In this week’s episode, Steve returns to Business Matters with Juliette Foster. He explains why attacks on critical infrastructure are on the rise, what real cyber resilience looks like, and how do-it-yourself hackers are changing the threat landscape. Steve and Juliette also discuss whether UK organizations should invest or hold back in this time of slow economic growth.

Key Takeaways:

1. Critical infrastructure are targets because they play important societal roles, and an attack will often trigger a quick response.
2. Focus for leaders of critical national infrastructure organizations must shift from prevention to recovery.
3. Crime-as-a-service and DIY hackers are changing the threat landscape.

1. The government’s role in protecting critical infrastructure (5:33)
2. Investing in cyber resilience during a time of slow economic growth (9:22)
3. The concept of the “virtual trusted insider" (24:55)

1. “A lot of industries really are operating with still fairly dated infrastructure, which is then being connected straight into the internet. So that's a good pathway for a malicious actor.” - Steve Durbin
2. “We're talking about really fast-moving, fast-changing, emerging technologies that are going to be really having a very firm, strong impact on the way that businesses operate, and boards have to do a better job of catching up to understand the risk.” - Steve Durbin
3. “I think the gold standard, Juliette, would be-- and it's very simple, actually-- it's about understanding your key data, making sure that your crown jewels are protected. It's about understanding your key processes, making sure that you know what they are and the operational impact of those. And then it's about practice and rehearsal.”

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

Today, Steve speaks with Will Vogt, expert on Chinese tech policy. The two discuss China’s approach to technology, how it can impact western businesses, and the country’s investments in tech infrastructure in emerging markets in Africa and Latin America. Will also gives his thoughts on how business leaders best can understand tech developments in China in the coming years.

Key Takeaways:

1. China is moving toward a more centralized, collectivist internet.
2. Understanding Chinese cultural norms is helpful when looking to do business with Chinese corporations.
3. If you are looking to expand into emerging markets, expect various nation states and private actors to be operating there.

1. The Chinese state’s relationship between technology, security, control, and culture (7:58)
2. China and AI (9:47)
3. How Chinese tech and infrastructure is spreading to emerging markets (18:39)

1. “There's a real risk there that comes from any sort of social, economic, or political revolution, and that is something that has global impacts now because a China that melts down has a lot of externalities involved, and I think that's just something that those stakeholders who are engaged with China, it's important to keep that in mind, not only for global stability, but also to understand the counterpart's point of view.” - Will Vogt
2. “In certain contexts, what we might call a bug or hallucination in an AI platform can also be viewed as a potential mechanism for propaganda or for establishing a national narrative.” - Will Vogt
3. “China is changing rapidly. I really want to reiterate to de-emphasize the conversations about chips and even about regional issues in East Asia. So I would say you need to look outward. And it's worth having a better understanding of what markets are being emphasized by China, because that will tell you a lot.” - Will Vogt

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.

Today, Steve is in conversation with Dr. Ashley Sweetman, co-author with Nina Paine of the recently released book, Communicating Cyber Risk: Build Cyber Resilience Through Compelling Communication, including how to translate complex cyber risk into business and financial terms. Ash highlights the importance of empathy and honesty, and notes that more and more C-suite executives now consider these “soft” skills as important as technical skills. Ash and Steve also dive into how to communicate cyber risk to the board, what a security-focused culture is, and challenges created by AI.

Key Takeaways:

1. Lead with honesty and transparency, but make sure you understand who you are communicating to and tailor your message accordingly.
2. A leader that takes cybersecurity seriously goes a long way to build a security-focused culture.
3. Cultivating relationships between the cybersecurity team and other teams is important for cyber resilience.

1. Why more cybersecurity employees should receive communications training (4:48)
2. What a security-focused culture looks like (9:24)
3. Ash’s advice for communicating cyber risk that leaders can implement right now (20:37)

1. “Communicating things in business and financial terms is a pretty key skill. If you can put numbers on things and give talk in kind of estimative intelligence language, that can be helpful. It's about explaining things in terms of real world impact and the impact on the customer or your clients.” - Ash Sweetman
2. “It's having those relationships with the board that preexist, the trust and credibility that you build up over time so that when the inevitable happens or if you're in a bit of a crisis period, everybody knows their roles. The board is able to challenge effectively. They're equipped with the right skills and questions to provide constructive challenge, and that is built over time rather than just when your back is against a wall.” - Ash Sweetman
3. “I don't think anytime soon AI’s going to be relied upon as the kind of producer of communications, but I think it could do some good peer comparison, for example, or ask some really good constructive challenge questions and things like that.” - Ash Sweetman

Read the transcript of this episode
Subscribe to the ISF Podcast wherever you listen to podcasts
Connect with us on LinkedIn and Twitter

From the Information Security Forum, the leading authority on cyber, information security, and risk management.