Cyber Security Weekly Podcast

Roanne Monte is the CEO and Chief Product Officer of Armatec Global, a Sydney-based impact technology company serving the defence, critical infrastructure, and public and private sectors. With a steadfast commitment to a human-centred approach to product builds, Roanne leads the company in delivering innovative cyber and physical threat intelligence solutions that prioritizes user needs and drive measurable business value. As the creator and co-architect of the company’s flagship platform CapchrTM, Roanne harnesses the power of deep learning (DL), machine learning (ML), and artificial intelligence (AI) technologies to provide cutting-edge solutions that enhance security, protect critical assets, and ensure the safety of individuals and organizations.

An Australian-American raised in Sydney, Roanne holds a bachelor’s degree in computer science and psychology graduating cum laude from Harvard University and a juris doctor candidacy under an academic scholarship at Macquarie University Law School.

Roanne Monte, is set to address the Australian Security Conference about Australia’s Critical Infrastructure security. The panel will be discussing implications arising from the Security of Critical Infrastructure (SoCI) white paper, published by the Australian Security Research Centre in partnership with the Department of Home Affairs, which outlines the need for effective risk management and security planning.

For more information visit

https://securityexpo.com.au/

#mysecuritytv #securityexpo

What has the world learned about cyber-security from the Russia Ukraine War? According to Microsoft’s ANZ National Security Officer, Mark Anderson, while the kinetic war still rages within the borders of Ukraine, the cyberwar is borderless, playing out across networks globally.

Anderson has over 28 years experience in the IT industry with 18 of those at Microsoft in various roles across the globe. He will be presenting at the Australian Security Industry Association (ASIAL) Conference at Sydney’s ICC on August 30.

According to Anderson, while Russian attackers primarily focused on Ukrainian assets, this didn’t stop those who support Ukraine from being targeted. Anderson says, that within the first 6 months of the conflict, Microsoft detected Russian network intrusion efforts on 128 organisations in 42 countries outside of Ukraine.

Mark will discuss some key insights and lessons learned including:

- The destructive power of converging the three domains of cyber warfare

- Despite the expectation that nation states like Russia use advanced cyber hacking techniques, this conflict surfaced the fact that everyday hacking techniques – like those used by common cyber criminals – proved sufficient for threat actors.

- What is needed to ensure we continually improve our defences both from a collaboration perspective and the role of individuals and businesses.

For more information visit

https://securityexpo.com.au/

#mysecuritytv #securityexpo

Stephen Scheeler is Australia’s most authoritative voice on digital disruption, transformation, culture & leadership. His experience at the heart of Silicon Valley is truly unparalleled, and he has a unique ability to inspire audiences of all kinds with rare insight, humour & humility.

Stephen is the former Facebook CEO for ANZ and now CEO of revolutionary artificial intelligence start up, Omniscient – the world leader in using A.I. to decode the human brain.

Backed by some of Australia’s most iconic business names – including Gina Rinehart, Gretel Packer and Will Vicars – in 2022, Omniscient won the coveted South-by-Southwest (SXSW) Innovation Award for A.I. and Machine Learning.

Stephen is also founder of global advisory The Digital CEO, and Executive-in-Residence at the Asia-Pacific’s leading business school, the Australian Graduate School of Management.

Stephen is one of Australia’s most sought-after speakers & advisors on digital disruption, transformation, culture & leadership, and the future of technology, data & A.I.

A native New Yorker, Stephen has spent over 25 years in Asia-Pacific, with deep business & cultural experience across China, Japan, SE Asia & ANZ

Stephen will be presenting 'AI, Data and the future of security, a tech CEOs view' at the Australian Security Industry Association (ASIAL) Conference at Sydney’s ICC on August 30.

Most cyber security discussions centre on financial data or national security - but what if you need to secure the secrets of the human brain?

Omniscient are "the OpenAI of the Human Brain" - the world leader in using artificial intelligence to decode the brain.

Omniscient develops technology via the study of connectomics – data-driven construction and analysis of the brain's connections. Data are converted from MRI scans into 3D visuals of electrical activity occurring in the brain. The company’s latest technology, called Quicktome, is used by neurosurgeons as a surgical planning tool offering views of brain activity for each patient.

Security of individual patient records is of obvious concern, however Omniscient’s dataset can also reveal connections leading to mental health issues such as depression or even precursors to dementia or Alzheimer's Disease. Cyber security surrounding IP protection is vital for Omniscient, and many other businesses in globally significant technology.

For more information visit

https://www.o8t.com/

https://securityexpo.com.au/

#mysecuritytv #securityexpo

Stephen's previous interview, Episode 178, recorded 29 October 2019 is available here https://mysecuritymarketplace.com/av-media/demo-podcast/

We speak with Anirudh Chand, Head of Solutions Engineering, APJ at Fortra. Anirudh has worked in cyber security for the last 20 years, with emphasis on compliance, integrity monitoring, privilege access and vulnerability management. For the past seven years, he has been leading solution engineers for different vendors, developing teams that add intrinsic value to the organisations. He currently heads a highly skilled team of cyber security professionals for Fortra across Asia Pacific and Japan.

Founded in 1982, the company was previously known as Help/38, then HelpSystems, and in 2022 the company rebranded to Fortra. HelpSystems is known throughout the industry for its dedication to helping customers succeed by enhancing their approach to cybersecurity and automation. These days, advances in technology are often met with equally powerful cyberthreats that constantly adapt.

Fortra is focused on creating a simpler, stronger, and more straightforward future for cybersecurity by offering a portfolio of integrated and scalable solutions.

For further reading and inquiries visit

https://mysecuritymarketplace.com/fortra

#mysecuritytv #cybersecurity #fortra

Aaron is a council member and the Chief Executive (CYC) of Cyber Youth Collective. In his day job, Aaron is the Director of Business Development (Enterprise) at Wissen International, where he empowers enterprises to fortify their digital fortress, enhancing both technical safeguards and human vigilance, through a holistic and innovative approach to cybersecurity culture. Aaron has served in both public and private sectors, like the Cyber Security Agency of Singapore (CSA) and the Ministry of Education, Singapore and is passionate about developing the next generation of cybersecurity leaders.

In this interview at the Cyber Youth Summit 2023 (Singapore), Aaron shares highlights from the conference - designed by the youths, to be a platform and ecosystem to speak to industry partners, to find out more about a career in the cybersecurity industry.

He also shares his insights on approaching cybersecurity with a focus on youth in three key aspects:

a) The unique threats that youths may face in Cyber space – such as tailored social engineering tactics that target the youths

b) The special insights and skills that youths bring to the cybersecurity industry – such as abilities to step out of their comfort zones

c) Teaching cyber defense to the youths – such as going beyond the “do’s and don’ts”, to more about understanding the psychology of cyber criminals

For youths who are interested in a cybersecurity career, Aaron advises to first get “immersed” in the industry (such as attending conferences e.g. Cyber Youth Summit, and workshops). To get a practical understanding of cybersecurity as a career, Aaron suggests that youths explore internship opportunities, and participate in cybersecurity related projects. Most importantly, he also advises youths to persevere in pursuing their ambitions.

Aaron also advises industry partners to also consider a variety of education backgrounds when hiring youths for cybersecurity positions.

Recorded 23rd June 2023, 11.30am, Cyber Youth Summit 2023 Singapore, Marina Bay Sands

We speak with Dr Atif Ahmad, Associate Professor and Deputy Director for the Academic Centre of Cyber Security Excellence at the University of Melbourne and Current Visiting Associate Professor at UKM who is helping to develop Malaysia’s cyber incident response capability.

The project is funded by the Australian Department of Foreign Affairs and Trade (DFAT) and supported by the National Cyber Security Agency of Malaysia (NACSA).

The collaboration with Universiti Kebangsaan Malaysia (UKM) will see a joint team of UoM-UKM researchers build a reference model. This will assess practical cyber incident responses in organisations.

The project aims to support the development of Malaysia’s cyber-resilience. This is an objective of Australia’s Comprehensive Strategic Partnership (CSP) with Malaysia.

Phase two will commence in May 2023 and involve three case studies. It will provide a benchmarking report for Malaysian organisations and NACSA. This report will compare the practices of Malaysian organisations against a leading Australasian financial organisation.

Up to 100 cybersecurity managers and executives across several critical infrastructure sectors will be trained on how to evaluate incident-response practices.

The project will produce a reference model to assess cyber incident response practices in Malaysian organisations.

Further reading:

https://www.austrade.gov.au/news/success-stories/austrade-helps-facilitate-cybersecurity-project-between-top-australian-and-malaysian-universities

Cyber-threat intelligence for security decision-making: A review and research agenda for practice https://www.sciencedirect.com/science/article/pii/S0167404823002626?via%3Dihub

#mysecuritytv #cybersecurity #malaysia #unimelb #ukm #incidentresponse #cti #threatintelligence

Jane Lo, Singapore Correspondent speaks with Paul Griffin, Assistant Director of Master of IT in Business & Associate Professor, Singapore Management University.

Currently Paul is in SMU teaching postgraduate and undergraduate students in IT and FinTech as an Associate Professor of Information Systems.

He gained a PhD in quantum well photovoltaics at Imperial College London in 1997 and is now researching disruptive technologies applications and impact specializing in blockchain and quantum computing.

Prior to SMU he was leading application development on global IT projects in banking for over 15 years in the UK and Asia across the financial industry.

Paul has a number of projects on-going for analysing trade finance, transaction settlement optimization and financial market stability using quantum computing. He has been advising companies since 2014 and presenting at events, judging hackathons and moderating panel discussions on FinTech.

In this interview, Associate Professor Paul gives a glimpse into developments combining two emerging technologies – blockchain and quantum.

He first introduces the Blockchain Trilemma – the idea that it's hard for blockchains to enhance scalability and speed without sacrificing de-centralization. 

He notes how the combination of Quantum computers and Quantum networks can help secure communication between blockchain nodes. 

In addition, he also explains how consensus – the heart of blockchain’s decentralisation premise – could be scaled up and sped up by exploiting quantum technology.

Prof Paul also briefly touches on introducing quantum technology to artificial intelligence, and how qubits (quantum bits) could be trained up to 10x faster than using classical computing infrastructure.

Recorded 7th June 2023, 1pm, Quantum Summit, Singapore Expo.

Jane Lo speaks with Dimitris Angelakis, Chief Scientist and Founder (AngelQ Quantum Computing), Principal Investigator, CQT (Centre for Quantum Technologies, Singapore).

AngelQ Quantum Computing is a quantum software and consulting company based in Singapore. AngelQ builds architecture-agnostic quantum and quantum inspired software solutions ready for company deployment. Example industries it works with are market and consumer research, finance, energy and sustainability, and supply chain.

Angelakis completed his PhD in quantum physics at Imperial College in 2002 and his thesis received the UK Institute of Physics Quantum Electronics Thesis Prize that year. Since then, he has been leading quantum computing research teams in Cambridge, Greece and Singapore. His research awards include the 2018 Google Quantum Innovation Award and the Valerie Myerscough Award from University of London.

Dimitris G. Angelakis joined CQT in 2009 as a Principal Investigator after being a regular visitor and collaborator of the quantum group since 2003. He was born and raised in a small farm in Chania, Crete, Greece, where his childhood curiosity for the wonders of nature led him to study physics in the University of Crete in Heraklion. In 1998 he was offered a PhD position in quantum optics to work with Sir Peter Knight FRS at Imperial College London supported by the Greek State Scholarship Foundation.

His PhD work in quantum light-matter interactions received the Valerie Myerscough prize in 2000, and also the Institute of Physics UK prize in 2002. In 2001 and at age 25 he was elected college research Fellow at University of Cambridge (St Catharine's JRF) and worked in the Department of Applied Mathematics and Theoretical Physics until 2007.

A year after his move to Cambridge, the Centre for Quantum Computation in Cambridge was initiated by Artur Ekert, where he joined to work in implementations of quantum simulation and computation.

In 2008 he took over a faculty appointment at his hometown Technical University of Crete, where he in now a tenured associate professor of Quantum Physics at the School of Electrical and Computer Engineering (part time since 2012).

He is known among others for his pioneering work in quantum simulators using light-matter systems. He received the Google Quantum Innovation Prize in 2018.

In this interview, Dimitris introduces the trends of Quantum Technology, pointing to the developments in 3 rapidly emerging pillars – Quantum Computing, Quantum Networks, Quantum Devices.

Focusing on the area of Quantum Computing, Dimitris elaborates on how practical problems that require optimization, simulation and machine learning solutions would benefit from the speedup afforded by quantum technology.

Hence, for organisations to be “quantum ready”, Dimitris suggests a key first step for organisations is identifying where there are existing problems relying on optimization – such as routing and navigation.

In addition, Dimitris advises that transforming such problems to be “quantum ready” entails working with a quantum technology company to incorporate machine learning, and to co-design the quantum algorithms specific to the organisation’s problem.

Dimitris also stresses that quantum technology companies are working in partnerships with quantum hardware infrastructure providers to make quantum computing easily accessible to organisations via APIs. Such accessibility removes a major misconception that many have about quantum computing – that adoption requires acquiring specialized hardware.

With the disruptive nature of quantum technology, the need to be “quantum ready” is crucial. As such, Dimitris reminds organisations that performance and speedups goals are part of an overall journey that is foremost about learning – and in this, finding the right partner and quantum startup to work with, is one of the keys to success.

Jane Lo, Singapore Correspondent speaks with Yakir Kadkoda, Security Researcher and Ilay Goldman, Security Researcher with Aqua Security

Yakir Kadkoda combines his expertise in vulnerability research with a focus on discovering and analyzing new security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Prior to joining Aqua, Yakir worked as a red teamer.

Ilay Goldman specializes in discovering and analyzing novel security threats and attack vectors in cloud native environments, supply chain security, and CI/CD processes. Additionally, Ilay conducts research on open-source security and vulnerabilities. Prior to joining Aqua, he worked as a red teamer.

In this interview at Black Hat Asia, Yakir and Ilay explain the complexity of a modern software supply chain, and the dependency of a typical software development cycle on open-source code, and the wide array of tools and platforms.

They note that in this supply chain ecosystem, there are many vulnerable tools and platforms trusted by majority of developers.

To highlight some examples of these vulnerabilities, Yakir and Ilay divide the development flow of many organizations into different phases – Integrated Development Environments (IDEs), Source Code Managers (SCMs), Continuous Integration/ Development (CI/CD), Package management and more.

They point out, for instance, the potential of malicious IDE extensions that may be inadvertently trusted by developers, or how threat attackers could compromise accesses to package manager platforms to impersonate malicious packages.

They also share how they found tens of thousands of tokens of open source projects that have been leaked by CI/CD platforms, which could be exploited for lateral movement.

Wrapping up, they advise that software developers practice security-by-design – that whilst “security takes time”, fixing the problem later may incur even more costs and time.

Recorded 11th May 2023, 11am, Black Hat Asia 2023, Singapore Marina Bay Sands

#BHasia #mysecuritytv #supplychain #cybersecurity

Jane Lo, Singapore Correspondent speaks with Sandro Pinto, Associate Research Professor and Cristiano Rodrigues, PhD candidate of the University of Minho, Portugal.

Sandro holds a PhD in Electronics and Computer Engineering. Sandro has a deep academic background and several years of industry collaboration focusing on operating systems, virtualization, and security for embedded, cyber-physical, and IoT-based systems. He has published 70+ scientific papers in top-tier conferences/journals (e.g., IEEE S&P, USENIX Security) and is a skilled presenter with speaking experience in several academic and industrial conferences (e.g., Black Hat Asia, Hardwear.io, RISC-V Summit, Embedded World). Sandro is a long-term supporter of open-source projects and is currently helping several companies and institutions to make security practical at scale.

Cristiano Rodrigues is a PhD candidate at the University of Minho in Portugal, with a master's degree in Electronic and Computer Engineering. Cristiano is a driven and skilled individual with extensive expertise in ardware/software co-design, safety-critical systems, trusted execution environments for microcontrollers, Armv8-M TrustZone, and embedded security for IoT-based systems.

In this interview, Sandro and Cristiano gave highlights of their talk on a novel class of microarchitectural timing side-channel attacks affecting MCUs.

They shared that while the discovery of Spectre and Meltdown side channel attacks exposed the potential side channel attacks on hidden transient states, there is one class of computing systems apparently is resilient to these attacks: microcontrollers (MCUs).

Sandro introduced that MCUs are at the heart of embedded and IoT device (such as smart watches, IoT home devices), and as such resource constraint in terms of computing power, memory and power consumption.

As such, he said there is a common belief that MCUs are not vulnerable to such attacks as Spectre or Meltdown, as MCUs microarchitecture is intrinsically simple - compared to the more complex microprocessors powering Cloud infrastructure, server, desktops and hence more vulnerable to side channel attacks.

Sandro and Cristiano demonstrated the fallacy of this assumption through their attack on a Smart IoT lock.

By mounting a side channel (timing) attack on a Smart lock application (that for example unlock a vault or a door), they were able to retrieve the secret PIN.

Sandro also reflected on the challenges and shared some thoughts on increasing the sophistication of the attack (e.g. remote access, alleviate the need for access to code, scaling to multiple types of microcontrollers).

Wrapping up, he stressed that sharing the results of their work is part of responsible disclosure, and advised consumers who buy IoT devices with affected microcontrollers to look out for potential announcements from manufacturers. (For an example of a follow-up action from a manufacturer ARM, see: https://developer.arm.com/documentation/ka005578/latest/)

Recorded 11th May 2023, 12noon, Black Hat Asia 2023, Singapore Marina Bay Sands

#bhasia

#cybersecurity

#mysecuritytv