Cybersecurity must be baked into the metaverse
The metaverse is set to play a large role in the next era of connectivity, but it will bring with it a range of security threats. Conversations around the security of the metaverse need to take place now
Love it or loathe it, a lot of people are talking about the metaverse. But if cybersecurity isn’t baked into the metaverse from the start, it may cause some serious issues, ranging from scamming to extortion and impersonation.
Global cybersecurity company Trend Micro Incorporated has released a report warning of a ‘darkverse’ of criminality hidden from law enforcement, which could quickly evolve to fuel a new industry of metaverse-related cybercrime. The company says tech companies need to start developing security models now to protect the future metaverse. Cybercriminals might look to compromise ‘digital twin’ spaces run by critical infrastructure operators for sabotage or extortion of industrial systems, Trend Micro predicts. Or they could deploy malware to metaverse users’ full-body actuator suits to cause physical harm. The metaverse may still be in its fledgling stages, but what is clear is that conversations need to take place now to protect users from cybersecurity threats.
MARCUS LAW marcus.law@bizclikmedia.com
“A ‘darkverse’ of criminality hidden from law enforcement could quickly evolve to fuel a new industry of metaverserelated cybercrime”
Accelerate Your Net-Zero Carbon Initiatives with Low-Code
Featured with:Executives from Appian, AWS, and Xebia share their collaborative efforts and excitement about their partnership in low-code, cloud, and sustainability.
Technology is instrumental to achieving next-level capabilities across industries. But organizations that want to operate sustainably must choose technology that lets them adhere to strong environmental, social, and governance principles.
Appian Corporation, a process automation leader, is a critical piece of the digital transformation and sustainability puzzle. The enterprise-grade Appian Low-Code Platform is built to simplify today’s complex business processes, with process mining, workflow, and automation capabilities.
“By quickly building apps that streamline and automate workflows, organizations are using Appian to make their processes for monitoring and reporting on ESG initiatives faster, simpler, and more effective,” says Meryl Gibbs, Emerging Industries Leader at Appian.
“Both AWS and Appcino are amazing partners of ours,” says Michael Heffner, VP Solutions and Industry Go To Market at Appian. “We have an extremely long legacy engagement with AWS as our trusted, go-to-market partner and Appcino builds “meaningful, business-focused applications on the Appian platform and is amazing in all things ESG.”
Digital transformation in ESG.
As an AWS leader enabling sustainability solutions built on the cloud, Mary Wilson, Global Sustainability Lead at AWS, talks about the partnership with Appian.
“Our objective is to help our customers achieve sustainability goals across their business operations,” says Wilson. “[This means] looking at data availability, meaning access to more data, and enabling actionable insights. “Lowcode, cloud-enabled, technologies will allow organizations to build fast, learn fast, iterate, and continue to improve these insights to drive their sustainability outcomes.”
Tarun Khatri, Co-Founder & Executive Director of Appcino (product part of Xebia), explains just how critical ESG is in the face of digital transformation. “The investment community now considers ESG reporting as a major factor for measuring performance,” says Khatri The collaboration will continually uncover new insights and provides customers the opportunity to accelerate their ESG goals with speed and security.
BIG PICTURE
RECORDS SHARED FOR FREE ON A HACKER FORUM
Twitter has confirmed over 5.4 million user records – containing non-public information – that had been stolen in January 2022 and then fixed have since been shared for free on a hacker forum.
Joseph Carson, Chief Security Scientist at Delinea, points out that “this particular attack has just been acknowledged by Twitter”.
“The public disclosure of Twitter users’ phone numbers enables an attacker to attempt to bypass 2FA or MFA, if enabled.
“Mobile phone numbers are just one step in the attack path to targeting users through MFA fatigue, but attackers may take the easy path and sell the data on to scammers to make themselves a bit of money.”
THE BRIEF
BY THE NUMBERS
Gov.UK’s CyberSecurity Breaches Survey 2022
39% 83%
of UK businesses identified a cyber attack in 2022
of UK businesses identified phishing attempts as the most common threat vector
“We’re in a tenuous situation where new digital and emerging technologies are capable of delivering so many benefits in the physical world”
Grant Geyer, CPO at ClarotyRECRUITMENT AND RISING SALARIES IN THE CYBERSECURITY SECTOR
George Barnes of Hamilton Barnes, a provider of talent solutions to the network engineering sector, shares his views on the state of cybersecurity recruitment in 2023.
DATA PRIVACY BUY SECTOR
We explore the sectors most at risk from a data breach and new legislation designed to protect them.
HOW CYBER-SECURE IS THE METAVERSE?
Cybersecurity experts share their concerns about the safety of the metaverse as it starts to take shape.
HOW QUICKLY SHOULD BANKS RECOVER FROM A CYBERATTACK?
KEYLOGIC SYSTEMS
KeyLogic Systems – an analytics, IT transformation, and research and engineering firm – has been awarded a prime contract from the US Department of Energy's (DOE) National Energy Technology Laboratory (NETL) for strategic analysis support services.
The five-year contract is initially valued at US$99mn. NETL is one of the 17 national laboratories operated by DOE and focuses on America's economic prosperity via its energy, environmental, and nuclear challenges through foundational science and transformative technology solutions.
The EU is set to introduce new regulations that will see financial services firms having to show how quickly they could recover from a cyberattack.
This comes as regulators fear their increasing reliance on a small pool of cloud vendors could result in downtime at a range of banks due to an outage at just one of the major cloud players.
Thomas Eeles, CSIRT manager at Orange Cyberdefense, Europe’s largest MSSP, says: “A major part of incident response, especially when dealing with large scale incidents, is recovery and remediation.
“It is abundantly clear to those in the industry which companies have a disaster recovery plan, and which don’t. From my perspective, those that don’t have a recovery plan always – without fail – end up spending more money and time on recovery than on the actual investigation itself. I would say this reaches a rough 70/30 split.
“Businesses that do have a recovery plan will save time and money by planning their recovery strategy before it’s needed.”
GLOBAL HOMELAND SECURITY MARKET
The global homeland security market was valued at US$675.4mn in 2021 and is projected to grow at a CAGR of 5.89% during the forecast period 2022-2032. The global market is expected to reach US$872.6mn in the year 2026, whereas it is anticipated to reach US$1,252.8mn in 2032. The results came from Visionagain’s new report entitled the Homeland Security Market Report 2022-2032.
PAYPAL
A new scam is tricking unsuspecting people out of their hard-earned cash as fraudsters pretend to be from PayPal. A TikToker has taken to social media to warn others how she fell for an incredibly clever and deceptive Paypal scam to raise awareness so that it doesn’t happen to other people. Tori PowisDodson said she fell for the scam and lost more than £100.
MEDIBANK
Hackers that stole customer data from Australia's largest health insurer Medibank have now released a file of pregnancy terminations. It follows Medibank's refusal to pay a ransom for the data, a move supported by the Australian government. Medibank urged the public to not seek out the files, which contain the names of policy holders rather than patients. CEO David Koczkaro warned that the data release could prevent people from seeking medical attention.
TIMELINE TRENDS SET TO DEFINE CYBER SECURITY IN
THE EXTINCTION OF MAINFRAMES WILL ACCELERATE
There’s no denying mainframe use has been declining for years. Mainframes are expensive, they require specialist IT skills to use and maintain, and in most use cases have been outclassed by open platforms for a very long time. However, they have remained a cornerstone of many IT systems as organisations have not been brave enough to move critical functions to modern environments or have relied on the fact that data on mainframes is air gapped from other systems to protect it.
In 2023, pressures to make core business data more readily available to third parties for analytics’ purposes and to drive faster real-time experiences will accelerate mainframes’ extinction. The air gap that traditionally protected mainframe data from public-facing access will disappear as businesses push for greater availability. A lack of appropriate controls will put that data at increased risk of being compromised. At this point, this reduced security will mean mainframes aren’t worth the extra cost and complexity for many organisations.
ORGANISATIONS WILL RECEIVE RECORD FINES
Too many organisations still tackle data security with a patchwork of technology, leaving most data unmonitored and unprotected. At the same time, regulations continue to expound on the need for specific types of monitoring as well as protection for different types of data, further exacerbating the risks of siloed security practices. 2023 will see a huge wake-up call, as at least one organisation will receive a record fine because of its lack of unified security.
On average, organisations are juggling more than 75 security solutions across network, application and data security. Trying to manage these tools increases both the risk of burn-out and the chance that security teams will miss threats. With new threats to data, applications and networks emerging all the time – from increasingly sophisticated API attacks to fresh bot exploits – organisations will need a unified approach to stand a chance of tackling these new dangers, avoiding hefty fines, and protecting their most sensitive assets.
2022 was a challenging year for enterprise security, with consumers losing trust in organisations' ability to keep their data safe. APIs have have come under increased assault. As data security becomes more of a priority, cybersecurity company Imperva shares its predictions for 2023.
BOTS WILL TAKE OVER THE INTERNET
By the end of 2023, only half of all internet traffic will come from a human. What’s more, two-thirds of all bad-bot traffic will be considered moderate or advanced, making these automated threats harder to detect and stop. In 2023, APIs will become the prime target for bad bots. Seen as signposts to sensitive data, 2022 saw vulnerable APIs cost businesses $75bn a year. This problem is only going to worsen next year because API defences often overlook automated threats.
Bots will become a persistent threat that organisations need to look out for or else risk data leakage. The challenge is that tried-and-tested methods of defeating bots may not work. For instance, returning a CAPTCHA challenge to an API request breaks the calling application. Businesses need to use machine learning to differentiate normal API behaviour from malicious traffic and to understand what data should be transmitted through the API. Organisations will face an uphill battle mitigating automated attacks targeting their API libraries until bot management and API security are used in concert.
CLOUD SECURITY TOOLS WON’T BE FIT FOR PURPOSE
2023 will be the year we see organisations begin to question whether they are being too trusting of cloud security. They will increasingly realise that the cloud is not secure-by-design and that bundled security tools from cloud providers simply don’t cut it. Despite initially appearing to be easy to use, enterprises are finding – to their cost –that the one-size-fits-all approach of many cloud services’ security offerings simply cannot fully protect data in the cloud. There will always be differences in circumstances that leave a gaping hole for attackers.
Without putting in proper controls to secure the cloud, vulnerabilities and misconfigurations of cloud environments will be one of the biggest risks to data. Enterprises will see a thorough security audit as one of the essential steps to adopting any cloud service and ensuring that they have the right security and tools in place to meet their exact needs, instead of blindly trusting their provider. After all, it doesn’t matter how much money you save migrating to the cloud if you increase the risk of a costly breach in the future.
Grant Geyer
Grant Geyer, CPO at Claroty, explores the security concerns with XIoT devices
“ It is crucial that networks are segmented with asset-class network policies to restrict unnecessary connectivity”
Q. Can you tell me a bit about Claroty and what you do?
» Cybersecurity has been an exponentially increasing business and societal challenge for the past couple of decades. However, as medical devices, water treatment, and the energy grid are modernised, the stakes for public safety are off the charts.
While enterprises, consumers, and governments use more and more digital technology to improve society, that same digital technology can be attacked by hackers. A breach in the cyber world can now impact the physical world – as we saw in the attack against Colonial Pipeline.
Claroty’s mission is to ensure national security, economic security, and public safety by helping organisations secure their Extended Internet of Things – the XIoT.
In August 2022, we launched Claroty Dome, a new, cloud-based cybersecurity platform that helps modern industrial enterprises build cyber and operational resilience. It is the first industry solution to provide the ease and scalability of SaaS without compromising the security controls – visibility, protection, and monitoring – of cyberphysical systems.
My role at Claroty is the Chief Product Officer, working with our leading experts at Claroty to ensure we are setting a clear vision on how to help organisations, and delivering best-in-class products to help arm our customers in this new dangerous front in the cyber conflict.
Q. Could you explain what XIoT is?
» XIoT stands for the Extended Internet of Things and is a term used to encompass all cyber-physical systems –technology devices that have connections to the cyber world and physical world. XIoT is touching all aspects of security, ranging from Operational Technology (OT) that can be used to control a production line or electric grid, to connected medical devices such as MRIs or infusion pumps, to building automation systems and elevators as well as enterprise IoT systems like thermostats and lighting. Because of its broad application in so many segments in our lives, we refer to it as the Extended Internet of Things.
» We’re in a tenuous situation where new digital and emerging technologies are capable of delivering so many benefits in the physical world, while security has been an afterthought.
Historically, industrial environments weren’t connected to the network or Internet, so the risk was mitigated. As more and more devices are connected, these longstanding cyber risks are being exposed to cybercriminals and foreign governments, who look to benefit financially or politically from our digital exposure. As organisations continue to connect more XIoT devices to their networks to support business operations, we’re seeing more cyberattacks against them. Our own research shows the frequency of these attacks growing, with vulnerability disclosures impacting IoT devices increased by 57% in the first half of 2022 when compared to the second half of 2021.
Q. The impact of attacks on XIoT devices is clearly serious –could you give some examples?
» XIoT devices are one of the few areas within cybersecurity where a cyberattack can have a direct impact on human life. It’s alarming that nearly 75% of XIoT vulnerabilities have a high impact on system and device availability. And it’s not just our research: over the last year, we are seeing more news headlines where cyberattacks did, or could, have a potential impact on public safety.
In February 2021, a cyber criminal gained remote access to a water treatment facility in Florida and tried to change the chemical level by increasing the sodium hydroxide content to a dangerous level – something that has the potential to create serious harm. Seven months later, we saw the first case of a ransomware attack leading to fatality. A hospital in Alabama was hit by a ransomware attack that caused equipment to shut down and, tragically, resulted in the death of a baby. These attacks are not simply data being breached or an employee not being able to access certain files and systems. Cyberattacks against XIoT devices can have extremely serious consequences and impact humans nationwide.
Q. What are the main security concerns with XIoT devices?
Grant Geyer of Claroty on Edge, VC Round and Market
Q. What can organisations do to protect their XIoT devices?
» It is crucial organisations have comprehensive visibility into all their XIoT devices. By having full visibility, security teams can see all the XIoT devices that are connected to their network and the vulnerabilities they are at risk from. There are a number of steps enterprises can take in order to achieve this, including managing vulnerabilities and misconfigurations, and running an asset discovery programme to understand what is actually connected to their network.
Furthermore, it is crucial that networks are segmented with asset-class network policies to restrict unnecessary connectivity. By segmenting networks, malware no longer has the freedom to move laterally across them, meaning it can be easily located and mitigated by security teams. As work moved from on-premise to remote during the pandemic, organisations need to ensure that their remote users are using Strong Authentication for remote access to their cyber-physical systems. By implementing these security procedures, organisations can greatly reduce the risk of XIoT devices being the downfall of their cybersecurity posture, and they can continue to reap the benefits the devices bring when it comes to business performance, efficiency, and operational resilience.
The future for cybersecurity is resilience
PRODUCED BY: KRISTOFER PALMER WRITTEN BY: GEORGIA WILSONFlourishing in the wake of rising disruption, it is estimated that global spend on services and technologies that enable digital transformation will amount to US$1.8tn by the end of 2022 – an increase of 17.6% in investment compared to 2021.
Despite the need for innovative solutions to tackle growing demands, supply shortages and talent shortages, as well as increase transparency, resilience and agility, it is important to remember that, with more systems, comes new vulnerabilities that need to be protected.
While the benefits are clear, it will be vital to be prepared for accelerated digitalisation and understand the potential cybersecurity implications in the future, as global predictions expect 45% of organisations to experience attacks on their software supply chains by 2025.
Headquartered in Indonesia, Bukalapak’s key challenge is navigating the complex security landscape. According to a report, nearly 20,000 phishing attacks targeting Indonesia have been detected since the start of 2021, with more than one billion exposed credentials identified.
As Head of Information and Cybersecurity at Bukalapak, Yogesh Madaan is tasked with leading the company through its navigation of not only the regional but also the global threat landscape.
YOGESH MADAAN HEAD INFORMATION AND CYBERSECURITY, BUKALAPAKYogesh Madaan, Head Information and Cybersecurity at Bukalapak, discusses the threat landscape in Indonesia and the need for resilience and talent
“There are a lot of disruptive technologies emerging that are thinking outside of the box when it comes to cybersecurity protection”
Bukalapak: The future of cybersecurity is resilience
In the last few months, Indonesia has seen a rise in cybersecurity attacks in the form of stolen data and data breaches. “Indonesia is one of the prime target for financiallymotivated ransomware gangs. In 2021, ~10% of attacks in Indonesia were ransomware attacks, ~15% were unauthorised network access sales, and more than ~50% were database sharing requests,” explains Yogesh.
“Understanding the threats is the first phase; now we need to be one step ahead of these attackers, and this is what we are trying to do at Bukalapak,” he adds.
Developing a proactive security strategy and availability management system where the company can innovate and implement solutions allows Bukalapak to assess the market vulnerabilities and be proactive in its response to securing its critical assets.
“We are ultimately trying to build an infrastructure that is resilient to any attacks. We are building a safer cyberspace for our customers and employees as well as addressing the key security risks ,” says Yogesh.
During the height of the pandemic, one of the biggest threats to organisations was the potential for attackers to use home networks to hack the wider system. “At Bukalapak, we trained our employees on how to secure their home network to educate our employees and raise awareness.
“Awareness is key in cybersecurity for anybody and everybody. These days, human beings are the weak link, so we spend a lot of effort training our employees in cybersecurity for the new technologies, as well as developing a proactive and scalable cybersecurity ecosystem, and finding the right talent,” explains Yogesh.
Closing the gaps with cybersecurity transformation
Joining Bukalapak almost 18 months ago, Yogesh’s role was to conduct an assessment of the current cybersecurity threat landscape at Bukalapak, building on ongoing efforts and establish a long-term strategy to address the future security threats –something many businesses have embarked on post-pandemic.
“I was brought in to harness my experience in the industry to provide a fresh set of eyes to identify the potential gaps and strengthen the Information and Cybersecurity domain. Today, we operate with a strong combination of teams working across vulnerability management, identity and access management, core infrastructure , governance risk and control, data security, and cloud security,” explains Yogesh.
“Our goal is to transform our team from being reactive to proactive, as well as transparent,” he adds. “This is the start of our three-year strategy. On our journey, we are also strengthening end-user security, email protection tools, and building a security operation centre. But this would not have been possible without the support, collaboration, and buy-in from internal teams, C-suite, and our partners.
EXECUTIVE BIO
YOGESH MADAAN
TITLE: HEAD OF INFORMATION AND CYBERSECURITY INDUSTRY: INFORMATION TECHNOLOGY LOCATION: SINGAPORE
Yogesh is the Head Information and Cybersecurity/CISO at Bukalapak. He is a seasoned technology leader with 18+ years of experience in information and Cybersecurity, technology risk management, regulatory compliance and controls, operational risk, data protection, cloud risk management, compliance- and conduct-related topics, outsourcing, IT account management and production support.
Yogesh holds an MBA in IT Systems, prior to joining Bukalapak, Yogesh spent his career as Head of Information and Cybersecurity, Singapore at Standard Chartered Bank in 2020 and two years as Director – APAC Technology Risk Manager at UBS AG.
They have helped us to transform our cybersecurity posture and, where required, have guided guide us in the right direction.”
Furthering its commitments to enabling a proactive cybersecurity approach, Bukalapak has been in partnership with Ensign – who helps companies to maximise both value and advantages by providing the most robust cyber-defence capabilities and services.
Security Operation Centre with Ensign Keen to partner with an organisation that could help drive the development of its Security Operation Centre (SOC), Yogesh explains why Ensign was the perfect partner for the task: “We spent conscious efforts to find the right partner who fits with our security strategy. Ever since onboarding Ensign, the organisation has been proactive
“Understanding the threats is the first phase; now we need to be one step ahead of these attackers”
CONSULT
We provide advice and recommendations that can enhance an organisation's cyber posture, strategy, and risk management.
INNOVATE
Our in-house R&D unit is the core of all our capabilities, originating AI-powered, patented cybersecurity solutions.
DESIGN & BUILD
We design and build cybersecurity infrastructure, implementing best-of-breed solutions as well as secure-by-design and zero-trust principles.
OPERATE
RESPOND
In the event of a cyber breach, our team of experts has the means and experience to help mitigate threats, and get organisations up and running in no time.
Asia’s largest, pure-play cybersecurity service provider with an end-to-end offering
We believe that cybersecurity is a journey where organisations must constantly and progressively improve to remain cyber secure. To achieve this, Ensign adopts a strategic approach in cybersecurity through our end-to-end capabilities in Consult, Design & Build, Operate, and Respond, in all domains of IT, OT, IoT, Cloud and 5G. These four capabilities are underpinned by Innovate, which is powered by Ensign Labs, our R&D unit that performs deep research into cybersecurity threats and solutions. This approach provides us with the ability, and agility to help our clients enhance their cybersecurity posture and constantly stay up-to-date to “meet the threat”.
Ensign’s AI-Powered Cyber Analytics: Generating More Differentiated Outcomes
We caught up with Charles Ng, Executive Vice President for International Business & Key Accounts for Ensign InfoSecurity, to talk about cybersecurity, R&D and Bukalapak.
“As Asia’s largest pure-play cybersecurity services provider, Ensign’s robust capabilities and end-to-end portfolio of cybersecurity solutions and services put us in good stead to help our clients enhance their security posture as they invest in digital technologies, and accelerate digital transformation,” Charles Ng says.
“We invest a significant amount of our revenue in R&D, and this translates into tangible cybersecurity outcomes and benefits for our clients. It allows us to design and deploy highly customised cyber solutions not found in
existing off-the-shelf products. Having released three patents which have been recognised as some of the best AIpowered Cyber Analytics innovations and technologies in the industry, we can address our clients’ unique security challenges. By incorporating our innovations into their systems for more accurate and efficient threat detection, we enable them to adopt a more proactive, predictive security posture to stay ahead of threat actors.”
“Ensign’s footprint across Asia, covering Singapore, Malaysia, Indonesia, Australia, Hong Kong, and South Korea is an important differentiator, especially for Indonesia-based Bukalapak. The breadth and depth of our expertise and solutions is the key reason that organisations across different geographies and industries choose to partner with us.”
Ensign’s partnership with Bukalapak
Founded in 2010, Bukalapak is Indonesia’s leading and first publicly-listed tech company dedicated to providing a fair economy for all through its creation of an online marketplace, online-to-offline platform, as well as specialised platforms. An advocate of cybersecurity, the company searched for a trusted partner who could understand their threat environment and provide end-to-end solutions. Ensign stood out with its strong capabilities - i.e., consult, design & build, operate, and respond - along with its R&D and significant coverage in Asia.
Ng adds, “Having to always be ahead of the game, we are committed to give our best to Bukalapak.”
Learn more
are adopting a coordinated approach to safeguard our important entities and systems”
YOGESH MADAAN HEAD INFORMATION AND CYBERSECURITY, BUKALAPAK“We
and supportive in addressing our security concerns. The staff are very knowledgeable in their respective domains to help us build a SOC –which we have been working on for the last three months – and guide us on various cybersecurity-related issues. Ensign has huge experience in building SOCs, working with many organisations in Indonesia and Singapore; they have a huge ecosystem of partnerships.”
2,000+
around resilience, which is important in the current cyber landscape.
The future is resilient
Looking to the future, Yogesh explains that future strategies will continue to be centred
Number
of Employees
“We are building a resilient infrastructure by adopting a coordinated approach to safeguard our important entities and systems,” Yogesh says. “We are also dedicated to building a safer cyberspace with secure authentications and authorisations for both our employees and customers to ensure that they continue to feel cyber safe.
With every development, Yogesh explains the importance of scalability and the need for developing talent: “When it comes to
Bukalapak’s partnership with Imperva supports digital growth and
program
Bukalapak is an Indonesia based tech enabler and All-Commerce company whose mission is to make a fair economy accessible for all through offline and online platforms. To protect their users, Bukalapak partnered with Imperva, a global leader in cybersecurity, to mitigate attacks from malicious actors.
While Bukalapak had an existing Cloud WAF in place, it was not meeting their needs. With a high cost of service, difficulties in reaching their support team, and a lack of PoPs in countries in which they had a large presence, a switch in solutions was pivotal; enter Imperva.
Solution
As Bukalapak increases its own companies and domains, so does the complexity increase. New environments must be protected, and Imperva’s Cloud WAF can handle such complexity.
“We need a top-notch solution to protect our infrastructure. We have a lot of data from many customers that needs to be protected. Hence, a robust WAF solution is a must and Imperva is that solution.” said Yogesh Madaan, Head Information and Cybersecurity at Bukalapak.
Support enhances the value of the solution
With such technical depth in cybersecurity, having a team that took the time to understand Bukalapak’s pain points and to explain differences in Imperva’s solution from their last was crucial.
“One of the biggest advantages we have going with Imperva is Support. And that’s how things should be,” said Madaan. “It’s very easy for companies to sell solutions, the support is where the problem lies. People don’t spend time on that, but Imperva has.”
Results
With a vast initial deployment, it was crucial to Bukalapak that their new Cloud WAF solution was well explained for overall understanding throughout their organization. “We have a lot of data that needs to be protected,” said Madaan. “Imperva stayed very patient with us. They are quite good with my team to provide us information.”
Learn more →
A JOURNEY TO DISCOVER THE UNKNOWNS BUKALAPAK ONBOARDS QUALYS
chose the holistic Qualys VMDR solution for an accurate and complete picture of all our IT assets’ vulnerability and compliance status with insights into the most severe threats so we can respond quickly.”
Yogesh Madaan, Chief Information & Security Officer, BukalapakAs a leading online marketplace in Indonesia, Bukalapak chose Qualys’ award winning Vulnerability Management, Detection and Response (VMDR) to strengthen its overall security posture.
Qualys VMDR provides Bukalapak with a single, end-to-end solution to automatically discover, assess and remediate all of its IT assets for vulnerabilities. Today Bukalapak enjoys a much-reduced attack surface, thanks to Qualys.
Learn more
“We
developing a vibrant cybersecurity ecosystem, it is important that our solutions are scalable. We are also committed to growing our talent when it comes to cybersecurity and training our people in the right way. The industry is a very evolving field right now, so we must adopt a holistic view in order to ensure that we can deal with future challenges.”
Dedicated to being one of the cyber safe companies, the next 12 to 18 months will be centred around people, processes and technology for Bukalapak, a trend that is mirrored across industry as the world becomes more connected than ever.
“Automation is becoming increasingly important for the cybersecurity industry, along with data-driven analysis, and artificial intelligence (AI). There is a lot of work to be done, and I want to make sure we have the
DID YOU KNOW?
Application Security with Imperva
To ensure resilient security from the application security perspective, Bukalapak partnered with Imperva to simplify its application security posture. Web application attacks prevent important transactions and steal sensitive data. “Imperva Web Application Firewall (WAF) stops these attacks with near-zero false positives and a global SOC to ensure your organisation is protected from the latest attacks minutes after they are discovered in the wild. “We were looking for a tool, one that can help us meet our requirements and Imperva fits in well,” explains Yogesh.
Partnering with Qualys Vulnerability Management is a key security domain and after we moved to Qualys our reporting has gotten much better. Qualys solutions make our job easier because of the accuracy. Our teams can trust that the vulnerabilities identified are correct and accurate, and it leads to better health and better trust. Qualys provides us with real- time transparent data on the vulnerable systems which enables us to act in time and secure our systems.
“We are ultimately trying to build
that is resilient to any attacks”
YOGESH MADAAN HEAD INFORMATION AND CYBERSECURITY, BUKALAPAKtalent to back up these trends and be able to identify and address any vulnerabilities,” says Yogesh.
“There are a lot of disruptive technologies emerging that are thinking outside of the box when it comes to cybersecurity protection. Ransomware for example has become a menace in the world right now. While it's hard to stop, there are companies developing disruptive technologies to do just that.”
Yogesh concludes by commenting on the rise in geopolitical tensions and their impact on the cybersecurity landscape: “Physical threats such as the war in Russia and Ukraine also enter into the cyber world, and attacks have become more prominent. It will be important as we become increasingly more connected to understand the attack surface and how we can protect it. Important elements in the future will be:
Identifying the threat landscape/impact
an infrastructure
Arecent study from data breach solicitors Hayes Connor has uncovered the industries most affected by data breaches.
It analysed the Information Commissioner Office’s ongoing data security report, which shows how businesses have been conforming to GDPR since its inception.
The findings have revealed the sectors with the highest percentage of data
breaches since the ICO began recording its data in 2019, identifying that the health sector made up the majority of total data breaches, taking up almost one-in-five cases since 2019.
Interestingly, the education and childcare sector came second place, making up almost one-in-seven cases. Joint third-place with the finance, insurance, and credit sector is local government and retail, collectively
DATA PRIVACY
SECTOR BY SECTOR
WRITTEN BY: VIKKI DAVIESCyber magazine
making up just under one-in-ten cases. This amounts to around 2,929 data breaches within each of the third-place sectors, out of the total 32,541 data breaches since 2019.
The report also analysed the types of data that had been breached within the different sectors. The research found that basic personal identifiers being breached came up top within the finance sector at 74%. The second-highest form of data
breaches involved economic and financial data at 37%.
The findings also showed the different incident types behind the data breaches: the number one reason behind data breaches within the finance sector was due to data being emailed to incorrect recipients. The total number of these cases was 569. There were also 509 cases of data being posted or faxed to the incorrect recipient, and 415 cases of phishing.
explores the sectors most at risk from a data breach and the new legislation designed to protect them
GDPR regulations
Part of the 2018 GDPR regulations require businesses to report a data breach within 72 hours. Failure to notify a breach when required to do so can result in a significant fine of up to £8.7mn or 2% of your global turnover. Rather concerningly, though, in the finance, credit and insurance sector, it’s taking over 72 hours to report 37% of their data breaches, leaving the sector vulnerable to large fines.
Christine Sabino, Legal Director at Hayes Connor, says: “What’s concerning is the public puts a lot of trust in industries such as the health, government, and education sectors, with the expectation that their data is going to be handled securely.
“With so many of these data breaches being caused by human error, it’s very clear that these industries are in dire need of datahandling training, at the very least.”
The Data Privacy Bill
UK Ministers are currently considering a new Data Protection and Digital Information Bill. The Bill is intended to update and simplify the UK’s data protection framework with a view to reducing burdens on organisations, providing them with greater flexibility on how to comply with certain aspects of the data protection legislation and improving the clarity of the framework.
While the new initiative has been created to simplify data privacy and make data more accessible, many businesses have voiced their concerns about the challenges the bill poses for organisations. Life Science Law’s Wendy Lloyd-Goodwin, a solicitor with more than 20 years’ experience in the sector, says: “One of the key challenges with the proposed Bill is ensuring the right safeguards are in place so that data is protected. The Bill aims to lower safeguards governing
WENDY
LLOYD-GOODWINLIFE SCIENCE LAW
“The nature of the Bill is to simplify the UK’s data protection framework, yet, in reality, for businesses operating outside of the UK, it will cause more complexity and more confusion”
data collection and processing to reduce the ‘burden’ on business, by, for example, abolishing the statutory requirement for organisations that process data to have an independent Data Protection Officer.
“Instead, organisations will designate a senior employee to oversee its compliance with data protection rules. It also suggests introducing a new, ‘flexible’ accountability regime that allows businesses to decide on how far they will be compliant, based on the scale and their perceived operational risks.
“Another key challenge is for those businesses wishing to operate outside of the UK. Under the new proposals, organisations would be able to take a risk-based approach to assessing the impact of transferring personal data internationally using standard contractual clauses. This change could present a real risk to the free-flow of personal data between the UK and the EU.
“Such a risk-based approach may differ from EU approaches, where some data protection authorities have said that the GDPR’s provisions on transfers of personal data to third countries do not allow for this approach. The very nature of the new Bill is to simplify the UK’s data protection framework, yet, in reality, for businesses operating outside of the UK, it will cause more complexity and more confusion,” she concludes.
Data breach insurance
Cybercrime has become a highly lucrative operation; it isn’t going away and is only set to worsen as companies continue to engage digital technology. Many have taken out cyber insurance to insulate themselves from the punishing costs of cyberattacks and data breaches.
Nevertheless, companies across the world are likely to face increases in the cost of insurance as the number of claims increase
“Companies must increase the visibility and transparency of the components in their open-source software and applications if they are to stay one step ahead of cyber criminals”
VIVIAN DUFOUR CEO, METERIAN
year-on-year. According to research conducted by FitchRatings US, claims volume has risen 100% annually over the past three years.
In part a result of this, the cost of cyber insurance has risen steeply during 2022 both in the US and the UK. According to Marsh, the UK cyber insurance market experienced a pricing increase of 102% year-over-year in the first quarter of 2022.
As a result of rising claim costs, the insurance industry is tightening their qualifying requirements and limiting their coverage. Cyber insurers now require organisations to provide information about their security controls if they want coverage. This can include technical, procedural, and human controls.
CEO of network security company Meterian Vivian Dufour says: “Many cyber insurers have tightened their standards and are no longer paying out for breaches that have resulted from a known vulnerability. This should serve as a sharp wakeup call to boardrooms that deploy technology with little thought to the security implications. If companies want to ensure they continue to receive all the benefits of their policy, it’s vital that they have a rigorous patch management system. Corporates may have short memories when it comes to known vulnerabilities but, as the evidence shows, cyber criminals do not.
“Companies must increase visibility and transparency of the components in their open-source software and applications if they are to stay one step ahead of cyber criminals. Without continuous management of your governance, risk, and compliance of open-source, your company is walking a tightrope without a safety net. Those that fail to learn from history are doomed to repeat it.”
Managing risk and growing the global app ecosystem
WRITTEN BY: MARCUS LAW PRODUCED BY: JAKE MEGEARYApple’s 2009 advert – which coined the phrase ‘There’s An App For That’ – was just the beginning. Over the last 13 years, there has been a global explosion of app downloads ranging from mobile games to productivity tools. And, with figures from Statista suggesting there were 230bn global mobile app downloads in 2021, there are no signs of a slowdown.
For AppLovin, a leading growth platform with an ultimate mission to grow the global app ecosystem, the goal is to help developers expand their audience and their revenue while helping the industry continue to thrive.
Since launching in 2012, AppLovin has been instrumental in defining many of the world’s most popular apps and game studios. The company’s leading mobile marketing and monetisation platform provides app developers with a powerful, full-stack solution to solve their missioncritical functions like user acquisition, monetisation, and measurement.
“Really, at the end of the day, the goal is to grow that whole app ecosystem,” explains Jeremiah Kung, AppLovin’s Global Head of Information Security and Compliance.
“Growing up, we didn't have cell phones, we barely had the internet,” he laughs, “and now it's different.”
“Everything's on the phone, and apps are growing,” he adds. “We want to grow that ecosystem so that everyone is successful –
AppLovin is on a mission to provide app developers with the tools they need to thrive – balancing speed and comprehensive information security is vital
Prevent AppSec Data Breaches
Data Theorem’s solutions are powered by its award-winning Analyzer Engine, which leverages a new type of dynamic and runtime analysis that is fully integrated into the SDLC, and enables organizations to conduct continuous, automated security inspection and remediation.
Real-time Active Protection for AppSec
Organizations today need tools that are purpose built for securing modern application stacks to prevent data breaches. Past-generations of runtime AppSec tools (WAFs, RASPs, EDRs) are unable to address critical areas of modern application stacks such as cloud-native applications.
As an example, serverless applications with APIs, such as AWS Lambda, cannot be secured using traditional web application firewalls (WAFs), runtime application self-protection (RASPs), or endpoint detection and response (EDR) agents. This is because there are no accessible operating systems for agent installation nor traditional network perimeters with ingress/egress points. Data Theorem now uniquely delivers runtime defenses and observability across its entire product suite, addressing security gaps in modern application exposures commonly found with cloud-native stacks.
Data Theorem Active Protection is a runtime defense and observability
offering. It works across Data Theorem’s product portfolio to help customers enable application-layer security defenses across their application stacks from the client layer web and mobile apps to the API data transport layer and lastly cloud infrastructure. The runtime defenses include attack prevention, OWASP Top 10 rules, known malicious sources, policy violations of encryption levels, authentication types, authorization rules, and a variety of custom rule checks including preventing Broken Object Level Authorization (BOLA) attacks. Further, organizations also need increased observability (logging, tracing, trending) before enforcing security policies because of the dynamic nature of their modern application stacks. Customers can enable Data Theorem’s Active Protection through the use of their SDKs (software development kits), application extensions (Lambda layers), and AppSec proxy (L7 sidecar proxying).
Managing risk and growing the global app ecosystem
from the developers and the applications to the businesses and the advertisements behind that – so that it's a win-win for everybody.”
A risk-off approach to cybersecurity Trust and transparency continue to be incredibly important for both organisations and individuals, with concerns around data protection increasing in recent years. As Kung explains, from an information security perspective, by not storing personal information from devices, AppLovin takes a ‘risk-off’ approach.
“From a security point of view,” he says, “our technology never knows who owns the device and only captures what ad types that device interacts with. For example, it's more like: ‘That device likes Wordscapes games, so let’s send them more ads for Wordscapes-type games’ as they will be more likely to download. We never know who the owner of the device is,” Kung adds.
“We removed the significant risk from the equation, which ensures significant risk reduction from an InfoSec perspective.”
The app market may have been on a meteoric rise in recent years, but as with all industries, there is a negative side, with bad actors posing daily threats. For Kung, who joined the business in May 2022, transparency is particularly important when it comes to cybersecurity.
“I try to stay as plugged in as I can to the business so I can understand the threat and risk,” he comments. “I've added tools and processes, but I think what really counts from the cybersecurity piece at this point is transparency.”
“This is a highly technical company with a lot of smart people. My first priority for information security was to conduct assessments; I did my poking and prodding, and penetration testing.”
“They have made some really smart choices and done some really clever things,” Kung adds. “We’re now focused on adding enhancements and improvements over time. The one improvement we added for the cyber side was transparency.”
Cyber success is down to people
For Kung, a cybersecurity professional with more than 20 years of experience in the industry, the key factor to driving a successful cybersecurity programme is down to the people.
As he explains, when joining AppLovin, the first thing he did was create an advisory programme to sit and talk to developers, establishing conversations and processes around when to introduce InfoSec checks.
“We’d have a conversation around what the developers are working on to determine the best point in time for my team to conduct penetration tests,” Kung says. “And we’ll have regularly scheduled conversations to check in.”
In a fast-paced environment such as the technology industry, it’s also highly important not to sacrifice the speed of development. Having joined AppLovin following several cybersecurity roles at financial institutions, Kung is particularly aware of the differences between the east and west coast working in cybersecurity.
JEREMIAH KUNG
TITLE: GLOBAL HEAD OF INFORMATION SECURITY AND COMPLIANCE
INDUSTRY: COMPUTER SOFTWARE LOCATION: CALIFORNIA, US
Jeremiah Kung is AppLovin’s Global Head of Information Security and Compliance. AppLovin enables developers to grow their business with a powerful set of industry-leading solutions. Jeremiah is a risk-based CyberSecurity and Technology executive with strong beliefs in innovation and partnership. He has led multiple digital transformations and has found that the constant drive to improve along with the business is the key factor to leading a successful security program in any company. Jeremiah is a results-oriented hands-on cybersecurity professional with 20 years of successful history of leading cybersecurity, data privacy and risk management programs
“Coming from a banking organisation or FinTech, you’re so highly regulated,” Kung comments. “You have to find everything and fix everything before it goes to production. The CISO must sign off on everything, and it doesn’t go to production until they’ve done all their tests and they’re happy that everything’s fixed.”
JEREMIAH KUNG GLOBAL HEAD OF INFORMATION SECURITY AND COMPLIANCE, APPLOVIN“But here,” he adds, “our business success depends on the velocity of our releases. So, it’s all about how you find that perfect momentum of putting the security controls
place but not slowing the process down.”
“That’s what’s really fascinating – finding that balanced mix. And at the end of the day, it comes down to people.”
“We have extremely talented developers who are willing to work with us. We have tools that give us visibility, and we are also willing to work with the team. I’m not going to hand them scan reports and say, ‘Here are
in
“Our business success depends on the velocity of our releases. It’s all about finding that perfect momentum of putting the security controls in without slowing the process down”
some findings, go fix them’. I commonly say, ‘These are the findings, let me look at them, and perhaps we find things which might be an issue’. This allows us to track if it’s a quick fix – and if not, we’ll ensure it’s prioritised in the next release.”
Managing third-party risk
With a rising number of security breaches arising from third-party relationships,
managing third-party risk is a particularly relevant issue in cybersecurity – especially in light of the SolarWinds attack, which opened many eyes to the dangers of insufficient onboarding and monitoring of third-party vendors.
“I aim to look at all threats and ensure they’ve been looked at,” Kung explains. “Third-party risk is a great one. For vendors we’re doing business with, we ask questions to ensure that they are properly secured, and will protect our data.”
“You don't want to say, 'Here are 1,000 questions, please answer them', to every company you work with. That could potentially slow things down,” he says. “Instead, we'll do our own assessment, then we’ll come regularly to reassess and ask questions.”
Particularly in the cybersecurity world, a strong network of partnerships is vital –
“Especially in a SaaS world, you can't be on your own and just have your own developers build everything”
and AppLovin is no different. In addition to a partnership with Google, Kung explains that working with smaller companies, such as Data Theorem and MAKINSIGHTS, has significant advantages.
“I have liked working with the smaller, hungrier companies because they're willing to work with you,” he muses. “Especially in a SaaS world, you can't be on your own and just have your own developers build everything. As smart and as efficient as they are, we do need to partner with some vendors out there.”
“With Data Theorem, I met with their CEO quarterly, when I was back at EastWest Bank,” Kung says. “At the time, we were building mobile apps to do business banking in China as well as the United States, so the security needed to be top-notch.”
When looking for a tool to protect from Magecart attacks, a discussion with Data Theorem’s CEO led to the development of a ‘hack toolkit’, which could detect a multitude of vulnerabilities with a push of a button.
“It’s been interesting to watch them grow their business from just scanning the mobiles to the web to then creating a piece for cloud security, and followed this up by creating a piece for API security,” Kung says. “These were all the things I was worried
about, and now I had just the tool I needed in order to find this solution.
“MAKINSIGHTS is another great example of a nimble company: they came on board and provided excellent service by supplying us with skilled former 'Big Four' consultants, many based out of LATAM,” he adds. “Working with MAKINSIGHTS brings the latest in cyber processes, policy, governance advice, risk assessment, pen testing –essentially the full gambit of Information Security from an outside perspective.”
AppLovin has also been partnering with Google, utilising cutting-edge tools in both the cyber and the cloud space.
“A lot of times, solutions are being built on-premise and tend to be legacy, and slower,” Kung explains. “Google is doing some pretty innovative work now in the cloud, engineering-wise. By partnering
“When we’re evaluating a vendor we’re starting to do business with, we do deeper dive assessments to see if they are properly secured and whether they are going to protect our data”
HEAD OF INFORMATION SECURITY AND COMPLIANCE,
with Google there are a lot of interesting options we're considering including looking at information security from a different point of view than the typical push-button compliance checklist.”
How organisations manage InfoSec is changing
In an increasingly cloud-based environment, Kung predicts there will be shifts in the way organisations manage their information security.
“At the end of the day, security never really has an end state,” he says. “Threats are always changing and the business is always evolving. Eventually, more and more systems are going to move to the cloud. Larger institutions will be tougher, but smaller companies and high technology companies are mostly going to be in the cloud. And, if they’re not already there, they’re going to start moving to Kubernetes and to serverless functions, which is really going to shift the way we do information security.”
With different threat factors and different attack surfaces to look at, organisations need to be constantly assessing security threats while thinking outside the box.
“Passwords are pointless,” Kung states. “You really should be doing multi-factor authentication (MFA) – those are ways of thinking outside the box of technology.”
“I've seen some really cool ideas from Transmit Security, who had an awesome tool that would get to know who you are,” he says. “We would know a user held the phone in a particular way, so we can authenticate it – a robot, for example, wouldn’t be holding it at all. I don’t know if that's the ultimate solution, but out-of-the-box thinking like that is where we need to go.”
And, with AppLovin’s goal to continue growing the app ecosystem, InfoSec will similarly continue to hold a vital role.
“I'm definitely looking at every new product we're coming out with, making sure it's secure and focusing on helping grow the business without slowing it down,” Kung comments.
“For AppLovin, the goal is to continue to grow the business and the app ecosystem, even at a time of economic uncertainty,” concludes Kung. “We're focused on growing that ecosystem, helping it thrive, and moving it forward.”
“When you do cyber insurance forms or client security inquiries, the question asked is ‘how long is your password?’
That's not the right question”
Recruitment and rising salaries in the cybersecurity sector
George Barnes, Co-Founder and Director of Hamilton Barnes, shares his views on the state of cybersecurity recruitment in 2023Escalating inflation, eye-popping interest rates, contracting GDP – in his Autumn Statement, the Chancellor acknowledged that we’re in a recession. Well, maybe in the ‘real’ world, but not in the tech world. And let’s face it, it’s becoming increasingly hard to differentiate between the two.
I firmly believe that the expected economic downturn will pass the technology industry – and specifically cybersecurity – by, and there are a number of reasons for that line of thinking.
During a traditional recession, companies will lay off staff to keep themselves afloat and pull back on their spending, usually across some key areas. Marketing is frequently the first to go and, historically, reining in investments in technology and infrastructure has been a close second. Cybersecurity in particular has often been an afterthought for many businesses, so much so that, in the ‘old days’, SMEs would struggle to get cybersecurity funding until they were the victim of an attack. Only then did it become a priority.
But that couldn’t be further from what’s going on in 2022. There have been a few cases of cybersecurity layoffs, but, generally speaking, the sector is booming like never before –albeit partly fuelled by necessity – with investments ramping up in response to soaring levels of cybercrime.
Cyberattacks
fuelled by COVID-19
With cybersecurity at an all-time high, COVID-19 has a lot to answer for. Indeed, the number of cyberattacks on businesses increased by almost 70% in 2021, with two-in-five (40%) of those targeted at SMEs because security policies weren’t agile enough to prevent or mitigate against malware, phishing, ransomware, denial of service attacks, and SQL injections –amongst other threats – when employees started working remotely. Changes in perimeter have led to increased security threats as employees access sensitive data through unsafe Wi-Fi networks and use personal devices for work.
The average cost of an attack to businesses has soared into the tens of thousands of pounds, and organisations are therefore wising up to the fact that the traditional cybersecurity approach of waiting until the horse has bolted no longer works. A recent report by Morgan Stanley showed that security software is the area in which CIOs are least likely to cut spending, should the economy worsen.
So, it’s now a case of ‘how can you afford not to invest in cybersecurity?’ and this changing landscape has prompted a resurgence in recruitment in the sector, with 30,000+ vacancies open in the current market. This ‘candidate-driven’ market is driving up salaries as companies are forced to throw money at the problem to compete for the best talent.
We’re seeing cyber positions that used to pay £80k/pa being advertised at over £110k/pa, so organisations that are struggling to keep up are looking at younger candidates. Fresh graduates are being offered salaries of £50k/pa when their only cyber experience is studying it in a textbook. Indeed, recent figures from the Office for National Statistics show that our sector – the ‘professional and scientific industry’ – is the only one where pay continues to match inflation.
“I firmly believe that the expected economic downturn will pass by the technology industry”
Wage growth in the professional and scientific industry has remained above inflation throughout 2022
Regular wage growth in the professional and scientific industry has sat above inflation since November 2018. It remained so during the coronavirus pandemic and has kept pace with prices as they have risen over the last year.
Since May to July 2022, the professional and scientific industry has been the only one where regular wage growth (excluding bonuses) has remained higher than inflation, sitting at
10.1% in July to September 2022. This means average wages in the industry in this period were 10.1% higher than the same period the previous year.
Wage growth in other industries – such as property, information and communication, retail, and finance –also sat largely above inflation in recent years. However, between January to March 2022 and April to June 2022, rising inflation outpaced regular wage growth in all of these industries.
Refining the way we work
Organisations are also being forced to examine their ways of working, with 75% of our clients allowing flexible work arrangements. The pull of such positions with these companies is so strong that we generally fill them within a week or 10 days. However, for the 25% that are insisting that staff be in an office, that timeframe goes up to two months. Candidates are demanding more flexible options and even graduates –who could benefit from the interaction that comes from an office environment early in their careers – are opting to work from home. Change is upon us, but one area where this is unarguably positive is in gender diversity acrossthe sector. I, along with other Hamilton Barnes colleagues, regularly attend schools and universities to raise awareness of the career opportunities that are available to young people. Five years ago, in a lecture theatre filled with 100 STEM students, there’d be one girl. Now it’s more like 20.
And that’s a great thing, because women are great in cybersecurity roles. I recently read Yuval Noah Hariri’s fascinating study of humankind’s evolution, Sapiens. This might seem like a tangent but bear with me; the book explores how our male ancestors honed their long-distance vision for hunting with spears, whereas females’ sight was more geared towards foraging. This has resulted in women developing a greater attention to detail and a more analytical brain, making them perfectly geared towards cybersecurity roles.
What recession?
So a recession? Far from it. Across the sector, adoption of a secure, data-first culture is fuelling faster hiring in greater volumes than
ever before, as clients aim to outrun their competitors and keep up with demand from consumers. Instead of pulling back on spending, businesses are rushing to invest in top-quality tech talent, with cybersecurity specialists, senior network engineers and network security architects some of the key roles Hamilton Barnes is recruiting for.
As things stand, businesses simply can’t become a market leader without spending money. Now is not the time to be cautious; any business that fails to invest in technology is going to fall behind. It remains to be seen whether there is the talent to fill the void and the awareness in the education sector to continually fuel the pipeline. But that’s probably a different article entirely.
“This ‘candidate-driven’ market is driving up salaries as companies are forced to throw money at the problem”
GEORGE BARNES CO-FOUNDER AND DIRECTOR OF HAMILTON BARNES
Syngenta's building capabilities and
WRITTEN BY: JOHN O'HANLON PRODUCED BY: TOM VENTUROSyngenta's journey building out modern capabilities in cyber and cloud space
Widely known as a leading science-based innovator in agritech, Syngenta needs very little introduction.
In addition to its multi-billion-dollar turnover and 30,000-strong workforce, the global company is known for its significant investment in the scientific side of the business, driving advances in agritech that help farmers meet global demands surrounding sustainability and growth. As such, Syngenta dedicates a whopping $1.3bn a year to R&D, regularly bringing new products to market; this dedication to identifying cutting-edge tech and practices has helped it maintain its lead in a competitive market.
Despite this, though, the 22-year-old organisation faces the same problems as any other large business when keeping up with tech and security advances in a constantly fluctuating environment – with the two being interdependent in certain areas like cloud security and therefore complex to maintain.
Syngenta's Global Head of Infrastructure and Cybersecurity, Vanja Vlaski, oversees the company's networks, included within which is cloud, as well as workplace technologies, the helpdesk, and overall cybersecurity.
“Infrastructure and security are at the base of any company today. Anything that goes wrong in any sub-department impacts every single employee and the company overall. As an example, having a data breach causes parts of our operations to stop, and that has an immediate financial impact. If some part of our cloud service is unavailable, key business applications don't work. That's a simplistic explanation of how important all these interdependent technologies are.”
The world of agriculture is, according to Vlaski, surprisingly fastpaced and forward-thinking in terms of cyber and technology, so it’s important that the same attitude is applied to the security of those.
“Nowadays, as you go on investing in infrastructure, you don’t take that static view any more; falling behind in capability, getting out of touch with latest technologies, developments and frameworks can have that direct, immediate impact all the way to where your sales and go-to-market strategies interface with your customer. This is as fast-changing a technology landscape as it is anywhere else.”
Syngenta's leaders in infrastructure, cybersecurity and cloud strategy share their fast-track transformation programme
Syngenta and cybersecurity
This, in a nutshell, is how the IT landscape looks from Vlaski's standpoint. To take a closer look at the threat levels, we can turn to Paul Carugati – he's Syngenta's Global Head of Information Security, or CISO.
“When we're talking about information and cybersecurity, it's all about risk management,” he asserts. “To my team and to all of our internal and external customers, I say that, essentially, the role we play is as facilitators of risk in every corner of the global business. We help them all to understand the level of cyber risk that's being incurred, to help to find what the risk 'appetite' is, and then implement the appropriate controls to effectively manage those risks.”
A business like Syngenta is very dynamic, he points out, so this is essential. “The
organisation is continually changing shape and that makes it difficult to pinpoint where it may become vulnerable, especially in the cybersecurity realm. We face constant technical and administrative threats that hinder the operation of the business. We have to not only understand the technology that is driving those threats, but also the people component.”
In addition to needing to raise awareness among stakeholders, Carugati likes to re-emphasise the basic fact that while technology can do quite a lot to keep a business secure, it’s less effective when lacking strong human collaboration. This is particularly true in cases where much of the threat – and, conversely, defence – stems from users, as at Syngenta.
SUBU IYER
TITLE: GLOBAL HEAD OF CLOUD SERVICES AND IT INTELLIGENT AUTOMATION
LOCATION: GREATER CHICAGO AREA
Subu Iyer is a seasoned executive who brings a holistic perspective to people leadership, technology strategy, and solution integration. A strong believer in the phrase “Think beyond the here and now” he is an expert in analyzing, incubating, productionalizing and evangelizing numerous emerging technologies like RPA, Chatbots, Hyper Automation solutions, Cloud Native services and API platforms within an Enterprise. Subu is an intelligent problem solver with an innate ability to leverage diverse perspectives to create winning solutions and drive consensus. He has a track record of developing high performance teams by fostering an environment of mentorship and collaboration. With a rich history of excellence in program & service delivery, multi-million dollar budget management, business partnerships, cross functional team management and cloud implementations he has acted as a motivator to propel the productivity of onsite, virtual, global, offshore and vendor teams.
We helped Syngenta save almost half a million dollars a month and boost agility in the cloud. Here’s how we did it.
Ask Syngenta, and they’d probably say the right partner is cloud-native. One that looks after your cloud environment in a reliable way while boosting agility, increasing speed to market, and unearthing major cost savings.
Syngenta is a leading Agricultural Technology (AgTech) company. Helping farmers improve yield, increase profitability and grow more sustainably are key factors underpinning the company’s strategy.
Cloud and data play major roles in connecting farmers with their technologies. Syngenta has a strong cloud and IT team, and were used to working with traditional CSIs and hyper-scalers to manage their environments.
Syngenta started working with Nordcloud in 2020. At first, we came in to help migrate some workloads to the cloud. It was an opportunity to sow the seeds of a different, cloud-native approach.
There was a clear difference in how lean and nimble this approach was. So, when the team needed help with automations, we also got involved with those. The result: manual tasks that might’ve taken many hours previously could be completed in 10 minutes or less. Account vending processes that used to take many days were shortened to 5 hours.
Then the cost savings. Our FinOps experts took a microscope to the environment to identify potential savings. They harvested information around rightsizing, utilisation, and resource optimisation, identifying half a million euro a month in cloud savings.
It’s this added value that means some of the biggest and best companies are shifting to cloudnative MSPs to look after their environments.
Cloud natives know how to boost performance while reducing costs. They’ll deliver best practices to drive efficiencies. They make clever improvements that cut licence and capacity costs or reduce technical or security risks.
Cloud natives strengthen security without slowing enterprises down. They know how to implement bestpractice governance, take care of security operations, or conduct a Zero-Trust maturity assessment.
The impact of this approach is an agile, secure and reliable cloud team and environment that empowers the entire organisation.
How do you know if you’re working with the right cloud managed services provider?
Syngenta: Crops, Seeds and Cybersecurity
“The majority of threats we see come from our end users. End users outside and inside the business can be our most vulnerable area. But at the same time, they can be our greatest defence against those threats if they are educated and trained properly in threat awareness and protection.
“In the ever-changing technological landscape our threats are very dynamic. It's an almost continuous game of cat and mouse to stay on top of those technical issues from a threat management perspective, but ideally, with our strategic outlook and the protection and defensive measures that we put in place, we can manage those responsibly.”
The journey to cyber maturity
Becoming a fully cloud-based company (ahead of most competitors in the space) was a challenge. Once achieved, though, it became necessary to turn the attention of the teams to the questions of how to modernise the company’s application landscape and
drive the business towards a cloud-native approach. Cybersecurity moved to front and centre. “If I look back three to four years,” says Vanja Vlaski, “this was not a professionally run department; today, it is a 24/7 operation.”
That was before the arrival of Paul Carugati and the setting up of a dedicated organisation. “Prior to my time here, there were certainly areas of competency on information security within the business, but they were extremely decentralised; nothing formal was in place. As a result, the organisation started seeing more incidents that were impacting operations negatively.”
So, how did Syngenta – with the collaboration of Vlaski, Carugati and the rest of the team – link these decentralised strands?
“We centralised the function, working directly under the CEO and CIO to establish a central and global information security organisation,” explains Carugati.
“From there, we aligned standards and the best practices defined for enterprise risk management – including ISO 27001, NIST 800.53, and, more recently, the NIST CSF (cybersecurity framework), which are needed to understand the appropriate capabilities for the purpose of organising teams and building responsibility for information security in a growing enterprise.
“One of the first things we did was to implement a formal risk management and treatment framework. We had to create that from scratch, as well as a team to govern it. In the process, we established
EXECUTIVE BIO
SUBU IYER GLOBALVANJA VLASKI
TITLE: GLOBAL HEAD OF INFRASTRUCTURE AND CYBERSECURITY
LOCATION: GREATER CHICAGO AREA
Senior technology and business services leader with front-line experience ranging from engineering and development roles in technology startups to delivering complex large scale programs and achieving transformed business services/technology capabilities within large corporations.
I am acknowledged for strong communication skills and creation of high performing teams, with a proven track record of driving: global transformation and change programs, business digital/technology strategy, process simplification and outsourcing focused on savings contributions and top line growth.
“A key focus area for us in 2023 will be to drive the adoption of Infrastructure-as-code across the Enterprise for increased agility and standardised compute deployments”
HEAD OF CLOUD SERVICES AND IT INTELLIGENT AUTOMATION, SYNGENTA
PAUL CARUGATI
TITLE: CISOLOCATION:
SPOKANE-COEUR D'ALENEAccomplished information security executive with a proven ability and rich expertise in the successful execution of Information Security programs in global organisations across multiple commercial industries. Paul is a specialist in collaborative technology, building high-performing teams, program management, fostering a culture of data protection through business enablement and risk management, and achieving positive, measurable behavioral change through accountability and integrity. He is an in-demand speaker who holds many accreditation and industry certifications showcasing his technical and business prowess. Paul is passionate about raising community awareness about cyber security and privacy. Paul has spoken to and coached a variety of executives and BoD members on cybersecurity.
PAUL CARUGATI CISO, SYNGENTA“End users can be our most vulnerable area but at the same time they can be our greatest defence against threats if they are educated and trained properly in threat awareness and protection”
good cadence with our legal, finance and HR partners. We then introduced ourselves and established good partnerships right across the all lines of service as well as in the functional areas of the organisation, especially from an R&D perspective.
“Where we find ourselves now evolved from what I found to be a baseline maturity model: reactive, unstable, ad hoc and inconsistent into the standards-aligned, documented and risk-based programme that I think is absolutely critical to be able to maintain from a cybersecurity perspective in a global organisation.”
It's not a finished job though, given the dynamic threat landscape – ever-evolving and expansive.
“Without continuing to grow and innovate in this space we will remain static and find our maturity level reducing. We have to
grow, and we have to innovate along with the company’s risk appetite. Our goal over the next few years is to move the needle even further across our maturity curve toward a more proactive and metrics-driven organisation, with a predictive, integrated information and cybersecurity programme.
“We need not only to address the current needs of the business, but to actually predict what those are going to be, if we are to stay one step ahead of our cyber adversaries. And we must be able to build security controls and capabilities into our technological solutions across the organisation as opposed to bolt-on solutions.”
The road to the cloud
A great leap forward in capability and tech maturity was taken when the company moved all its on-prem infrastructure to the cloud. The responsibility of Subu Iyer, Global Head of Cloud Services, DevOps and IT Intelligent Automation, Syngenta's journey to the cloud started back in 2016 with the setup of Cloud 1.0 in AWS.
"Migration of applications from data centres to the cloud started then, as the cloud promised a 50% reduction in operating costs. We successfully migrated the initial batch of 500-plus applications to the cloud in 2020, but project teams soon started running into governor limit-related issues linked to a single account architecture in Cloud 1.0. Subsequent discussions with AWS led us to setting up the secure multi-account landing zones, or Cloud 2.0. This proved to be a huge milestone for us. After detailed analysis and careful considerations, we chose to migrate the entire suite of SAP platforms and workloads out to our Cloud 2.0 ecosystem that same year,” explains Iyer.
“Following in the footsteps of the AWS operation, we then set up the multi-account
landing zones in Azure in Netherlands and Chicago in 2021. That year saw us onboarding Nordcloud as the Managed Services Provider for the steady state operations of all our cloud assets. This meant that, for the first time, we had round-the-clock support coverage for this critical foundational service.
“In a massive, complex undertaking in 2022, we migrated the last set of applications and all the infrastructure services out of the data centres, making Syngenta a 100% cloud operation. This was really the proudest moment for our infrastructure and security teams. Everyone banded together to unwind the decades' worth of legacy – and often undocumented, on-prem solutions – and set up fit-for-purpose, cloud-ready alternatives".
In a cloud-first organisation, how does the wider business successfully engage, communicate and share best practices on
cloud policy and IT infrastructure?
“In the cloud organisation we have a competency called Cloud Business Partners (CBPs),” Iyer says. “Their primary goal is to engage with all our stakeholders and understand their vision and strategy, so that we in Cloud Services can organise to better support them and help them meet their goals. The CBPs also drive the cloud initiatives and priorities with teams across geographies and functions.
“Apart from that, we have the architecture, engineering and automation units that provide additional capabilities, services and competencies to support our customer base. We also empower our customers by providing a guided experience on our self-service platform for provisioning all their cloud assets, supported by guidance on cloud-native design patterns and best practices. All this helps make sure that
whatever they may build accords with Syngenta's codes and standards.”
Talking about cybersecurity, Iyer states: “Cybersecurity is particularly important in the cloud and compute space. We have to ensure that that the assets we manage are always patched for vulnerabilities, and that we stay on top of all the upgrades and new iterations. It's also important that the guardrails around our cloud infrastructure and various account types that we provide our customers are accompanied by the right security controls and policies, while providing them the required levels of flexibility and autonomy.
And, of course, MFA-based SSO with rolebased access are key to ensure that only authenticated, authorised users have access to the relevant cloud assets."
Currently, Syngenta’s priority is to optimise the assets in the cloud and modernise legacy
applications to embrace cloud-native design patterns, while making sure that all new applications and services that are onboarded to the cloud follow the latest technology trends.
"A key focus area for us in 2023 will be to drive the adoption of Infrastructureas-code, or IaC, across the enterprise for increased agility and standardised compute deployments."
But, as Vanja Vlaski is proud to document, this has been a massive and transformative operation that will make life easier for all Syngenta's employees and customers. Just as importantly, it will release funds for product development, boosting R&D to drive better and more sustainable food production in every corner of the globe.
How cyber-secure is the Metaverse?
Cybersecurity experts share their concerns about the safety of the metaverse as it starts to take shape
WRITTEN BY: VIKKI DAVIESLove it or loathe it, the metaverse is the next evolution in social connection and the successor to the mobile internet. It’s not on single technology or device, and it’s not the service of any one company. Instead, it's the convergence of several separate technologies, all of which are quickly maturing for mainstream use. Together, those technologies can create the experience of an immersive, 3D environment in which users interact with their surroundings and other users as if they are in a shared space.
According to Deloitte, there is so much more to the metaverse than just a virtual space. It also has at least two other important characteristics that enhance its potential as a new platform with a wide variety of uses. First, it is likely to include both the physical and digital/virtual worlds in the user's experience. Second, the metaverse is expected to have a native economy, including digitally-native assets and trade. While the Internet today has an important relationship to the economy, the metaverse could have its own economy.
Many of the big super brands have already moved into the metaverse and, with a surge of hardware sales expected this Christmas, many more will likely follow suit as we move through the coming year. Brands entering this space are on a level playing field. Everyone’s trying out new things and finding their feet. Some have entered the gaming metaverse space, while others have established their brand in a walkable city.
Get reliable network coverage and security protection, fast.
A modern network must be able to respond easily, quickly and flexibly to the growing needs of today’s digital business. Must provide visibility & control of applications, users and devices on and off the network and Intelligently direct traffic across the WAN. Be scalable and automate the process to provide new innovative services. Support IoT devices and utilize state-of-the-art technologies such as real-time analytics, ML and AI. And all these must be provided with maximum security and minimum cost.
This is the power that brings the integration of two cloud managed platforms, Cisco Meraki and Cisco Umbrella. This integration is binding together the best of breed in cloud-managed networking and Security. cisco.com cisco CiscoSecure CiscoSecure
Serious cybersecurity issues of the metaverse
Throughout the business and consumer worlds, a lot of people are talking about the metaverse. Andy Swift, Technical Director of Offensive Security at Six Degrees, says that a big concern is that if cybersecurity isn’t baked into the metaverse from the start, it may cause some serious issues. He lists some of his biggest concerns:
• Scamming in the metaverse Going back centuries, scammers have sought to use communication channels to exploit victims’ trust. Just like with phone calls, letters and emails, metaverse users should be hyper aware of scammers, especially as it is in its infancy.
• Lack of regulations As far as I’m aware, there are no universally agreed upon and adhered to regulations in the metaverse Given its global nature, establishing jurisdictions and management will be tough. Users who fall foul of crime in the metaverse risk falling through the cracks if properly enforceable regulations remain absent.
• Extortion and impersonation We have no idea how criminals will seek to exploit the virtual and augmented reality functionality of the metaverse. They surely will, though. Maintaining control of your online identity may be challenging in the brave new world of the metaverse.
• NFT fraud Of all the products available in the crypto space, NFTs have possibly garnered the most coverage – and
scepticism. But the fact is that people will want to buy NFT artwork and display it in the metaverse. What if the NFT provider is fraudulent and sells you a fake? It’s unclear in the metaverse or otherwise how you can reclaim your money.
• New technology security hiccups The metaverse is less about new technology and more about the combination of existing technology. This could present unforeseeable cybersecurity gaps – just look at the patchy security history of some of our biggest social platforms, especially during their formative years.
• Risks to minors Like with many other types of online technology, the metaverse presents risks when it comes to controlling children's access to content. And when people are given the ability to present online personas that are completely different from them in real life, it’s safest to prepare for the worst.
“ There is so much more to the metaverse than just a virtual space ”
Trend Micro’s report
Global cybersecurity company Trend Micro Incorporated has released a report warning of a ‘darkverse’ of criminality hidden from law enforcement, which could quickly evolve to fuel a new industry of metaverserelated cybercrime.
The company says tech companies need to start developing metaverse security
Trend Micro has put together some questions to start asking:
· How will we moderate user activity and speech in the metaverse? And who will be responsible?
· How will copyright infringements be policed and enforced?
· How will users know whether they’re interacting with a real person or a bot? Will there be a Turing Test to validate AI/ humans?
· Is there a way to safeguard privacy by preventing the metaverse from becoming dominated by a few large tech companies?
· How can law enforcement overcome the high costs of intercepting metaverse crimes at scale, and solve issues around jurisdiction?
models now to protect Metaverse-like applications and the future Metaverse.
Lewis Duke, Sales Engineer at Trend Micro says: “The metaverse will play a large role in the next era of connectivity and will bring with it a range of security threats, many of which will leverage tactics and techniques of which the industry is already aware. This gives us as a security community the chance to not only predict the likely threats that the metaverse will bring, but also start to prepare how we can protect ourselves and our organisations to avoid the historical disconnect between innovation and security.”
Bill Malik, Vice President of Infrastructure Strategies for Trend Micro, says: “The metaverse is a multibillion-dollar, hi-tech vision that will define the next internet era.
Although we don’t know exactly how it will develop, we need to start thinking now about how it will be exploited by threat actors. Given the high costs and jurisdictional challenges, law enforcement will struggle to police the metaverse in general in its early years. The security community must step in now or risk a new Wild West developing on our digital doorstep.”
The dawn of the darkverse Trend Micro predicts the darkverse will resemble a metaverse version of the dark web, enabling threat actors to coordinate and carry out illegal activities with impunity. It says underground marketplaces operating in the darkverse would be impossible for police to infiltrate without the correct authentication tokens. Users can only access a darkverse world if they’re inside a designated physical location, meaning that there’s an additional level of protection for closed criminal communities. This could provide a haven for multiple threats to flourish—from financial fraud and ecommerce scams to NFT theft, ransomware and more.
The cyber-physical nature of the metaverse will also open new doors to threat actors. Trent Micro predicts that cybercriminals might look to compromise the ‘digital twin’ spaces run by critical infrastructure operators for sabotage or extortion of industrial systems. Or they could deploy malware to metaverse users’ full-body actuator suits to cause physical harm. Assault of avatars has already been reported on several occasions.
Although a fully-fledged metaverse is still some years away, metaverse-like spaces could become commonplace much sooner. Trend Micro’s report seeks to start an urgent dialogue about what cyber threats to expect and how they could be mitigated.
“
The metaverse will play a large role in the next era of connectivity and will bring with it a range of security threats ”
CISOS FROM FORTUNE 500’S
TOP10 COMPANIES
The role of Chief Information Security Officer (CISO) has evolved significantly since the name was first coined back in 1994. Moving away from simply establishing and monitoring computer security architecture, the 2000s saw CISOs come face-to-face with ever-more complex systems, managing business alliances and the cross-sharing of data between organisations.
Nowadays, the CISO role has become one of the most valuable, pushed to the fore in an age of advancing tech and risky outliers hoping to exploit security gaps. What’s more, the role is no longer confined to tech and computer-based firms – any organisation utilising digital programs, across any sector, requires a CISO to manage security.
So, we take a close look at the CISO movers and shakers across a range of sectors, discovering more about them as individuals, their backgrounds and what makes them tick!
Being entrusted with the role of CISO and the security of tech systems for leading brands is no small undertaking. We explore a who’s who of CISOs in 2023
Prior to his current role of CISO at AmerisourceBergen – where he’s responsible for the strategy, definition, implementation and operation of the company's global information security and Disaster Recovery Programs – Alden Sutherland held the position of Vice President and Chief Information Officer with MWI Veterinary Supply, which was acquired by AmerisourceBergen in early 2015. Before joining MWI in 2012, he served as President of Exploridor, President of Pristine Pools and Spas, and Chief Information Officer at both Jostens, Inc. and Entegris, Inc. Sutherland has also held various leadership positions with Novartis. He graduated from Boise State University in 1988 with a Bachelor of Business Administration.
McNeil SVP, Global CISO McKessonMichael McNeil is a leader with extensive business experience, well-known for getting the job done and making tough decisions while enabling those that work with and for him to grow and reach their potential.
A Global Chief Security & Privacy Officer whose performance excellence, unrelenting results’ focus and aggressive implementation McNeil demonstrates an indelible commitment to ethical business practices, McNeil has worked for organisations like Philips, Medtronic, Liberty Mutual, Pitney Bowes, Reynolds & Reynolds, Johnson & Johnson and AT&T.
Phil Venables is – as you’d expect for a man who works at a global giant like Google – a specialist in information & cybersecurity, cloud services, enterprise risk, technology risk and business resilience. Throughout his career, Venables has accumulated significant experience in multiple industries and multiple geographies, from in-depth engineering to board-level management. Venables also sits on several advisory boards including The President’s Council of Advisors on Science and Technology (PCAST) and HackerOne
James Jervey CISO Berkshire Hathaway
is a highly
with over 25 years of consistently building high-performing teams and successful organisations, committed to enabling IT as a means of organisational development and growth.
Jervey has a proven ability of building strong relationships, influencing and inspiring resources, and empowering teams to promote business growth and value. He is recognised as an energetic, motivated, hands on contributor with a majestic strategic vision and passion for effective, sustainable results.
06Saša Zdjelar
IT Strategy Leader
Exxon Mobil
Saša Zdjelar is the IT Strategy Leader for Exxon Mobil, an American multinational oil and gas corporation headquartered in Irving.
Zdjelar describes his role as: “Taking ideas from incubation to commercialisation, developing a vision, articulating a strategy and then building the necessary coalition of support to execute is where my background and experience are best put to use.”
At Exxon, Zdjelar has carved a successful career as a business, technology and security professional with 20 years of experience leading global teams.
Robert Booker VP & CISOUnitedHealth Group
Robert Booker has held the position of VP and CISO at UnitedHealth Group for over 13 years. This role followed a successful career working with organisations such as BT Americas, Medical College of Georgia, and the US Navy. During his time at BT Americas, Booker was responsible for the management of information security and compliance activities for BT's managed network services program, feeding directly into the role he is currently in.
As CISO at CVS Health, Chandra McMahon leads its Global Security, responsible for protecting the company from cyber threats and driving the CVS mission of helping people on their path to better health.
CVS Health’s presence in communities across the country means it is uniquely positioned to understand a range of healthcare needs. To make that happen, the team’s mission is to protect the information entrusted to them by patients, customers and colleagues with best-in-class IT infrastructure and continuous innovation.
George Stathakopoulos VP of Corporate Information Security AppleNext up, we give you…a highly experienced Vice President of Information Security with a demonstrated history of working in the consumer electronics industry: George Stathakopoulos.
Skilled in scalability, enterprise software, culture change, online services, and vulnerability assessment, Stathakopoulos boasts experience as a strong military and protective services professional with a Bachelor's degree focused in Computer Science from Portland State University.
CJ Moses is Amazon Web Services’ new Chief Information Security Officer (CISO).
Moses, who has worked for AWS for 14-plus years, has been its Deputy CISO and Vice President of Security Engineering since 2016. He was also AWS’s Deputy CISO from March 2010 to October 2012 before becoming General Manager of AWS’ government cloud. Moses will continue reporting to former CISO Stephen Schmidt in his new role as he learns the ropes.
Prior to joining AWS in 2007 as Senior Management of Virtual Private Cloud, Moses was an Assistant Section Chief for the Federal Bureau of Investigation for close to four years, with a team that provided technical investigative analysis involving software and hardware. Moses is an avid racecar driver.
0 0 0 0 1 1
Jerry
Geisler SVP & Global CISOWalmart
A US Marine Corps veteran and all round smart guy, Jerry Geisler is highly educated with accreditation from the likes of the Harvard Kennedy School (Cybersecurity & Policy) and Carnegie Mellon University (CISO Institute). Geisler serves as the Senior Vice President and Chief Information Security Officer (CISO) of Walmart’s Global Information Security department. His responsibilities encompass data security not only for Walmart’s 220 million customers, but also its 2.3 million associates.
An avid supporter of the industry, Geisler and his team actively support several local and national programmes to encourage and promote the inclusive development of the next generation of technologists and security practitioners.