Transcript 0:00 [gentle music] If you're listening right now, you should be scared. We are seeing a rise in financial, environmental, and infrastructure damage as a result of all of these hacks. 0:18 Now, here's the bigger question: what are we doing about it? What needs to happen next? 0:28 [upbeat music] Welcome to The Peggy Smedley Show, the podcasting voice of IoT and digital transformation, with your host, Peggy Smedley. 0:45 Hello, listeners, and welcome to The Peggy Smedley Show. As always, I'm your host, Peggy Smedley. 0:51 This month all along, w- we have been talking about infrastructure and a little bit about security, so today I really wanna delve into how we're going to be securing and why we really need to be talking about securing infrastructure. 1:05 Think about airports, and highways, and rails, and hospitals, and bridges, and electricity grid, and power plants, and oil refineries, and water systems. 1:16 Look, I could keep going on, but the reason we need to invest is to keep our infrastructure safe from the bad guys, those guys who hack into them and are doing bad things. 1:28 Look no further than to the SolarWinds or the case out of Oldsmar, Florida, and many others for why we need to be having this conversation. 1:38 We've talked about some of this in the past, but I think we really need to dive into this a little bit more today. 1:45 So I'm gonna really talk much more about what we need to be thinking about, and why we need to be thinking about it, and what the bad guys are thinking about. 1:53 But first, let's talk about our guests, 'cause we've got some really wonderful people, as always, on the show. 1:58 I'm gonna be talking to Gary Binder, principal engineer and chief security architect at Intel, and he's got a lot to share. 2:05 And then I'm gonna wrap up the show with Ryan McMahon, vice president of insurance and government affairs at Cambridge Mobile Telematics. So stick around. We've got a lot to talk about today. So let's get started. 2:18 If we don't invest in security now, let me share with you what's going to happen next. I'm just gonna lay it all out there. Businesses will experience theft and financial loss, right? That's simple. 2:31 A report from McAfee says global losses from cybercrime topped $1 trillion at the end of 2020. That represents a 50% increase from what we're looking at in 2021. 2:47 Other reports show the average total cost of a data breach is $3.86 million, and that's the average time to identify and contain a breach in just 280 days. 3:02 So we know there is a huge cost to data breaches. Now, let's talk about some of the other impacts on businesses and all of us as individuals. 3:13 Businesses will also experience downtime in operations, and we all know that impacts simply the bottom line. Looking at the hard facts, that equates to an average interruption to business was about 18 hours. 3:31 Now, I don't know about any of you, especially during COVID, but I can't afford to lose 18 hours. Can your business afford it? Now, another impact is damage to brand reputation. 3:46 Now, this should be essential considering we have been talking about sustainability, and companies need to understand that if they don't make the move, they could see their brands take a significant hit. 4:00 I mean, I know a lot of brands out there that can't afford that. That's why BP and Amazon are promoting net zero and low-carbon plans to overcome the negative optics from consumers and the media in general. 4:17 Now, I don't even want to talk about the psychological and social considerations. Individuals have become so depressed, and anxious, and even confused during this year-long nightmare we've all been living. 4:33 The effects are vast and wide. I mean, let's be honest, there's so much to cover, but we really need to narrow in specifically on the impact of cyberattacks on our critical infrastructure. 4:49 Now, I'll bet you if you go back into my shows for the past... 4:53 since 2008 when I began, you will see I talk about infrastructure and cybersecurity a lot, because this gives me the greatest concern, and it's the one I think we are not taking seriously enough. 5:07 This has been a problem for years, decades, since we talk about connecting everything. In 2017, GE said 91% of power generation organizations had experienced a cyberattack. In 2017. 5:26 And 67% of companies with critical infrastructure suffered at least one attack that year alone. 67%. That was back in 2017. Now, let's do some other numbers here. 5:43 Back in October of 2019, Siemens and the Ponemon Institute released a report on the global energy industry specifically. 5:53 Now, keep in mind this report was done just a few short months before the pandemic started.Now check out this number. 6:01 It found fifty-four percent in utilities expected an attack on critical infrastructure within the next twelve months. That's pretty scary. The report anticipated attacks, and guess what? 6:19 They were right. Then the pandemic hit and things got worse. We hear case after case of attacks on our critical infrastructure. And if you're listening right now, you should be scared. 6:36 We are seeing a rise in financial, environmental, and infrastructure damage as a result of all of these hacks. Now, here's the bigger question: what are we doing about it? What needs to happen next? 6:54 The American Edge project, a national security policy, was released in February. 7:00 Now, the research done is very interesting, and its goals are pretty simple: protecting the ability to innovate, secure US technology networks and data through enhanced cybersecurity, and advancing an open internet. 7:16 Okay, you gotta like that. Now, I wanna talk more about the security pillar and what it really means here, and here's why. 7:25 The report shows there are two primary drivers of risk when it comes to defending against cyberattacks. One is the complex tools available and the number of adversaries who can access them. 7:40 This includes non-nation states, and the second is the interconnectivity of the systems. 7:48 Now, as I've been saying here on this show, the pandemic has sped up this as people and businesses are increasingly working from home. 7:57 Now, this report suggests the number of devices connected to the internet has rose from about seven billion in twenty eleven to more than twenty-five billion this year already. 8:11 As many of you know, this has increased the threat surface. Those bad guys have many ways to get in, and they're loving it, and we need to protect it. 8:24 The recent SolarWinds breach just reveals how bad guys can exploit US cyber vulnerabilities. 8:31 The scope and scale of attacks can come from domestic or foreign actors seeking to create as much damage as possible and create as much havoc to the US infrastructure. 8:46 Perhaps it starts with strengthening US government response to cyberattacks. This is particularly the case with our critical infrastructure. 8:57 The US Congress has established the Cyber Solarium Commission, or CSC for short, to develop a consensus on a strategic approach to defending the United States in cyberspace against cyberattacks. 9:13 Now, this is important because following the SolarWinds attack, the CSC recommends to codify a cyber state of distress. 9:23 Now, this could potentially ensure the government has adequate resources to respond to a cyber incident. 9:31 A CSC also endorsed having agencies like CISA share information and analysis with industry on threats and shared concerns. Now, this includes supply chain security and cyber threats, which is really important. 9:47 The CSC also recommends improving partnerships with private sector. 9:53 Intel, for example, suggests encouraging governments to focus on bipartisan consensus approaches to improve cybersecurity and privacy while fostering IT innovation. 10:05 Even Deloitte recommends a layered defense, network segmentation, endpoint security, even access controls, prevention and detection, privilege access management, and data backup. 10:19 So you can see there's a lot of people coming together thinking there's many things we have to do to protect things in a cyberattack scenario. Okay, so let's think about this. 10:29 So what's my opinion for today when we look at all of these things? We need to have a very real conversation about the digital divide. 10:39 We need to talk about what will happen if we don't invest in security in our critical infrastructure. We need to understand the risks and implement protection. 10:53 We need to recognize this is a serious, a very serious problem, and we need to invest the right money to do something about it. We can't wait. 11:07 If we don't, you can bet we are going to see a significant breach, if not breaches on our utilities, on our water systems, and other critical infrastructure. Again, I'll repeat that. 11:22 Significant breaches on our utilities, on our water systems, and other critical infrastructure. It's really time to stop debating and talking about strategic ideas. 11:37 Simply, with all due respect, while we are all talking, the evildoers are targeting our weakest links. 11:47 They know what they wanna do, and they're doing it, and they're getting through because we're trying to debate what to do and we're not taking the action to stop them. So here's my tip for today. 12:01 We really need to do things to secure our systems. We need to do it today.It's all about action. We know we have this increased threat surface. We need to take utilities as an example. 12:19 Let's think about this. They are increasingly adopting business models that connect IT, OT, distribution assets, you name it. They're connecting them all. Everything is becoming connected. 12:32 We know this, and it's happening every day. And there is a real value to connecting everything, and we want that. But we need to protect our data and our systems. 12:45 We need to make sure we have not compromised all the data. Here's the question: Can you say you've protected all the data? We need to be thinking about a developed layered defense and network segmentation. 13:01 Consider endpoint security and access controls. Do prevention and detection. And we always need to be thinking constantly about always backing up the data. It can't be something we'll get to later. 13:16 We always have to back up the data. We don't want to be sitting ducks. We don't want the potential financial, environmental, or infrastructure damage that will come as a result of all of this. 13:30 And we certainly don't want to give those nefarious characters a way to get in. 13:37 As always, I'd love to know what you think about all of this that we've talked about, so share your thoughts with me on Twitter at connectedwmag or post something on LinkedIn. Let's engage in a conversation. 13:49 Together, we can keep the bad guys away. But I want to know what you think. Check out our website at connecttheworld.com or our show website at thepeggySmedleyShow.com and stick around. We've got more to come. 14:00 We're gonna take a quick commercial break. This is The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. And remember, with great technology comes great responsibility. We'll be right back. 14:12 [outro music]
