Top 5 cyber security facts we learnt from Aapo Cederberg

Last week, we had the privilege to learn from Aapo Cederberg, a leading cyber security expert with vast experience in the field of cyber security. He is currently the CEO of Cyberwatch Finland and an associate fellow at Geneva Centre for Security Policy. He has previously held the position of Secretary General overseeing the Security and Defence Committee within the Finnish Ministry of Defence from 2007 to 2013 and worked in various positions in the Finnish Defence Forces.

Our team was profoundly honored to attend a workshop with him. During the day, we were able to hear his views about cyber security, especially from the global perspective, and how it intertwines with government politics, affects institutions and service providers, and touches our daily life. He shared his insight on how cyber security is mixed with politics, both international and domestic, and how it affects our life in the very physical world of basic amenities such as food, water and electricity as well as in the digital domain.

 

 

I’d like to highlight the following five topics from the workshop:

1.     The extent of cybercrime is immense

The value of cybercrime is expected to rise up to USD 2 trillion by 2020, while the expenditure on fighting it is expected to lag behind at USD 200 million. Even today, the value of cybercrime is higher than the value of drug-trafficking. Cybercrime has already become an established line of business of its own, offering services such as crime-as-a-service. These services are used by common criminals and terrorists as well as state actors. The actual identities of cybercriminals are routinely blurred, making it difficult to decipher their actual goals.

2.     The threats evolve at an extremely rapid speed

The first computer viruses were seen around the 90s. The world of cybercrime is a completely different set today. The competence of the criminals and the level of intricacy of the attacks has grown tremendously, and keeps on evolving at a fast pace. Large-scale software applications have long lifespans, and today’s threats could not have been predicted when they were created. The rapidly changing threat landscape poses risks to those legacy applications and the teams in charge of their security.

3.     The number one cyber security risk is the human

Machines are predictable, humans are not. Humans can be forgetful of their phones, memory sticks and other belongings, or use “password” as their password. But they can also be the target of phishing attempts, and the more valuable the target, the more sophisticated the attempts. Humans can also share classified information by accident or even on purpose. The risk of an insider ranges from 50% to 65% depending on the source, making it not only the highest risk but also the most difficult one to prevent.

4.     Sourcing for the right solution is complex

There is no single company in the world that would offer an all-in-one cyber security solution. Instead, there are numerous companies offering different services in infrastructure security, threat intelligence, endpoint security, application security, web security and a lot more. There are a number of companies offering their services in each of these specific fields. The buyer needs a very high level of knowledge and understanding of the field be able to make the best possible sourcing decisions. That also brings us to the next point in the list, trust.

5.     Trust is the key in cyber security business

You can only lose trust once, they say. This is most definitely true in cyber security. Whenever companies choose a cyber security provider, they are buying protection, which is very intangible and only truly revealed when an incident happens. On the other hand, to be protected, one must allow the service provider access to critical networks and critical data. This requires absolute trust between the counterparties.

The attacks are getting more elaborate, and criminals’ skills increase by the day. In this environment, it is nearly impossible to obtain a confirmed, absolute level of cyber security, even though that is what we must strive for. Today’s sophisticated attacks can breach even the strongest defences. Our actions must be based on the assumption that they are already in.