Hello everybody and welcome to today's cybersecurity webinar. 

I'm Associate Professor John Williams. I'm the Deputy Director of the Cybersecurity Initiative here at the University of Queensland, and it's my pleasure to be your moderator and mc for this evening's event. 

So why is the future of cybersecurity important? 

The cybersecurity industry is rapidly growing every day. Even with the increased attention on protecting electronic information, there is ample reason for businesses, organisations, and the public to be concerned. 

Malicious cyber activity against Australian national and economic interests has increased in recent years in terms of its frequency, scale, and sophistication.

Cyber-security ventures expect global cybercrime costs to grow by more than 15% per year over the next five years, reaching more than 10.5 trillion US dollars annually by 2025 up from 3 trillion US dollars in 2015. They predicted there will be a ransomware attack on businesses every 11 seconds from 2021 up from 41 seconds.

In 2016 alarmingly more than half of all cyberattacks are committed against small to mid-sized businesses, and 60% of them go out of business within six months of falling victim to a data breach or hack. Cybersecurity is now a global priority as cybercrime and digital threats grow in frequency and complexity. 

As a global university our mission at the University of Queensland is to address global cybersecurity challenges and educate top cybersecurity leaders. 

We are the first organisation in Australia to adopt the internationally recognised cybersecurity education framework, which is the current gold star standard around the world for cybersecurity education and job alignment.

It is estimated that Australia will need an additional 18,000 cybersecurity professionals by 2026, UQ has partnered with industry experts to develop the most comprehensive master of cybersecurity program in Australia to genuinely address the interdisciplinary nature of this field while meeting the need for deep technical specialisation in core areas.

These specialisations include cyber defence, cyber criminology, crypto, cryptography, and leadership streams, allowing students to play to their strengths and forge a path in this growing global industry. In November, 2020, UQ establish an Industry 4.0 energy test lab in partnership with Siemens and with funding support from the Australian government.

The cybersecurity Energy test lab team facilitates research and education in critical infrastructure, resilience and cybersecurity. At UQ, we are fortunate to have a team dedicated to enhancing cybersecurity initiatives and our newly launched cybersecurity strategy reflects the constantly evolving cybersecurity threat landscape, and the diverse needs of the university and our community.

We hope that today's webinar will serve as an opportunity to hear firsthand about UQs future trends, perceived threats in emerging technology as well as the evolving global landscape. 

Thank you again for joining me and my thanks to all of the speakers on the panel this afternoon. Thank you.

It's now my pleasure to introduce our keynote speaker today. Keren Elazari is a globally recognised security researcher, author, and strategic analyst. Her independent research work and writing about emerging security issues has been featured by Ted Scientific, American Wired, the Financial Times.

She holds an MA in security studies from Tel Aviv University, where she's now senior researcher at the Blavatnik Interdisciplinary Cyber Research Centre, focusing on the complex relationships between hackers, industry and government. She's also a guest faculty member at Singularity University in California.

In 2014, Keren became the first Israeli woman to speak at the annual TED Conference. Her TED talk about the role of hackers has been viewed by millions, translated into 30 languages, and selected for Ted's list of most powerful ideas. Keren is also the founder of Israel's largest hacker community event, BSides Tel Aviv, and the co-author of the Women in Tech book, an Amazon bestseller.

Thanks very much for joining us, Keren. Over to you. 

Thank you so much, John, and thank you, Jessica. It's my pleasure to join you today from sunny Tel Aviv. So good morning from Tel Aviv. Good evening in Australia, and good day wherever you are in the world. I'd like to share with you today my point of view, my perspective about our possibility for a secure future.

And to do that, I'm going to take a look at what our future, the cybersecurity future looks like. But we're going to take a look at that possibility for a secure future from the perspective that I have held throughout my career in the cybersecurity space for more than 20 years. 

And that is the hacker's perspective.

The hacker point of view is how I grew up in this industry here in Tel Aviv. I was a very curious little child, and growing up I had a lot of questions. My curiosity was my main driver. In fact, if you ask my mom who might be on today's webinar, she will tell you that instead of a bedtime story, I got volumes of the encyclopedia to read before sleep.

I was a very curious little girl. And when we first got access to the internet here in Israel in the early nineties, I realised that through the internet, through the worldwide web, I could find answers to all of my questions. If only I could teach myself how the internet worked. And sometimes I had to also teach myself how to get into password protected websites or sometimes other people's computers because that's where the information that I was curious about, that's where it was.

I hadn't realised that my activities were actually called being a hacker. Not until I met my hacker mentor her name. Angelina Jolie in 95, she portrayed a fierce high school hacker in the Hollywood movie Hackers. And that film instantly captured my heart and my mind because it represented a view of kids, really high school kids who are passionate about the same things as I was.

And they used their capabilities, they used their hacking skills in that movie to ultimately save the day. For those of you who have not seen this film yet, I absolutely recommend it.  25 years, and it's still a classic. To me, that movie showcased what hackers can look like. 

And seeing a young girl represented in that film, a young woman, was absolutely instrumental in my choice to pursue this as a life and as a career.

And this is exactly what I've dedicated my life to since I saw that film. The study of what hackers can show us, how hackers uncover the true realities of our digital world. 

These are just some of the organisations I've worked with in the past 25 years. As you've heard, I'm a researcher here at Tel Aviv at the ICRC Blavatnik Interdisciplinary Cyber Research Centre.

I'm also a guest faculty member with other organisations around the world, and I've spent some time working with the Israeli military as most young women and men do at the age of 18 right here in Israel. I'm also the founder of two non-profit initiatives that started here in Israel, but are now making impact worldwide.

The first is Bsides Tel Aviv, which is Israel's largest hacker and security research community conference hosted by Tel Aviv University. 

And our call for papers right now is open for our 2021 summer event, so you can actually suggest one of your topics, one of your maybe research projects to share with us in Tel Aviv, and we would really welcome you.

The second non-profit is the Leading Cyber Ladies, which was started here in Israel as a platform for women in cybersecurity to connect. And in the past two years has grown into a global community with thousands of members from Israel, Europe, north America, and hopefully soon Australia and the Pacific region.

In 2014, I received a prestigious once in a lifetime opportunity to share my point of view about hackers on the international TED stage, and I claimed that in some cases hackers can actually act as the immune system for our digital age because they show us what is possible, they uncover vulnerabilities, and even the malicious hackers force us to evolve.

I also focused in my talk about the role of friendly hackers, which is something I'd like to explore in this keynote today, but it's not just about what hackers do, it's up to all of us today. I think it's time to adopt a mindset of a digital immune system, and it's absolutely necessary as the world encountered and evolved to come to grips with COVID-19. 

We have also had a lot of changes in the digital realm, and I think now is a great opportunity to have that chance for mindset to adopt our immune system in public health. 

Thinking that we've really been practicing in the past year, we can bring that mindset to the digital realm and I can guarantee you this is what criminals have been doing. 

So let's talk a little bit about how COVID-19 changed the landscape for cyber criminals. 

When we all started hearing about COVID-19, about a year ago, it was a hot topic and people would flock to websites, applications, and maybe newsletters that featured information about this new pandemic, what it was doing around the world, how things were progressing.

So criminals used these key words to get on people's computers, whether with malicious applications or in other tools like emails that would get your attention and that you would click on. 

But as the pandemic progressed, we all slowly got a little bit desensitised to many of these terms. So criminals latched onto the new terms that now people would care the most about financial terms, things about taking a medical leave of absence from your job, or maybe a payment application or a beneficial aid application, a relief grant that you signed up for. 

These are things that people would absolutely interact with if they got into their inbox, and this is exactly what criminals took advantage of. 

Here's an email from the United States that was using a legitimate email by the United States Department of Labour, copying the exact email word for word verbatim, just adding in the additional attachment a Word document, which would actually be the first stage loader for an ongoing trick bot infection.

Trick bot is a specific type of malware. It's used in banking, Trojans, it's used in other types of criminal operations, and it's doing very well because it uses a variety of tricks to get on people's computers. 

Now, this is what happened in the US. In the UK criminals adapted to the government offering relief grants for small and medium businesses.

So they set up their own application, if you will. 

They created malicious PDF files that would masquerade as the legitimate relief grant applications. Furthermore, incentivising people to submit their details or the document might expire in a few days. So using that element of time. Now what we are seeing here is just one form of malicious innovation.

Cyber criminals react to whatever is happening, but innovation is not just about, the types of technology that they use, the malware that they use, or how they latch onto popular terms. 

Sometimes the innovation is also about the business model for the criminal operation or their approach, how to find their targets, how to find their victims.

And the next story I'm about to share with you is really a fantastic example of how bold criminals have been in the past year. 

So this is the Tesla Gigafactory in Reno, Nevada. In the United States. It's a factory where Tesla makes a lot of important components. It's part of its production line, including their batteries.

Now, last year, during the summer of COVID-19, the height of lockdowns and restrictions, a criminal travelled from Russia to Nevada to meet with an employee working at that factory. 

And they took that employee out on a scenic trip, a tour to Lake Tahoe, where they popped question, not, will you marry me? But rather, will you accept $1 million in exchange for introducing malware into the Tesla network?

Knowingly introducing malware. 

So they weren't tricked, they were offered money, and this was extremely bold. From the criminalist point of view. I think you would agree, going directly to an employee and offering them a cash payment of a million dollars. Thankfully for Tesla, the employee didn't agree.

What they did is actually report this to the FBI and they, together with the FBI created a sting operation to gather more information about that criminal's operation and to ultimately arrest them and what was discovered from the indictment documents. 

And yes, I know many of you don't read cybercriminal indictment charges, but this is something that I do because it teaches us a great deal about criminal operations and the law enforcement agencies that release these do a great job of really tracking down the different modus operandi of criminal groups.

We can learn from this indictment, for example, that the same criminal was allegedly part of a group that got away with a $5 million ransom from a major company called CWT. You might have heard about Carson Wagoner Travel. If not, they're a major travel technology software company. And when they got hit with the ransom, we also got our very first glimpse of another innovation from the criminal point of view.

So the criminals did not just infect that company with ransomware, malware that will encrypt their files and then require a payment in ransom, usually Bitcoins, in order to release the access to the files, which is, you know, almost a perfect crime because they don't have to steal anything. All they do is disrupt the organisation's access to their own data.

They added another layer of sophistication. They created a chat forum where they were chatting with their targets, their victims, which they called their clients. And here you can see the actual chat conversation. The person from CWT is reaching out to the criminals asking for a very special price because they responded within two days as the criminals instructed them.

They're asking for a discount, they don't want to pay $10 million in ransom, and the criminals respond. 

Mind you, the criminals are calling themselves support in this conversation, which is extremely, bold and cheeky, and they're explaining to their victims, yes, well, this is a special price. You will get a discount because you did respond quickly.

However, this is a standard amount for a company of your size, and it's probably much cheaper than lawsuits, expenses, reputation loss, and leakage. 

So what we're seeing here is criminals are using a second element to the attack. It's not just about ransomware, it's also about extortion. They're basically threatening to leak the company's private files, IP and valuable information.

In order to incentivise the victims to pay this innovation was born back in 2019 by a group called Maze, which launched some very successful ransomware campaigns. 

And the reason for it is that they realised a lot of companies are getting more prepared for ransomware attacks, so they have a lot of backups in place, and those companies are now capable of reverting to the pre ransom situation.

However, the criminals still want to make their payday, so what they're doing is stealing some choice files, some intellectual property, some sensitive files, and then threatening to leak these to the public as incentive for their victims to pay. 

The first target of such an attack was back in 2019. It was an American company called Allied Universal, and in order to prove they were serious, Maze actually leaked this snippet of sensitive internal files to a tech journalist to show that they're real. 

Afterwards, they created a website where they actually feature the leaks from companies that wouldn't collaborate with them, wouldn't pay the ransom, as they say. These are companies that do not wish to cooperate with us, so they're shaming their victims.

And some of these victims are very well-known companies, very well-known brands. I'm sure you've heard about some of these brands, but of course there's an interesting twist in the plot. Just a couple weeks ago, actually, a couple months ago, at this time in early November, Maze started getting so much attention.

The criminals weren't comfortable anymore, so they put out this press release on November 1st saying they're shutting down the project. 

They're not going to continue doing it. They've had enough. They are not going to collaborate with other criminal groups. And mind you, these are criminal groups that have websites, official press releases, brands, logos.

They are acting like a business. And you guessed it, even when they announced that they're going to shut down. That's never the end of the story because with this particular group, just a few weeks after the allegedly shut down, a new piece of ransomware started making the rounds and becoming just as successful as Maze.

But this time it had a different name, a different brand. It's called Regor RaaS, and it's not just a Russian sounding name. Regor is the malware name. RaaS actually stands for Ransom as a Service, so they're basically infecting organisations and then selling off that access to other criminal groups to organise the ransom operation. 

So the criminals have really evolved in the stretch of less than a year they came up with a new business model. 

They made a lot of money. They went bold and sent people to offer cash money to billing accomplices within organisations. And then they rebranded and created a new business model where they're the platform and they're actually enabling other criminal groups to run additional criminal operations all within the scope of the year.

Just imagine how many different innovations and business models a regular company goes through within much longer periods of time. 

So what these stories help to illustrate is that while for many organisations, COVID-19 has been about adapting to a new reality, coping, changing our business models in order to survive. For criminals, it's been an opportunity to thrive.

It's been a Renaissance one could say, some people have even called it a COVID-19 Renaissance. 

Now, at the same time, our digital lives have also changed. 

We've introduced more technology into our lives than ever before because we rely on technology like we're doing just today to communicate and stay safe during COVID-19.

So this has actually created what I like to call an expanding digital universe of opportunities for bad guys. 

And we could, you know, talk a lot about how many different devices and tools and gadgets are out there. But, I could show you statistics and tell you the numbers, but let me just ask you this with a hand on your heart.

What do you have surrounding you right now where you're joining us from? 

You have more family members and pets or digital devices. I can tell you that I've got dozens of digital devices just where I'm at. And I think this is the reality for many of us home is not just the new office these days, it's also the space where we consume education, entertainment, it's where we live and where we do everything online. 

And of course, digital collaboration tools like Zoom, for example, which we're using today, have also become a target for criminals and specifically Zoom credentials have even become popular targets for criminals. So what we're really seeing is that our new reality has created vast opportunities for bad guys to explore.

Now, what should we be doing in this new reality? 

Well, I've got a few ideas and I want to start with one major idea. 

I think it's great. It's a great time to focus on something I like to call cyber hygiene in this new context of COVID-19. 

Usually when we hear about cyber hygiene, we talk about updating our operating system or maybe not downloading malicious apps or clicking on links.

And these are fantastic advices, but there's also other elements to cyber hygiene. 

For example, sharing our computer access and our digital services with other people, or recycling our passwords. You wouldn't recycle your COVID-19 mask, would you? You wouldn't give it to somebody else to use after you've used it.

So why are we doing the same things with our digital services, thereby creating further opportunities for bad guys to infect us? Let's bring some of the hygiene models that we've adapted so strongly in the past year, like, you know, washing our hands, maintaining social distancing, and keeping masks to ourselves.

Let's bring some of these concepts into the digital world. 

Now, I've got many more ideas to share with you. I just want to finish with one. Final note that I want to maybe further explore in our discussion. 

The concept of a digital immune system requires all of us to build up our herd immunity to make lives harder for the bad guys.

And there's one element I'm very passionate about, which is that hackers can actually help.

And very briefly, I'd like to share with you that in the past five years, I've dedicated a lot of my time and my attention right here at Tel Aviv University to the study of a phenomena called Bug bounty programs, which is actually a way for major organisations as big as some of the biggest brands you might have heard of to actively work with and collaborate with friendly hackers from all over the world.

Now these friendly hackers really represent a diverse background. They come from all walks of life, all backgrounds. 

This is specifically a map from the Google Bug Bounty program, and it's from 2016. Now, you'll notice there are not a lot of dots in Australia, but the reality today is that there are many security researchers in Australia contributing in bug bounty programs.

And I just want to highlight one program, a company called Bugcrowd, which was actually founded by an Australian, which is actually a platform that connects these individual friendly hackers with big businesses. 

And according to Bugcrowd, in 2020, during the pandemic, there's actually been more friendly hackers contributing their findings, identifying high criticality, high severity vulnerabilities than ever before.

So actually being locked down at home actually contributed to more hackers helping everybody stay safer. 

My point of view is that everybody can be a hacker hero, and this is why I'm extremely hopeful. That we have education programs like your university's education program and like the ones that we have in Tel Aviv University.

Many workforce reports tell us that we need millions of security professionals to join up in this industry. It needs all the help it can get. Some of them are going to come from academic programs. Some of them I believe are also going to come from the Friendly Hacker community, which I get together with each year at defcon, the world's largest hacking convention.

The truth is, when I go to hacking conventions, I don't see criminals. I see the talent and possibilities of our future. 

So with that in mind, I'd like to thank you for your time. Thank you for your attention, and I'd be really, really interested to discuss with you, to hear your questions, and to really see what you have in mind and talk to the other panellists.

Thank you so much for your time and wherever you are in the world. I hope you stay safe, John, back to you. Thanks very much Keren for that. 

But first I would like to introduce the rest of our panel. If I could ask, Paul and Rob to turn on their cameras. So they are Paul Toomey is the CEO of Biosecurity Systems, an infection minimisation solutions company. He founded Argo Pacific, a cybersecurity consulting firm for governments and Fortune five hundreds worldwide.

And he co-founded Stash, the data centric security company. He also served as president and CEO of ICAN for six years. And then we have Robert Champion. Robert has 30 years experience in the Queensland government information and communications technology office, and is the Queensland Government Chief Information Security Office where he oversees the development and implementation of information security across a wide range of state government portfolios.

Thanks Paul and Rob both for joining us this evening. 

Thank you. So, I'd like to throw a question to you, Paul, just to get things started. 

So, reflecting on what Keren has just said, what's your take on the emerging threats and our readiness to combat them? 

I think Karen put forward a model around public health that I've been spent a lot of the last 10 years trying to promote as well, which I'm wondering whether we'll succeed or not frankly.

I chair an organisation called Cyber Green that every week, scans the entire internet and basically records inside networks where there's poorly configured protocols for the use of networking equipment, and produces huge amounts of data, which we could then use for public response.

Similarly, I expect the bug crowd type people are trying to find stuff for public benefit. 

The difficulty is are we in an area where we can actually take a common good approach to cybersecurity? Or are we in an arms race and which one of these things are we in?

I know at Cyber Green, we do not go beyond a certain level in the way in which we actually look the stuff through, because we start getting into the space where private companies do the same function for companies and they operate like we're in the arms tracks and I'm one of your weapon suppliers if you like.

I'm competing against the other side. We're trying to come down to a certain level saying, well, here's macro data and trying to get that out. 

I'm eventually going to get Keren's response to this, as you'll know from the military background on and elsewhere that the sort of techniques you can find to do good hacking and the same things you do in defining zero days that you can use for other purposes.

I've still struggling. I've spent 10 years of my time on this question of can you have a public health approach to cybersecurity? 

What are the limits of that versus are we in a zero-sum game, which is really an arms race? 

Thanks Paul. 

And actually Keren and I and others had a bit of a chat the other night, talking a bit about some of the economics of bug bounty.

Rob, now to you, in your role as QGCIO, you're responsible for the cybersecurity of a tremendously diverse range of state government organisations. So within that context, what do you see as some of your major challenges?

And do you see any other roles for the state government in the cybersecurity conversation more broadly? 

Yeah, definitely. 

I think there are a number of themes that I picked up on in Keren's discussion. That digital immunity piece is where we talk around building resilience to the system.

So immunity is one of those first pieces. 

There's a whole bunch of preventative things that we can be doing, but it's much more expensive to defend than it is to attack. 

I think one of our fundamental problems is our vendors quite often are incentivised in some of the wrong ways through the capital model that we use.

We've got to put that change in the economics of the cybersecurity arms race that Paul spoke about. 

It is always going to be a challenge. 

We've got a greater attack surface than we've ever had. We've got a diversity that is growing day by day. And our embracing digital technologies is really fundamental to the way government and business delivers services.

So it has got to be fundamental to the organisation that we take cybersecurity very seriously. 

I think the main challenges that I see is around the skills and the engagement. We've got a whole bunch of challenges with it being seen as just a technical area, when it's very much multidisciplinary.

We need people who understand not just the technology risk, but also that business risk and translate that into the business of government and the business of corporations so that they really take it to heart, and manage that risk. 

But as an ecosystem, we've got to find better ways to build that digital immunity and build our resilience to these types of threats.

Thanks very much, Rob. 

Keren, I've seen you nodding furiously at points there. 

I might give you an opportunity to respond to what you just heard from Paul and Rob. 

Thank you so much, John. So I absolutely agree Paul and Robert, there are a few great points that you brought up.

From my perspective, what I really try to focus on with the immune system idea and with the public health efforts. 

I think that governments and vendors and internet service providers can do a lot on their side, but it's also about individual choices. In the same way that the past year COVID-19 forced us to make different types of choices in our lives.

It's a lot about the choices people make each day. 

And to our audience today, the students, the representatives from business and public sector, you all make, and I make hundreds of security decisions each day when we click on links, when we install applications, when we update or do not update our software when we buy a new gadget into our home and leave it with the default username and password.

So, and certainly I mentioned the idea of passwords generally being one of the ways that criminals today are easily getting into organisations because so many people recycle their passwords. 

So when I focus on the public health point of view or the immunity point of view, whilst I don't necessarily have the government or the industry representation or perspective that you bring Paul and Robert, I want to focus on the law of big numbers.

I want to focus on how we can get hundreds and thousands and millions of people to make different security choices. 

And with the friendly hackers, I can absolutely tell you that in the past five years as I've researched this phenomena, it has had an impact on the big picture because it's impacted the amount of effort that a criminal organisation has to go through in order to find new vulnerabilities.

In the past, in our industry, it was well known to discuss the concept of a zero-day vulnerability or previously unknown vulnerability as something that's traded in the criminal underground markets. 

Dozens of thousands or hundreds of thousands in the past year, the cost to develop and acquire such as zero days has gone up because criminals have to invest more time, more effort, and they have to really invest more into their operation. 

So those friendly hackers identifying a lot of the low hanging fruit, quote unquote, of easy to find vulnerabilities, they're helping everybody just raise that level of security. 

I did want to ask a question though, to Paul and Robert about 10 years ago.

I remember that I was sitting, I was participating in a security panel in Singapore and there was a gentleman from Australia who spoke about a project called the I Code Project, which was supposedly some sort of a pilot operation for internet service providers in Australia to together identify infected computers within their networks and then wall them off from the internet.

Now, I don't have any information about how successful that pilot project was or not. 

Paul, maybe you, you've got some background with that or Robert, but that's something I was I was hopeful about when I heard about that initiative. I do think that gov state governments, local governments and ISPs are in a position to do a lot more, to kind of clean up the internet as it were.

Also by, you know, forcing a quarantine on an infected device or an infected network. 

This is very similar to what we're seeing with COVID-19. So that's my point of view. 

Let's take this moment in time as an opportunity to bring in those public health models that we're using with COVID-19, because cybersecurity is a major issue.

So it did come into effect. I think it first came in 2010. I had run the government agency that dealt with that 10 years prior to that and knew the discussion. 

Basically that was a response from a threat from the government that it was going to essentially make them accountable for the breaches.

You'll see there's a pattern of Australian government regulation, which like threaten you with things and hopefully we'll do a deal. 

We've just done that with Google on Facebook. So it was the same thing. And it was a pressure brought to bear on the ISPs themselves to have their own code.

It was very unpopular with the Americans. They didn't like the idea that private sector could actually be censured. That caused us a lot of grief in the background. 

Maybe Robert, you might know better. I don't quite know how it's actually evolved.

We should follow up on that, but it is a bit of a pattern here of trying to create these industry codes by threatening to have regulation. 

It's an Australian governance thing. 

I recall that that program that Keren spoke about and I think some of that has moved into the commercial antivirus and the endpoint security companies, that threat sharing.

Things like the Cyber threat Alliance and a number of those other pieces of visibility that ISPs have is really key to how we respond to this and getting the response to the right place. 

Always the challenge is going to be how much does the government intervene in those scenarios and what's the consequences of that intervention?

If we take the public health example, the costs of things like hotel quarantine, the costs of border closure have societal wide costs that are borne broadly across the society in a number of different places. 

We've got to be able to map those things out, and we don't necessarily always know what the impacts of these things are going to be.

Taking that approach where we either cut connectivity off from the internet, your machine is no longer fit to be connected to a public system can have potential impacts on healthcare, could have impacts on commerce, it could have impacts on education or other things. So understanding all of those is quite difficult.

It's kind of like that old observation that the only secure computer is one that's switched off, unplugged and buried in cement. 

And that's our challenge to find the balance between availability and security.

Michael asks, how can new ventures or SMEs, small to medium enterprises defend themselves and their IP or digital assets against being hacked or stolen with very little budget to focus on digital immunity or cybersecurity?

I think there's, there's a number of things. Particularly awareness. If you look back and take that public health example, in Australia we had a very high profile campaign that was run in the eighties around slip, slop, slap, which was skin cancer.

I think we are in the situation where public awareness is not just up to the technology providers to fix this. It's actually people's behaviour. It's the choices they make. 

As you said before, Keren. I think the vendors can make life easier.

In the technologies coming out of the box, being secure, not accepting default passwords and some of those behaviours can be fixed. 

We are seeing it with the combination of identity as well. So rather than every organisation and every user interaction, having its own unique identity being established, that there's a consolidation of identity around a number of providers.

And that federation of the system, I think will help us make it more secure over time, but there is some personal responsibility there as well. 

So how do we engage the population? How do we engage the small businesses, get them just enough information, not to overwhelm them, but also to provide them meaningful mitigations for the typical threats that they face.

And not every organisation's going to be the same. 

They'll be quite unique, but there are some threats that are quite common across the entire ecosystem. 

I'd say three things I would say, first of all although I'm basically a person in favour of startups and entrepreneurship, very big vendors spend a lot of money on security.

So if your email is with a big vendor, your storage is with a big vendor, your ISPs a noted player, you've got some degree of confidence that the sub component parts, you've got people looking after your security. 

The second thing I'd observe is, uh, the Australian Cybersecurity Centre, or the Australian Signals Directorate, have done a lot of work recently on advice, and the Queensland government does the same advice to small business.

So if you were to go to cyber.gov au you'll see actually some advice to small business there. 

And then there are people like the Global Cyber Alliance. They're actually out of New York, but they produce tools quite specifically for small business, which are free, which also help them improve their cybersecurity.

I would like to jump in there as well, and not from my perspective. 

I think often cases, small to medium organisations are ones where there's no one person who is the dedicated security manager or security director. 

It's usually either a shared responsibility of a few people, or if it's a very small organisation, the one person that's taking care of all of the IT and digital needs also has to take care of cybersecurity.

So for an organisation like that, that's really pressed for resources, I would recommend not just going for the government advice. 

And here in Israel, the National Cyber Bureau also has advice and tools for small to medium organisations. I'd also recommend working with your ISP and with your technology vendors to make sure that you offload some of that security capability to a bigger fish that's going to help you be safer, but also spend time, not just money or resources into technology, but spend time if you can, once a month, once a quarter, make it your security day.

Go through things, review your systems, maybe spend some time attending a technical security conference, a hacker conference, or a webinar to just update yourself.

It doesn't take up a lot of money. It takes time, which is a valuable resource in of itself, but some of the ways you get the most bang for your buck is by just immersing yourself.

If you are that director who's responsible for security choices, just to immerse yourself for a day and a quarter or a day and a year in security knowledge so that you can bring that knowledge back to your organisation and make everybody safer. 

Thanks very much, Keren. We've got another question here.

What is the space for the humanities to make contributions to the industry?

I studied computer science and I've got technical certifications, but my first degree at Tel Aviv University, I studied computer science at another university prior to that. But my first degree at Telaviv University is actually from the humanities faculty, and it's a degree in the history and philosophy of science and technology.

I absolutely want to resonate on this call today, the security industry needs people from a variety of backgrounds and disciplines, and that includes economics, it includes security studies, international relations. It includes psychology, it includes sociology. It includes so many different aspects. 

And even just to come to grips with the questions we discussed today, public health decisions, these are policy decisions, not technology decisions, right?

And coming up with models to evaluate the risk factors, to suggest tools that people will actually embrace instead of revolt against. This is where we need people with humanities backgrounds, with social studies backgrounds, and I've got a lot of colleagues in the industry, security professionals in a variety of roles and companies that have that kind of background.

So I want to reiterate that to everybody on today's webinar. Cybersecurity is more than just programming or analysing malware or looking at code or looking at network packet captures, it requires a variety of different disciplines and there's a need for people to bring in those different disciplines.

Thanks, Karen, Rob, or Paul? 

Yeah, totally agree.

I think, it has been left probably to technologists for way too long. Cybersecurity is a much broader problem than what technology can solve. We talked about those behavioural aspects before.

There are economic aspects that you already called out. 

There's the business from a risk point of view, because quite often the behaviour in cybersecurity incidents is to not talk about them and to minimise that collateral damage or ancillary damage about reputation and other things.

There's plausible deniability that it won't happen to me and two, for me to change my way. 

So there's the whole behavioural aspect of organisations that if we don't get the right questions being asked by the right people in the organisation, the technologists can't answer all of those questions.

And I think some of those things are well outside of where technology can engage. 

You cannot avoid all risk, but you can understand it and then minimise it to an appropriate level.

Paul, anything you want to add. I've got some more questions here from the audience if we keep going with those. 

So Rowan asks a question.

If small time hackers do start doing this frontline work, how do they get the legitimacy to convince other people that the vulnerabilities they find are worth dealing with? 

And, and we might broaden that generally to the legitimacy of ethical hacking?

Fantastic question. 

So I can tell you first of all, they are garnering more and more legitimacy and credibility for their reports, and in the past few years, it's become easier for what you call a small time hacker. 

It's become easier for an independent hacker to report a vulnerability, be acknowledged for their efforts, sometimes be remunerated for their efforts with money or with other prizes, and it's become a lot easier and more streamlined and straightforward than it was in the past.

I can tell you that when I was growing up and I was hacking, if I found the vulnerability, you know, 20 years ago, 15 years ago, usually my only recourse was to do something with it, to demonstrate a hack so that I would get people's attention or maybe leak it to the media. 

Both of these would be probably illegal depending on the circumstances and disruption. They would not be helpful behaviours, but I wouldn't really necessarily have a choice today.

Hackers do have a choice, and even for companies that don't have a public vulnerability disclosure program or a bug bounty program, there are ways to get in touch. And I've seen this happen all over the world, and in some cases it's hard for those hackers, like you mentioned to get the credibility.

So they need help from other hacker groups, hacker movements, and they come together in alliances, whether they are unofficial communities or groups, or more official groups. 

In the past year, we've actually seen a group specifically looking at vulnerabilities in healthcare environments. And that was set up by volunteers just because of COVID-19.

So a lot of hackers around the world decided they want to invest time and attention in finding vulnerabilities in healthcare systems so that they can help those healthcare providers stay safe during COVID-19. 

And they came together in something called the CTI, the Cyber Threat Intelligence League, a voluntary group of hackers that has now thousands of representatives from all over the world.

The answer is there are legitimate ways to disclose vulnerabilities, whether via bug bounty programs or otherwise. And there are groups, movements, alliances, movements within the friendly hacker world so that they don't have to act alone. They can gather that credibility by working together with other hacker movement.

Thanks Keren.

Rob, perhaps from your perspective as the person who's responsible for the security of some really important digital systems, how does the ethical hacking community and bug bounties fit? How does that look from your side of the digital wall?

At this point in time, we don't have formal bug bounty programs. 

However, we have taken steps to strengthen the processes to make sure that reports of vulnerabilities and reports of bugs are accepted or are receipted by the organisation and actioned.

And I think that's one of those first steps for a lot of organisations. There quite often is a level of defensiveness. Not because the organisation's risk adverse. It's because quite often the security practitioners or the infrastructure people who have to manage it are work adverse. They've already got enough on their plate.

This is just something else. Particularly if they don't understand what the business risk associated to that is. If they've then got to go and find an owner in the business to take ownership of that fund, potentially the remediation work, or the change necessary, quite often that's a load that already goes on top of a defender.

That can be challenging for a lot of organisations. But I think bug bounty programs do play a part going forward, particularly product centric ones where lots of things depending on these products, they can all make better understanding of the risks that we face as consumers of those products.

But we also want secure and reliable services for organisations being put out that we actually have trust in what's happening. And I think maintaining trust and confidence is really important. 

We'll never be vulnerability free or bug free. It'll be an awful long time before we ever get to that situation, if at all.

But we've actually got to be able to make sure that we've got that due diligence built into the system, that immunity gets built up over time, that the fitness of these services is being challenged on a regular basis and that we've actually got ways of dealing with the outcomes of it rather than just saying that the hackers are the problem.

We've talked a lot about vulnerabilities here from software, but that we make an observation about network vulnerabilities, which tend to be amplifiers of attacks.

Universities and TAFEs and high schools should have everybody leaving saying in their sleep change default setting, change default setting, change default setting.

The degree of vulnerability in the networks left because the equipment gets deployed with default settings is mind blowing. And look, I would readily acknowledge the role of tertiary institutions and others in making sure that basic security concepts are a fundamental part of a software engineering degree.

For example, you know, anyone learning, learning web development needs to be learning about the vulnerabilities in parallel. I think the sector needs to take that one on board and see that as part of our role. 

What do you see as the best bets in terms of cybersecurity innovation in the next five years?

What do you see making a big impact in the next five years? 

And I'll start with you, Keren. 

Thank you. 

Number one, automation. More and more automation, machine learning in the defensive side, but also on the offensive side. We see criminals utilising more automation in a variety of ways.

So definitely something that's already happening going to happen even more on the defensive side. Automation, that's number one. 

Number two is I think is crowdsourcing cyber security. The concept of bug bounty is one such element. I think we're going to see more models to incentivise individuals to make better security decisions, and we're going to see some security products and innovations around individual decisions, everyday behaviours to help people get safer.

So that's number two. 

Number three. I'm very hopeful about passwords and authentication and identity and changes, fundamental changes in how we treat identity and maybe a move away from passwords into a password less future that uses different types of authentication mechanisms. 

And that's what I'm really hopeful about.

Fantastic. Thanks Keren. Paul, your take three bets for the next five years. 

So Keren's very positive. I'm going to be the dark side of the force. I'm going to take one of her innovations and add it to the thing that worries me a lot. One of the things I'm very concerned about is internet of things and SCADA systems being increasingly vulnerable to cyberattack at large scale.

But what I worry about, is the innovation of the criminals that Keren's referring to, moving into that space and then posing risks and we've just seen that in the last month, right? 

Somebody changing the settings inside a water plant in a small town in Florida that fortunately somebody found. What I worry about is the impact that has on real people.

Several people asked, how do you make this real? That'll make it really real. 

The second thing worries me more about is that nation states cannot determine whether that was another nation state or whether that was a proxy or whether that was a criminal. 

And I think that's the stuff that is really dangerous when we come to state-to-state relationships. The criminals really could take us to the brink. 

I think we're going to see much more automation and artificial intelligence in the attackers as well as in the defenders.  think the skills piece is making sure that we've actually got a supply chain of professionals to be able to address this and the shortage is going to be a big issue going forward.

I think my third one really is around the need for multidisciplinary collaboration. We touched on before where it's very much not just a technical problem, we need all sorts of disciplines to buy into the conversation.

Fantastic. Thank you so much. 

I'd like to say thank you to the University of Queensland, to the Embassy of Israel in Canberra, Tel Aviv University, and the Blavatnik Instant Interdisciplinary Cyber Research Centre, for initiating and helping to support this.

Thank you so much. Thanks.