies in the region will see more and more of these sophisticated cyberattacks.”

Schneier advises that organisations should take cybersecurity seriously. “Companies need protection against people using common hacking tools, which are known as low-focus attacks and can impact thousands of networks worldwide. They need detection to spot the attackers and then if they do get through, a response to minimise the damage, restore security and manage the fallout is needed,” Schneier said. 

Cloud-based systems are susceptible to cyberattacks 

Meanwhile, cloud services will remain a hotbed of activity this year with USD118 billion in spending on the greater cloud ecosystem, according to IDC Forecast Report for 2015. Cisco Systems Inc. believes present cyberthreats are stealthier than ever following last year’s widespread man-in-the-middle (MITM) attack on Apple’s iCloud system. 

Any organisation using cloud-based applications and services are still vulnerable to cyberattacks. To understand and protect against these incidents, organisations need to mobilise all aspects of their cyberdefences to focus on the threat. 

“It has to be about gaining visibility and control across the extended network in the cloud – before an attack happens, while it is in progress and even after an attack has happened and succeeded in stealing information and damaging systems,” said Philippe Roggeband, Business Development Manager of Cisco Security Architecture.

“Organisations must implement internal programmes to ensure users know how to recognise and avoid clicking on potential malware. Education is an essential component and when combined with visibility and control, it can help minimise cyberattacks and protect our networks,” Roggeband added.

As the region’s largest and only I.T. security knowledge event, GISEC will address key issues surrounding cybersecurity management, identity management and disaster recovery across susceptible industry sectors such as financial services, governments, oil & gas, I.T. and pharmaceuticals as well as for individuals. GISEC’s exhibition segment will also showcase over 150 exhibitors, attracting over 5,000 trade visitors and security professionals from 50 countries including Chief Information Security Officers (CISOs) and Chief Information Officers (CIOs). 

Key sponsors of GISEC include BT Global as the Lead Sponsor; GBM as Diamond Sponsor; CISCO and Spire Solutions as Platinum Sponsors; and Etisalat, Paladion Networks, Palo Alto Networks as Gold Sponsors; and Fortinet, Guidance Software, Paramount and Qualys as Silver Sponsors. Key exhibitors also include Airwatch, Airbus Defence & Space, Neustar, Bit 9, Cyberroam, Splunk, Lancope and Mindware.

Powered by GITEX TECHNOLOGY WEEK, the region’s leading technology event, GISEC and GEMEC are strictly trade-only events and are open to business and trade visitors from within the industry only. GISEC and GEMEC are open 10am-6pm from 26-28 April 2015 at Sheikh Rashid Hall at Dubai World Trade Centre. Visitor attendance is free of charge. For more information, please visit www.gisec.ae.