Cyber Security Weekly Podcast

Lum Chune Yang (co-founder and CEO of SpeQtral) brings with him experience in technology and business roles in quantum, space and telecommunications sectors. He was previously Head of Strategic Development at CQT (Centre for Quantum Technologies) with a concurrent appointment as Deputy Director, Industry Engagement and Partnerships at NUS (National University of Singapore), where he was responsible for engagements with industry and government stakeholders in commercializing technologies.  Prior to that, he was responsible for business development at SES, a global satellite operator, working with both government and commercial customers on telecommunication satellite programmes. He also spent time in China and the US as a management consultant with ZS Associates, advising MNCs on a variety of strategy, M&A and marketing topics. He has an academic background in quantum and physics research during his early career. Chune Yang holds an MBA from INSEAD, an MSc in Physics from the Pennsylvania State University, and a BSc (Hons) in Physics from NUS In this interview, Chune Yang shares with the audience on the launch of Southeast Asia’s first Quantum Networks Experience Centre (QNEX), and the recent trial toward setting up Quantum-Secure Networks using quantum-enabled encryptors and Quantum Key Distribution (“QKD”) system. He explains that “what we have today in our cell phones, the semi-conductor chips, the lasers we use – all use quantum phenomena.” Quantum 2.0 or the “quantum future”, is the ability to manipulate and control each quantum, such as a photon - a single particle of light, or an atom, which leads to the implications such as quantum computers and quantum communications. Noting that “one thing that quantum computer can do, is that it will break most of the encryption that we have today”, he points to an emerging “store and decrypt later” threat - where threat actors wiretap and store data in some data centre – to decrypt later when they want to hack into the communication. QKD, by “embedding the secret key in particles of light and transmitting it across to the end users”, Chune Yang says, will help to secure and encrypt any communication or data that we transmit to each other. He also shares how the QKD will be extended beyond the terrestrial implementation to space using satellites to address photon degradation challenges. Chune Yang also stresses that we are early on the evolution of the “quantum future”, which includes quantum internet and quantum networks – concepts that are much richer than secure encryption. Recorded 16th November 2022, 9am, SpeQtral, Fusionopolis, Singapore.

Tim serves as the Technical Director - ICS and SCADA programs at SANS, and is responsible for developing, reviewing, and implementing technical components of the SANS ICS and SCADA product offerings. Additionally, performing contract and consulting work in the areas of ICS cybersecurity with a focus on energy environments. A recognized leader in CIP operations, he formerly served as the Director of CIP (Critical Infrastructure Protection) Compliance and Operations Technology at Northern Indiana Public Service Company (NIPSCO) and was responsible for Operations Technology, NERC CIP Compliance, and the NERC training environments for the operations departments within NIPSCO Electric. Recognizing the need for ICS-focused cyber security training throughout critical infrastructure environments and an increased need for NERC CIP hands-on training, Tim authored and instructs the ICS curriculum's newest course ICS456 - Essentials for NERC Critical Infrastructure Protection. Outside of SANS, Tim continues to perform contract and consulting work in the areas of ICS cyber security with a focus on the energy sector. Before accepting the opportunity to join SANS, Tim enjoyed a 15-year career with NIPSCO (Northern Indiana Public Service Company) - one of Indiana's largest natural gas and electric companies in the state, where he held management and leadership positions as well as EMS Computer Systems Engineer responsibilities over the control system servers and the supporting network infrastructure.  During his career, Tim has served as the Chair of the RFC CIPC, Chair of the NERC CIP Interpretation Drafting Team, Chair of the NERC CIPC GridEx Working Group, and Chair of the NBISE Smart Grid Cyber Security panel. In this interview held on-site at the SANS ICS APAC Summit and Training 2022, Tim shares his insights on the developments in ICS (Industrial Control Systems). He starts by explaining the evolution of the term “ICS” into “cyber-physical” – from “data-at-rest, data-in-use, data-in-motion” perspective to one where “data that does something, data that means something,” or in other words, data that has a “kinetic component,” a “physics component.”   Viewed this way, cyber-physical systems could be large scale, like SCADA covering multiple states, or could be on a plant floor distributed control system, could be individual PLCs, or the IIoT (Industrial Internet of Things) which are “using small edge devices to control parts of buildings, or SMART cities or transportation.” Tim also gives an update on the threat landscape in cyber-physical systems and how intellectual property/data theft has evolved to process manipulation. The latest is the recently discovered malware – “Pipedream,” where the modularity of the malware framework is a “force multiplier.” By piecing different malicious components, he explains that threat actors can achieve their goals without knowing their specific environments – and also across multiple sectors. Besides the evolving threat landscape,

We speak with Larry Clinton, author of Cybersecurity for Business. Larry is the president of the Internet Security Alliance. He advises industry and government on cyber policy and regularly appears in the media to provide an expert opinion. He has briefed NATO, the Organization of American States (OAS), G-20 and the US Congress. He has twice been named to the NACD 'Directorship 100' list of the most influential individuals in corporate governance. Larry is also the author of the published book, 'Cybersecurity for Business'. The Internet Security Alliance provides thought leadership in cybersecurity and works with the US government to advocate for public policy that will advance the interests of cybersecurity. For a copy of the book head to https://www.koganpage.com/product/cybersecurity-for-business-9781398606142 (https://www.koganpage.com/product/cybersecurity-for-business-9781398606142)Interview recorded on MySec.TV on Friday 21 October, 2022#cybersecurity (https://www.youtube.com/hashtag/cybersecurity) #koganpage (https://www.youtube.com/hashtag/koganpage) #larryclinton (https://www.youtube.com/hashtag/larryclinton) #internet (https://www.youtube.com/hashtag/internet) #internetsecurity (https://www.youtube.com/hashtag/internetsecurity) #alliance (https://www.youtube.com/hashtag/alliance) #companydirectors (https://www.youtube.com/hashtag/companydirectors) #NACD (https://www.youtube.com/hashtag/nacd) #riskmanagement (https://www.youtube.com/hashtag/riskmanagement) #cyberinsurance (https://www.youtube.com/hashtag/cyberinsurance)

In this episode, we speak with Wilson Ang, a dispute resolution lawyer at Norton Rose Fulbright Singapore and head of the Asia regulatory compliance and investigations practice, as well as Jeremy Lua, a dispute resolution lawyer at Norton Rose Fulbright Singapore focusing on regulatory investigations and compliance.Wilson focuses on strategic governance issues, including conducting internal investigations on business ethics and anti-corruption matters, often involving the US Foreign Corrupt Practices Act, the UK Bribery Act, and the Singapore Prevention of Corruption Act. Wilson has extensive experience designing and implementing compliance programs, conducting integrity due diligence reviews and handling complex and sensitive issues involving bribery, fraud, sanctions, money laundering/terrorist financing, cyber-security attacks, data breach incidents, competition law and financial services regulatory violations in Asia and beyond. Wilson's practice also involves ESG issues like modern slavery and business human rights due diligence, health and safety matters, environmental regulatory disclosures and corporate governance. Jeremy is experienced in a broad range of complex regulatory investigations and compliance matters, focusing on data protection, cybersecurity and technology matters, often assisting clients in navigating crisis situations, such as responding to data breach and cybersecurity incidents. He has also represented and advised clients on investigations initiated by the Personal Data Protection Commission of Singapore (PDPC). Jeremy’s practice includes matters involving anti-bribery and corruption, anti-money laundering, sanctions, export controls and financial fraud, as well as ESG issues like modern slavery and business human rights due diligence. Before joining Norton Rose Fulbright, Jeremy was a Deputy Public Prosecutor at the Attorney-General's Chambers of Singapore, with a focus on technology crime. In this podcast, Wilson and Jeremy share the latest updates in cybersecurity and data protection regulations across the Asia region, and the legal considerations that organisations need to keep in mind when developing cybersecurity and data protection measures.The ongoing digital transformation has increased the available surface areas for threat actors to exploit, including human processes. Wilson shares an example of how Norton Rose Fulbright advised an international bank in its efforts to recover almost half a million dollars from a sophisticated attack by a threat actor, which conducted a lot of reconnaissance work to succeed with its attack. The ongoing Razer vs Capgemini case has also put a spotlight on third-party risk in the data privacy context. Wilson provides a broad perspective on third-party IT supplier risk management, noting that “digital supply chains can be a point of weakness for the organisation. The chain reaction from a single attack on one supplier can compromise the whole network of organisations downstream”. He cautions that, however, “trying to obtain recourse is not straightforward.”Jeremy expands on this issue, providing an overview of the breach notification obligations, including expected timeframes and considerations around the risk of harm. He advises organisations not to “jump the gun”, and instead focus on securing a reasonable level of confidence in the facts of the matter, before taking the next step. On the prevalent threat of ransomware and the rise of the ransomware-as-a-service model,

Cybersecurity has become too complex for most organisations. While every organisation wants the best cyber defences, few have the skilled resources to deliver them.Almost every organisation has a strategic initiative driving their digital transformation journey. Customers need to be served digitally and remotely, rather than visiting physical locations. Employees need to remain productive despite needing to work from home. The nature of an organisations network changed fundamentally, and a much larger and more vulnerable attack surface was exposed to attackers using more sophisticated methods. The traditional response is to buy yet more cybersecurity technology further overwhelming security operations teams, which in many SME is a single person also responsible for many other IT tasks.Despite organisations spending record budgets on cyber-defences, attackers are more successfully infiltrating networks and remaining undetected for longer. The current model isn’t working for most organisations.That is why organisations are increasingly searching for an alternative path, that allows them to reduce risk, increase efficiency and reduce costs. Characteristics needed to achieve these 3 improvements are:1. Security Operations Centre that includes proactive threat hunting and neutralization2. Integrated cybersecurity defences allowing automated responses to security events, avoiding the need to involve a human thereby increasing time to response and increasing efficiency3. Expert Cybersecurity Professionals available whenever required without the challenge and cost of hiring and retaining role such as incident responders, threat analysts and cyber threat hunters4. Unified Management enabling the in-house team to work more efficiently at a single consoleSophos provide this Cybersecurity as a Service, built on 37 years expertise securing organisations of all sizes, geographies and industries.We speak with Hywel Morgan, Manager, Systems Engineering for ASEAN and Korea, Sophos.Read Morehttps://mysecuritymarketplace.com/sophos-cybersecurity/

Bill Nelson is the Chair of Global Resilience Federation (GRF). GRF is a non-profit association dedicated to helping ensure the resilience and continuity of critical and essential infrastructure and organizations against threats, incidents and vulnerabilities. Previously, Nelson was the President and CEO of the Financial Services Information Sharing and Analysis Center (FS-ISAC). In his 12 years, Nelson led FS-ISAC in its response to major cyber and physical threats and vulnerabilities that affected the financial services industry, including partnering with Microsoft to take down four major botnet infrastructures. He was also responsible for creating the Sector Services Division of FS-ISAC, which was established to assist other sectors and became the genesis for launching Global Resilience Federation. Nelson was named the fifth most influential person in the field of financial-information security by the publication Bank Info Security and he also received the prestigious RSA Award for Excellence in Information Security. Before joining FS-ISAC, Nelson was the Executive Vice President of NACHA, the electronic payments association, where he oversaw the development of the ACH Network into one of the largest electronic payment systems in the world, processing nearly 14 billion payments by the time he transitioned to FS-ISAC. In this podcast, Bill introduces the audience to ISACs (Information Sharing and Analysis Centre), and the formation of OT-ISAC (“Operational Technology ISAC”), which was established under Pillar 2 of Singapore’s OT Cybersecurity Masterplan launched at Singapore International Cyber Week 2019. He stresses how is trust is important in supporting effective information sharing, and how initiatives, such as the Traffic Light protocol is critical to facilitating sharing with the appropriate audience. Bill also highlights the prevalence of wiper malware in the Russian-Ukrainian conflict in cyber space and the impacts in Asia. With the rising threat landscape, Bill advises organisations to adopt a “defence-in-depth” approach to withstand and recover from cybersecurity incidents. To minimize service disruptions in the face of destructive attacks and events, he also points to the need for building resiliency. Referencing GRF’s “Operational Resilience Framework”, he explains how the multi-sector working group is developing rules and implementation aids that support the organisation’s recovery of immutable data. Interview by Jane Lo, Singapore Correspondent. Recorded on-site at OT-ISAC Summit 2022 held at the VOCO Hotel, Orchard Road, Singapore on 7th September 2022 4.30pm.

Stuart Campbell is the Information Technology Manager at Ruapehu District Council, New Zealand. Stuart, who pioneered the use of drone technology at the council, designs and leads the council’s project to use drone technology to create 3D maps of cemeteries He is also a highly prolific writer in the past few years, all while working his full time job at the Ruapehu District Council. He also trains others in martial arts, a passion Stuart has held for decades and which inspires his writing. In this on-site interview at the Raffles Town Club in Singapore, Stuart gives some highlights of his presentation in Singapore at AIBotics on “Drones Surveying – From Cemeteries to Modern Buildings.” He explains how the Ruapehu District Council in New Zealand is mapping out its cemeteries using high-definition cameras on a drone. Flying the drone on a lower attitude also produces better resolution images than the legacy solution which relies on cameras at 15,000 feet.  Stuart also shares some tips and lessons, and behind the scenes challenges, giving an example of how a simple occurrence of reflection could affect the image taken by the drone camera. While drones are fun, he advises that before jumping into implementing the technology to carefully consider the regulations such as weight and situational restrictions. He also notes other considerations for drone operators, including the types of drones, the times of day or even the climate and battery power consumption. From a drone security and safety perspective, while Stuart shares that he has never been hacked, he confesses to having crashed a few drones. Recorded by Jane Lo, Singapore Correspondent on-site at the Raffles Town Club in Singapore, 23rd August 2022.

Jane Lo, Singapore Correspndent speaks with Zoltán Balázs, Head of Vulnerability Research at CUJO AI. CUJO AI is a company focusing on home IoT Security. Before joining CUJO AI he worked as a CTO for an AV tester company, an IT Security expert in the financial industry for five years, and as a senior IT security consultant at one of the Big Four companies for two years. His primary areas of expertise are penetration testing, malware analysis, computer forensics and security monitoring. He released the Zombie Browser Tool that has POC malicious browser extensions for Firefox, Chrome and Safari. He is also the developer of the Hardware Firewall Bypass Kernel Driver (HWFWBypass), the Encrypted Browser Exploit Delivery tool (#IRONSQUIRREL) and the Sandbox tester tool to test Malware Analysis Sandboxes.
He found and disclosed a vulnerability in IP cameras, and this vulnerability was exploited by the Persirai botnet, running on ˜600 000 cameras. Zoltán has been invited to give presentations at information security conferences worldwide including DEF CON, SyScan360, SAS2018, Virusbulletin, Disobey, Deepsec, Hacker Halted USA, Botconf, AusCERT, Nullcon, Hackcon, Shakacon, OHM, Nopcon, Hacktivity, and Ethical Hacking. Proud OSCE. In this on-site interview at “Hack-in-the-Box” held at the Singapore Intercontinental Hotel, Zoltán gives some highlights of his presentation on “Web3 + Scams = It’s a Match!” Sharing his perspective on what the Web3 world encompasses – including non-fungible tokens (NFTs) – he explains how some of the over-valuations reported in the media for NFTs may leave an impression of fraud and scams. He also points out how some of the old fashion investment scams such as “rug pulls” and “pump and dump” still plagues the Web3 world. One common tactic, such as preying on victim’s “fear of missing out” (FOMO) on an attractive investment, can also be seen in the promotion of Bored Apes Yacht Club NFT collection. Zoltán also outlines a highly notable scam known as the “Squid Game” rug pull, where the combination of the ease of creating tokens, and the popularity of the Netflix TV show lured victims to put money into the fraudulent investment scheme. To avoid falling victim to one of the scams, Zoltán’s advice is “take time, don’t rush.” Recorded on-site at the Singapore Intercontinental Hotel in Bugis, 26th August 2022, 11am Singapore Time.

Jane Lo, Singapore Correspondent speaks with David Pethes, Co-Founder, Qrucial, Head Ambassador for Eastern Europe of Polkadot.David is a Web3 researcher and security expert that founded the largest crypto hacking competition in the world called CCTF (Crypto Capture the Flag). He is also the co-founder of QRUCIAL and has more than 10 years experience in IT penetration testing and got several global certifications. Since 2021 he is the Head Ambassador for Eastern Europe of Polkadot – a sharded protocol that enables blockchain networks to operate together seamlessly. In this on-site interview at “Hack-in-the-Box” held at the Singapore Intercontinental Hotel, David shares some of the highlights of his presentation on “Breaking Web3: Exploitation Techniques for Cryptocurrency Hacking.” Introducing his perspectives of what Web3 encompasses, and the history of smart contracts, David shares that Web3 world is more than just technological changes (and bitcoin). Enabled by smart contracts, he observes how Web3 presents opportunities for societal and monetary innovations. David points to how the emerging Web3 architecture is built on both blockchain concepts as well as components from centralised computer infrastructure (such as SQL databases) in traditional architecture. Security vulnerabilities in Web3 therefore, he notes, comprise of new emerging threats, as well as the ones commonly observed in today. David wraps up the interview with an introduction to his Crypto Capture the Flag (CCTF) contest, which provides a legitimate platform to challenge white-hat hackers to find vulnerabilities in the rapidly evolving Web3 infrastructure. Recorded on-site at the Singapore Intercontinental Hotel in Bugis, 25th August 2022, 7pm Singapore Time.

We speak with Daniel O’Toole, Senior Adviser for Space within the Sector Team for Defence, Space and Infrastructure at the Australian Trade and Investment Commission (Austrade). In addition to his role at Austrade, Daniel has also served as partial secondee at the Australian Space Agency since 2018. In this capacity he works on joint Austrade-Space Agency initiatives that help promote the growth of the Australian space industry through international market programs and opportunities. Prior to joining Austrade in 2016, Daniel worked for two Japanese organisations that worked to build partnerships in Australia. He worked for the Japan Oil, Gas and Metals Organisation (JOGMEC), where he led research on issues impacting the local minerals market. He then worked for the Japan External Trade Organisation (JETRO) in Sydney, helping to connect Australian and Japanese businesses and increase two way trade and investment between Japan and Australia. Daniel holds a Bachelor of International Studies from the University of New South Wales and a Masters of Strategic Affairs from the Australian National University.Recorded for Australia in Space TV, Friday, 29 July 2022 (Due to a technical issue the video version is not available)For more episodes visit www.australiainspace.com.au#Austrade #space #asitii